Regression identified in Service Provider library, new version pushed

[Ferenc Wágner]

"Cantor, Scott" <cantor.2 at osu.edu> writes:

> On 11/17/17, 10:37 AM, "users on behalf of Robert Bradley" <users-bounces at shibboleth.net on behalf of robert.bradley at it.ox.ac.uk> wrote:
>
>> The Debian policy for packaging is generally that the upstream version
>> number of the package remains constant for a given release.
>> (Exceptions exist for firefox-esr and the like.)  So, on Debian the
>> Shibboleth SP release is 2.6.0 for stretch, and 2.5.3 for jessie.
>
> That's basically why it's untenable for me to support it without
> changing how we do things. 2.5 has been unsupported for a year.
> I support only what I package.

Hi,

I'd be interested to hear what sorts of support requests arrive from
Debian users, especially if something makes these Debian-specific.
Supporting a particular packaging is a concept different from supporting
the packaged software itself (just like user support differs from
security support).  I don't think Shibboleth packaging in Debian has any
user-visible peculiarities, but maybe we could streamline it still.
I can imagine the elderly versions being a giveaway; always feel free to
refer such requests to the pkg-shibboleth-devel mailing list or the
Debian bug tracker.  We'll help determine if the issue is present in the
latest supported version and if so, proxy it.

> So if we were to "support Debian", it would have to be a carefully
> considered position and probably would only apply to members because
> it would involve supporting code I'd already supplanted.

According to my experience you've been doing a superb job at supporting
Debian.  And Russ made the same statement when he stepped down as the
Debian maintainer of your software.  (I'm sure he meant it because he
still couldn't let go entirely and occasionally chimes in.)  What I
mean: upstreams aren't expected to actively backport security fixes or
otherwise support the versions frozen into Debian releases.  That's the
responsibility of the package maintainer and the security team.  Of
course timely and correct security updates are really only possible with
upstream cooperation, which you've always been more than open to.

> Or I would have to actually provide packages myself that weren't part
> of Debian itself but that stayed current

Something like that is already present in the official Debian backports.
Thanks to Etienne, the 2.6 version of the SP has been available in
jessie (Debian oldstable) for more than a year.  Basically the same is
true for wheezy (Debian oldoldstable): XMLTooling and OpenSAML are
official -- or rather, were: oldoldstable backports have been discontin-
ued, so we couldn't provide official patched 2.6 binaries for wheezy.

On the other hand, the Debian LTS team was very quick to backport the
latest security fixes to the oldoldstable release (that is: to 2.4.3).
-- 
Regards,
Feri