Comment 20 for bug 2059303

I've been asked to try to help these updates along; I'm not on the SRU team so I can't give concrete directions, only suggestions.

My assumption is that these package updates should be published first to -updates for autopkgtest testing, and once they have passed testing and phased to users, then we should republish these updates to -security so that they are available to all users. Does this sound correct?

This is much easier to execute if the updates have been built in a PPA with only -security enabled, and not -updates. (The -security pocket is built with only packages from -release and -security, not -updates.) Do packages built in such a PPA exist?

The SRU workflow asks for packages to be either uploaded with dput to the queue or debdiffs provided. I see some debdiffs here, but some additional work was performed after most of the debdiffs were uploaded. Are the posted debdiffs something that the SRU team should work with? The Ubuntu Sponsors team was added around three weeks ago, before much of the work was done, it's entirely possible that this has fallen off their radar as a result. (And, the general hustle of responding to the xz-utils issue, release time goals, etc.)

So, with the reminder that I'm not on the SRU team, I think the next steps should be:

- prepare a PPA with only -security enabled
- build packages
- ask SRU team to move the packages to -proposed and see how autopkgtests go
- phase the update
- ask the security team to binary copy the packages to -security once it's proven in the field

What do you think?

Thanks