14:00:09 #startmeeting 14:00:09 Meeting started Thu Nov 27 14:00:09 2025 UTC. The chair is el_cubano. Information about MeetBot at https://wiki.debian.org/MeetBot. 14:00:09 Useful Commands: #action #agreed #help #info #idea #link #topic. 14:00:11 #topic Roll call 14:00:16 o/ 14:00:21 Please go ahead and announce your presence here 14:00:26 o/ 14:00:26 o/ 14:00:27 \o 14:00:46 hi 14:00:54 o/ 14:00:57 o/ 14:01:05 \O 14:01:19 o/ 14:01:21 \o 14:01:22 o/ 14:01:35 hi everyone o/ 14:01:51 \o 14:01:54 o/ 14:01:58 As noted by helmut just before we started, the agenda can be found here: https://pad.riseup.net/p/lts-meeting-agenda 14:04:02 OK. That looks like everyone who will be showing up, so let's move on. 14:04:14 Ah, one added note... 14:04:21 Regrets: lamby 14:04:30 Alright. Next topic. 14:04:46 #topic New team members 14:04:54 (None this month) 14:05:18 And, since that's it for that topic, next topic. 14:05:22 #topic Action item review 14:05:43 Action: (carried over from last month) Review packages which may be subject to upgrade regressions, close the associated ML thread, and create a plan for dealing with the packages that have been identified 14:06:19 This one was to santiago and me, but we didn't make any progress on this. 14:06:38 I reviewed a couple of packages and poked the related people, but more work is needed 14:07:16 there's a report by lts-cve-triage.py, and I think ta has been fixing some of the packages 14:07:43 pochu, good point 14:07:43 I wonder if that's something we want to make a collective effort to clear that list 14:08:11 pochu, yeah, absolutely. my idea has been to ping individual first, and ask if any help is needed 14:08:18 those packages are not in dla-needed atm, so I don't know 14:08:42 santiago: what individual? (many of) those packages are not in dla-needed, those are old issues for the most part 14:08:57 santiago, pochu: could you update the action item on the agenda, under the "Result:"? 14:09:09 I am assuming that we don't consider this finished, so I will carry it over to next month. 14:09:11 pochu: is there an url for the list? 14:09:22 pochu, the people who handled the updates in older releases 14:09:36 santiago: ah, makes sense 14:09:58 maybe add those packages to dla-needed and assign them to those individuals? then if they don't act, they will be unassigned and anybody can pick them up? 14:10:19 IIRC most remaining impacted packages from lts-cve-triage.py, and not in dla-needed.txt, have low priority (low-severity, no sponsoring) 14:10:53 though I see erlang and busybox which I didn't expect 14:11:02 also https://salsa.debian.org/lts-team/lts-updates-tasks/-/issues/?label_name%5B%5D=%28O%29SPU 14:12:09 erlang is #1115093 14:12:43 for packages whose fix is missing in bullseye, adding them to dla-needed.txt makes sense. But the inconsistency issue also happens for CVEs that were fixed in bullseye (and older) and that remain open in bookworm or trixie 14:12:50 I pinged the maintainer if they still work on the update but no reaction 14:12:59 So, I think that to summarize this item, there has been some action taken, but more remains. 14:13:05 well, this is almost exactly what i raised and suggested a couple of months ago :) 14:13:08 but glad this is coming to action. :) 14:13:16 santiago: Would it be OK if we conclude the discussion on this item and move on? 14:13:27 el_cubano, sure 14:13:49 OK, next item. 14:14:02 * pochu doesn't know what the conclusion is :) 14:14:02 Action: (carried over from last month) Follow-up to ML and Andreas concerning upload of nvidia-graphics-drivers 14:14:34 I've wrote Andreas a mail, but I guess I need to ping him again. 14:14:44 pochu: it is still WIP, and I'd like to not try to hash out the details during the action item review, which is supposed to be a quick/short part of the meeting :-) 14:14:57 We can come back to this during AOB. 14:15:00 ack 14:15:21 tobi: I presume that you are referring to nvidia-graphics-drivers action item. Is that right? 14:15:26 yes 14:16:03 OK. Thanks for the update. I will carry this action item over for the next meeting. 14:16:07 Anything else on this one? 14:16:49 I think that's all on this 14:16:56 Thanks! Next action. 14:16:59 Action: (carried over from last month) Follow-up to ML and Andreas concerning upload of nvidia-graphics-drivers 14:17:02 Assignee: Santiago & Tobi 14:17:05 Result: WIP? - https://lists.debian.org/debian-lts/2025/10/msg00027.html 14:17:07 need to poke Andreas again (tobi) 14:17:12 Oops. Copy/pasta error. 14:17:19 Action: Send the first documentation recap email 14:17:59 In a very impressive display of just-in-time delivery, beuc has sent out the promised summary email mere minutes before this meeting started :-p 14:18:29 :-D 14:18:30 Seriously, just from a very quick scan, they seem very informative and quite useful given the big documentation changes in the last month. 14:18:43 +1 14:18:46 hi 14:18:47 I meant to do it at the beginning of the month but got sidetracked with an heavy FD week. Next one probably earlier next month. 14:18:58 sorry for being late 14:18:59 kudos to Beuc 14:19:09 thanks :) 14:19:14 I plan to read them through in detail later and I encourage everyone to also review the change summary, especially if you haven't been closely following the MRs and issues that are touching the documentation. 14:19:21 rouca: No worries, and welcome. 14:20:00 OK. I consider this action item closed/completed. Any objections? 14:20:10 Beuc: thanks indeed for the summary! 14:20:31 thanks for hte summary really helpful 14:20:32 no objections, awesome work Beuc! 14:21:28 OK, so let's move on to the next action item. 14:21:42 Action: Try out and document the ELTS VMs for use in Incus 14:21:57 that's on me 14:22:06 charles: I don't think I saw kanashiro here, so could you provide an update? 14:23:00 kanashiro is my test subject :-) We've been testing things together 14:23:41 I'm preparing a blog post about it, but still need to think how the best way to condesate the info for our documentation 14:24:00 the summary for having elts images in incus is: 14:24:09 one need to use debefivm to create an elts VM image or grab a debusine built one (https://debusine.freexian.com/freexian/base/workflow/) 14:24:17 Need to convert to qcow2 (qemu-img convert for instance) 14:24:26 Need to create incus metadata tarball 14:24:32 and then import it to incus 14:24:46 (a bit more detailed in the meeting agenda) 14:24:47 charles: please be aware that base is due to be renamed to "elts" 14:25:12 helmut: ack, will update in the meeting agenda 14:25:26 how soon will this happen? 14:25:35 or soon (tm)? :-) 14:25:51 it is not yet renamed, but a lot of things have been moved out already and the "elts" name has ben released by renaming it to "elts-staging" like last week 14:26:11 this year 14:26:43 ack, I will pay attention and then update it when the move happens 14:26:55 there will be an announcement mail 14:27:07 ack 14:27:45 I guess the last thing to do about this is to add to the technical documentation page in the lts-team website 14:27:53 Cool. Thanks for the update. 14:27:56 Anything else on this? 14:28:07 which I plan to do early december at most 14:28:41 el_cubano: no, that's all 14:29:30 Ack. Moving on, then. 14:29:39 Action: Discuss the state of ca-certificates and how the LTS team might be able to help the maintainer 14:29:48 charles: afaik you can't pass --keyring= multiple times 14:30:01 el_cubano: I tried to contact sylstre without sucess 14:30:08 Ack. 14:30:22 I will phone to mozilla fundation paris and get a physical appointement 14:30:35 jochensp: weird, it seems to work (though I tested in trixie not testing/sid) 14:30:40 The situation with this one is a bit challenging. But we are trying to see how to help. 14:30:58 rouca: Please let us know how that goes. 14:31:23 I can get to Paris to meet julien or sylvestre 14:31:30 but I need to get first contact 14:32:10 I don't see Sylvestre involved in ca-certificates 14:33:10 santiago: ca-certificates come from mozilla 14:33:22 santiago: they are extracted from mozilla upstream 14:34:47 Anything else on this one? 14:34:50 sure, but we are talking about the status in debian. Sylvestre hasn't been involved in the packaging 14:35:04 anyway... this task is more on a Debian level 14:36:23 santiago: Should we then consider this closed/completed for the purposes of LTS? That is, not carry it over to next month? 14:37:30 IMO, I would keep it in the agenda for any LTS-related action. But happy to hear other's opinion 14:38:04 OK. That works for me. We'll carry it over. 14:38:26 Are we good to conclude the action item review and move on? 14:38:53 I'd say yes 14:39:15 OK, then let's move on. 14:39:32 #topic Debusine news 14:40:12 * LucasKanashiro[m] says hi while reading the backlog 14:40:32 Thanks to helmut we have some updates on Debusine. Please have a look at the update as provided in the agenda and if you have questions or feedback then helmut is here and is able to answer questions and listen to feedback. 14:41:00 LucasKanashiro[m], hi! 14:41:19 LucasKanashiro[m]: o/ 14:41:39 o/ LucasKanashiro[m] 14:41:58 * charles waves to LucasKanashiro[m] 14:42:51 helmut: are debusine.f.c and debusine.d.n always on the version or they are handled separetely (a bit off-topic, sorry) 14:43:16 (but I'm curious) 14:43:16 charles: presently, we manage them at equal versions most of the time 14:43:37 The guvicorn switch was tested on debusine.d.n before being propagated to debusine.f.c. 14:43:56 ack, so we should expect the same level of features for them, right? 14:44:11 We still follow the development branch tightly (updating one to four times a week) 14:44:30 Yes. 14:44:35 awesome! 14:45:08 We intend to retain compatibility with trixie's debusine-client. There is breakage on the horizon though. I suppose in a year, we might be requiring trixie-backports. 14:45:51 ack 14:45:57 Any other Debusine questions or move on? 14:46:50 (or infrastructure questions in general) 14:48:27 OK. It looks like there are no more questions/feedback for helmut 14:48:41 helmut, thanks for the update 14:48:43 helmut: Thanks for the update and the info on Debusine development/deployment 14:48:57 #topic Featured issues of the month 14:49:13 I have again failed to identify one or more specific issues to highlight. 14:50:18 I would encourage anyone who might be in the situation of wanting to work on something but not able to find a package or packages which are good fit, to check lts-extra-tasks and the internal projects for a wide variety of non-packaging tasks that need to be done/worked on. 14:51:00 OK. So, let's move on to the next item. 14:51:07 #topic LTS-ELTS Team consolidation 14:51:46 Almost 2 weeks ago we made the biggest single change related to the merger (combining the ledgers). 14:52:05 Please have a look at the thread on the internal ML for details about what this means for reporting. 14:52:36 Also keep in mind that going forward only one allocation of hours will be made each month (instead of two), so please adjust your max_hours accordingly. 14:54:48 Any questions or comments related to the team merger? 14:56:13 thanks 14:56:33 y/w 14:56:39 OK. Let's move on. 14:56:50 #topic Any other business 14:56:51 Has there been previous discussion about installing debian-security-support by default (starting with Unstable, not just for LTS/ELTS)? 14:57:14 jbicha: perfect timing :-) 14:57:22 Let's start off the AOB section with this. 14:57:39 I'm not aware of any specific discussion related to that. 14:57:56 it was something I thought about while reading through the LTS docs. Ok, I'll send an email to the LTS list for more discussion on the idea then. 14:57:57 I think the only way to achieve that is to make it 'Priority: required' (or maybe 'standard'). 14:58:26 it could be added to specific tasks too 14:58:43 Ah, good point. 14:58:57 Prio:important is sufficient for default installations, please avoid required 14:59:29 required ends up in debootstrap --variant=minbase and --variant=buildd 14:59:33 helmut: Right, of course. I forgot all about 'important'. 15:00:14 jbicha: So, depending on how you envision this being addressed, then it might make sense to have the discussion on debian-devel. 15:00:27 that ^ 15:00:29 please also add a note to the release-notes, in case 15:00:45 Personally, I would rather see the priority change or task inclusion happen in sid and then move into the older releases. 15:01:21 Anything else about d-s-s? 15:01:34 yes for debian-devel, but I think discussing it on the lts list first might be good 15:02:30 you can give me a task to start this discussion 15:03:05 Certainly. If we can articulate why it would be good to have this as a default in the LTS context, then that may help convince others that it should be the default starting in sid. 15:03:28 #action jbicha start a discussion about debian-security-support being installed by default 15:03:32 jbicha, I would ask Holger first 15:04:04 ok 15:04:10 as a co-maintainer, i’ll speak with Holger and get back to you, jbicha. :) 15:04:16 OK. I think that's everything for d-s-s. 15:04:21 thanks 15:04:21 i have thoughts but let me get back. 15:04:48 charles: You made some changes very recently to the docs relate to vulnerabilities without a CVE ID. 15:05:06 just a shout out for reviews: https://salsa.debian.org/lts-team/lts-team.pages.debian.net/-/merge_requests/26 15:05:27 to make sure I didn't miss anything important 15:06:27 that's all for this AOB el_cubano 15:06:48 Thanks! 15:06:51 I have a question about 15:06:51 sorry, a late comment about the lts-elts merger: an update of python3-pyxian is pending. it should handle the hours report correctly. I'll announce when it will be available. 15:07:12 santiago: I actually announced it yesterday :-/ 15:07:21 autopkgtest in elts does it ported to newer autopkgtest in order to avoid bug 15:07:35 I completely missed it then! sorry 15:07:37 (gcc 6 one) 15:08:03 rouca: do you have context? 15:08:35 santiago: so I understand the python3-pyxian from yesterday is fine or is there more coming? 15:08:49 santiago: np 15:10:20 rouca: ?? 15:10:25 https://salsa.debian.org/ci-team/autopkgtest/-/merge_requests/599 15:11:21 (released as autopkgtest 5.51) 15:12:44 anything else to discuss? 15:13:37 rouca: That appears to have been merged to master, so I would expect to make it's way through sid. 15:13:53 I don't have anything else for AOB. Does anyone have anything else? 15:14:27 i do but we’re over time, should i bring it up in the next meeting instead? 15:14:40 utkarsh2102, sure 15:14:49 it’s not urgent — just around salsa ci and its usage (i even mailed a few weeks back) 15:14:58 okeydoke, can bring it up next time. thanks o/ 15:14:59 ah, I forgot to answer to that email 15:15:06 we can follow-up there 15:15:24 in that case, i won’t have to bring it up. thanks! 15:15:24 Alright, so let's call AOB finished. 15:15:35 #topic Next meeting 15:15:41 Next meeting: 2025-12-18 14:00 UTC [Location: Jitsi: https://jitsi.debian.social/LTS-monthly-meeting] 15:15:48 NOTE: this is the third Thursday rather than the fourth Thursday, to avoid colliding with Christmas (which is a holiday for many people on the team) 15:16:04 appreciated :-) 15:16:10 +1 15:16:30 ok 15:16:45 Alright. Thanks to everyone for participating. 15:16:46 collaborator-only: can we have the google calendar event back? 15:16:52 thanks everyone. see you soon! o/ 15:16:58 thanks! 15:17:03 o/ 15:17:15 helmut, what do you mean? 15:17:17 bye! 15:17:22 santiago: Oh yeah, helmut DM'd me about the event on the Google calendar. 15:17:48 I still see it, but he no longer sees it. The original even was created by buxy some time ago, so I don't know if something has gone wrong with it. 15:17:48 thank you everybody! 15:17:59 bye! 15:18:02 I think you should create a new event and send it to the collaborators. 15:18:14 +1 15:19:17 For now, just create an event for December. Next week I'll generate the meeting schedule for 2026, and then the dates will be known for certain and events can be created for those. 15:19:35 So, let's consider the main/official part of the meeting completed at this point. 15:20:14 Nobody is required to remain for the last part, but everyone is welcome. We will be discussing some more in depth technical issues (which are likely not interesting to the entire group) 15:20:18 #topic MEETING APPENDIX: Discussion of technical questions/issues and reviews 15:20:53 Firstly, is there additional discussion on the packages subject to upgrade regression? (This was the discussion that started to happen during the action item review at the beginning of the meeting) 15:21:03 pochu, santiago: ?? 15:22:02 one additional action item is to add the bullseye-related packages to dla-needed 15:23:05 #action rouca (FD this week) and utkarsh2102 (FD next week) add the bullseye-related packages to dla-needed 15:23:09 rouca, utkarsh2102: ^^ 15:23:13 rouca, as you are FD this week, would you like to add them (or part of those). I could also help. 15:23:30 cool beans — i’m also happy to do it. 15:23:56 Anything else about packages that are at risk for upgrade regression? 15:24:07 for those regarding bookworm and/or trixie, we should keep in mind the next point releases, so now is a good time to propose help on those packages 15:24:11 do we want to assign it to people who dealt with the previous DLA or just add it. 15:24:24 I'll reiterate that there are many packages in the report that are low-priority. 15:24:35 and/or unsupported. 15:25:37 utkarsh2102: That's a sensible default. I recall last time also sending emails with a short "hey, package foobar is back in dla-needed and assigned to you since you most recently worked on it and it would be best if you could handle the remaining work" 15:25:41 Beuc, good point. thanks. So: adding those packages to the work queue needs some triage/filtering first. Does that make more sense? 15:26:15 Works for me. 15:26:22 Anything else on this? 15:26:34 not from me 15:27:26 maybe also check https://bugs.debian.org/cgi-bin/pkgreport.cgi?users=release.debian.org@packages.debian.org;tag=pu 15:27:30 OK. Let's move on to the last item. 15:27:32 for in-progress SPUs 15:27:41 Documentation on how to deal with importing new upstream releases on the git side 15:27:47 I wasn't able to find so documentation for how to deal with new upstream releases for lts/elts in git so I assume we don't have it. 15:27:48 charles: This was you, right? 15:27:54 el_cubano: yes 15:28:04 It's not as straightfoward as it seems, requires creating a branch upstream/ and importing it there 15:28:16 (at least that's how I do it) 15:29:47 since we are sharing more official debian repos with tls/elts, I think it would be good to have it documented to avoid pushing an old upstream release on top of the regular upstream branch for unstable/experimental 15:30:01 AFAIK the upstream branch can be used in any order 15:30:30 GBP handles it 15:30:50 I was aware pristine-tar could be, didn't know about the regular upstream branch 15:30:59 yes^ 15:31:01 why not? :) 15:31:37 i use the regular workflow for a bunch of packages that we often update to a newer version. 15:32:38 The Debian packagers for that package may have a specific way to import new upstream releases, so maye check with them when that happens anyway. 15:32:49 Especially if there's repackaging/dfsg. 15:33:03 that's a *me* thing then, but I rather have then completely split (git log --oneline --graph works better that way) 15:33:12 Beuc, good point. thanks. So: adding those packages to the work queue needs some triage/filtering first. Does that make more sense? 15:33:32 Maybe in that case the script should ignore unsupported packages? 15:34:01 And CVEs that are 15:34:17 Otherwise those issues will be in the triaging script report forever 15:34:31 +1 15:34:57 pochu[m], ignored CVEs should be handled; unsupported is delicate as this is a private freexian-only list, plus we're not opposed to non-funded people doing that work (as in, this is part of Debian). 15:35:29 for lts, we could take the unsupported package from d-s-s 15:35:57 ah I meant non-sponsored above 15:35:58 That's what I meant 15:36:17 unsupported should be or already 15:36:19 We should prioritize sponsored packages, but not-sponsored are also supported in LTS 15:36:55 yeah I misused "unsuppored" above 15:37:03 Then everything in the report can be taken care of, with appropriate priority (all those should be minor issues) 15:39:04 We've been going back&forth with low-priority packages lately. 15:40:36 OK. I think that the remaining details can be discussed and sorted out on the ML. Any objections? 15:40:41 Easy fixes tend to get claimed prior higher-priority packages (even when I tag "low priority"). Coordinates made a sweep in xla-needed.txt to ditch packages with low-priority CVEs. Hence as a FD I tend to be careful not to add low-priority packages. 15:41:52 Beuc, any suggestion about how to improve that today? 15:41:54 That's why I never added all of the packages from the report. If we want to change our policy to put a focus on dist consistency, that's fine by me, I just need to be told. 15:43:07 As I said in other places, when we'll have point-release-like/batch updates, handling low-priority issues would be easier, or at least more consistent with the rest of debian 15:44:11 santiago, re:improvement, AFAIU currently we're just more picky about adding low-pri packages in dla-needed.txt right? 15:44:29 right 15:44:49 santiago, though I have to note that you claimed the least-prio package at ELTS ;) 15:46:12 Beuc, yeah, and that is because I don't have enough spoons to handle more complex packages 15:46:37 that is probably a situation that I share with others 15:46:39 Yeah they are good for newcomers too. 15:47:10 yeah, but we don't have any right now 15:47:28 I think that we are mostly repeating things that we've said before :-) 15:47:56 I'm certainly not opposed to updating the tooling and the documentation to be more explicit/clear/consistent with our current approach. 15:48:19 Anything else, or can we call it done here? 15:49:13 Alright. I'm going to end the meeting here. Certainly, the discussion can continue, it just won't be recorded as part of the meeting minutes. 15:49:24 Thanks again to everyone for participating for contributing. 15:49:27 #endmeeting