[Bug 1828171] Re: New toolchain updates need to be rebuilt against -security only

[Dimitri John Ledkov]

Note one can create .deb packages with arbitrary version numbers not
matching what is listed in debian/changelog.
And this package does that, for Spaß and clarity.

And both builds appear to produce binaries with version numbers
matching the underlying source gcc versions e.g. both builds produce:

gccgo-alpha-linux-gnu-4:8.3.0-1ubuntu1.2

Which launchpad will not allow to publish.

Also I don't think you need to strictly rebuild and republish
gcc-defaults-ports and similar packages. as they should be
metapackages only and don't contain any toolchains.... (and i.e. are
safe to copy into -security pocket)

-- 
Regards,

Dimitri.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gcc-defaults in Ubuntu.
https://bugs.launchpad.net/bugs/1828171

Title:
  New toolchain updates need to be rebuilt against -security only

Status in binutils package in Ubuntu:
  New
Status in eclipse-titan package in Ubuntu:
  New
Status in gcc-7 package in Ubuntu:
  New
Status in gcc-7-cross package in Ubuntu:
  New
Status in gcc-7-cross-ports package in Ubuntu:
  New
Status in gcc-8 package in Ubuntu:
  New
Status in gcc-8-cross package in Ubuntu:
  New
Status in gcc-8-cross-ports package in Ubuntu:
  New
Status in gcc-defaults package in Ubuntu:
  New
Status in gcc-defaults-ports package in Ubuntu:
  New
Status in ggcov package in Ubuntu:
  New
Status in binutils source package in Bionic:
  Fix Committed
Status in eclipse-titan source package in Bionic:
  Fix Committed
Status in gcc-7 source package in Bionic:
  Fix Committed
Status in gcc-7-cross source package in Bionic:
  Fix Committed
Status in gcc-7-cross-ports source package in Bionic:
  Fix Committed
Status in gcc-8 source package in Bionic:
  Fix Committed
Status in gcc-8-cross source package in Bionic:
  Fix Committed
Status in gcc-8-cross-ports source package in Bionic:
  Fix Committed
Status in gcc-defaults source package in Bionic:
  Fix Committed
Status in gcc-defaults-ports source package in Bionic:
  Fix Committed
Status in ggcov source package in Bionic:
  Fix Committed
Status in binutils source package in Cosmic:
  Fix Committed
Status in eclipse-titan source package in Cosmic:
  Fix Committed
Status in gcc-7 source package in Cosmic:
  Fix Committed
Status in gcc-7-cross source package in Cosmic:
  Fix Committed
Status in gcc-7-cross-ports source package in Cosmic:
  Fix Committed
Status in gcc-8 source package in Cosmic:
  Fix Committed
Status in gcc-8-cross source package in Cosmic:
  Fix Committed
Status in gcc-8-cross-ports source package in Cosmic:
  Fix Committed
Status in gcc-defaults source package in Cosmic:
  Fix Committed
Status in gcc-defaults-ports source package in Cosmic:
  Fix Committed
Status in ggcov source package in Cosmic:
  Fix Committed

Bug description:
  [Impact]
  With LP: #1814369, the toolchain packages have been updated in both cosmic and bionic, but due to an error those packages were built in -proposed as any regular SRU. For toolchain updates there exists a policy that those should be always built against -security *only*, and then released to both -security and -updates.

  Since this is not the case with the current toolchain update, we need
  to no-change rebuild all of the previously released toolchain packages
  in a -security enabled devirt PPA, sync them to -proposed with
  binaries and then release into the archives.

  [Regression Potential]
  As these are toolchain packages, there is always some regression potential. These will be no-change rebuilds so in theory the risk should be low, but the current versions of the packages have not been built against -security only before. It is hard to say how any regressions could manifest themselves.

  [Test Case]
  Making sure there are no reported regressions in the GCC and binutils test suites. Hopefully this will be sufficient.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/binutils/+bug/1828171/+subscriptions