Should one be able to install with only release + -security enabled?

[Robie Basak]

Hi Nish!

On Wed, Nov 25, 2020 at 08:57:55AM -0600, Nish Aravamudan wrote:
>          However, I am finding a few package updates (in Bionic in my case,
> but I think Focal may also have this problem) that only have fixes in the
> -updates pocket. This prevents installation from succeeding with preseed.

It's my understanding that packages in the security should not break
anything in the release pocket, and that the security team take the
effort to build and copy extra things to the security pocket so that it
doesn't develop a dependency on the updates pocket.

I can think of two "exceptions":

1. If something was broken at time of release, then you can expect it to
stay broken by not taking the updates pocket (by definition!). So you
can only expect adding the security pocket to not regress things, as
opposed to fixing anything that was previously broken. Does your setup
work with the release pocket only?

2. Anything that a security upload regresses against the release pocket
should be treated as a bug. I'm not surprised to hear you're hitting
this in installer packages since that's a pretty obscure use case.

There are bugs that are awkward to fix where leaving some far less used
use cases broken in a stable release is the "least worst" solution. I
wouldn't be surprised if you run into something like this in trying to
fix this situation. Apart from that, I expect fixes would be accepted.

However note that I don't speak for the security or archive admin teams.
I imagine it'd be down to them to decide upon accepting fixes as they'd
all have to go into the security pocket. I'm just relaying my
understanding of the traditional intent (which I think confirms yours?).

HTH!

Robie
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-devel-discuss/attachments/20201125/0dd88f97/attachment.sig>