The Debian/Ubuntu SSL bug

[Dave Jones]

On Tue, May 13, 2008 at 11:15:15AM -0800, Jeff Spaleta wrote:
 > On Tue, May 13, 2008 at 10:56 AM, Dave Jones <davej at redhat.com> wrote:
 > >  Something the SuSE guys have done which I'm thinking we should adopt for our
 > >  patches (in the kernel at least), is a header at the top of each patch
 > >  detailing its upstream status, (and if not upstream, why not).
 > 
 > A status header for all patches might be a good thing, if....
 > we can do it in such a way that we can establish some sort of process
 > that periodically reviews the status headers for each patch and uses
 > manpower to do the follow-up for older patches or patches without a
 > status header.
 > 
 > I would imagine it could be run in a similar way to how the Feature
 > Process is run, with a Patch Wrangler (Team) who is(are) deputized to
 > seek out maintainers when updates concern patches status are needed.
 > 
 > Did you also intend to draw a line in the sand concerning the age of a
 > patch? If a patch is a certain age it automatically needs more
 > frequent status updates? Sort of like when you reach a certain age and
 > you need to go in for a colonoscopy on a regular basis?

In some cases 'never' will be a valid answer for 'when upstream?'.
Features that got vetoed (hi execshield!), or just distro-centric
changes that upstream doesn't care about.

For anything else, I think patches that survive >1 release should
probably be eyed with suspicion.  We're supposed to be "close to upstream"
after all, and if patches are lasting longer than that without good reason,
questions should probably be asked.

	Dave

-- 
http://www.codemonkey.org.uk