Is the linuxcnc community prepared to support the linuxcnc edition currently in Debian Bullseye for 3-4 years? In other words, willing and able to fix any security issues or other fatal problems with the package in a timely maner? <URL: https://tracker.debian.org/pkg/linuxcnc > show version 2.9.0~pre1+git20230208.f1270d6ed7-1 is the one that is going to be included in the next stable Debian release. If not, it might be an idea to ask the ftpmasters and/or release manager to remove it from testing before tomorrow, to have a chance to get it removed before the new stable release is published. I do not know how long it take to build ISOs and running other release machinery, but doubt there is much time to successfully get the package removed. There should also be a release critical bug report (severity critical or serious) stating that the package is not yet ready for a stable release in Debian. Perhaps by upgrading the severity of this bug report.
I willing to put some effort into this.
The current version of LinuxCNC in Debian is a pre-release
("2.9.0~pre1..."). Many new fixes have gone in to our 2.9 branch since
that upstream tarball was made, and undoubtedly more patches will come
over the 3-4 years that Bookworm will be active.
What is Debian's policy for how we are to fix problems with our package
in the Debian stable release, specifically: when is it ok to update the
upstream tarball to a newer 2.9 snapshot vs when must we backport
specific bugfix commits and place them in debian/patches?
I don't fully understand the question. But we still support LinuxCNC 2.8 on Ubuntu 12.04 so I don't think that there is any question that we are in it for the long haul.
[Andy Pugh] current version in Debian Testing is the one that will be around in Debian for the duration of Debian 12 Bookworm, and not be surprised by the need to keep it working and secure for some years to come. I just found <URL: https://wiki.debian.org/UpstreamGuide > which seem to have some useful information for upstream projects. The update policy for stable as expressed on <URL: https://release.debian.org/ > is "Fast response for security updates. Minor updates include security and other important fixes only." Very good. :)
Is there really no opportunity to push an updated version at this point? I suppose we can always point users at our own repository if they want the new stuff (like the Mesa modbus driver)
I backport sounds reasonable to me. Would want to wait for the official 2.9 in Debian testing, though. Steffen