[Server-devel] Debian LTS Clarification & UbuCon @ SCaLE March 1-2 (free)

[James Cameron]

On Sat, Feb 18, 2017 at 03:58:26PM -0500, Adam Holt wrote:
> Thanks to Alex Perez:
> 
> "The Debian project is extending its famous development process to offer
> long-term support."
> http://www.linux-magazine.com/Issues/2017/194/Debian-LTS
> 
> I'm having trouble understanding if this is really different from
> the promises made in very recent years,

Which promises are they?  My guess is that you don't actually need to
compare promises in detail.

> but hopefully experts can clarify how the rubber's increasingly
> meeting the road, delivering on these proactive security promises :)

Probably you mean "how to use LTS?"

1.  recognise that long-term support is mostly security updates which
close vulnerabilities that are detected after release,

2.  set up and test the automated installation of the security updates
(using http://security.debian.org/ in sources.list); if network
bandwidth for updates is a problem, avoid deploying certain large
packages, set large packages to hold using dpkg, switch to using
ostree, delta packages, or use other tricks,

3.  make a list of packages for which you need long-term support; such
as the list of packages in your product, (sudo dpkg-query -W),

4.  subtract from the list any that the Debian release notes
specifically exclude; such as WebKit or VirtualBox; and figure out how
to self-support those packages,

5.  the remaining packages are long-term supported; so ensure the
debian-security-support package is installed and is configured to
inform the user somehow.

-- 
James Cameron
http://quozl.netrek.org/