Bug#1004441: unblocking chromium?
On Fri, Jan 06, 2023 at 08:41:50AM +0100, Paul Gevers wrote:
> Dear Chromium team, Security team,
>
> On 27-01-2022 17:15, Moritz Muehlenhoff wrote:
> > On Wed, Jan 26, 2022 at 09:38:42PM +0100, Paul Gevers wrote:
> > > > So, I'm proposing the following: we unblock chromium from
> > > > testing, with the understanding that prior to bookworm's release, we
> > > > have a discussion with the release team about whether chromium will
> > > > be allowed in the stable release. This will allow testing users to
> > > > upgrade for now, and then at bookworm freeze time we can figure out what
> > > > will happen with chromium (and prepare the appropriate release notes if
> > > > it will no longer be in stable/testing). What does the release team &
> > > > others think of this?
> >
> > Sounds good!
> >
> > > If the security team agrees with the message this is sending,
> > > I propose the following. We create an RC bug against release.debian.org (to
> > > make sure this issue is not forgotten, but not directly blocks chromium)
> > > with an "Affects: chromium", that clearly states that we postpone the
> > > decision. The decision will depend on how chromium updates (both in sid and
> > > supported releases) are handled between now and approximately the freeze. If
> > > we do this, don't get me wrong, I'll kick chromium out of bookworm again if
> > > there's no good track record before we release.
> >
> > Sounds good!
>
> It's about time we start discussing this. In your opinion, did the Chromium
> Team show enough track record to warrant chromium in bookworm during its
> stable cycle? From the raw number of uploads my first impression is yes, but
> I have no idea of the quality, how the communication went and those kind of
> details.
Andres's work has been top notch and it seems recently someone else has joined
the effort as well, so if they are up for continuing with Chromium's pace, that's
perfectly fine to continue to do so for bookworm.
We might consider to set some expectation for oldstable-security, though e.g state that
oldstable-security updates stop three months after the release of stable or so.
Chromium is very fast-paced in toolchain changes (e.g. in the past new C++ features
become incompatible with GCC and we might see something similar with LLVM (which
is used these days) as well.
Cheers,
Moritz
Reply to: