On Sun, Feb 16, 2020 at 7:45 PM Neal Gompa <ngompa13(a)gmail.com> wrote:
On Thu, Feb 13, 2020 at 3:37 PM Chris Murphy <lists(a)colorremedies.com> wrote:
> On Thu, Feb 13, 2020 at 12:53 PM David Cantrell
> <david.l.cantrell(a)gmail.com> wrote:
> > > Similarly, a package with a medium CVE NEW bugzilla would be orphaned
> > > reminders (after 9-12 weeks), retired at a point if still not CLOSED after
> > >
> > > With low severity, that is 6 reminders (after 15-18 weeks), retired at a
> > > if still not CLOSED after 6 months (similarly to the current policy).
> > Where do get bug severity information?
> Fedora Workstation WG has an issue "Reconsider updates policy" that
> relates to this question.
> If there are any security updates, GNOME Software pops up a
> notification to install them. This thwarts attempts to avoid nagging
> the user, because so many updates contain some sort of security
> mitigation. One proposal is to not treat security updates as special,
> and still wait until a week has passed for the update.
> But the contra argument is, well what if there is an urgent security fix?
> The repo metadata, I guess, needs some way of distinguishing urgent vs
> non-urgent security updates, so that GNOME Software knows whether to
> notify the user accordingly. But is there a reliable way of
> distinguishing between urgent and non-urgent security updates? I'd
> informally suggest "urgent" is something that should be applied today
> or tomorrow. Anything else can wait a week or two.
The repo metadata has the property, so packagers just have to set it
in Bodhi when submitting updates. It defaults to unspecified.
It *does* default to unspecified, yes. However, when submitting an
update of type "security", bodhi won't let you even submit the update
unless you set the severity to something other than "unspecified".
> 真実はいつも一つ！/ Always, there's only one truth!
> devel mailing list -- devel(a)lists.fedoraproject.org
> To unsubscribe send an email to devel-leave(a)lists.fedoraproject.org
> Fedora Code of Conduct:
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: