Bug#589864: tomcat5.5: Missing security policy prevents proper logging when used with Sun's JVM

[Ralph Plawetzki]

Hi Torsten,

thanks for your reply.
Since this is no big thing to change I was reading the maint-guide to
see what is necessary to apply the change when I stumbled over
http://packages.qa.debian.org/t/tomcat5.5.html.

Actually I am working with Debian for a while now, but wasn’t aware of
the fact that testing has such a higher priority when it comes to fixing
bugs than stable has. Maybe it is because you guys want to get testing
out as soon as possible…

I could apply the change and let the bug concerning the Debian policy
open, but in my mind there is no sense in updating the package with the
new policy statement, if there are four other open security issues, that
are not fixed for tomcat5.5 but have been fixed for tomcat6.0.26-5. It
would increase the usability of the package, but there are more
important open issues that are out of my ability to fix.

Please don’t get me wrong: I appreciate the work you do very much and
would love to help you, but in this case it doesn’t make sense in my
mind.

Thanks anyway.

Regards,
Ralph