[request-tracker-maintainers] Uploading RT5 to sid

[Dominic Hargreaves]

On Tue, Nov 30, 2021 at 09:31:51AM +0000, Dominic Hargreaves wrote:
> On Tue, Nov 23, 2021 at 10:36:15PM +1300, Andrew Ruthven wrote:
> > Hey,
> > 
> > I'm keen to upload RT 5.0.2 and associated modules to sid. I think the
> > approach is:
> > 
> > 1) upload libmodule-install-rtx-perl that is in experimental to sid
> > 2) upload 5.0.2 packages
> > 
> > Once 2 & 3 are in sid:
> > 3) upload all the various RT5 extensions
> 
> Sounds good, though I believe that the extension packages can be
> uploaded to sid now (see the TODO in 
> 
> https://docs.google.com/spreadsheets/d/17WvGt5oedk2qsekJbPl-CLyhrs8FIaFDobinMMMP5p8/edit#gid=0
> 
> )
> 
> > Do we want to upload RT 4.4.5 to sid?
> 
> Interesting question. We want to remove RT4 from testing before the
> next release. But I imagine there will be users who will benefit from
> a few more uploads of RT4 to unstable in the meantime, so I'd say yes.
> Do you have cycles/interest in doing that? If not I can probably step
> in.
> 
> From https://docs.bestpractical.com/release-notes/rt/4.4.5 I see
> that there's also a security vulnerability (username enumeration through
> timing side-channel attack) fixed in 4.4.5. I'll file a separate bug about
> that now.

Correction, that's already done:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995167