which package best used for each Debian release

[Jonas Smedegaard]

Hi Rob,

Quoting Rob van der Putten via Pkg-voip-maintainers (2024-09-07 11:13:49)
> On 06/09/2024 13:14, José Miguel Gonçalves wrote:
> > I was wondering, what is the current maintenance status of Asterisk on 
> > Debian?
> > I see that there are packages published on unstable, but the current 
> > version has a reported security vulnerability (CVE-2024-42365 
> > <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1078574>) since 
> > August 12, that was still not addressed.
> > Is the goal to still maintain Asterisk packages in Debian or there is 
> > lack of man-power for that?
> > I'm using these packages since 2015 and I need to upgrade some servers 
> > that I support form Asterisk 16 to 20 and I was wondering if could 
> > continue to use Debian packages (even if I need to backport them from 
> > unstable to bookworm) or if I need to go in other direction (find some 
> > alternative Debian packaging, or compile/package it myself).
> 
> While on the subject of Asterisk.

Thanks for moving the conversation away from the bugreport.

Even better to also change the subject line.

I've done it now, guessing from the contents of your post :-)


> PSTN is phased out rapidly over here. The only alternatives are VOIP and 
> GSM. So I had my old PSTN number ported to VOIP.
> I'm currently using the Asterisk from Debian 11 / Bullseye on a 12 / 
> Bookworm system. You have to install libldap.4-2 and libssl1.1 from 11, 
> but it does work.
> Is it also possible to use the Asterisk from 11 on a 13 / Trixie system 
> or does one need to build a backport?

Asterisk built for a specific release of Debian is designed to work with
that release of Debian.  It might be badly designed (have bugs) and it
might (accidentally) work backwards or on the Moon as well, but that is
untested.

Maintenance of Asterisk is understaffed.  Please don't expect there to
be sufficient resources at hand to provide pseudo-official judgements on
fringe configurations.  Feel free to explore such setups (you might
learn something from it, even if it breaks), just please don't burden
this too tiny team with your exploring tengential consequences of the
lack of stable packaging due to the very lack of maintainers.

Related more general advice:
https://wiki.debian.org/DontBreakDebian#Don.27t_make_a_FrankenDebian

> I suppose the alternative would be to wait for 14 / Forky to become
> stable.

No, if nothing changes then there will be no Asterisk in Forky either!

The alternative is that someone rolls up their sleeves and try help out,
as José is doing.

I don't say that that someone have to be you, but waiting alone does not
lead to Asterisk entering stable. Ever.


> BTW, I always chown the files under /etc/asterisk/ to root:asterisk so 
> the process can't write to it's own config files. I don't use 
> functionality where Asterisk needs to write to these files.

Please report issues using the Debian bugtracker, instead of posting it
more loosely here on the mailinglist.

Using the bugtrackiner helps simplify maintaining Asterisk packaging in
Debian (which is especially important when understaffed), and helps also
to discover it for others that similarly to you find it an issue and
perhaps even are able to help solve it.

More on reporting bugs: https://www.debian.org/Bugs/Reporting


Thanks,

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/
 * Sponsorship: https://ko-fi.com/drjones

 [x] quote me freely  [ ] ask before reusing  [ ] keep private
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-voip-maintainers/attachments/20240907/dc648200/attachment.sig>