On Thu, Feb 13, 2020 at 3:37 PM Chris Murphy <lists@xxxxxxxxxxxxxxxxx> wrote: > > On Thu, Feb 13, 2020 at 12:53 PM David Cantrell > <david.l.cantrell@xxxxxxxxx> wrote: > > > > Similarly, a package with a medium CVE NEW bugzilla would be orphaned after 4 > > > reminders (after 9-12 weeks), retired at a point if still not CLOSED after 4 months. > > > > > > With low severity, that is 6 reminders (after 15-18 weeks), retired at a point > > > if still not CLOSED after 6 months (similarly to the current policy). > > > > Where do get bug severity information? > > Fedora Workstation WG has an issue "Reconsider updates policy" that > relates to this question. > https://pagure.io/fedora-workstation/issue/107 > > If there are any security updates, GNOME Software pops up a > notification to install them. This thwarts attempts to avoid nagging > the user, because so many updates contain some sort of security > mitigation. One proposal is to not treat security updates as special, > and still wait until a week has passed for the update. > > But the contra argument is, well what if there is an urgent security fix? > > The repo metadata, I guess, needs some way of distinguishing urgent vs > non-urgent security updates, so that GNOME Software knows whether to > notify the user accordingly. But is there a reliable way of > distinguishing between urgent and non-urgent security updates? I'd > informally suggest "urgent" is something that should be applied today > or tomorrow. Anything else can wait a week or two. > The repo metadata has the property, so packagers just have to set it in Bodhi when submitting updates. It defaults to unspecified. -- 真実はいつも一つ！/ Always, there's only one truth! _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
