Description and rationale

Debian has a dedicated Security Team that works relentlessly to release timely packages updates that address security vulnerabilities without otherwise changing the behavior of the released stable distribution.

This is critical for the security of all downstream users of Debian, but also of derivatives: this ranges from individuals, to companies small and large, all the way to governments and state-wide infrastructures: any improvement on the toolchain and workflows of the Security Team has therefore tremendous potential impact.

Debusine is extended to meet the specific needs of the Security Team, and offers a streamlined workflow:

• Embargoed updates are kept private until their coordinated public release
• All updates are reviewed and validated by an official member of the team before being released
• To support those reviews, debusine can generate comparisons with the former version of the package and can show the results of the various QA tasks that were automatically scheduled. It is important to test not only that the fixed package itself works, but also that it doesn’t introduce any issue in the rest of the system; this is especially important for core packages, where an unintended change of behavior introduced by the security fix can cause many other unrelated software to misbehave.

Developer perspective

This is about adding those features related to embargos/visibility and the associated Access Control Lists, as well as providing convenient and straightforward procedures and interfaces for comparing packages/uploads, reviewing and collaborating on them, and allowing a human operator to perform various actions like signing and releasing.