[OE-core] [PATCH RFC CFH][sumo 00/47] CVE check backport

[Adrian Bunk]

On Mon, Nov 11, 2019 at 07:54:34AM -0800, Khem Raj wrote:
> On Mon, 2019-11-11 at 16:14 +0200, Adrian Bunk wrote:
> > On Mon, Nov 11, 2019 at 01:12:47PM +0000, Richard Purdie wrote:
>...
> > > As I've said in a few places, the TSC really needs to figure this
> > > out
> > > and its complicated by the LTS discussions. Those discussions are
> > > happening but aren't simple.
> > 
> > Past releases and future releases might be separate topics.
> > 
> > Please keep in mind that many people already have to support products
> > on existing stable branches, working under the assumption that
> > patches 
> > submitted by the community will be accepted.
> > 
> > Closing future non-LTS branches early might be OK if this is part of
> > a 
> > clearly communicated EOL schedule for future LTS and non-LTS
> > releases, 
> > like it is clear when Ubuntu releases will be released and for how
> > long 
> > they are supported.
> > 
> > But this visibility on upstream support is needed before deciding on
> > a Yocto release for a product. Future LTS releases are irrelevant
> > for 
> > existing products that cannot move to a different stable branch.
> 
> current and prior two releases are actively maintained.

"master and the latest 2 stable branches"
(AFAIK thud is no longer actively maintained)

> So that should
> have been the consideration when selecting a release for production in
> past. see
> 
> https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance

Which also says "but well-tested patches may still be accepted for them".

The question is exactly how the patch acceptance for the community 
maintained stable branches works for people who are maintaining
products on these older branches.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed