Debian testing security team

Goals

The Debian testing security team is a group of Debian developers and users who are working to keep Debian's testing branch in good shape with respect to security. Since packages migrate to testing from Debian's unstable branch, a secondary goal of the team is to improve the state of security in unstable.

Security Tracker

The team is tracking new security holes on an ongoing basis, making sure maintainers are informed of them and filing bug reports in the Debian BTS. The result of this work is availably in the Security Tracker web page. This tracker contains information about all branches of Debian and is also used by the stable security team.

Security support for testing

The team is providing security support for Debian's testing branch by

• writing patches and doing NMUs to unstable as necessary
• tracking the fixed packages and working with the Debian Release Managers to make sure fixes reach testing quickly
• if this process is too slow, providing fixed packages built against testing in the testing-security apt repository:

  		deb http://security.debian.org testing/updates main contrib non-free
  		deb-src http://security.debian.org testing/updates main contrib non-free
  		

  However, the majority of security fixes reach testing by migration from unstable.

Note that in order to take advantage of the security support for testing, you must update your system on a regular basis.

Limitations

For several reasons, the security support for testing cannot be expected to be of the same quality as for Debian's stable branch:

• Updates for testing-security usually receive less testing than updates for stable-security.
• Testing is changing all the time which increases the likelihood of problems with the build infrastructure. Such problems can delay security updates in testing.

Announcements

Daily notifications about fixed security issues are sent to the debian-testing-security-announce@lists.debian.org mailing list.

Contacting the team

To contact the team, use

• the team mailing list at secure-testing-team@lists.alioth.debian.org (Please note that this is a public list, and as such, you should not send details of undisclosed vulnerabilities to this address.)
• IRC: Our irc channel is #debian-security on the OFTC network.

For issues related to the Debian security tracker, use the

• security tracker mailing list at debian-security-tracker@lists.debian.org

Helping the team

• Helping the testing security team
• Uploading to the testing-security repository

More information

• List of open security issues in testing
• Debian Security Analyzer shows which open issues affect your system
• Subversion repository holding the data for the Debian security tracker. It may be checked out from svn://svn.debian.org/secure-testing/. There is also a mailing list for the commit messages.
• Alioth project page with a list of team members.
• Mitre's CVE database

Internal information

• Introduction to our processes
• Bugs tagged security that have not been added to the tracker, yet
• Information about accepted uploads to testing-security is sent to debian-testing-changes

$Id$