Glibc stable release process (Glibc 2.26.1)

[Florian Weimer]

On 10/01/2017 09:59 PM, Andreas K. Huettel wrote:
> To be honest, if I were a long-time glibc distro maintainer I'd probably agree
> with you and prefer hand-picking. Starting from a tag / tarball is something I
> prefer because I'm not that versed with things yet.

We continuously rebase Fedora on top of the upstream stable release 
branch for that Fedora release (but we do not switch branches within a 
release).

I doubt there is a clear preference, and each approach has its 
advantages and disadvantages.

I still don't understand why you need tarballs for releases, though.  or 
put differently, the difference between glibc 2.26.5 and glibc 2.26-40 
seems rather minor to me, and producing the tarballs is quite a bit of 
work for us.

Regarding security backports, you really need to read and understand our 
announcement of significant issues anyway.  People keep rediscovering 
semantically dependent patches in glibc 2.19 for the CVE-2015-7547 fix 
because the posted patch applies without conflicts without them, and 
this despite we clearly named those patches in the release announcement. 
  This is why I'm wary of pretending further that things are simple. 
They are not.

Thanks,
Florian