On Fri, May 07, 2021 at 11:17:26AM +0100, Anahata via users wrote: Thanks; just subscribed.

On Fri, May 07, 2021 at 11:26:28AM +0000, Andy Smith wrote: Brilliant tips, thanks a lot! This one I knew about, at least. Much appreciated. I should be covered now with the DSA subscription and unattended-upgrades installed. Yes it would :-)

On 07/05/2021 11:06, Adam Spiers wrote: Debian don't upgrade versions, they backport fixes to the version in a release. From the Debian security mailing list: For the stable distribution (buster), these problems have been fixed in version 4.92-8+deb10u6. John -- Xronos Scheduler - https://xronos.uk/ All your school's schedule information in one place. Timetable, activities, homework, public events - the lot Live demo at https://schedulerdemo.xronos.uk/

On Fri, May 07, 2021 at 11:06:37AM +0100, Adam Spiers wrote: Well that was slightly more painful than it probably should have been, but I managed it by adding the following source: deb http://deb.debian.org/debian buster-backports main which is documented at https://backports.debian.org/Instructions/ According to https://tools.bitfolk.com/wiki/Apt-cacher#Available_mirrors I should have been able to prepend apt-cacher.lon.bitfolk.com/debian/ but deb http://apt-cacher.lon.bitfolk.com/debian/deb.debian.org/debian buster-backports main did not work. Furthermore, as the backports instructions explain, all backports are deactivated by default (i.e. the packages are pinned to 100), so a simple "apt install exim4" won't work; instead you need apt install exim4/buster-backports I'm sure there's some package pinning voodoo which mitigates the need for this suffix, but I always found Debian's handling of package priorities confusing and never got the hang of it.

On Fri, May 07, 2021 at 11:56:21AM +0100, Andy Bennett wrote: Yes, I saw that. Another case of missing information, unfortunately: "Your configuration needs to be reworked." without providing anything explaining how or why it needs to be reworked. It should not have been hard to include some pointers to this, or perhaps a link to some documentation. The hint to add the "allow_insecure_tainted_data" option as an alternative to reworking the config which somehow magically avoids the taint errors is better than nothing, but it leaves a strong taste of voodoo in the mouth. In an ideal world, everyone would have time to read the entire exim4 documentation and become experts in exim4 configuration, but that's not how the real world works. For such a prominent open source project used by so many, I'd expect better communication. But don't mind me, I just needed to vent because this derailed some of my morning ;-)

On Sat, May 08, 2021 at 09:15:46AM +0000, Andy Smith wrote: Ah OK thanks, I missed that. I think the wording is clear; the problem is more a case of missing information which could make it easier for Debian part-timers like me to figure out the correct combination: OK. IMHO the problem seems to be a combination of the following: - https://backports.debian.org/Instructions/ only mentions deb.debian.org, and says nothing about alternative mirrors. - https://tools.bitfolk.com/wiki/Apt-cacher#Available_mirrors doesn't mention deb.debian.org, and even though backports.debian.org is listed, it doesn't explain how to derive a source correctly pointing to a Bitfolk mirror of backports. Prior to emailing the list, I tried several combinations of hosts and paths before giving up and just using deb.debian.org. Even after your explanation above, I'm unsure how to derive the correct cached source URL, given that the official backport instructions don't give a source URL which uses ftp.uk.debian.org or backports.debian.org (or any of the other mirrors listed in the wiki page). Maybe there's an underlying assumption that a mirror can be used simply by swapping out the original host name for the mirror, but even if that's the case I think it should be documented explicitly because it's not uncommon for mirrors to be hosted at a different URL path to where they were on the original host. I was trying to figure all this out in a rush, so I have to admit I didn't read the pages as carefully as I would normally want to, and maybe being in a hurry meant that I missed something obvious. But I suspect a few small additions in the places I've highlighted (Debian pages too, not just Bitfolk) would have made things clearer. Hope that makes sense. Cheers, Adam

On Sat, May 08, 2021 at 07:48:44PM +0100, Andy Bennett wrote: Another nice tip; thanks! Why are these things well hidden? It makes no sense to me. Although this doesn't work with apt-cacher.lon.bitfolk.com AFAICS, and that seems deliberate so there are probably good reasons for it.

Hello, On Sat, May 08, 2021 at 06:04:44PM +0100, Adam Spiers wrote: Debian's instructions are probably that way because they don't know what country the viewer may be in, so directs people to a geo-ip redirector. All Debian mirrors are meant to carry the same stuff so anything you can get from deb.debian.org you should also be able to get from ftp.uk.debian.org or ftp.de.debian.org and so on. Once you know that ftp.uk.debian.org/debian/ can be used any place that deb.debian.org/debian/ is mentioned then hopefully you can see that what you wanted was: deb http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/ buster-backports main Please do edit the article in a way that you think would make that obvious to anyone in future! The other thing the article should make clear, but obviously doesn't, is that if you try to use anything that's not in the list of "available mirrors" then it won't work, and you should just use it directly. So even if someone did not spot that they could use "ftp.uk.debian.org" instead of "deb.debian.org", I would have hoped that they would then think, "oh, it's not in the list, so I will need to use it directly". Which you did eventually do but not until getting frustrated trying a few things. So if you can think of some wording that would have made it clear that any attempt to jam "deb.debian.org" onto the end of the apt-cacher URI would not work, because it's not in the allowed list, please do add it! The other thing is, maybe it was not clear that just not using the apt-cacher is not a big deal? All it does is save your data transfer quota the bytes of downloading the packages and maybe is quicker if another customer already downloaded them. That was a bigger deal back in 2007 when customers had 100GB/month to use. Not so much today when it's 4TB. Just following the Debian backports instructions directly leads to something that works the way it's expected to. Maybe this is clearer now that I've explained that "deb.debian.org/debian" and "ftp.uk.debian.org/debian" are essentially interchangeable? Just make the changes to the BitFolk wiki articles that you think make things clearer. If you make mistakes then I or someone else will correct them hopefully without destroying the intent of what you added. As it stands I don't know how to make them clearer maybe because I don't know what people don't know, if you see what I mean. Like the fact that the article pre-dates the existence of deb.debian.org and I didn't know that Debian pages were using "deb.debian.org/debian" more consistently as opposed to saying things like "YOUR-DEBIAN-MIRROR/debian". I don't think I want to add deb.debian.org to the apt-cacher allowed list as I don't really see the point in it doing a geo-ip redirection back to some other UK mirror. May as well just explicitly use ftp.uk. I think I'd rather that people understood that if they want to use a mirror that's not cached by apt-cacher then just use it directly. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting

Hi Adam, On Sun, May 09, 2021 at 05:44:10PM +0100, Adam Spiers wrote: […] Thanks! I didn't really see the need to change anything that you added. I've deleted it as you're right that it's just confusing now. Its inclusion dates from a time when backports was on a separate mirror, not on Debian's main mirrors. That was the case when the article was first written and then later on Debian made its backports archives more official by putting them on their main mirrors. Cheers, Andy -- https://bitfolk.com/ -- No-nonsense VPS hosting

On Fri, May 07, 2021 at 11:54:25AM +0100, Andy Bennett wrote: Thanks, that's good to know. I wonder how they expect people to discover that when there is no explanation of that on the page. It would not be hard to add a tooltip or footnote which gives more information. I already had that, but nothing from LWN made me expect that 4.92.x would be fixed. With hindsight, I could have checked /usr/share/doc/exim4/changelog.Debian.gz. Indeed. That's why it's standard practice to list specific versions showing which distro packages have the fixes.