Bug#907723: link package versions on security-tracker to source packages

[Mike Gabriel]

Package: security-tracker
Severity: wishlist
X-Debbugs-Cc: debian-***@lists.debian.org

Hi,

when working for the LTS team, I regularly need to download source
packages from the LTS version of Debian. My development machine
normally runs a newer Debian version, having deb-src URLs for Debian
LTS in sources.list is possible but not a good option (for me) as it
increases latency for apt update.

So, I always go to [1] with my web browser, copy the URL of the .dsc
file and then dget that .dsc file.

However, for the actual CVE tracking work, I browse the
security-tracker.debian.org platform. This could be my only web tool
to use, if it allowed me to download source packages directly from
there. Unfortunately, this is not (yet) possible.

On a page like this [2] all package versions of the given package in
Debian are listed, so it should be easy to make these version strings
clickable hyperrefs that either link to the corresponding page on [1]
or even directly to the .dsc file of that version in the package
archive (the latter would be my preferred choice).

Is that something that would be helpful to others using the
security-tracker? What would be the preferred linking target, if so,
then?

Looking forward to some feedback from Security team members and LTS
members. I'd be happy to put some work into this, if liked by others.

Thanks+Greets,
Mike

[1] https://packages.debian.org/source/<lts>/<srcpackage>
[1] https://security-tracker.debian.org/tracker/CVE-2018-10873

[Moritz Mühlenhoff]

Post by Mike Gabriel
Package: security-tracker
Severity: wishlist
Hi,
when working for the LTS team, I regularly need to download source packages
from the LTS version of Debian. My development machine normally runs a newer
Debian version, having deb-src URLs for Debian LTS in sources.list is
possible but not a good option (for me) as it increases latency for apt
update.
So, I always go to [1] with my web browser, copy the URL of the .dsc file
and then dget that .dsc file.
However, for the actual CVE tracking work, I browse the
security-tracker.debian.org platform. This could be my only web tool to use,
if it allowed me to download source packages directly from there.
Unfortunately, this is not (yet) possible.
On a page like this [2] all package versions of the given package in Debian
are listed, so it should be easy to make these version strings clickable
hyperrefs that either link to the corresponding page on [1] or even directly
to the .dsc file of that version in the package archive (the latter would be
my preferred choice).
Is that something that would be helpful to others using the
security-tracker? What would be the preferred linking target, if so, then?
Looking forward to some feedback from Security team members and LTS members.
I'd be happy to put some work into this, if liked by others.

The PTS does exactly that and the Security already links there. Adding this
to the Security would be a duplication of effort and also out of scope.

Cheers,
Moritz

[Mike Gabriel]

Control: close -1
Control: tags -1 wontfix

HI Moritz,

Post by Moritz Mühlenhoff

Post by Mike Gabriel
Package: security-tracker
Severity: wishlist
Hi,
when working for the LTS team, I regularly need to download source packages
from the LTS version of Debian. My development machine normally runs a newer
Debian version, having deb-src URLs for Debian LTS in sources.list is
possible but not a good option (for me) as it increases latency for apt
update.
So, I always go to [1] with my web browser, copy the URL of the .dsc file
and then dget that .dsc file.
However, for the actual CVE tracking work, I browse the
security-tracker.debian.org platform. This could be my only web tool to use,
if it allowed me to download source packages directly from there.
Unfortunately, this is not (yet) possible.
On a page like this [2] all package versions of the given package in Debian
are listed, so it should be easy to make these version strings clickable
hyperrefs that either link to the corresponding page on [1] or even directly
to the .dsc file of that version in the package archive (the latter would be
my preferred choice).
Is that something that would be helpful to others using the
security-tracker? What would be the preferred linking target, if so, then?
Looking forward to some feedback from Security team members and LTS members.
I'd be happy to put some work into this, if liked by others.

The PTS does exactly that and the Security already links there. Adding this
to the Security would be a duplication of effort and also out of scope.
Cheers,
Moritz

Ah... I see. I oversaw the PTS links. And there I now found the .dsc
URL links.

Nice and sufficient.

Thanks,
Mike

[Debian Bug Tracking System]

Post by Mike Gabriel
close -1

Bug #907723 [security-tracker] link package versions on security-tracker to source packages
Marked Bug as done

Post by Mike Gabriel
tags -1 wontfix

Bug #907723 {Done: Mike Gabriel <***@das-netzwerkteam.de>} [security-tracker] link package versions on security-tracker to source packages
Added tag(s) wontfix.

[Paul Wise]

Post by Mike Gabriel
when working for the LTS team, I regularly need to download source packages
from the LTS version of Debian. My development machine normally runs a newer
Debian version, having deb-src URLs for Debian LTS in sources.list is
possible but not a good option (for me) as it increases latency for apt
update.

I would suggest you use either apt-venv or chdist (from devscripts) to
enable you to have the apt metadata for LTS and stable releases so
that you can easily download the source using apt. I do this and have
a cron job to automatically run apt update for each chdist.

Post by Mike Gabriel
So, I always go to [1] with my web browser, copy the URL of the .dsc file
and then dget that .dsc file.

This misses out verifying apt signatures.

[Holger Levsen]

Post by Paul Wise

Post by Mike Gabriel
So, I always go to [1] with my web browser, copy the URL of the .dsc file
and then dget that .dsc file.

This misses out verifying apt signatures.

the .dsc file is signed and dget verifies it.

[Paul Wise]

Post by Holger Levsen

Post by Paul Wise

Post by Mike Gabriel
So, I always go to [1] with my web browser, copy the URL of the .dsc file
and then dget that .dsc file.

This misses out verifying apt signatures.

the .dsc file is signed and dget verifies it.

dget does not verify the apt signatures though, since it does not download them.