One Bugzilla report per distro version or one for all?

[Ville Skyttä]

Best practice question:

Assuming a security issue in package foo which is shipped and vulnerable
in many distro versions, do people find it better to file one
copy-pasted bug report per distro version or a "combined" one for all
which lists the affected distro versions?

The one-for-all approach would have the benefit of easier copy-pasting
between audit/* files and probably more accurate Bugzilla references in
maintainer %changelog entries as the same specfile is used for all
distro versions in the vast majority of cases.  It could make things
slightly harder to track, eg. in Bugzilla queries and such.

[Dennis Gilmore]

On Thursday 11 May 2006 15:15, Ville Skyttä wrote:
>  Best practice question:
>
>  Assuming a security issue in package foo which is shipped and vulnerable
>  in many distro versions, do people find it better to file one
>  copy-pasted bug report per distro version or a "combined" one for all
>  which lists the affected distro versions?
>
>  The one-for-all approach would have the benefit of easier copy-pasting
>  between audit/* files and probably more accurate Bugzilla references in
>  maintainer %changelog entries as the same specfile is used for all
>  distro versions in the vast majority of cases.  It could make things
>  slightly harder to track, eg. in Bugzilla queries and such. 
I would think one
bugzilla entry for all.  If you did one for each  you could 
be dealing with 5 bug reports.

-- 
Regards

Dennis Gilmore,  RHCE
Proud Australian

[Josh Bressers]

>  On Thursday 11 May 2006 15:15, Ville Skyttä wrote:
>  > Best practice question:
>  >
>  > Assuming a security issue in package foo which is shipped and vulnerable
>  > in many distro versions, do people find it better to file one
>  > copy-pasted bug report per distro version or a "combined" one for all
>  > which lists the affected distro versions?
>  >
>  > The one-for-all approach would have the benefit of easier copy-pasting
>  > between audit/* files and probably more accurate Bugzilla references in
>  > maintainer %changelog entries as the same specfile is used for all
>  > distro versions in the vast majority of cases.  It could make things
>  > slightly harder to track, eg. in Bugzilla queries and such.
>  I would think one bugzilla entry for all.  If you did one for each  you could 
>  be dealing with 5 bug reports. 
I ack this.  Things can quickly get out of hand.  To beat my favorite dead
horse, mozilla, you have 4 products, across 5 distributions = 20 bugs.

-- 
    JB

[Jesse Keating]

On Thu, 2006-05-11 at 16:59 -0400, Josh Bressers wrote:
>  
>  I ack this.  Things can quickly get out of hand.  To beat my favorite
>  dead
>  horse, mozilla, you have 4 products, across 5 distributions = 20
>  bugs.  
The problem you run into is then you set yourself up for having to
release all or nothing.  If distro A is holding up release of fixed
packages for distro B thats not a good thing.  If we want our pushing
tools to close bugs accordingly (like they do with Core) then we're
probably going to have to separate these by distributions.

Now to use mozilla again, why couldn't we push all 4 products into one
bug report?  20 bugs down to 5 bugs is a pretty big drop.  And there
could be a tracking bug that has all the info, and sub-bugs filed in
each distro to be the place holder for when said package goes out.  This
allows a package to go out, allows a pushing system to close a bug
associated w/ a package update, and allows a top level bug to easily
track the progress of each affected distro.

-- 
Jesse Keating
Release Engineer: Fedora

[Marc Deslauriers]

On Thu, 2006-05-11 at 18:34 -0400, Jesse Keating wrote:
>  The problem you run into is then you set yourself up for having to
>  release all or nothing.  If distro A is holding up release of fixed
>  packages for distro B thats not a good thing.  If we want our pushing
>  tools to close bugs accordingly (like they do with Core) then we're
>  probably going to have to separate these by distributions.
>   
Don't we usually release updates for all distros at the same time? For
Legacy, it was a PITA when we tried to have a bug per distro.

>  Now to use mozilla again, why couldn't we push all 4 products
> into one
>  bug report?  20 bugs down to 5 bugs is a pretty big drop.  And there
>  could be a tracking bug that has all the info, and sub-bugs filed in
>  each distro to be the place holder for when said package goes out.  This
>  allows a package to go out, allows a pushing system to close a bug
>  associated w/ a package update, and allows a top level bug to easily
>  track the progress of each affected distro.
>   
Four products can result in four different update advisories. Wouldn't a
pushing system have trouble figuring out if the bug can be closed
automatically or not?

Marc.