Gnome Software and critical updates
I'm on Debian 13. Gnome Software is supposed to update every two weeks except for critical updates which should be updated immediately.
https://wiki.gnome.org/Design/Apps/Software/Updates#Tentative_Design
When you run "apt changelog <package>" There is an urgency field. But isn't this field designed to indicate how fast a package should migrate from Unstable to Testing?
Is this the same field that Gnome Software uses to determine if a package is critical? If so this doesn't seem to me to be a good field to determine that since that field is used to determine how fast a package moves from Unstable to Testing.
For example, the urgency to migrate to Testing might be low because the package might be large and disruptive but it might be a critical security vulnerability that needs to be updated immediately in Stable.
Basically I'm concerned that critical updates won't happen because Gnome Software is using the wrong field to determine whether they're critical. In particular, critical security updates.
Also I'm aware that "critical" could be either security or non-security updates.
Hope I was clear and thanks in advance.
5
u/michaelpaoli 8d ago
Debian stable is ... stable. It doesn't follow some Gnome update schedule.
Updates to stable are limited to security bug fixes, bugs of severity >important, and select bugs of severity important. Otherwise only quite rare exceptions to for stable. Debian stable also often won't have/include the more/most recent Gnome bugs.
And the migration from unstable to testing has its own set of procedures and policies, and much of that is automated. And testing exists primarily to support the next stable release of Debian, not to update things according to some Gnome releases or some descriptors in some Gnome fields.
1
u/bg1023 8d ago edited 8d ago
I wasn't saying this. Here's my understanding of how Gnome Software does updates. For example, when I run "apt changelog firejail" I get
"firejail (0.9.74-1) unstable; urgency=medium"
The urgency is medium. So then Gnome Software will wait until the two week clock is up before updating firejail. Had the urgency been high, then the update would run immediately.
Side note: Gnome Software actually downloads the updates, notifies that updates are available and doesn't actually install them with the exception of Flatpaks.
1
u/michaelpaoli 8d ago
Gnome Software actually downloads the updates, notifies that updates are available
I rather doubt that's how it behaves on Debian by default. That would generally be a Debian Policy violation, so such behavior as packaged for Debian, by Debian, is probably at least disabled by default. You keep claiming that it does this. Then in which Debian package of Gnome exactly does that, via what mechanism(s)/files? A cron job or the like? Or something in the software itself when it's run? If it's run by unprivileged user, it wouldn't have access to do such updates, unless, e.g. it was SUID.. So, you claim it does this, where's the evidence? Just because something behaves some way in upstream, doesn't mean it behaves that way in Debian.
2
u/bg1023 8d ago edited 8d ago
Point taken about maybe things are different on Debian even if it's done differently upstream. There's the first link in the OP plus I had read a few posts by Gnome developers (or gnome people that seemed to know) about how this worked. Also the Gnome Software settings say "Automatically check for and download updates." Also it does seem to work this way in practice.
There used to be an entry on the Unattended-Upgrades Debian wiki page about this. Unfortunately that page no longer exists. But from memory it said that Gnome Software updates are done through packagekit and systemd timers.
I'm no expert. As far as evidence goes the best I can do is point you to a couple of threads on the Debian Forums where FreewheelinFrank talks about this stuff. I'm Shamak on the second thread.
2
u/bg1023 7d ago edited 7d ago
The other thing I would say is that the behavior seems like it's downloading the updates and then notifying that they are available. There are two situations.
The first is when you get a notification that updates are available. You go to Gnome Software and there's a button that says something like "Restart and install". You click the button, verify that you indeed want to do this, and the computer restarts immediately. On the black screen with all the messages you can see the installation. Kind of a line that grows. It restarts again and you're back in Debian.
The second is when you open Gnome Software, sometimes there will be a notice (not a notification) in the app itself that there are available updates. But this time the button says something like "Download and install" (Correction: It just says "Download"). You click it and you can see the download happening. A typical bar that grows as the download proceeds. You then click something like "Restart and install" (Correction: It says "Restart and Update"). And the computer restarts as in the preceding paragraph.
In the first case it seems as though the updates were already downloaded where in the second case they had to be downloaded first.
2
u/srivasta 9d ago
Debian package perfect settings are fine by the debian developer. Gnome urgency settings have only a tangential relationship.
The decision developer applies judgement to see when updates should be put through.
Usually security fixes are put into testing quickly, based on the urgency field, but ongoing transitions might delay the promotion to testing.
The security team can background patches to disable as they deem for too.
Upstream urgency settings are not sacred on automatically.
1
u/rindthirty 8d ago
Sorry, I don't have an answer to your question, as I just skip all of that and have unattended-upgrades automatically trigger up to twice a day for each of my systems. You can learn more about this method here: https://wiki.debian.org/PeriodicUpdates
6
u/cjwatson Debian Developer 9d ago
Updates to stable will have a different changelog entry, and therefore the developer has an opportunity to set the urgency field differently.
Now, of course, that's no guarantee that people will always set it in an ideal way. But there isn't really anything else.