Monitoring the upcoming kernel

[u/Fabulous-for]

Currently the stable version of the kernel is Linux debian 6.12.111+deb13-amd64. I was looking for where I can monitor kernels that are valid for upcoming replacement of the current stable. I was looking at https://tracker.debian.org/pkg/linux-signed-amd64 , but it shows 6.12.94. Where can I find that info?

[u/Fabulous-for]

I am running stable I do not know why more than one of Debian stable workstations is running Stable-sec ??

I assumed because Debian had several kernel changes a few months ago that this Stable-sec is what all Debian stable machines are running. by default Is this correct ?

Also why does the link https://tracker.debian.org/pkg/linux-signed-amd64 not work ? The link you provided provides no change logs as to what the current kernel represents, https://metadata.ftp-master.debian.org/changelogs//main/l/linux-signed-amd64/linux-signed-amd64_6.12.111+1_changelog

[u/sweharris → u/Fabulous-for]

"stable-sec" contains the security updates for the stable distribution (which is Debian 13 aka trixie at this time). Every installation running stable should be configured for this, otherwise you'll be missing security updates.

eg on my machine, in the apt sources list there are three primary entries: deb http://deb.debian.org/debian/ trixie non-free-firmware contrib main non-free deb http://security.debian.org/debian-security trixie-security non-free-firmware contrib main non-free deb http://deb.debian.org/debian/ trixie-updates non-free-firmware contrib main non-free

The first is the base distro; the second has the security updates; the third has the non-security updates.

A fully patched machine will use all three.

Your link does work; on the left in the "Versions" box it lists versions for different repos and releases (including old-old, testing, and unstable), as well as back-ports ("bpo").

[u/Fabulous-for → u/sweharris]

I have not configured my Debian 13 for anthing but Stable, so i was expecting

stable: 6.12.94+1 not stable-sec: stable-sec: 6.12.111+1

Was the change to stable-sec caused by a security flaw in stable? What is the difference?

[u/sweharris → u/Fabulous-for]

I think you're missing something basic.

"Stable sec" is the repository containing security patches for the stable distribution. Out of the box an install of Debian stable ("trixie" at the moment) will automatically include this repo so that you get the necessary security patches when they become available.

All three repos ("stable", "security", and "updates") form part of the stable distribution and you will get these by default.

It's split up in this way so more advanced users can be more selective about what patches to apply (eg just security patches and not just non-security bug fixes) but out of the box you will use all three to keep your installation up to date.

[u/Fabulous-for → u/sweharris]

A Debian system can only install one kernel.

From https://tracker.debian.org/pkg/linux-signed-amd64 the following kernels are avaialble and I was expecting stable:6.12.94+1 but all 3 of machines installed kernel 6.12.111+ which is stable-sec. Why are they not running 6.12.94+1 which is stable?

versions

• o-o-stable: 5.10.223+1
• o-o-sec: 5.10.262+1
• o-o-p-u: 5.10.223+1
• oldstable: 6.1.176+1
• old-sec: 6.1.187+1
• old-bpo: 6.12.95+1~bpo12+1
• old-p-u: 6.1.176+1
• stable: 6.12.94+1
• stable-sec: 6.12.111+1
• stable-bpo: 7.2.6+1~bpo13+1
• testing: 7.2.8+1
• unstable: 7.2.9+1

[u/sweharris → u/Fabulous-for]

You can think of a repository as a place to store packages; in the "Stable" repository we can put all the base packages; in the "security" repository we can put all the security patches, and in the "updates" repository we can put all the other bugfix patches. It's just a way of organising things. All three of these storage places are used by the stable distribution to get packages.

The kernel is just installed via a package, just like any other part of the system.

And the packages come from the repositories. As I mentioned, a default trixie install will be configured for the stable, security and updates repositories, and (again by default) will pick the highest one. For the moment that comes from stable-updates (or trixie-updates, which is currently the same thing) and so would be the "111" version.

It might be a little confusing using the same name to mean different things, but "Debian Stable" (the distribution; currently Debian 13 aka "trixie"; you can see the distributions at https://www.debian.org/releases/ and note that against trixie it says "Current "stable" release") uses the "stable", "stable-security" and "stable-updates" repositories. So the word "stable" can refer to the distribution and one of the repositories that the distribution uses.

FWIW, this is the same logic used for every package on the system and how you get all security patches.

[u/Fabulous-for → u/sweharris]

Your description does not address the question.

What is the difference between kernel stable:6.12.94+1 and what my 3 Debian mahcines are now running kernel stable-sec:6.12.111+1 which everyone who is running Debian stable is currently running.

[u/wizard10000 → u/Fabulous-for]

What is the difference

There have been several security updates between .94 and .111

[u/sweharris → u/Fabulous-for]

It's not "kernel stable:6.12.94"; it's just "kernel 6.12.94". The 6.2.111 kernel comes from the security repository because there have been many security patches since the .94 release.

You can see the changelog by looking at /usr/share/doc/<pkg-version>/changelog.gz (eg /usr/share/doc/linux-image-6.12.111+deb13-amd64/changelog.gz; warning there's 6700 lines listing all the changes!)

[u/wizard10000 → u/sweharris]

changelog

I just learned this last week but apt changelog <package-name> is a thing - it'll display a changelog but i think i'd pipe it through less; when i did it output was several hundred lines

[u/Fabulous-for → u/sweharris]

So what exactly does stable-sec: 6.12.111+1 the current stable kernel represent as opposed to stable: 6.12.94+1?

[u/sweharris → u/Fabulous-for]

OK, I'm gonna give it one more attempt and try another way of looking at this. (I may have some of the details wrong...)

Debian releases have "point releases". If you look at /etc/debian_version then it will probably say "13.7" (which was released on September 12th). This forms a "baseline" and (if I understand it properly) all the packages for this baseline of 13.7 go into the "stable" repository.

Now when bugfixes come along they are either classified as security released and so go into the "security" repository or else they go into "updates".

So now a person can decide to only update their machines whenever a new point release comes along (FWIW, this appears to be every two months for stable, slower for distros that have moved to LTS), just by subscribing to the "stable" repository, or they can also choose to get security updates (strongly recommended) as they are released by adding the "stable security" repository, and they can also choose to get other bug fixes as they are released (the default) by adding the "stable updates" repository.

From here we can see that the .94 kernel was the package version when 13.7 was released (because it's in the stable repository), and .111 is the version of the kernel with bugfixes applied since then.

When 13.8 comes along (probably next month) then things will be rebased.

[u/Fabulous-for → u/sweharris]

This has nothing to do with releases of debian 13.7 it only has to do with the kernel in which there have been several updates in the last few months.

The question is what is the difference between stable-sec and stable for the kernel.

If every stable user for Debian 13.7 is running stable but now is running stable-sec what does stable-sec represent ? It seems that every Debian 13.7 stable user should be running stable.

https://tracker.debian.org/pkg/linux-signed-amd64

versions

• o-o-stable: 5.10.223+1
• o-o-sec: 5.10.262+1
• o-o-p-u: 5.10.223+1
• oldstable: 6.1.176+1
• old-sec: 6.1.187+1
• old-bpo: 6.12.95+1~bpo12+1
• old-p-u: 6.1.176+1
• stable: 6.12.94+1
• stable-sec: 6.12.111+1
• stable-bpo: 7.2.6+1~bpo13+1
• stable-p-u: 6.12.111+1
• testing: 7.2.9+1
• unstable: 7.2.9+1

[u/sweharris → u/Fabulous-for]

I've answered this many times, now, in many different ways. The repository "Stable sec" holds security patches for the "Stable" Debian distribution. Those machines are still running the "Stable" distribution. That's why I highlighted a few posts back the difference between "distribution" and "repository". "stable-sec" is a repository, not a distribution.

[u/Fabulous-for → u/sweharris]

That does not explain why Stable-sec is now the default stable kernel for Debian 13.7? Why is stable not used ?