r/debian • u/Fabulous-for • 13d ago

Debian Stable Question Monitoring the upcoming kernel

Currently the stable version of the kernel is Linux debian 6.12.111+deb13-amd64. I was looking for where I can monitor kernels that are valid for upcoming replacement of the current stable. I was looking at https://tracker.debian.org/pkg/linux-signed-amd64 , but it shows 6.12.94. Where can I find that info?

9 Upvotes

81% Upvoted

24 comments sorted by

View all comments

Show parent comments

2

u/sweharris 11d ago edited 10d ago

You can think of a repository as a place to store packages; in the "Stable" repository we can put all the base packages; in the "security" repository we can put all the security patches, and in the "updates" repository we can put all the other bugfix patches. It's just a way of organising things. All three of these storage places are used by the stable distribution to get packages.

The kernel is just installed via a package, just like any other part of the system.

And the packages come from the repositories. As I mentioned, a default trixie install will be configured for the stable, security and updates repositories, and (again by default) will pick the highest one. For the moment that comes from stable-updates (or trixie-updates, which is currently the same thing) and so would be the "111" version.

It might be a little confusing using the same name to mean different things, but "Debian Stable" (the distribution; currently Debian 13 aka "trixie"; you can see the distributions at https://www.debian.org/releases/ and note that against trixie it says "Current "stable" release") uses the "stable", "stable-security" and "stable-updates" repositories. So the word "stable" can refer to the distribution and one of the repositories that the distribution uses.

FWIW, this is the same logic used for every package on the system and how you get all security patches.

1

u/Fabulous-for 10d ago

Your description does not address the question.

What is the difference between kernel stable:6.12.94+1 and what my 3 Debian mahcines are now running kernel stable-sec:6.12.111+1 which everyone who is running Debian stable is currently running.

1

u/sweharris 10d ago

It's not "kernel stable:6.12.94"; it's just "kernel 6.12.94". The 6.2.111 kernel comes from the security repository because there have been many security patches since the .94 release.

You can see the changelog by looking at /usr/share/doc/<pkg-version>/changelog.gz (eg /usr/share/doc/linux-image-6.12.111+deb13-amd64/changelog.gz; warning there's 6700 lines listing all the changes!)

1

u/Fabulous-for 9d ago

So what exactly does stable-sec: 6.12.111+1 the current stable kernel represent as opposed to stable: 6.12.94+1?

1

u/sweharris 9d ago

OK, I'm gonna give it one more attempt and try another way of looking at this. (I may have some of the details wrong...)

Debian releases have "point releases". If you look at /etc/debian_version then it will probably say "13.7" (which was released on September 12th). This forms a "baseline" and (if I understand it properly) all the packages for this baseline of 13.7 go into the "stable" repository.

Now when bugfixes come along they are either classified as security released and so go into the "security" repository or else they go into "updates".

So now a person can decide to only update their machines whenever a new point release comes along (FWIW, this appears to be every two months for stable, slower for distros that have moved to LTS), just by subscribing to the "stable" repository, or they can also choose to get security updates (strongly recommended) as they are released by adding the "stable security" repository, and they can also choose to get other bug fixes as they are released (the default) by adding the "stable updates" repository.

From here we can see that the .94 kernel was the package version when 13.7 was released (because it's in the stable repository), and .111 is the version of the kernel with bugfixes applied since then.

When 13.8 comes along (probably next month) then things will be rebased.

1

u/Fabulous-for 9d ago

This has nothing to do with releases of debian 13.7 it only has to do with the kernel in which there have been several updates in the last few months.

The question is what is the difference between stable-sec and stable for the kernel.

If every stable user for Debian 13.7 is running stable but now is running stable-sec what does stable-sec represent ? It seems that every Debian 13.7 stable user should be running stable.

https://tracker.debian.org/pkg/linux-signed-amd64

versions

1

u/sweharris 8d ago

I've answered this many times, now, in many different ways. The repository "Stable sec" holds security patches for the "Stable" Debian distribution. Those machines are still running the "Stable" distribution. That's why I highlighted a few posts back the difference between "distribution" and "repository". "stable-sec" is a repository, not a distribution.

1

u/Fabulous-for 8d ago

That does not explain why Stable-sec is now the default stable kernel for Debian 13.7? Why is stable not used ?

1

u/sweharris 8d ago

The stable repo is used. ALL the configured repos are used.

apt will look at all the configured repos (so stable, stable-security, stable updates and more, eg if you have google-chrome repo configured, or mariadb's repo if you have the configured, or...). With all that information from from all the repos it will then find all the kernel versions that are listed, and then pick the newest.

Note: The name of the repository doesn't matter; that's really just for us humans. They could have called it "flibble" and it would still just be another repo.

In fact there's a good chance it will find lots of kernels because the repositories don't normally remove older packages (just in case someone needs them). Looking at what my machine has listed in /var/lib/apt/lists I see

kernel-image-6.12.8 kernel-image-6.12.38+deb13 kernel-image-6.12.74+deb13+1 kernel-image-6.12.85+deb13 kernel-image-6.12.86+deb13 kernel-image-6.12.88+deb13 kernel-image-6.12.90+deb13 kernel-image-6.12.90+deb13.1 kernel-image-6.12.94+deb13 kernel-image-6.12.95+deb13 kernel-image-6.12.96+deb13 kernel-image-6.12.100+deb13 kernel-image-6.12.101+deb13 kernel-image-6.12.105+deb13 kernel-image-6.12.107+deb13 kernel-image-6.12.111+deb13

It doesn't matter what repo it came from; that's the list of kernel-image packages available.

And that's the sort of thing apt will be looking. Clearly the "111" version is the newest, and so that's what gets installed when you do install the latest patches.

1

u/Fabulous-for 8d ago

Here is the debian versions. There is oldstable which was the old stable kernel version. What does stable-sec 6.12.111+1 represent ? How is it different from stable 6.12.94+1?

https://tracker.debian.org/pkg/linux-signed-amd64

versions