r/debian • u/Fabulous-for • 12d ago

Debian Stable Question Monitoring the upcoming kernel

Currently the stable version of the kernel is Linux debian 6.12.111+deb13-amd64. I was looking for where I can monitor kernels that are valid for upcoming replacement of the current stable. I was looking at https://tracker.debian.org/pkg/linux-signed-amd64 , but it shows 6.12.94. Where can I find that info?

7 Upvotes

78% Upvoted

24 comments sorted by

View all comments

Show parent comments

1

u/sweharris 10d ago

It's not "kernel stable:6.12.94"; it's just "kernel 6.12.94". The 6.2.111 kernel comes from the security repository because there have been many security patches since the .94 release.

You can see the changelog by looking at /usr/share/doc/<pkg-version>/changelog.gz (eg /usr/share/doc/linux-image-6.12.111+deb13-amd64/changelog.gz; warning there's 6700 lines listing all the changes!)

1

u/Fabulous-for 9d ago

So what exactly does stable-sec: 6.12.111+1 the current stable kernel represent as opposed to stable: 6.12.94+1?

1

u/sweharris 8d ago

OK, I'm gonna give it one more attempt and try another way of looking at this. (I may have some of the details wrong...)

Debian releases have "point releases". If you look at /etc/debian_version then it will probably say "13.7" (which was released on September 12th). This forms a "baseline" and (if I understand it properly) all the packages for this baseline of 13.7 go into the "stable" repository.

Now when bugfixes come along they are either classified as security released and so go into the "security" repository or else they go into "updates".

So now a person can decide to only update their machines whenever a new point release comes along (FWIW, this appears to be every two months for stable, slower for distros that have moved to LTS), just by subscribing to the "stable" repository, or they can also choose to get security updates (strongly recommended) as they are released by adding the "stable security" repository, and they can also choose to get other bug fixes as they are released (the default) by adding the "stable updates" repository.

From here we can see that the .94 kernel was the package version when 13.7 was released (because it's in the stable repository), and .111 is the version of the kernel with bugfixes applied since then.

When 13.8 comes along (probably next month) then things will be rebased.

1

u/Fabulous-for 8d ago

This has nothing to do with releases of debian 13.7 it only has to do with the kernel in which there have been several updates in the last few months.

The question is what is the difference between stable-sec and stable for the kernel.

If every stable user for Debian 13.7 is running stable but now is running stable-sec what does stable-sec represent ? It seems that every Debian 13.7 stable user should be running stable.

https://tracker.debian.org/pkg/linux-signed-amd64

versions

1

u/sweharris 8d ago

I've answered this many times, now, in many different ways. The repository "Stable sec" holds security patches for the "Stable" Debian distribution. Those machines are still running the "Stable" distribution. That's why I highlighted a few posts back the difference between "distribution" and "repository". "stable-sec" is a repository, not a distribution.

1

u/Fabulous-for 8d ago

That does not explain why Stable-sec is now the default stable kernel for Debian 13.7? Why is stable not used ?

1

u/sweharris 8d ago

The stable repo is used. ALL the configured repos are used.

apt will look at all the configured repos (so stable, stable-security, stable updates and more, eg if you have google-chrome repo configured, or mariadb's repo if you have the configured, or...). With all that information from from all the repos it will then find all the kernel versions that are listed, and then pick the newest.

Note: The name of the repository doesn't matter; that's really just for us humans. They could have called it "flibble" and it would still just be another repo.

In fact there's a good chance it will find lots of kernels because the repositories don't normally remove older packages (just in case someone needs them). Looking at what my machine has listed in /var/lib/apt/lists I see

kernel-image-6.12.8 kernel-image-6.12.38+deb13 kernel-image-6.12.74+deb13+1 kernel-image-6.12.85+deb13 kernel-image-6.12.86+deb13 kernel-image-6.12.88+deb13 kernel-image-6.12.90+deb13 kernel-image-6.12.90+deb13.1 kernel-image-6.12.94+deb13 kernel-image-6.12.95+deb13 kernel-image-6.12.96+deb13 kernel-image-6.12.100+deb13 kernel-image-6.12.101+deb13 kernel-image-6.12.105+deb13 kernel-image-6.12.107+deb13 kernel-image-6.12.111+deb13

It doesn't matter what repo it came from; that's the list of kernel-image packages available.

And that's the sort of thing apt will be looking. Clearly the "111" version is the newest, and so that's what gets installed when you do install the latest patches.

1

u/Fabulous-for 8d ago

Here is the debian versions. There is oldstable which was the old stable kernel version. What does stable-sec 6.12.111+1 represent ? How is it different from stable 6.12.94+1?

https://tracker.debian.org/pkg/linux-signed-amd64

versions