[Pkg-bitcoin-devel] Armory in Stable?

[Joseph Bisch]

Hi,

I originally thought that Armory would be okay in stable, because it
is bitcoind that does all the network communication. So no network
consensus issues should arise from bugs in Armory. But Charles from
upstream raised the following concerns in an email:

"Understood. I'm a little bit worried that if we release a new version of
Armory that fixes compatilbity with Qt, or if bitcoin core updates, Debian
users won't get the new version. I think it's important that Debian not get
"security patches", but rather our most up-to-date release as part of the
debian-updates or debian-security repositories. Is this possible?"

Regarding the stable-updates method, my understanding is that a line
has to be added to sources.list to enable that. So it is not a viable
option.

I'm not able to provide the same level of testing that Armory
Techologies Inc is able to provide, so I'd rather release new versions
instead of backporting patches anyway.

I asked yesterday in #debian-security about releasing new versions for
security reasons (I figure if out of date versions can potentially
result in lost bitcoins, then that is a security issue). The only
response I got was that new versions have been released in a few
cases. I did not get any response as to whether or not Armory's
specific case would allow for a new version to be released. Is there a
better method of communication with the security team for non-urgent
matters like this?

I imagine this came up when bitcoin-qt/bitcoind were being packaged. I
know ultimately the decision was to block the migration to testing,
but was there any discussion with the security team?

How should I proceed? Just block the migration or pursue getting a
more specific answer from the security team? I want to decide on a
course of action before the migration to testing on November 4, so I
can block the migration if necessary.

Cheers,
Joseph