[asterisk-users] Debian 7/Asterisk TLS bug and others

[Daniel Pocock]

On 11/08/12 01:26, Paul Belanger wrote:

>> Is Digium officially endorsing 1.8.13 for wheezy in any way?
>>
> No. Digium nor the Asterisk Project has anything to do with the package
> within Debian.  In fact, most of the work is done by Tzafrir.

I'm not referring to the actual packaging processes, but just the
general strategy

For example, if wheezy is released at Christmas, it could be the current
version for 2 years (until end of 2014) and then another year of
security updates (until end of 2015).  Anyone using Debian during that
period will come across Asterisk v1.8.13

It raises various issues:

- with TLS use likely to grow over that time, will the problems in the
current version become noticed by many more people?

- will general security updates for 1.8.x continue up to at least 2015?

I've raised a bug report in Debian about the general state of the TLS
support and to see if it is appropriate for the long lifespan of
packages in Debian - any comments on this would be really welcome
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=684649