Unrelated upates (eg hardware support) are pushed to feisty-security

[laga]

I have enabled the feisty-security repository in order to receive security updates (as implied by the name). However, I had to find out the hard way that not only security updates are released, but also new hardware support and other unrelated additions. See https://bugs.launchpad.net/ubuntu/+source/linux-source-2.6.22/+bug/139767

Similar releases can be found in Dapper, eg 2.6.15-26.47 which was released to dapper-security. The changelog includes items like "sound/pci{,/emu10k1}: Miscellaneous cleanups" which doesn't seem security-related to me.

I'm not sure of a better way to handle updates. There could be a special security-fixes-only tree for <release>-security and a normal tree with other changes (including the security fixes of course) for <release>-updates. Of course, this creates more work for the developers :( I'm sure someone can come up with a better workflow (if my bug doesn't get rejected).
I just find it hardly acceptable that package releases tagged as "security" break drivers. Of course, it's just me complaining right now about a rather obscure piece of hardware breaking but I'd be surprised if other users haven't been caught by similar regression in the past.

[Caroline Ford (secretlondon)]

None of these are actual bugs on the kernel.

[Caroline Ford (secretlondon)]

Soyuz?

[Julian Edwards (julian-edwards)]

Not a Soyuz bug, it's really up to the package developers to only put the relevant fixes in -security.