Comment 21 for bug 2014954

Hi, I have some comments/questions.

## debdiffs

- The d/changelog entries target unstable and not Ubuntu releases
- The lunar version string is wrong, the suffix should be ubuntu0.1.
- The d/changelog entry is not clear.
  For example: it begins with "This service". Which service?
- Nit: when adding new patches it is nice to mention it in d/changelog:

 * d/p/intel-mutual-authentication.patch:
   upstream cherry-pick to enable the XYZ feature

## dep-3 headers

"Origin": please specify if "upstream" or "backport", see [1]. It may be "upstream" for some Ubuntu releases and "backport" for others, if the patch had to be modified to apply cleanly.

Also: normally the link is to the individual cherry-picked commit, not to the PR/MR.

"Applied-Upstream": not needed in this case I believe. AIUI that's for when the patch originates from Ubuntu/Debian and then has been applied upstream. In this case it's the other way around.

"Reviewed-by": that's specific to the Ubuntu patch, do not put upstream contributions there: they are not involved with the Ubuntu packaging.

## general questions

It is not clear to me (and may not be clear to the SRU team) what the actual impact of this issue. Is the hardware unusable without this feature? In other words: please improve the [Impact] section. Which issue will users encounter because of this bug? (What does it mean that the device is "secured" until unlocked?)

Like Christian mentioned, it would be better to wait for 1.30 to be tagged by upstream before going ahead with the backporting. Would the libmbim release schedule align with the hardware release dates?

[1] https://dep-team.pages.debian.net/deps/dep3/