[tor-bugs] #13237 [Tor bundles/installation]: Development builds published to stable APT repositories

[Tor Bug Tracker & Wiki]

#13237: Development builds published to stable APT repositories
--------------------------------------+-----------------------
 Reporter:  johnwang                  |          Owner:  erinn
     Type:  defect                    |         Status:  new
 Priority:  critical                  |      Milestone:
Component:  Tor bundles/installation  |        Version:
 Keywords:  apt repository            |  Actual Points:
Parent ID:                            |         Points:
--------------------------------------+-----------------------
 Yesterday in the stable APT repository a couple of 2.5.x development
 builds for '''tor''' and '''tor-geoipdb''' appeared when I ran `apt-get
 upgrade -s` on my Ubuntu Trusty box:

 {{{
 * Inst tor-geoipdb [0.2.4.23-2~trusty+1] (0.2.5.8-rc-1~trusty+1 trusty
 [all]) []
 * Inst tor [0.2.4.23-2~trusty+1] (0.2.5.8-rc-1~trusty+1 trusty [amd64])
 }}}

 Users relying on the stable repository expect only stable builds, so this
 risky, possibly dangerous update was probably pushed by mistake. The
 development builds were also pushed to the APT repositories for Ubuntu
 Lucid, Precise, and Saucy; Debian Squeeze, Wheezy, Jessie, and Sid; and
 possibly others I haven't checked.

 Here's the contents of my `/etc/apt/sources.list.d/tor-stable.list`:

 {{{
 deb http://deb.torproject.org/torproject.org trusty main
 deb-src http://deb.torproject.org/torproject.org trusty main
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/13237>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online