For example:
apt-listchanges: Changelogs
---------------------------
bind9 (1:9.16.48-1) bullseye-security; urgency=high
* New upstream version 9.16.48
- CVE-2023-4408: Parsing large DNS messages may cause excessive CPU
load
- CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion
failure when "nxdomain-redirect" is enabled
...glibc (2.31-13+deb11u8) bullseye; urgency=medium
* debian/patches/any/local-qsort-memory-corruption.patch: Fix a memory
corruption in qsort() when using nontransitive comparison functions.
...imagemagick (8:6.9.11.60+dfsg-1.3+deb11u2) bullseye; urgency=medium
* Fix CVE-2021-3574: memory leak was found in TIFF coder
* Fix CVE-2021-4219: a special crafted file could lead to a DOS.
* Fix CVE-2021-20241 / CVE-2021-20243: divide by zero in
some coders (Closes: #1013282)
And so forth. If something makes me raise an eyebrow I can go look at the source code to see what's up. I also like for upstream maintainers and other members of the community being able to do that same. Having that process in place helps keep everyone honest. Why not have this for my car's computers too?For the install I would rather download a signed image onto a USB drive and flash from that versus letting my car communicate with the mothership indiscriminately. I also want to downgrade at any time with a previous known-good image when there's something about the update that I don't like. For example, if it sends my car's console unit into a bootloop.