The Art of Backporting: Lessons from Maintainer of Firefox and Thunderbird in RHEL

Backporting is one of those behind-the-scenes things that keeps software running smoothly, especially in long-term supported (LTS) environments. From my work at Red Hat, maintaining Firefox and Thunderbird for enterprise Linux, I’ve seen how important and tricky it is to balance security and stability. In this talk, I’ll share what I’ve learned about backporting, focusing on real-world challenges and practical solutions for Python developers and maintainers.

We’ll dive into some of the common issues, like fixing security bugs without causing other problems, managing dependencies across versions, and tackling critical vulnerabilities (like CVEs). I’ll also show how automation tools and scripts reduced our patching time by 30%, making the process easier, faster, and more reliable. After this talk, you’ll have simple, actionable ideas how to improve your backporting workflows and keep your projects secure and stable.

This talk is perfect for Python developers, maintainers, and open-source contributors who want to understand backporting better and use Python to simplify their workflows.

As a demo, we will go deep dive into rpm package building and backporting a fix of use-after-free memory issue in different os