Many fans of the Zabbix monitoring software wonder why the Debian "wheezy" release from May 2012 does not contain Zabbix any more. This became a frequently asked question so I decided to put this article up.
Dmitry Smirnov and I – well mainly him recently – are maintaining the Zabbix packages in Debian. We frequently uploaded new versions and the 1.8.2 version was included in Debian Squeeze that was released in February 2011. After the release several security-related issues were found and reported. It was our duty to fix the security problems in the 1.8.2 version. Many software developers kindly publish which part of the code was causing the security problem and provide a minimal fix. Unfortunately the Zabbix developers didn't have such a nice policy. Instead they just released new versions and basically said: "Just upgrade – the new version does not have that security issue." So we tried hard to find how to fix the problem without upgrading but failed in many cases. The Zabbix developers didn't help us either. So the Zabbix packages in Debian had an increasing number of security bugs.
Then the preparations of the "wheezy" release began right before we uploaded the first 2.0.x packages to Debian. We honestly told the Debian security and release teams of our problems and hoped to find a way to keep Zabbix in Debian. And we told them that the known security problems were indeed fixed by the 2.0.x packages. But of course we were all scared to see history repeating and ship a vulnerable software with "wheezy". And the 2.0.x package was so brand new und not well tested that the release team didn't like to put it into the new release yet.
So in the end we all decided to remove Zabbix from "wheezy" but keep uploading new versions to the "testing" branch. Dmitry took great care that the package can be backported to the stable release. So we intend to upload backports that you can use as a "wheezy" user. At the time of writing (May 2013) the backports branch was not yet online. But you should be able to find them later at packages.debian.org. Maybe when the release policy of the Zabbix developers changes and they help packagers backport the security fixes we will include Zabbix back in the next release.
Apparently the Zabbix people also now provide their own set of DEB packages. We can't say much about the quality. But we continue to provide DSFG-compliant packages for Debian.
Hope that answers it. 🙂