Your message dated Mon, 04 Jun 2012 21:40:27 +0000
with message-id <[email protected]>
and subject line Bug#669190: fixed in tellico 2.3.5+dfsg.1-4
has caused the Debian Bug report #669190,
regarding tellico: LDFLAGS hardening flags missing
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
669190: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=669190
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: tellico
Version: 2.3.5+dfsg.1-3
Severity: normal
Tags: patch
Dear Maintainer,
The LDFLAGS hardening flags are missing because they are
overwritten in debian/rules. The real source of this problem is
in variables.mk (a separate bug was already filed) but as the
patch additionally simplifies debian/rules I reported it here as
well.
DEB_*_MAINT_APPEND is the preferred way to set additional flags
(see man dpkg-buildflags for more information). For more
hardening information please have a look at [1], [2] and [3].
The following patch fixes the issue.
diff -Nru tellico-2.3.5+dfsg.1/debian/rules tellico-2.3.5+dfsg.1/debian/rules
--- tellico-2.3.5+dfsg.1/debian/rules 2011-12-20 01:08:43.000000000 +0100
+++ tellico-2.3.5+dfsg.1/debian/rules 2012-04-18 02:00:11.000000000 +0200
@@ -5,17 +5,13 @@
# Uncomment this to turn on verbose mode.
#export DH_VERBOSE=1
-DEB_KDE_LINK_WITH_AS_NEEDED = yes
-
-include /usr/share/pkg-kde-tools/makefiles/1/variables.mk
+export DEB_LDFLAGS_MAINT_APPEND = -Wl,--no-undefined -Wl,--as-needed
%:
- dh $@ --buildsystem=cmake --builddirectory=build
+ dh $@ --with kde
override_dh_auto_configure:
- dh_auto_configure -- \
- $(DEB_CMAKE_KDE4_FLAGS) \
- $(DEB_CMAKE_CUSTOM_FLAGS) \
+ dh_auto_configure --buildsystem=kde -- \
-DENABLE_WEBCAM=false
override_dh_shlibdeps:
To check if all flags were correctly enabled you can use
`hardening-check` from the hardening-includes package and check
the build log (for example with blhc [4]) (hardening-check
doesn't catch everything):
$ hardening-check /usr/bin/tellico /usr/bin/librecad
/usr/bin/tellico:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
/usr/bin/librecad:
Position Independent Executable: no, normal executable!
Stack protected: yes
Fortify Source functions: yes (some protected functions found)
Read-only relocations: yes
Immediate binding: no not found!
(Position Independent Executable and Immediate binding is not
enabled by default.)
Use find -type f \( -executable -o -name \*.so\* \) -exec
hardening-check {} + on the build result to check all files.
Regards,
Simon
[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
[4]: http://ruderich.org/simon/blhc/
--
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
Source: tellico
Source-Version: 2.3.5+dfsg.1-4
We believe that the bug you reported is fixed in the latest version of
tellico, which is due to be installed in the Debian FTP archive:
tellico-data_2.3.5+dfsg.1-4_all.deb
to main/t/tellico/tellico-data_2.3.5+dfsg.1-4_all.deb
tellico-scripts_2.3.5+dfsg.1-4_all.deb
to main/t/tellico/tellico-scripts_2.3.5+dfsg.1-4_all.deb
tellico_2.3.5+dfsg.1-4.debian.tar.gz
to main/t/tellico/tellico_2.3.5+dfsg.1-4.debian.tar.gz
tellico_2.3.5+dfsg.1-4.dsc
to main/t/tellico/tellico_2.3.5+dfsg.1-4.dsc
tellico_2.3.5+dfsg.1-4_amd64.deb
to main/t/tellico/tellico_2.3.5+dfsg.1-4_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Regis Boudin <[email protected]> (supplier of updated tellico package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Sun, 03 Jun 2012 10:29:26 +0200
Source: tellico
Binary: tellico tellico-data tellico-scripts
Architecture: source amd64 all
Version: 2.3.5+dfsg.1-4
Distribution: unstable
Urgency: low
Maintainer: Regis Boudin <[email protected]>
Changed-By: Regis Boudin <[email protected]>
Description:
tellico - Collection manager for books, videos, music, etc
tellico-data - Collection manager for books, videos, music, etc [data]
tellico-scripts - Collection manager for books, videos, music, etc [scripts]
Closes: 669190
Changes:
tellico (2.3.5+dfsg.1-4) unstable; urgency=low
.
* Fix passing of hardening flags. Thanks Simon Ruderich. Closes: #669190.
Checksums-Sha1:
9293524165a0905e62e0b18f911a3489ae31ecf6 1508 tellico_2.3.5+dfsg.1-4.dsc
b7f9fcc8f621607e6d07a94f4b651a0cbc3bb201 11335
tellico_2.3.5+dfsg.1-4.debian.tar.gz
6588e3b530ceb90ebc313f3e838604c9eeb10971 1142108
tellico_2.3.5+dfsg.1-4_amd64.deb
3d5010e82f245f00604783992a5fcae3a5b44567 4758942
tellico-data_2.3.5+dfsg.1-4_all.deb
7de6f9ac67b57d40ed321df9519bf3de8535ef47 64502
tellico-scripts_2.3.5+dfsg.1-4_all.deb
Checksums-Sha256:
974e222d5718127925e9093a122c0651fd1041b8a6292402a4eccb549ecd20a2 1508
tellico_2.3.5+dfsg.1-4.dsc
62d0009dfad346b61d3576e850e4cc8d8ea25633c1d9f273241bb78589ce3bfd 11335
tellico_2.3.5+dfsg.1-4.debian.tar.gz
c3b107c4671c260d0c2cda35abb5f1d8290f649a81d46b7c28807fdea54bd872 1142108
tellico_2.3.5+dfsg.1-4_amd64.deb
70cc6e21c11bcdf926aa9b480c7199a74e9958fa814f51bceb6f4f1268e9be31 4758942
tellico-data_2.3.5+dfsg.1-4_all.deb
f93e83dc6aa3dbc10c56174f6413c9c89f1671e08b330e05189842a206e58929 64502
tellico-scripts_2.3.5+dfsg.1-4_all.deb
Files:
c196a6e4b26856bfce88e9330b81a7f5 1508 kde optional tellico_2.3.5+dfsg.1-4.dsc
9370f24fb795f08c51122cb368b7a731 11335 kde optional
tellico_2.3.5+dfsg.1-4.debian.tar.gz
586401f1bb8b5b8fced281df30473a8c 1142108 kde optional
tellico_2.3.5+dfsg.1-4_amd64.deb
b49af5de36c32f3239462b6fbc82a3f1 4758942 kde optional
tellico-data_2.3.5+dfsg.1-4_all.deb
733a93440f08df47fb05a6dacc883cad 64502 kde optional
tellico-scripts_2.3.5+dfsg.1-4_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAk/NJvgACgkQVE17sLEtWVqL5wCbBSl11H2RuGVwNpUtwMPHQNJH
rBAAoL2uEHqqF787GI0J/E9d9aY5W6TE
=WvpT
-----END PGP SIGNATURE-----
--- End Message ---
