Your message dated Sun, 23 Jul 2017 23:25:24 +0000
with message-id <[email protected]>
and subject line Bug#869143: fixed in udevil 0.4.4-2
has caused the Debian Bug report #869143,
regarding [udevil] Unnecessary recommends reduces system security (particularly
pmount)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
869143: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=869143
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: udevil
Version: 0.4.4-1+b1
Severity: normal
udevil is a standalone secure mounting tool (and the packaged devmon
tool will use udevil if it is present) - however this package recommends
udisks2 and pmount, causing them to be installed on the system by
default. This defeats the purpose of udevil, since they can be used to
mount things outside of udevil's security model, and with the associated
security bugs etc that the simple udevil tool was made to avoid.
I have been pinged by the udevil programmer over this, hence the random
bug here - the 'official' upstream control has no recommends for this
reason:
https://github.com/IgnorantGuru/udevil/blob/next/distros/debian/control
Please can the 'recommends' packages be removed?
--- System information. ---
Architecture: Kernel: Linux 4.9.0-3-amd64
Debian Release: stretch/sid
990 testing 10.1.0.3 500 unstable 10.1.0.3 500
quodlibet-unstable lazka.github.io 100 ascii-proposed 10.1.0.3
--- Package information. ---
Depends (Version) | Installed
============================-+-============
libc6 (>= 2.14) | libglib2.0-0 (>= 2.16.0) | libudev1
(>= 183) |
Recommends (Version) | Installed
=========================-+-===========
udisks2 | 2.1.8-1+devuan2
zenity | 3.22.0-1+b1
pmount | 0.9.23-3+b2
Suggests (Version) | Installed
=========================-+-===========
eject | 2.1.5+deb1+cvs20081104-13.2
cifs-utils | curlftpfs | 0.9.2-9+b1
sshfs | 2.8-1
signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---
Source: udevil
Source-Version: 0.4.4-2
We believe that the bug you reported is fixed in the latest version of
udevil, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mateusz Łukasik <[email protected]> (supplier of updated udevil package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 23 Jul 2017 19:36:24 +0200
Source: udevil
Binary: udevil
Architecture: source
Version: 0.4.4-2
Distribution: unstable
Urgency: medium
Maintainer: Mateusz Łukasik <[email protected]>
Changed-By: Mateusz Łukasik <[email protected]>
Description:
udevil - Alternative storage media interface
Closes: 799745 840842 869143
Changes:
udevil (0.4.4-2) unstable; urgency=medium
.
* Fix manpage. (Closes: #840842 LP: #1614419)
* debian/control:
+ Clean Recommends field. (Closes: #869143)
+ Bump dh version to 10.
+ Use secured links.
+ Bump Standards-Version to 4.0.0. (no changes needed)
* Add cherry picks from upstream:
+ add --always-exec option for exec during startup/--mount-all.
+ fix misspelling privileges.
+ Fix "implicit declaration of function stat".
+ fix cannot mount iso file within iso file.
+ update lang pt_BR fr ru sv de it pl es.
+ Added ability to run under a user's systemd session.
* debian/patches:
+ Drop fix-spelling-error.patch match more changes included in cherry pick.
+ Add raspberrypi_config.patch -- Merge Raspberry Pi config changes.
They are more specific for Debian.
* Update debian/copyright.
* debian/rules:
+ Enable hardening.
+ Install [email protected] in correct place. (Closes: #799745)
Checksums-Sha1:
a84d5f0c932380c8173dbad71e8663058f9a8e4b 1526 udevil_0.4.4-2.dsc
3cf10debf94c909e6dbc32d6d52726e1088f94bc 14404 udevil_0.4.4-2.debian.tar.xz
f95b747fecdd9fcb65b3a578818298b044b46629 5694 udevil_0.4.4-2_source.buildinfo
Checksums-Sha256:
460dfd0f040d8e5a28d5182c911447331f785d059609e41786d13b50e16fdbaf 1526
udevil_0.4.4-2.dsc
c387bbcbac1ec1ad2906487a4007ca25c09966bfe42ec89a9f467aa4fbc1f1f5 14404
udevil_0.4.4-2.debian.tar.xz
58c4e6474159c06f941160d51800bcbd103504677ceee93998ab079ee3bc40db 5694
udevil_0.4.4-2_source.buildinfo
Files:
2442317811fdb0f66027100127abb588 1526 utils optional udevil_0.4.4-2.dsc
11cfdfc9c359bf0140bef46b15309491 14404 utils optional
udevil_0.4.4-2.debian.tar.xz
fc44e910717473b8a1c064f391ce84d1 5694 utils optional
udevil_0.4.4-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE/Zzi2Nd1S3irJ5u9LDtDb+rGgQEFAll1Jy4ACgkQLDtDb+rG
gQGwmgf+KYCw/hwPywiXbsAxFxZXGStRW24drhl/MrX96bKv1F0R4JC0veLvylGu
0UrKFSt9qbGTYXiuqjbUEAqoYkfri6fgMs5abvgIGUsRM73PZ/DsNsJlg8XBYniI
wamb0t4aHKJj77ELsiD/3dr5BbjTeQ2d/V7BEknTJjuwrdcMV1ZigefLcmtegKru
ho62MAgEixahCqoduRYxk9UUrbJhSWf2d2PshX2Wl5VugFwI6qIwzK5kG4kRKDws
uRq9hEwOgc6fsciJJ5wDQe9tdxhUxkr6S3OjUpjHO+Azf52z5wGB8fYk15PdR0qs
RZ4cGoumFvSMqgskzYxQA72gVOd8KQ==
=ZQSU
-----END PGP SIGNATURE-----
--- End Message ---
