Your message dated Fri, 25 Jul 2025 09:22:33 +0000
with message-id <[email protected]>
and subject line Bug#1106804: fixed in qemu 1:10.0.2+ds-2
has caused the Debian Bug report #1106804,
regarding qemu-user: statically linked against glibc without a Built-Using:
field
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1106804: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1106804
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: qemu-user
Version: 1:9.1.0+ds-4
Severity: serious
Justification: Policy 7.8
Dear maintainer,
The qemu-user package provides the following files which are statically
linked against glibc:
/usr/bin/qemu-aarch64
/usr/bin/qemu-aarch64_be
/usr/bin/qemu-alpha
/usr/bin/qemu-arm
/usr/bin/qemu-armeb
/usr/bin/qemu-hexagon
/usr/bin/qemu-hppa
/usr/bin/qemu-i386
/usr/bin/qemu-loongarch64
/usr/bin/qemu-m68k
/usr/bin/qemu-microblaze
/usr/bin/qemu-microblazeel
/usr/bin/qemu-mips
/usr/bin/qemu-mips64
/usr/bin/qemu-mips64el
/usr/bin/qemu-mipsel
/usr/bin/qemu-mipsn32
/usr/bin/qemu-mipsn32el
/usr/bin/qemu-or1k
/usr/bin/qemu-ppc
/usr/bin/qemu-ppc64
/usr/bin/qemu-ppc64le
/usr/bin/qemu-riscv32
/usr/bin/qemu-riscv64
/usr/bin/qemu-s390x
/usr/bin/qemu-sh4
/usr/bin/qemu-sh4eb
/usr/bin/qemu-sparc
/usr/bin/qemu-sparc32plus
/usr/bin/qemu-sparc64
/usr/bin/qemu-x86_64
/usr/bin/qemu-xtensa
/usr/bin/qemu-xtensaeb
glibc is mostly is mostly licensed under the LGPL, which requires that
the full source code of the incorporating binary package be made
available. According to Debian Policy ยง7.8 [1] such a binary package
MUST list the glibc source package (and possibly others) in the
Built-Using: field.
Please also note that Build-Using-Static is not (yet?) part of the
Debian Policy, and more importantly that DAK does not know about this
field, so can't use it to retain the older versions in the archive in
order to satisfy the licenses.
Regards
Aurelien
[1]
https://www.debian.org/doc/debian-policy/ch-relationships.html#additional-source-packages-used-to-build-the-binary-built-using
--- End Message ---
--- Begin Message ---
Source: qemu
Source-Version: 1:10.0.2+ds-2
Done: Michael Tokarev <[email protected]>
We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Michael Tokarev <[email protected]> (supplier of updated qemu package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 25 Jul 2025 12:05:29 +0300
Source: qemu
Architecture: source
Version: 1:10.0.2+ds-2
Distribution: unstable
Urgency: medium
Maintainer: Debian QEMU Team <[email protected]>
Changed-By: Michael Tokarev <[email protected]>
Closes: 1105938 1106792 1106804
Changes:
qemu (1:10.0.2+ds-2) unstable; urgency=medium
.
* d/control: switch from Static-Built-Using
back to Built-Using for qemu-user (Closes: #1106804)
* d/rules: simplify qemu:archlist variable generation
(does not change the resulting packages)
* d/control: drop build dependency alternative on python3-tomli,
which was needed for bpo builds before bookworm (Closes: #1105938)
* system-physmem-fix-use-after-free-with-dispatch.patch long-awaited
fix for UAF which was affected multiple other packages and was quite
difficult to track (Closes: #1106792)
Checksums-Sha1:
632858efa1697bd3f65e47f53a53cd6b19677e76 12423 qemu_10.0.2+ds-2.dsc
1700efae6f9469764e6e904349c3cf345aac0512 137596 qemu_10.0.2+ds-2.debian.tar.xz
f367a331423fa8f02f00d2d4836e6399aee5834a 6529 qemu_10.0.2+ds-2_source.buildinfo
Checksums-Sha256:
9342e890a03ee7e5b5f6162d3bb1685184fce640e7b6265ec962b235e08d633d 12423
qemu_10.0.2+ds-2.dsc
f29052eb342e6be1c23f4337c22809e2a7a14d0e01e02b0c3a8a65950ec1d411 137596
qemu_10.0.2+ds-2.debian.tar.xz
7d1f381ca8169447a7aefddeadd6d8d860117bce63a3ad9f228ae4d1c6ab2d44 6529
qemu_10.0.2+ds-2_source.buildinfo
Files:
21e0f9e7671679927d85f93095313bc9 12423 otherosfs optional qemu_10.0.2+ds-2.dsc
adaba180c53e409e2c217620d9827d1b 137596 otherosfs optional
qemu_10.0.2+ds-2.debian.tar.xz
db2674be302873e6c209107eb0c183d0 6529 otherosfs optional
qemu_10.0.2+ds-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEZKoqtTHVaQM2a/75gqpKJDselHgFAmiDSQUACgkQgqpKJDse
lHgfgRAAicZbA3jdyBE/TjncEhhedHx7RsyZyGrVQ/W+JhG2ivFyGaxmPdxKQs8M
h9vbfy5S8lz7EVn+a9XNkb9J1HbtTgaMXsorpoA1jzaX6TOy8Rbn3Ehf46OKecTA
/iqZRB/nee8VGhhmZiFZScgdqbBFT/+7alEKPEaEX4mh55WwTaTCxbW35OACBglv
lWRa29y72LerVrIzuPRvNIOudhO5vpLTPMftXbgikm2Ioc/O3gl58Gxqmz6yeuYp
BUSawZiF0lSTYA2d5Kpr/rNZS7WwSGRToIv2VO1iohWH+lUvBlG7rU4+ymDwjeKZ
vR9/YY4XUjSxhS1YanjwTM4MI6QwiCbdDrn8O6uhLXGDUf2Bz5QHIEsyZfu8V5ec
3yERk/dMZ/GyMj5WzuYgURn4mFPeeKUrghmhu0g7UmxKEt5PODdkeEd7dL97rRbt
c4Lvg5WRcuqHwdIiZhzfu0FDSjZz4Oh8gQadPy3DF8co/g/QMrlSbZDt9bjlXo8h
MQQUE2gvuiY2q7HS24Kfe7/TFXjixhjj51frFEb1yaeQhrgMJEeX6GREbev+BYqA
4H0t9mbt6kPQytqlI7B8iAJobA5Y0kS6RLjSn+8LrB99H+RDScFQZvZtWWYreFLc
SOWKtpv4ypU4Xi9TYpKdQw+OsDo7CZ++W7dJHy6GQ57PCQTCOIk=
=0nb8
-----END PGP SIGNATURE-----
pgp1YfgoFmeIo.pgp
Description: PGP signature
--- End Message ---
