Bug#1071161: glib2.0 2.66.8-1+deb11u4 flagged for acceptance

2024-05-21 Thread Adam D. Barratt
On Tue, 2024-05-21 at 11:23 +0100, Simon McVittie wrote:
> On Mon, 20 May 2024 at 20:12:24 +0000, Adam D Barratt wrote:
> > The upload referenced by this bug report has been flagged for
> > acceptance
> > into the proposed-updates queue for Debian bullseye.
> ...
> > Package: glib2.0
> > Version: 2.66.8-1+deb11u4
> > Explanation: fix a (rare) memory leak
> 
> Thanks for reviewing this change. Please consider also accepting
> #1071159 into bookworm-p-u (same change, different base version) to
> preserve the property that bookworm has no regressions when compared
> with bullseye, which I assume is something we want to be able to
> treat as an invariant.

Yep, that's the plan. I just ran out of time on yesterday's run through
the queues before I got to handling the bookworm upload.

Regards,

Adam



Bug#1071266: software-properties 0.99.30-4.1~deb12u1 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1071266 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: software-properties
Version: 0.99.30-4.1~deb12u1

Explanation: software-properties-qt: Add Conflicts+Replaces: 
software-properties-kde for smoother upgrades from bullseye



Bug#1071161: glib2.0 2.66.8-1+deb11u4 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1071161 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: glib2.0
Version: 2.66.8-1+deb11u4

Explanation: fix a (rare) memory leak



Bug#1070799: rustc-web 1.70.0+dfsg1-7~deb11u1 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1070799 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: rustc-web
Version: 1.70.0+dfsg1-7~deb11u1

Explanation: support firefox-esr and thunderbird in bullseye for LTS



Bug#1070232: python3.11 3.11.2-6+deb12u2 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1070232 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: python3.11
Version: 3.11.2-6+deb12u2

Explanation: protect zipfile from "quoted-overlap" zipbomb [CVE-2024-0450]; 
tempfile.TemporaryDirectory: fix symlink bug in cleanup [CVE-2023-6597]; fix 
"os.path.normpath(): Path truncation at null bytes" [CVE-2023-41105]; avoid 
bypass of TLS handshake protections on closed sockets [CVE-2023-40217]; strip 
C0 control and space characters in urlsplit [CVE-2023-24329]; avoid a potential 
null pointer dereference in filleutils



Bug#1069933: emacs 28.2+1-15+deb12u1 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1069933 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: emacs
Version: 28.2+1-15+deb12u1

Explanation: security fixes [CVE-2024-30202 CVE-2024-30203 CVE-2024-30204 
CVE-2024-30205]



Bug#1070218: pypy3 7.3.11+dfsg-2+deb12u2 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1070218 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: pypy3
Version: 7.3.11+dfsg-2+deb12u2

Explanation: strip C0 control and space characters in urlsplit 
[CVE-2023-24329]; avoid bypass of TLS handshake protections on closed sockets 
[CVE-2023-40217]; tempfile.TemporaryDirectory: fix symlink bug in cleanup 
[CVE-2023-6597]; protect zipfile from "quoted-overlap" zipbomb [CVE-2024-0450]



Bug#1065071: php-symfony-contracts 1.1.10-2+deb11u1 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1065071 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: php-symfony-contracts
Version: 1.1.10-2+deb11u1

Explanation: force loading of system dependencies



Bug#1069880: cpu 1.4.3-14~deb11u1 flagged for acceptance

2024-05-20 Thread Adam D Barratt
package release.debian.org
tags 1069880 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: cpu
Version: 1.4.3-14~deb11u1

Explanation: provide exactly one definition of globalLdap in ldap plugin



Bug#1068694: bullseye-pu: package json-smart/2.2-2+deb11u1

2024-05-20 Thread Adam D. Barratt
On Mon, 2024-04-22 at 17:57 +0100, Jonathan Wiltshire wrote:
> Control: tag -1 confirmed
> 
> On Tue, Apr 09, 2024 at 10:01:11AM +0200, Andreas Beckmann wrote:
> > +++ b/debian/patches/0004-CVE-2021-31684-Fix-indexOf.patch
> > @@ -0,0 +1,27 @@
> > +From: HAPPY 
> 
> Well if that doesn't tickle my antennae nothing will :)
> 
> Please go ahead.

It looks like the bookworm update didn't make it to stable-new (and
thus p-u) yet, so the bullseye update is stuck in oldstable-new so as
not to cause version skew.

Regards,

Adam



Bug#1071272: linux: building the bookworm-backports armhf kernel causes OOM on buildds

2024-05-17 Thread Adam D. Barratt
Source: linux
Version: 6.7.12-1~bpo12+1
Severity: serious
X-Debbugs-CC: debian-...@lists.debian.org
X-Debbugs-CC: d...@debian.org

Hi,

armhf builds of the bookworm-backports kernel appear to have led to
outages on several buildds recently.

Each of arm-ubc-04, arm-ubc-05 and arm-ubc-06 (QEMU ganeti guests)
stopped responding after starting to build the kernel, and had to be
rebooted. The build logs stop are various points - two at different
points during drivers/net, and one during the dpkg-deb runs at the end
of the build. The one common factor appears to be that the system logs
on each machine show the OOM killer being invoked during the build,
initially killing syslog but subsequently schroot and many system
processes.

Each buildd has 12GB of RAM and 120GB of swap available.

The issue also seems to be specific to the armhf build - arm-ubc-06
recently successfully built the armel build of the same kernel version.

Please let us know if you need any further information.

Regards,

Adam



Bug#1031888: emacs-nox: bullseye-security update fails to install on mips64el

2024-05-16 Thread Adam D. Barratt
On Thu, 2024-05-16 at 17:01 +0100, Sean Whitton wrote:
> control: reopen 1031888
> 
> Hello Adam,
> 
> On Fri 21 Apr 2023 at 10:19am +01, Adam D. Barratt wrote:
> 
[...]
> > With my DSA hat on, I'm not aware of it having been confirmed to
> > fix
> > the issue on bullseye. I'm happy to test an updated package in the
> > meantime. (FWIW the update isn't in p-u currently because of this
> > issue.)
> 
> I have prepared an update for bullseye incorporating upstream's fix
> for the memory leak.
> I would be grateful if you could test whether the mips64el
> installation is still reproducible.
> 
> As deb11u3 is already in p-u and tagged, I've versioned this deb11u4.
> I've pushed it to the fix-1031888 branch of salsa:rlb/deb-emacs.git.
> 

I've built a 27.1+1-3.1+deb11u4~1.gbp4104c1 package, and confirmed that
it installs cleanly over +deb11u2 on mipsel-osuosl-01.

I then checked the version numbers, and realised that +deb11u2 was the
version that was previously failing. Checking back, all of the
debian.org systems that were affected by the bug are either down or
have already been upgraded to bookworm, so I'm afraid I no longer have
a useful test environment for #1031888.

Regards,

Adam



Bug#1071172: libc6-dev omits the bits directory

2024-05-15 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Wed, 2024-05-15 at 22:10 +1000, Joris van der Geer wrote:
> package:libc6-dev
> version: 2.36

There's no such version of the package. However, assuming you mean the
package in bookworm (2.36-9+deb12u5),

> Libc6 omits thr ‘bits’ directory, rendering glibc inoperable

this is incorrect:

adam@darzee:~$ dpkg -S libc-header-start.h
libc6-dev:amd64: /usr/include/x86_64-linux-gnu/bits/libc-header-start.h

Regards,

Adam



Bug#1070761: bullseye-pu: package bart-cuda/0.6.00-1+deb11u1

2024-05-14 Thread Adam D. Barratt
On Tue, 2024-05-14 at 20:51 +0200, Santiago Vila wrote:
> > > As bart-cuda build-depends on nvidia-cuda-toolkit, which is in
> > > non-
> > > free, bart-cuda is not buildable on the buildd network, so this
> > > will
> > > also need a binary upload to be performed.
> > 
> > Ok, what's the best way to solve this? Can you reject the upload
> > so that I do it again including .debs?
> 
> Nevermind. I see that the upload was already accepted, and what is
> missing is a binary-only upload matching the already existing source.
> 

Yes, sorry if I wasn't clear enough about that.

> I'll make the missing binary upload.

Thanks.

Regards,

Adam



Bug#1070761: bullseye-pu: package bart-cuda/0.6.00-1+deb11u1

2024-05-14 Thread Adam D. Barratt
On Wed, 2024-05-08 at 17:18 +0200, Santiago Vila wrote:
> This upload fixes Bug #1070757 FTBFS in bullseye.
> Note: A similar request for a similar bug has been made for package
> "bart".
> 
> [ Impact ]
> Anybody who try to build the package from source may find
> that the package FTBFS unexpectedly.

As bart-cuda build-depends on nvidia-cuda-toolkit, which is in non-
free, bart-cuda is not buildable on the buildd network, so this will
also need a binary upload to be performed.

Regards,

Adam



Bug#1065013: nvidia-graphics-drivers 470.239.06-1 flagged for acceptance

2024-05-13 Thread Adam D. Barratt
On Wed, 2024-05-08 at 18:22 +0100, Adam D. Barratt wrote:
> On Wed, 2024-05-08 at 19:18 +0200, Andreas Beckmann wrote:
> > On 05/05/2024 20.52, Adam D Barratt wrote:
> > > Package: nvidia-graphics-drivers
> > > Version: 470.239.06-1
> > 
> > > Explanation: upstream security fixes [CVE-2022-42265 CVE-2024-
> > > 0074
> > > CVE-2024-0078]
> > 
> > Can we push these packages to bullseye-updates?
> > The kernel change that recently caused problems for the nvidia
> > modules 
> > in bookworm has now reached bullseye, too: #1070726, but the new 
> > upstream already sitting in bullseye-pu is sufficient to fix that.
> 
> Would wording similar to
> https://lists.debian.org/debian-stable-announce/2024/02/msg2.html
> be accurate / suitable? (With the 12.5 reference changed to the
> relevant DSA number.)

Not sure if you saw the previous mail, but see below for suggested SUA
text.

Regards,

Adam

===
This update addresses problems in three non-free driver packages supporting
nVidia graphics cards.
 
The Linux kernel released in DSA 5681-1 changed an inlined function to
call two GPL-only symbols, making that function inaccessible to non-free
kernel modules.

As a result, the nVidia kernel modules cannot be built via DKMS at
installation time for the updated kernel.

The following packages have been updated to correct the problem:

Source package Fixed version
== =
nvidia-graphics-drivers470.239.06-1
nvidia-graphics-drivers-tesla-470  470.239.06-1~deb11u1
nvidia-settings470.239.06-1
 
If you use the affected packages, we recommend you upgrade to these
versions.
===



Bug#1070670: shim-helpers-i386-signed 1+15.8+1~deb11u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070670 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-i386-signed
Version: 1+15.8+1~deb11u1

Explanation: rebuild against shim 15.8.1



Bug#1070670: shim-helpers-arm64-signed 1+15.8+1~deb11u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070670 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-arm64-signed
Version: 1+15.8+1~deb11u1

Explanation: rebuild against shim 15.8.1



Bug#1070660: shim-helpers-i386-signed 1+15.8+1~deb12u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070660 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-i386-signed
Version: 1+15.8+1~deb12u1

Explanation: rebuild against shim 15.8.1



Bug#1070670: shim-helpers-amd64-signed 1+15.8+1~deb11u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070670 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-amd64-signed
Version: 1+15.8+1~deb11u1

Explanation: rebuild against shim 15.8.1



Bug#1070660: shim-helpers-arm64-signed 1+15.8+1~deb12u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070660 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-arm64-signed
Version: 1+15.8+1~deb12u1

Explanation: rebuild against shim 15.8.1



Bug#1070660: shim-helpers-amd64-signed 1+15.8+1~deb12u1 flagged for acceptance

2024-05-09 Thread Adam D Barratt
package release.debian.org
tags 1070660 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: shim-helpers-amd64-signed
Version: 1+15.8+1~deb12u1

Explanation: rebuild against shim 15.8.1



Bug#1070660: shim 15.8-1~deb12u1 flagged for acceptance

2024-05-08 Thread Adam D Barratt
package release.debian.org
tags 1070660 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: shim
Version: 15.8-1~deb12u1

Explanation: new upstream release



Bug#1070670: shim 15.8-1~deb11u1 flagged for acceptance

2024-05-08 Thread Adam D Barratt
package release.debian.org
tags 1070670 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: shim
Version: 15.8-1~deb11u1

Explanation: new upstream release



Bug#1065013: nvidia-graphics-drivers 470.239.06-1 flagged for acceptance

2024-05-08 Thread Adam D. Barratt
On Wed, 2024-05-08 at 19:18 +0200, Andreas Beckmann wrote:
> On 05/05/2024 20.52, Adam D Barratt wrote:
> > Package: nvidia-graphics-drivers
> > Version: 470.239.06-1
> 
> > Explanation: upstream security fixes [CVE-2022-42265 CVE-2024-0074
> > CVE-2024-0078]
> 
> Can we push these packages to bullseye-updates?
> The kernel change that recently caused problems for the nvidia
> modules 
> in bookworm has now reached bullseye, too: #1070726, but the new 
> upstream already sitting in bullseye-pu is sufficient to fix that.

Would wording similar to
https://lists.debian.org/debian-stable-announce/2024/02/msg2.html
be accurate / suitable? (With the 12.5 reference changed to the
relevant DSA number.)

Regards,

Adam



Bug#1067106: bullseye-pu: package nvidia-settings/470.239.06-1

2024-05-06 Thread Adam D. Barratt
Control: tags -1 + pending

On Mon, 2024-05-06 at 20:29 +0200, Andreas Beckmann wrote:
> while accepting the nvidia stack yesterday (many thanks for that!)
> you missed to tag etc. this bug, while the package was accepted
> (perhaps attributed to a different bug?).

Yep, the metadata in the comment file had a typo in the bug number.
Fixed now, thanks.

Regards,

Adam



Bug#1070490: libc6: Unpacking libc6:amd64 2.28-10+deb10u3 over 2.28-10+deb10u2 breaks system

2024-05-06 Thread Adam D. Barratt
On Mon, 2024-05-06 at 13:02 +0200, Jan Krčmář wrote:
> Package: libc6
> Version: 2.28-10+deb10u3
> 
> Upgrading the system (Debian 10/Buster) causes corrupted system,
> ending with kernel panic and unbootable system.
> 
[...]
> The following packages will be upgraded:
> apt apt-transport-https apt-utils base-files ca-certificates 

The fact that APT is being upgraded here seems strange - APT hasn't
changed in buster for 3 years. What's your base system?

> 
[...]
> Unpacking libc6:amd64 (2.28-10+deb10u3) over (2.28-10+deb10u2) ...
> Replaced by files in installed package libcrypt1:amd64 (1:4.4.18-4)
> ...

This, on the other hand, looks like you've done something odd to your
system. libcrypt1 doesn't exist until bullseye, so at some point you
have partially upgraded your base system. In conjunction with your pre-
upgrade system apparently having an APT version that's /older/ than the
one in buster, this feels odd.

Regards,

Adam



Bug#1067016: nvidia-settings 470.239.06-1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067016 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: nvidia-settings
Version: 470.239.06-1

Explanation: new upstrem bugfix release; build for ppc64el



Bug#1065053: nvidia-graphics-drivers-tesla-470 470.239.06-1~deb11u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1065053 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: nvidia-graphics-drivers-tesla-470
Version: 470.239.06-1~deb11u1

Explanation: new upstream LTS release [CVE-2024-0074 CVE-2024-0078 
CVE-2022-42265]



Bug#1065013: nvidia-graphics-drivers 470.239.06-1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1065013 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: nvidia-graphics-drivers
Version: 470.239.06-1

Explanation: upstream security fixes [CVE-2022-42265 CVE-2024-0074 
CVE-2024-0078]



Bug#1067843: nvidia-open-gpu-kernel-modules 535.161.08-1~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067843 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-open-gpu-kernel-modules
Version: 535.161.08-1~deb12u1

Explanation: update to 535 series LTS drivers [CVE-2023-0180 CVE-2023-0183 
CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 
CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 
CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022 CVE-2024-0074 
CVE-2024-0075 CVE-2024-0078]



Bug#1067821: nvidia-graphics-drivers 535.161.08-2~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067821 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-graphics-drivers
Version: 535.161.08-2~deb12u1

Explanation: new upstream stable release [CVE-2023-0180 CVE-2023-0183 
CVE-2023-0184 CVE-2023-0185 CVE-2023-0187 CVE-2023-0188 CVE-2023-0189 
CVE-2023-0190 CVE-2023-0191 CVE-2023-0194 CVE-2023-0195 CVE-2023-0198 
CVE-2023-0199 CVE-2023-25515 CVE-2023-25516 CVE-2023-31022 CVE-2024-0074 
CVE-2024-0075 CVE-2024-0078]



Bug#1067745: nvidia-settings 535.171.04-1~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067745 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-settings
Version: 535.171.04-1~deb12u1

Explanation: new upstream LTS release



Bug#1067742: nvidia-xconfig 535.171.04-1~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067742 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-xconfig
Version: 535.171.04-1~deb12u1

Explanation: new upstream LTS release



Bug#1065653: nvidia-modprobe 535.161.07-1~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1065653 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-modprobe
Version: 535.161.07-1~deb12u1

Explanation: prepare to switch to 535 series LTS drivers



Bug#1067739: nvidia-persistenced 535.171.04-1~deb12u1 flagged for acceptance

2024-05-05 Thread Adam D Barratt
package release.debian.org
tags 1067739 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-persistenced
Version: 535.171.04-1~deb12u1

Explanation: switch to 535 series LTS drivers; update list of supported drivers



Bug#1070202: RM: rust-atk-sys/experimental -- ROM; RoM; unmaintained library

2024-05-02 Thread Adam D. Barratt
On Wed, 2024-05-01 at 21:15 +0200, Matthias Geiger wrote:
> I uploaded an experimental version some time ago that wasn't picked
> up by dak apperantly when it was removing it from unstable.

For reference, that's expected - the removal command operates on a
single suite, so removals from more than one suite need a bug for each.

Regards,

Adam



Bug#1070175: RM: salt/3002.6+dfsg1-4+deb11u1

2024-05-01 Thread Adam D. Barratt
On Wed, 2024-05-01 at 19:46 +0200, Moritz Muehlenhoff wrote:
> On Wed, May 01, 2024 at 06:29:29PM +0100, Adam D. Barratt wrote:
> > On Wed, 2024-05-01 at 13:02 +0200, Moritz Muehlenhoff wrote:
> > > Please remove salt in the next Bullseye point release.
> > > It was already removed frm unstable for being unsupportable
> > > and unmaintained (https:://bugs.debian.org/1069654).
> > > 
> > > There are two related packages which need to be removed
> > > alongside, since salt-common depends on them (but which
> > > have no other dependencies outside of salt):
> > > 
> > > pytest-salt-factories 0.93.0-1
> > > pytest-testinfra 6.1.0-1
> > 
> > I'm not doubting whether at least the former should be removed, but
> > "salt-common depends on them" isn't a reason to remove things in
> > itself. A relationship in the opposite direction certainly would be
> > (i.e. "they depend on salt-common").
> 
> It's actually build dependencies, both pytest-salt-factories and
> pytest-testinfra build depend on salt-common.

Ah, that makes more sense. Thanks for the clarification.

Regards,

Adam



Bug#1070175: RM: salt/3002.6+dfsg1-4+deb11u1

2024-05-01 Thread Adam D. Barratt
On Wed, 2024-05-01 at 13:02 +0200, Moritz Muehlenhoff wrote:
> Please remove salt in the next Bullseye point release.
> It was already removed frm unstable for being unsupportable
> and unmaintained (https:://bugs.debian.org/1069654).
> 
> There are two related packages which need to be removed
> alongside, since salt-common depends on them (but which
> have no other dependencies outside of salt):
> 
> pytest-salt-factories 0.93.0-1
> pytest-testinfra 6.1.0-1

I'm not doubting whether at least the former should be removed, but
"salt-common depends on them" isn't a reason to remove things in
itself. A relationship in the opposite direction certainly would be
(i.e. "they depend on salt-common").

Regards,

Adam



Bug#1067821: bookworm-pu: package nvidia-graphics-drivers/535.161.08-2~deb12u1

2024-04-28 Thread Adam D. Barratt
On Sun, 2024-04-28 at 13:43 +0200, Andreas Beckmann wrote:
> Please reject nvidia-graphics-drivers/535.161.08-1~deb12u1, nvidia-
> driver-full is uninstallable on ppc64el (but that was hidden by the
> other t64 transition blockers).

Done, thanks for letting us know.

Regards,

Adam



Bug#1070005: mirror submission for mirrors.hostico.ro

2024-04-28 Thread Adam D. Barratt
On Sun, 2024-04-28 at 13:28 +, Hostico wrote:
> Package: mirrors
> Severity: wishlist
> User: mirr...@packages.debian.org
> Usertags: mirror-submission
> 
> Submission-Type: new
> Site: mirrors.hostico.ro

This is *not* a new submission. Please do not submit duplicate details
for already listed mirrors.

You were already advised two days ago to allow a few days for your
mirror to automatically return to the published listing and that you
did not need to resubmit. That advice has not changed in the meantime.

If the intent was to change some details, the submission form has an
"update" option; highlighting which details you believe have changed
via a comment helps in such cases.

Regards,

Adam



Bug#1068798: bookworm-pu: package fdroidserver/2.2.1-1

2024-04-11 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Thu, 2024-04-11 at 11:36 +0200, Jochen Sprickerhof wrote:
>   [ ] the issue is verified as fixed in unstable
> 
[...]
> Upstream is still working on a long term fix that will be uploaded to
> unstable later. I agreed with upstream to use use the patch provided
> in the mail on oss-security already now.

In any case, assuming that the issue affects unstable (which appears to
be the case), it should be fixed there first.

Regards,

Adam



Bug#1051024: bookworm-pu: package igtf-policy-bundle/1.22-1~deb12u1

2024-04-08 Thread Adam D. Barratt
On Mon, 2024-04-08 at 14:26 +0200, Dennis van Dok wrote:
> I've uploaded a new version since unstable is already at 1.128-1.

The package you've uploaded is versioned 1.128-1+deb12u1, which is
higher than the version in unstable. The stable upload needs to have a
lower version number, conventionally 1.128-1~deb12u1.

It appears you've also uploaded a 1.128-1~deb12u1 package, which
confusingly seems to be a rebuild of 1.12_7_-1 from unstable.

I'm going to flag both uploads for rejection. Once you get confirmation
of that having been actioned, if what you're actually aiming for is to
get a rebuild of 1.128-1 into stable then please:
- use 1.128-1~deb12u1 as the package version
- attach a revised debdiff to this bug

Regards,

Adam



Bug#1068569: RM: nfs-ganesha-ceph [armel armhf i386] -- NBS; ceph dropped 32 bit support

2024-04-08 Thread Adam D. Barratt
On Mon, 2024-04-08 at 11:42 +0200, Christoph Martin wrote:
> Hi Sebastian,
> 
> the packages are already removed from testing and unstable.
> Where do you see a problem?

I'm not Sebastian, but the archive disagrees with you about the
packages having been removed from unstable.

adsb@coccia:~$ dak ls -s unstable -a armel,armhf,i386 nfs-ganesha-ceph 
nfs-ganesha-rados-grace nfs-ganesha-rgw 
nfs-ganesha-ceph| 4.3-5 | unstable   | armel, armhf, i386
nfs-ganesha-rados-grace | 4.3-5 | unstable   | armel, armhf, i386
nfs-ganesha-rgw | 4.3-5 | unstable   | armel, armhf, i386

Regards,

Adam



Bug#1067821: bookworm-pu: package nvidia-graphics-drivers/535.161.08-1~deb12u1

2024-03-29 Thread Adam D. Barratt
On Thu, 2024-03-28 at 18:40 +0100, Andreas Beckmann wrote:
> On 27/03/2024 21.10, Adam D. Barratt wrote:
> > Please go ahead, bearing in mind that the window for 12.6 closes
> > over
> > the coming weekend.
> 
> The whole nvidia stack has now been uploaded, 
> src:nvidia-graphics-drivers is sitting in NEW.

It's now in stable-new.

We have a bit of an issue in terms of accepting / shipping the 535
bookworm stack, however. The upload of 535 to unstable is blocked from
migration to testing by openssl, which is in turn blocked by dpkg,
which is manually blocked for the time64 transition.

Would we be better to ship the 525 packages that are already in p-u and
revisit 535 for 12.7, or skip those updates as well and just include
535 when we can?

Regards,

Adam



Bug#1067980: bookworm-pu: package gpaste/43.1-3+deb12u1

2024-03-29 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Fri, 2024-03-29 at 15:57 +0100, Andreas Beckmann wrote:
> In order to smoothen upgrade paths I'd like to add some
> Breaks+Replaces
> to bookworm. This avoids a file conflict in case libgpaste6 (last
> released with stretch) is still installed.

Please go ahead.

Regards,

Adam



Bug#1068016: bookworm-pu: package node-babel7/7.20.15+ds1+~cs214.269.168-3+deb12u2

2024-03-29 Thread Adam D. Barratt
Control: tags -1 + confimred

On Fri, 2024-03-29 at 17:41 +0100, Andreas Beckmann wrote:
> To smoothen some upgrade paths from buster -> bullseye -> bookworm we
> need to add some Breaks+Replaces against obsolete packages.

Please go ahead.

Regards,

Adam



Bug#1067821: bookworm-pu: package nvidia-graphics-drivers/535.161.08-1~deb12u1

2024-03-27 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Wed, 2024-03-27 at 09:51 +0100, Andreas Beckmann wrote:
> In order to receive further upstream support (i.e. CVE fixes), we
> need
> to switch src:nvidia-graphics-drivers from the 525 series (EoL
> 12/2023)
> to the 535 series, a new LTSB branch sufficient for the lifetime of
> bookworm. (The first 535 beta appeared during deep freeze of
> bookworm.)
> This driver supports a superset of the GPUs supported by the 525
> drivers, no GPUs have been dropped.
> 
[...]
>   I'm currently doing interoperability tests with
>   src:nvidia-open-gpu-kernel-modules. (These two source packages
>   need to be updated together due to the strict firmware
>   dependency.) An upload to bookworm will only happen after the
>   package is in sid.

Please go ahead, bearing in mind that the window for 12.6 closes over
the coming weekend.

Regards,

Adam



Bug#1067843: bookworm-pu: package nvidia-open-gpu-kernel-modules/535.161.08-1~deb12u1

2024-03-27 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Wed, 2024-03-27 at 14:43 +0100, Andreas Beckmann wrote:
> We need to update src:nvidia-open-gpu-kernel-modules to a new
> upstream
> version to stay in sync with src:nvidia-graphics-drivers (for a
> matching
> firmware-nvidia-gsp upstream version) and to fix some CVEs.
[...]
>   [ ] the issue is verified as fixed in unstable
>   I'm currently doing interoperability tests with
>   src:nvidia-graphics-drivers. (These two source packages
>   need to be updated together due to the strict firmware
>   dependency.) An upload to bookworm will only happen after the
>   package is in sid.

Please go ahead, bearing in mind that the window for 12.6 closes over
the coming weekend.

Regards,

Adam



Bug#1067745: bookworm-pu: package nvidia-settings/535.171.04-1~deb12u1

2024-03-26 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Tue, 2024-03-26 at 11:09 +0100, Andreas Beckmann wrote:
> In order to upgrade src:nvidia-graphics-drivers to the 535 LTS series
> (the 525 series currently in stable is already EoL), we need to
> update
> some additional packages (some driver components can be built from
> source and reside in contrib).

Please go ahead.

Regards,

Adam



Bug#1067742: bookworm-pu: package nvidia-xconfig/535.171.04-1~deb12u1

2024-03-26 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Tue, 2024-03-26 at 10:51 +0100, Andreas Beckmann wrote:
> In order to upgrade src:nvidia-graphics-drivers to the 535 LTS series
> (the 525 series currently in stable is already EoL), we need to
> update
> some additional packages (some driver components can be built from
> source and reside in contrib).

Please go ahead.

Regards,

Adam



Bug#1067739: bookworm-pu: package nvidia-persistenced/535.171.04-1~deb12u1

2024-03-26 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Tue, 2024-03-26 at 10:40 +0100, Andreas Beckmann wrote:
> In order to upgrade src:nvidia-graphics-drivers to the 535 LTS series
> (the 525 series currently in stable is already EoL), we need to
> update
> some additional packages (some driver components can be built from
> source and reside in contrib).

Please go ahead.

Regards,

Adam



Bug#1067564: bookworm-pu: package cpu/1.4.3-14~deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Sat, 2024-03-23 at 18:40 +0100, Andreas Beckmann wrote:
> The last QA upload four years ago fixed a FTBFS (multiple definitions
> of
> a global variable) by replacing that variable with an extern
> declaration
> and zero definitions. This didn't result in a linker error (missing
> symbol) because it happens in a plugin library and thus is only
> detected
> at runtime when the plugin gets loaded (i.e. always).

Oh dear...

Please go ahead.

Regards,

Adam



Bug#1067149: bookworm-pu: package hovercraft/2.7-6~deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Tue, 2024-03-19 at 12:03 +0100, Andreas Beckmann wrote:
> hovercraft is unusable w/o python3-setuptools
> 
> [ Impact ]
> hovercraft is unusable without manual installation of additional
> packages.

Please go ahead.

Regards,

Adam



Bug#1066096: bookworm-pu: package libpod/4.3.1+ds1-8+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Tue, 2024-03-12 at 10:24 -0400, Jérôme Charaoui wrote:
> podman in bookworm suffers from a race condition which causes the 
> "network ls" command to fail intermittently in certain scenarios

Please go ahead.

Regards,

Adam



Bug#1065052: nvidia-graphics-drivers-tesla-470 470.239.06-1~deb12u1 flagged for acceptance

2024-03-25 Thread Adam D Barratt
package release.debian.org
tags 1065052 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: nvidia-graphics-drivers-tesla-470
Version: 470.239.06-1~deb12u1

Explanation: new upstream stable release; improve compatibility with newer 
kernel versions; security fixes [CVE-2022-42265 CVE-2024-0074 CVE-2024-0078]



Bug#1065653: bookworm-pu: package nvidia-modprobe/535.161.07-1~deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Fri, 2024-03-08 at 09:42 +0100, Andreas Beckmann wrote:
> In preparation to switching bookworm from the nvidia-graphics-drivers
> 525.* series (production branch, EoL) to the 535.* series (long term
> support branch, receives updates until July 2026), we need to update
> nvidia-modprobe again. We already have a 535 release in bookworm, but
> there was recently a new option being added.

Please go ahead.

Regards,

Adam



Bug#1065264: bookworm-pu: package phpseclib/1.0.20-1+deb12u2

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Sat, 2024-03-02 at 11:19 +0100, David Prévot wrote:
> I’d like to see CVE-2024-27354 and CVE-2024-27355 addressed in the
> next
> point release. We agreed with the security team that these issues are
> not worth a DSA. This update also fixes an issue in dependency
> loading
> similar to CVE-2024-24821 as fixed in composer/DSA-5632-1.
> 

Please go ahead.

Regards,

Adam



Bug#1065263: bookworm-pu: package php-phpseclib/2.0.42-1+deb12u2

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Sat, 2024-03-02 at 11:17 +0100, David Prévot wrote:
> I’d like to see CVE-2024-27354 and CVE-2024-27355 addressed in the
> next
> point release. We agreed with the security team that these issues are
> not worth a DSA.

Please go ahead.

Regards,

Adam



Bug#1065261: bookworm-pu: package php-phpseclib3/3.0.19-1+deb12u3

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Sat, 2024-03-02 at 11:15 +0100, David Prévot wrote:
> I’d like to see CVE-2024-27354 and CVE-2024-27355 addressed in the
> next
> point release. We agreed with the security team that these issues are
> not worth a DSA. This update also fixes an issue in dependency
> loading
> similar to CVE-2024-24821 as fixed in composer/DSA-5632-1.

Please go ahead.

Regards,

Adam



Bug#1065068: bookworm-pu: package php-doctrine-deprecations/1.0.0-2+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 12:12 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1 (the last one for
> Bookworm).
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Please go ahead.

Regards,

Adam



Bug#1065067: bookworm-pu: package php-doctrine-lexer/2.1.0-2+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 12:08 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Again the branch name probably wants adjusting.

Please go ahead.

Regards,

Adam



Bug#1065065: bookworm-pu: package php-doctrine-annotations/2.0.1-1+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 12:05 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Please go ahead.

Regards,

Adam



Bug#1065062: bookworm-pu: package php-zend-code/4.8.0-1+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:58 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Please go ahead.

Regards,

Adam



Bug#1065060: bookworm-pu: package php-proxy-manager/2.11.1+1.0.14-1+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:50 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Please go ahead.

Regards,

Adam



Bug#1065059: bookworm-pu: package symfony/5.4.23+dfsg-1+deb12u2

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:54 +0100, David Prévot wrote:
> Hi,
> 
> Le Thu, Feb 29, 2024 at 11:40:25AM +0100, David Prévot a écrit :
> >   [x] attach debdiff against the package in (old)stable
> 
> Now it’s true.

Please go ahead.

Regards,

Adam



Bug#1065058: bookworm-pu: package php-symfony-contracts/2.5.2-1+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:31 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1, #1065056 and #1065057.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

Please go ahead.

Regards,

Adam



Bug#1065057: bookworm-pu: package php-composer-xdebug-handler/3.0.3-2+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:18 +0100, David Prévot wrote:
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next
> point release.

+  * Track debian/bookworm-security

Even though this update isn't going to the security archive?

Please go ahead.

Regards,

Adam



Bug#1065056: bookworm-pu: package php-composer-class-map-generator/1.0.0-2+deb12u1

2024-03-25 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-29 at 11:10 +0100, David Prévot wrote:
> [1/9 for bookworm]
> 
> This is a follow up from composer/DSA-5632-1.
> 
> In order to fix a Debian-specific issue related to CVE-2024-24821, we
> agreed with the security team to push related dependencies via the
> next point release.

All 9 of them. :-/

Please go ahead.

Regards,

Adam



Bug#1066928: ovn 23.03.1-1~deb12u2 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1066928 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: ovn
Version: 23.03.1-1~deb12u2

Explanation: fix insufficient validation of incoming BFD packets [CVE-2024-2182]



Bug#1065413: openssl 3.0.13-1~deb12u1 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1065413 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: openssl
Version: 3.0.13-1~deb12u1

Explanation: new upstream stable release; fix excessive time taken issues 
[CVE-2023-5678 CVE-2023-6237], vector register corruption issue on PowerPC 
[CVE-2023-6129], PKCS12 Decoding crashes [CVE-2024-0727]



Bug#1067206: amavisd-new 2.13.0-3+deb12u1 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1067206 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: amavisd-new
Version: 2.13.0-3+deb12u1

Explanation: handle multiple boundary parameters that contain conflicting 
values [CVE-2024-28054]; fix race condition in postinst



Bug#1065562: postfix 3.7.11-0+deb12u1 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1065562 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: postfix
Version: 3.7.11-0+deb12u1

Explanation: new upstream stable release



Bug#1065376: libxml-stream-perl 1.24-4+deb12u1 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1065376 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: libxml-stream-perl
Version: 1.24-4+deb12u1

Explanation: fix compatibility with IO::Socket::SSL >= 2.078



Bug#1064993: systemd 252.23-1~deb12u1 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1064993 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: systemd
Version: 252.23-1~deb12u1

Explanation: new upstream stable release; fix denial of service issues 
[CVE-2023-50387 CVE-2023-50868]



Bug#1052455: freetype 2.12.1+dfsg-5+deb12u3 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1052455 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: freetype
Version: 2.12.1+dfsg-5+deb12u3

Explanation: disable COLRv1 support again; fix function existence check when 
calling get_colr_glyph_paint()



Bug#1064588: glibc 2.36-9+deb12u5 flagged for acceptance

2024-03-24 Thread Adam D Barratt
package release.debian.org
tags 1064588 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: glibc
Version: 2.36-9+deb12u5

Explanation: revert fix to always call destructors in reverse constructor order 
due to unforeseen application compatibility issues; fix a DTV corruption due to 
a reuse of a TLS module ID following dlclose with unused TLS



Bug#1065413: bookworm-pu: package openssl/3.0.13-1~deb12u1

2024-03-24 Thread Adam D. Barratt
On Mon, 2024-03-04 at 07:38 +0100, Sebastian Andrzej Siewior wrote:
> This is an update to the current stable OpenSSL release in the 3.0.x
> series. It addresses the following CVE reports which were postponed
> due to low severity:
[...]
> I'm not aware of a problems/ regression at this point.

Sorry for not getting to this sooner. Is this still the case?

Regards,

Adam



Bug#1053191: mirror submission for mirror.kpfu.ru

2024-03-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

Hi,

Apologies for the delay in getting back to you.

On Fri, 2023-09-29 at 06:50 +, kpfu.ru wrote:
> Site: mirror.kpfu.ru
> Archive-architecture: amd64 i386

Our automated checks noticed an issue with your mirror:

o The trace file at
  http://mirror.kpfu.ru/debian/project/trace/mirror.kpfu.ru
  is missing some required information.

  We expect at least the Maintainer and Upstream-mirror values to be filled in,
  and your trace file is missing one or both of them.


As an additional note, is there a reason that you only mirror amd64
packages? In general users will expect mirrors to carry all
architectures.

Regards,

Adam



Bug#1058071: mirror submission for mirrors.cat.pdx.edu

2024-03-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

Hi,

Apologies for the delay in getting back to you.

On Mon, 2023-12-11 at 23:52 +, Sage Imel wrote:
> Site: mirrors.cat.pdx.edu
> Archive-architecture: amd64 arm64 armhf hurd-amd64 i386 riscv64

Our automated checks noticed an issue with your mirror:

o The trace file at
  http://mirrors.cat.pdx.edu/debian/project/trace/mirrors.cat.pdx.edu
  is missing some required information.

  We expect at least the Maintainer and Upstream-mirror values to be filled in,
  and your trace file is missing one or both of them.

As an additional note, is there a reason that you only mirror a subset
of Debian's official architectures?

Architectures-Configuration: EXCLUDE alpha arm armel hppa hurd-i386 ia64 
kfreebsd-amd64 kfreebsd-i386 m68k mips mipsel powerpc s390 s390x sh sparc 

armel, mipsel and s390x are all currently supported architectures and
would be expected to appear on all Debian mirrors.

Regards,

Adam



Bug#1063915: mirror submission for debian.mirrors.ovh.net

2024-03-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Wed, 2024-02-14 at 20:03 +, OVHcloud wrote:
> Site: debian.mirrors.ovh.net
> Archive-architecture: ALL amd64 arm64 armel armhf hurd-i386 hurd-
> amd64 i386 mips mips64el mipsel powerpc ppc64el riscv64 s390x
> Archive-http: /debian/
> Maintainer: OVHcloud 
> Country: FR France
> Location: Anycast (Gravelines, Roubaix and Strasbourg)

I know there was some discussion on IRC, so apologies if I'm rehashing
here, but:

- are the individual backends exposed in any way?
- how do you ensure that the backends are in sync with each other?
- what are the chances of users seeing inconsistent state if they hit
different backends which aren't at the same stage of updating?

Regards,

Adam



Bug#1067488: mirror listing update for mirror.lon.macarne.com

2024-03-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Fri, 2024-03-22 at 10:36 +, Arne wrote:
> Submission-Type: update
> Site: mirror.lon.macarne.com
> Archive-architecture: ALL amd64 arm64 armel armhf hurd-i386 hurd-
> amd64 i386 mips mips64el mipsel powerpc ppc64el riscv64 s390x
> Archive-http: /debian/
> Archive-rsync: debian/
> Maintainer: Arne 

The only change here from #1067086 seems to be that the original
request has:

Maintainer: Macarne LLC 

Do you want it changing to the individual address instead?

Regards,

Adam



Bug#1064431: mirror submission for mirror.fra.macarne.com

2024-03-22 Thread Adam D. Barratt
Control: forcemerge 1067082 -1

Hi,

This has been handled in the duplicate #1067082.

Regards,

Adam

On Fri, 2024-02-23 at 07:59 +0800, Arne Ruhnau wrote:
> Hi, should be fixed thanks. Arne
> 
> > On Feb 23, 2024, at 2:24 AM, Adam D. Barratt
> >  wrote:
> > 
> > Control: tags -1 + moreinfo
> > 
> > On Wed, 2024-02-21 at 23:45 +, Macarne LLC wrote:
> > > Submission-Type: new
> > > Site: mirror.fra.macarne.com
> > 
> > Our automated checks found an issue with your mirror:
> > 
> > o The trace file at
> >  
> > http://mirror.fra.macarne.com/debian/project/trace/mirror.fra.macarn
> > e.com
> >  is missing some required information.
> > 
> >  We expect at least the Maintainer and Upstream-mirror values to be
> > filled in,
> >  and your trace file is missing one or both of them.
> > 
> > 
> > Please fix that and let us know once it's done.
> > 
> > Regards,
> > 
> > Adam
> 



Bug#1063621: clamav 1.0.5+dfsg-1~deb12u1 flagged for acceptance

2024-03-08 Thread Adam D Barratt
package release.debian.org
tags 1063621 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: clamav
Version: 1.0.5+dfsg-1~deb12u1

Explanation: new upstream stable release; fix possible heap overflow issue 
[CVE-2024-20290], possible command injection issue [CVE-2024-20328]



Bug#1063621: bookworm-pu: package clamav/clamav_1.0.5+dfsg-1~deb12u1

2024-03-07 Thread Adam D. Barratt
On Fri, 2024-02-09 at 23:12 +0100, Sebastian Andrzej Siewior wrote:
> This is an update to the latest clamav release in the 1.0.x series. 

One small thing you may want to fix for any follow-up updates:

+clamav (1.0.5+dfsg-1~deb12u1) bookworm; urgency=medium
+
+  * Import 1.0.4 (Closes: #1063479).

Regards,

Adam



Bug#1064031: rustc-web 1.70.0+dfsg1-7~deb12u2 flagged for acceptance

2024-03-04 Thread Adam D Barratt
package release.debian.org
tags 1064031 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: rustc-web
Version: 1.70.0+dfsg1-7~deb12u2

Explanation: fix build issues and file conflicts



Bug#1064031: rustc-web 1.70.0+dfsg1-7~deb12u1 flagged for acceptance

2024-03-03 Thread Adam D. Barratt
On Sat, 2024-03-02 at 03:54 -0500, Andres Salomon wrote:
> rustc-web (1.70.0+dfsg1-7~deb12u2) bookworm; urgency=medium
> 
>    * Non-maintainer upload.
>    * Increase allowed test failures on armhf and ppc64el to fix
> FTBFS.
>    * Provide Conflicts/Replaces for rust*-mozilla*, which could still
> be
>  installed from oldstable (closes: #1064562).
>    * Add Provides/Conflicts/Replaces for libstd-rust-1.70 (closes: 
> #1064563).

Please go ahead.

Regards,

Adam



Bug#1064371: mirror.xeonbd.com at https://www.debian.org/mirror/list#per-country

2024-03-01 Thread Adam D. Barratt
[Removed owner@bugs from CC, this has absolutely nothing to do with
them]

On Sun, 2024-02-25 at 05:11 +0600, XeonBD Admin wrote:
> Recently through Bug#1064371 mirror.xeonbd.com was approved as a
> Debian mirror but the mirror is not listed at
> https://www.debian.org/mirror/list#per-country
> 
> Is there anything else we need to do to add the mirror.xeonbd.com on
> https://www.debian.org/mirror/list#per-country

You need to have more patience. Re-submitting your details is not going
to help.

The public mirror list is automatically generated by filtering the 
underlying source list for mirrors with a high enough "score". You can
see the current status of your mirror at
https://mirror-master.debian.org/status/mirror-info/mirror.xeonbd.com.html


Once it reaches at least +50 your mirror should be included in the
public listing automatically.

Regards,

Adam



Bug#1065169: debsources: incomplete support for non-free-firmware

2024-03-01 Thread Adam D. Barratt
Package: qa.debian.org
User: qa.debian@packages.debian.org
Usertag: debsources
Severity: important

Hi,

While waiting for an update run on sor.d.o to finish earlier today (so
I could add a little disk space to /srv) I noticed some errors in the
logs relating to non-free-firmware packages; e.g.:

2024-03-01 08:59:19 updater:ERROR failed to add 
nvidia-graphics-drivers/525.147.05-7~deb12u1
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/sqlalchemy/engine/base.py", line 1276, 
in _execute_context
self.dialect.do_execute(
  File "/usr/lib/python3/dist-packages/sqlalchemy/engine/default.py", line 609, 
in do_execute
cursor.execute(statement, parameters)
psycopg2.errors.StringDataRightTruncation: value too long for type character 
varying(8)

This appears to be because MR!6 didn't change the size of the field in
lib/debsources/models.py and "non-free-firmware" is obviously larger
than 8 characters.

I assume this needs a database migration as well as a change to
models.py, but it's not completely clear to me how/when those get
applied, particularly as 011-to-012.sql has existed since early 2020
but models.py still specifies DB_SCHEMA_VERSION as 11.

Regards,

Adam



Bug#1064031: rustc-web 1.70.0+dfsg1-7~deb12u1 flagged for acceptance

2024-02-27 Thread Adam D. Barratt
On Tue, 2024-02-27 at 15:00 -0500, Andres Salomon wrote:
> So it looks like I'll need a new upload to fix two bookworm
> architecture 
> build failures (armhf and ppc64el), and also to fix #1064562. Should
> I 
> file a new release.d.o bug, or continue using this one?

Given that both issues are related to the initial upload tracked in
this bug, re-using this one is ifne.

Regards,

Adam



Bug#1064031: rustc-web 1.70.0+dfsg1-7~deb12u1 flagged for acceptance

2024-02-23 Thread Adam D Barratt
package release.debian.org
tags 1064031 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: rustc-web
Version: 1.70.0+dfsg1-7~deb12u1

Explanation: new source package to support builds of web browsers



Bug#1060214: mirror listing update for repository.su

2024-02-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Sun, 2024-01-07 at 17:42 +, repository.su wrote:
> Submission-Type: update
> Site: repository.su
[...]
> Comment: This address is a replacement for the existing mirror
> mirror.surf

The tracefile still contains:

Running on host: mirror.surf

Please fix that and let us know when done. (Likely be changing the
MIRRORNAME variable in your ftpsync config.)

Regards,

Adam



Bug#1063635: mirror listing update for mirror.limda.net

2024-02-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Sat, 2024-02-10 at 08:09 +, Limda Host wrote:
> Submission-Type: update
> Site: mirror.limda.net
> Archive-architecture: ALL amd64 arm64 armel armhf hurd-i386 hurd-
> amd64 i386 mips mips64el mipsel powerpc ppc64el riscv64 s390x
> Archive-http: /debian/
> Archive-rsync: debian/
> Maintainer: Limda Host 
> Country: BD Bangladesh
> Location: Dhaka
> Sponsor: Limda Host https://www.limda.net

Please could you clarify what has changed relative to your current
listing?

Regards,

Adam



Bug#1064289: mirror submission for elmirror.cl

2024-02-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Mon, 2024-02-19 at 18:57 +, https://elmirror.cl wrote:
> Site: elmirror.cl
> Archive-architecture: ALL amd64 arm64 armel armhf hurd-i386 hurd-
> amd64 i386 mips mips64el mipsel powerpc ppc64el riscv64 s390x
> Archive-http: /debian/

Our automated checks noticed an issue with your setup:

o The trace file at
  http://elmirror.cl/debian/project/trace/elmirror.cl
  is missing some required information.

  We expect at least the Maintainer and Upstream-mirror values to be filled in,
  and your trace file is missing one or both of them.


Please fix that and let us know once it's done.

Regards,

Adam



Bug#1064371: mirror submission for mirror.xeonbd.com

2024-02-22 Thread Adam D. Barratt
On Tue, 2024-02-20 at 22:14 +, XeonBD wrote:
> Site: mirror.xeonbd.com
> Archive-architecture: ALL amd64 arm64 armel armhf hurd-i386 hurd-
> amd64 i386 mips mips64el mipsel powerpc ppc64el riscv64 s390x
> Archive-http: /debian/
> Maintainer: XeonBD 
> Country: BD Bangladesh
> Location: Bangladesh
> Sponsor: XeonBD https://www.xeonbd.com

Our automated checks noticed an issue with your setup:

o We recommend mirrors not sync directly from service aliases such as
  ftp..debian.org (only HTTP is guaranteed to be available at
  ftp. sites).  Maybe change your config to sync from
  the site currently backing the ftp..debian.org service you sync
  from?

Regards,

Adam



Bug#1064431: mirror submission for mirror.fra.macarne.com

2024-02-22 Thread Adam D. Barratt
Control: tags -1 + moreinfo

On Wed, 2024-02-21 at 23:45 +, Macarne LLC wrote:
> Submission-Type: new
> Site: mirror.fra.macarne.com

Our automated checks found an issue with your mirror:

o The trace file at
  http://mirror.fra.macarne.com/debian/project/trace/mirror.fra.macarne.com
  is missing some required information.

  We expect at least the Maintainer and Upstream-mirror values to be filled in,
  and your trace file is missing one or both of them.


Please fix that and let us know once it's done.

Regards,

Adam



Bug#1064031: chromium and rustc in bookworm

2024-02-22 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Thu, 2024-02-15 at 19:25 -0500, Andres Salomon wrote:
> Chromium now requires a Rust compiler to build, and it specifically 
> needs a rustc with profiler support built into it. This package can 
> hopefully be shared with firefox and other browser/web engines that
> end  up needing a newer rustc.

Please go ahead.

Regards,

Adam



Bug#1063675: bookworm-pu: package nvidia-graphics-drivers/525.147.05-6~deb12u1

2024-02-12 Thread Adam D. Barratt
On Mon, 2024-02-12 at 17:59 +, Jonathan Wiltshire wrote:
> The point release dates go to
> debian-stable-annou...@lists.debian.org which
> is very low traffic.

Actually, that's one place they *don't* go in advance. The first mail
to -stable-announce is at the point that processing of uploads is
already frozen.

(They do go to -project@ldo, amongst others, which is also generally
not too busy.)

Sending to d-d-a would require a second mail in each case, as the main
announcement is to debian-release@ BCCed to several other lists and
team aliases. From memory of previous discussions, dda was avoided both
for that reason and because it doesn't really capture the right
audience (not everyone who cares about point releases is a DD, and
"many" DDs don't particularly care about stable updates).

If it would help, we could easily add an additional address to the
notification list.

Regards,

Adam



Bug#1062044: qemu 7.2+dfsg-7+deb12u5 flagged for acceptance

2024-02-06 Thread Adam D Barratt
package release.debian.org
tags 1062044 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==

Package: qemu
Version: 7.2+dfsg-7+deb12u5

Explanation: revert patch causing regressions in suspend / resume functionality



Bug#1062044: qemu 7.2+dfsg-7+deb12u4 flagged for acceptance

2024-02-06 Thread Adam D. Barratt
On Tue, 2024-02-06 at 20:49 +0300, Michael Tokarev wrote:
> 06.02.2024 20:33, Adam D. Barratt:
> > On Tue, 2024-02-06 at 19:37 +0300, Michael Tokarev wrote:
> > > problematic upstream commit (on master) is this one:
> > > https://gitlab.com/qemu-project/qemu/-/commit/effd60c878176bcaf97fa7ce2b12d04bb8ead6f7
> 
> > Technically we already froze p-u for 12.5 on Sunday evening, as
> > previously announced. If you could get an upload just fixing that
> > single issue with a small change uploaded today then I'd be tempted
> > to
> > accept it anyway.
> 
> Oh. I knew we're getting late, but not *that* late.
> 

The point release(s) are on Saturday, and we always freeze a week
beforehand.

> The change isn't small per se, as the commit is rather large (mostly
> due to many changed tests, - it changes order of output in quite some
> places).  Here's the diffstat:
> 
>   monitor/qmp.c |   17 +
>   qapi/qmp-dispatch.c   |   24 +-
> --

This is the relevant bit for size IMO. If you're happy with the result
then please upload as soon as you're ready.

Regards,

Adam



  1   2   3   4   5   6   7   8   9   10   >