Bug#985339: nauty: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andrius Merkys
On 2021-03-17 00:51, Andreas Beckmann wrote:
> On 16/03/2021 16.05, Andrius Merkys wrote:
>> symlink_to_dir /usr/share/doc/nauty libnauty2 2.7r1+ds-1~
> 
> That looks correct.

Thanks for confirming.

>>  From this I gather that upgrades of nauty <= 2.7r1+ds-1 to this new
>> version should trigger the replacement of a symlink with real directory
>> before placing the files inside. Or am I wrong?
> 
> In buster we have
>   /usr/share/doc/nauty -> libnauty2
> but in jessie we had
>   /usr/share/doc/nauty -> /usr/share/doc/libnauty2
> 
> and that is not caught by the maintscript entry.

OK, I see, so the problem is due to jessie -> buster upgrade.

> The following should catch both cases:
> 
> symlink_to_dir /usr/share/doc/nauty /usr/share/doc/libnauty2 2.7r1+ds-2~

dpkg-maintscript-helper(1) says:

dpkg-maintscript-helper symlink_to_dir \
pathname old-target prior-version package -- "$@"

pathname is the absolute name of the old symlink (the path will be a
directory at the end of the installation) and old-target is the target
name of the former symlink at pathname. It can either be absolute or
relative to the directory containing pathname.

>From this I gather that absolute and relative paths are equivalent, but
I may read it wrong. Maybe both have to be added?:

symlink_to_dir /usr/share/doc/nauty libnauty2 2.7r1+ds-2~symlink_to_dir
/usr/share/doc/nauty /usr/share/doc/libnauty2 2.7r1+ds-2~

> I'll try to test that ...

Many thanks!

Best,
Andrius



Bug#985297: libreoffice-common: needs Conflicts against all packages shipping files in /usr/lib/libreoffice/share/registry

2021-03-16 Thread Rene Engelhard
tag 985297 + moreinfo

tag 985297 + unreproducible

thanks


Hi,

Am 15.03.21 um 15:11 schrieb Andreas Beckmann:
> during a test with piuparts I noticed your package fails to upgrade from
> 'buster'.


In what scenario?

- a clean buster debootstrap + apt install libreoffice

- a clean buster debootstrap + apt install task-desktop task-german-desktop

- a clean buster debootstrap + apt install libreoffice-writer


all upgrade fine in "quick tests"[1]. (if it matters apt dist-upgrade)


> In this complicated upgrade case I don't see a solution to get
> dpkg-maintscript-helper dir_to_symlink to work properly ...

dpkg-maintscript-helper exists for cases like this. If it fails to do
what it does, isn't it a dpkg-maintscript-helper  bug?


> Therefore I'd suggest to not use dir_to_symlink here ... but to
> fixup the link in postinst configure:
>
> if [ ! -L /usr/lib/libreoffice/share/registry ]; then
>   if [ -d /usr/lib/libreoffice/share/registry ]; then
>   # this will fail if the directory is not yet empty
>   rmdir /usr/lib/libreoffice/share/registry
>   fi
>   ln -s /etc/libreoffice/registry /usr/lib/libreoffice/share/registry
> fi

I should really work around a dpkg bug in all those maintainer scripts
now in hard freeze?


Regards,


Rene


[1] don't really have time, need to prepare for exams next week...



Processed: Re: Bug#985297: libreoffice-common: needs Conflicts against all packages shipping files in /usr/lib/libreoffice/share/registry

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> tag 985297 + moreinfo
Bug #985297 [libreoffice-common] libreoffice-common: do not use dir_to_symlink 
for /usr/lib/libreoffice/share/registry
Added tag(s) moreinfo.
> tag 985297 + unreproducible
Bug #985297 [libreoffice-common] libreoffice-common: do not use dir_to_symlink 
for /usr/lib/libreoffice/share/registry
Added tag(s) unreproducible.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
985297: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985297
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985220: marked as done (velocity: CVE-2020-13936)

2021-03-16 Thread Debian Bug Tracking System
Your message dated Wed, 17 Mar 2021 05:19:00 +
with message-id 
and subject line Bug#985220: fixed in velocity 1.7-6
has caused the Debian Bug report #985220,
regarding velocity: CVE-2020-13936
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
985220: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985220
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: velocity
Version: 1.7-5.1
Severity: important
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team 
Control: found -1 1.7-5

Hi,

The following vulnerability was published for velocity.

CVE-2020-13936[0]:
| An attacker that is able to modify Velocity templates may execute
| arbitrary Java code or run arbitrary system commands with the same
| privileges as the account running the Servlet container. This applies
| to applications that allow untrusted users to upload/modify velocity
| templates running Apache Velocity Engine versions up to 2.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-13936
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-13936
[1] https://www.openwall.com/lists/oss-security/2021/03/10/1

Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: velocity
Source-Version: 1.7-6
Done: tony mancill 

We believe that the bug you reported is fixed in the latest version of
velocity, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 985...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
tony mancill  (supplier of updated velocity package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Tue, 16 Mar 2021 21:07:58 -0700
Source: velocity
Architecture: source
Version: 1.7-6
Distribution: unstable
Urgency: high
Maintainer: Debian Java Maintainers 

Changed-By: tony mancill 
Closes: 985220
Changes:
 velocity (1.7-6) unstable; urgency=high
 .
   * Team upload.
   * Update Vcs URLs to point to Salsa
   * Patch for CVE-2020-13936 (Closes: #985220)
   * Ship Apache NOTICE file with package
Checksums-Sha1:
 ae20f4cde17a7aaeb84e8eb99bcf8c6ec3ab4f25 2439 velocity_1.7-6.dsc
 5da8184fe68a8279aea511beedef8a6f4e752956 9580 velocity_1.7-6.debian.tar.xz
 7665dcc76c845e7b351f0a16c9af43ff91897cf4 13384 velocity_1.7-6_amd64.buildinfo
Checksums-Sha256:
 aaac45302118aa6804da420dd072afc481bbdfb8ef5f66001a60125d1d5c9106 2439 
velocity_1.7-6.dsc
 7fd49066a8cacad395204808315ee8bf658f470fa38e640436672f5a44901f40 9580 
velocity_1.7-6.debian.tar.xz
 58b79c775303bc3fb8c4c0821630289e288b2670342367bfd331988e061ceec8 13384 
velocity_1.7-6_amd64.buildinfo
Files:
 5dd6d11a65ad6b62a562ad716833e4ca 2439 java optional velocity_1.7-6.dsc
 6b0ac1a31af547d5bf40ad1b6d3bb6cf 9580 java optional 
velocity_1.7-6.debian.tar.xz
 105ac48884389acc90ecad832a0cf683 13384 java optional 
velocity_1.7-6_amd64.buildinfo

-BEGIN PGP SIGNATURE-

iQJIBAEBCgAyFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmBRizYUHHRtYW5jaWxs
QGRlYmlhbi5vcmcACgkQIdIFiZdLPpYhCBAAopjhDQOWuaRtzot77W6FHtStz/Kb
7caA1w6ax0vfP0opTc8PIOi2PodMy8m9rn76h97Xa7pEK4YsqV/aDpwi5lEVCiwf
9N2+LOKBTr7DdgXcvMZtA+hyCCV0IwB/FpsWjWkxMAN+eV6BCosEkNKLCORf5cOQ
LByyLCmrb0ERX75Ux44U7twsh4ltdf5vSsOoV6G3H8nNSbmHnqOqPEq/kYa+bVXu
n+i9cicJzQrtXg4XCZPn5RJF/odPm0UFs8hvon0JdHAk1U1Bc7N2jlp/Ov50xHFm
PcrbKiYCJBjXup6+EO5mhcJGzEtpjmo112KkItvKWvxUKKV5/9Z51/6RzMcZoD0T
gtmaf1jS84bMWVpkORfeCY6J9lHKBI7n8vT3UlIRcj0mAfmOEh3fqZVObkftPQmx
qYdkLGWaCir6yV6smn5Qm5fcG6zM4ewCP+VHyy91KXJFjeb1Cbd02AeRKgnYG8c4
z/lnZBvrJCZvH1kMJl9s1guRRquPgyYewOnG4dfF5IW5wN+gQ55xh58CHn0jJzXD
GeGxnuw/KTC3P0Zu1xTbskbQOpHF8vQcooDv3kdZU4mrBfis1/hKe8HkGsRJA86K
9ns0FMuWhPetlkcRy+A/GA9IzvvGLjWQVlsCZQ0i91g+KL2czZoNu182NRuFBz8H
jZpylRgR2wJrIG0=
=/wCG
-END PGP SIGNATURE End Message ---


Processed: Bug#985220 marked as pending in velocity

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> tag -1 pending
Bug #985220 [src:velocity] velocity: CVE-2020-13936
Added tag(s) pending.

-- 
985220: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985220
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985220: marked as pending in velocity

2021-03-16 Thread Tony Mancill
Control: tag -1 pending

Hello,

Bug #985220 in velocity reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/velocity/-/commit/8ca516ee3f87fc810e1ffd42c635bd2dfc034e73


Patch for CVE-2020-13936 (Closes: #985220)


(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/985220



Bug#985265: marked as done (psgml: modifies shipped files: /usr/share/emacs/site-lisp/psgml/psgml-init.el)

2021-03-16 Thread Debian Bug Tracking System
Your message dated Wed, 17 Mar 2021 01:55:19 +
with message-id 
and subject line Bug#985265: fixed in psgml 1.4.0-11
has caused the Debian Bug report #985265,
regarding psgml: modifies shipped files: 
/usr/share/emacs/site-lisp/psgml/psgml-init.el
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
985265: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985265
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: psgml
Version: 1.4.0-10
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts

Hi,

during a test with piuparts I noticed your package modifies files it has 
shipped.

>From the attached log (scroll to the bottom...):

1m16.0s ERROR: FAIL: debsums reports modifications inside the chroot:
  /usr/share/emacs/site-lisp/psgml/psgml-init.el

The modified version of the file is actually an empty file.

This seems to be limited to tests with --install-recommends enabled or upgrades
from buster.

/usr/lib/emacsen-common/packages/install/psgml contains the following code
which is the likely culprit.

sed -e "s|=F|/usr/share/$FLAVOUR/site-lisp/$PACKAGE|" \
$STARTFILE > $ELDIR/$STARTFILE

I do not know anything about emacs packaging, no idea what would be correct.


cheers,

Andreas


psgml_1.4.0-10.log.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---
Source: psgml
Source-Version: 1.4.0-11
Done: Neil Roeth 

We believe that the bug you reported is fixed in the latest version of
psgml, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 985...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Neil Roeth  (supplier of updated psgml package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Tue, 16 Mar 2021 21:16:01 -0400
Source: psgml
Architecture: source
Version: 1.4.0-11
Distribution: unstable
Urgency: medium
Maintainer: Neil Roeth 
Changed-By: Neil Roeth 
Closes: 985265
Changes:
 psgml (1.4.0-11) unstable; urgency=medium
 .
   * Fixed bug where psgml-init.el was overwriting itself (Closes: 985265)
   * Added current flavor of emacs to postrm so it removes/purges properly.
Checksums-Sha1:
 0c2eefb70551fdf63e52de34252016de2c87447a 1670 psgml_1.4.0-11.dsc
 38cc0c5fbc50acad9f86a77b3c8316c82e420fdd 105815 psgml_1.4.0-11.diff.gz
 e4234fcf133ed5287f273ce2d53fd85320ca80fd 5034 psgml_1.4.0-11_amd64.buildinfo
Checksums-Sha256:
 c92fb362ac1073bce41d3fd507a394096280624c6b355b8b13542c0295a87e72 1670 
psgml_1.4.0-11.dsc
 488879c81b896eb56faff492179244f5d1ed07f9aca997bd25d1fd7bb0855159 105815 
psgml_1.4.0-11.diff.gz
 b22ee02a09110a6c60eea365c1a29eaacbb9494e927c3fdd0c25111fa1adf6a8 5034 
psgml_1.4.0-11_amd64.buildinfo
Files:
 4299bb3cbf6096a3600bfd83b1b6dcc7 1670 text optional psgml_1.4.0-11.dsc
 02968c4914690b9745f3412baff803a4 105815 text optional psgml_1.4.0-11.diff.gz
 44ffac23f74392120f92132f813d63d7 5034 text optional 
psgml_1.4.0-11_amd64.buildinfo

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEYdR7of/nqgLv7YjKNlwUCaSzpkAFAmBRW7sACgkQNlwUCaSz
pkBdvQ/9GF2WhJnMJocFCAUrkhaYEAp6TdIwjArLN3fLLjkx8c3BXXA0P83BwSqO
DX21+tU+Zii6Cl1NIjgtZ0m/gVD2gojM64q7esMDwLessUerZXX5SUDp6wv85j5c
aYxJ0e9M5HjQZsSKRQZVUGNlx+2KVvqawpOVgbQZ1er7oMPV4HpWiIY0ND55VmEP
ZicWfk8yeF3WvrCbdyRaLoH/l3hEIjsyLUIhC+rhlY9yAsb8ZBVugw4FHowIJ8VL
mi3jk7cKVK53+YoaJfSIZid3FCKMicHqzejwFQ5W9SQ2ehAy/kht7A09CqdTmrpr
FARIy9sXd4Y3tC6WB2M4SEZOcIj3NGV3VOM9K5ewExhTxeGdMGx3wjVwNW+KeVZa
wTeTstXVTGkQCMflCCGCWFbGXE/lXhcs+wVThO+2lkb753nVchsamDAyIdDd7Sk2
BgQTAXvdHBk3nAEPMk+7tlxWqUtb0HVmet3IfUqUh8jb5zpYM6TYYKVC4Som/81U
cQM6Fly243N6p3K4chwqXH2AgtpYPNvbnUARWs6Mo8oMbCnScEQ0i3vCjpWzHkdi
utncctUtQtDuOYdI7PiquYbohuDuJxIigDbuJODmQq03WI6AvrDUTUrP6ROwWV3k
UJeda45APlrNzTB+fKcKIX/JqHjF0q3sawwlz+EfC8lM2OL51CM=
=SXOo
-END PGP SIGNATURE End Message ---


Bug#985339: nauty: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andreas Beckmann

On 16/03/2021 16.05, Andrius Merkys wrote:

symlink_to_dir /usr/share/doc/nauty libnauty2 2.7r1+ds-1~


That looks correct.


 From this I gather that upgrades of nauty <= 2.7r1+ds-1 to this new
version should trigger the replacement of a symlink with real directory
before placing the files inside. Or am I wrong?


In buster we have
  /usr/share/doc/nauty -> libnauty2
but in jessie we had
  /usr/share/doc/nauty -> /usr/share/doc/libnauty2

and that is not caught by the maintscript entry.

The following should catch both cases:

symlink_to_dir /usr/share/doc/nauty /usr/share/doc/libnauty2 2.7r1+ds-2~

I'll try to test that ...


Andreas



Bug#985124: marked as done (fossil: fails to update schema for older repositories)

2021-03-16 Thread Debian Bug Tracking System
Your message dated Tue, 16 Mar 2021 21:49:15 +
with message-id 
and subject line Bug#985124: fixed in fossil 1:2.15~rc1-1
has caused the Debian Bug report #985124,
regarding fossil: fails to update schema for older repositories
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
985124: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985124
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: fossil
Version: 1:2.14-1
Severity: grave
Tags: upstream fixed-upstream

Dear Maintainer,

After updating the fossil package to 1:2.14-1, I've found that it fails
to open repositories created a while ago. It emits the following error
message:

SQLITE_ERROR(1): table sqlite_master may not be modified in "UPDATE
repository.sqlite_schema SET sql='CREATE TABLE blob(
  rid INTEGER PRIMARY KEY,
  rcvid INTEGER,
  size INTEGER,
  uuid TEXT UNIQUE NOT NULL,
  content BLOB,

Database error: table sqlite_master may not be modified: {UPDATE
repository.sqlite_schema SET sql='CREATE TABLE blob(
  rid INTEGER PRIMARY KEY,
  rcvid INTEGER,
  size INTEGER,
  uuid TEXT UNIQUE NOT NULL,
  content BLOB,
  CHECK( length(uuid)>=40 AND rid>0 )
)' WHERE name LIKE 'blob';PRAGMA writable_schema=OFF;}

The message indicates that the repository Sqlite DB is in defencive
mode, and its schema can't be modified using UPDATE.

As far as I can see, this bug is fixed upstream in the following commit:
https://www2.fossil-scm.org/fossil/info/d4041437b6f40d0cc62f22d2973498d596af325b1d18fed2dd7584aef733df7a
which is a part of the 2.15 release.

Please, apply the fix to the fossil package in Debian, as it is now,
fossil is not very usable. I'm sure, the bug is serious enough to grant
a freeze exception.

To reproduce the bug, just create an empty repository using fossil
binary from stretch (1:1.37-1), and try to connect to it using fossil
1:2.14-1:

fossil-1.37 new test.fossil
fossil-2.14 info -R test.fossil

Cheers!

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing'), (500, 'stable'), (1, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-4-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages fossil depends on:
ii  libc6   2.31-9
ii  libfuse22.9.9-5
ii  libsqlite3-03.34.1-3
ii  libssl1.1   1.1.1j-1
ii  libtcl8.6 [libtcl]  8.6.11+dfsg-1
ii  zlib1g  1:1.2.11.dfsg-2

fossil recommends no packages.

Versions of packages fossil suggests:
ii  gnupg  2.2.27-1

-- no debconf information

-- 
Sergei Golovan
--- End Message ---
--- Begin Message ---
Source: fossil
Source-Version: 1:2.15~rc1-1
Done: Barak A. Pearlmutter 

We believe that the bug you reported is fixed in the latest version of
fossil, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 985...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Barak A. Pearlmutter  (supplier of updated fossil package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Tue, 16 Mar 2021 21:13:47 +
Source: fossil
Architecture: source
Version: 1:2.15~rc1-1
Distribution: unstable
Urgency: medium
Maintainer: Barak A. Pearlmutter 
Changed-By: Barak A. Pearlmutter 
Closes: 961772 985124
Changes:
 fossil (1:2.15~rc1-1) unstable; urgency=medium
 .
   * New upstream version
 - fixes problem updating schemas on older repositories (closes: #985124)
 - does not run host tool on cross build (closes: #961772)
   * Use new ./configure --print-minimum-sqlite-version option
Checksums-Sha1:
 df77d7342ed2f5d28ec466e685e213a7e743da46 1887 fossil_2.15~rc1-1.dsc
 0133c82f3d378cec9ca231bb99dcaaa486a52513 4336684 fossil_2.15~rc1.orig.tar.xz
 9f214e25ee861dd320405e2e3b49f5455606afa9 45460 fossil_2.15~rc1-1.debian.tar.xz
 857299f03d83f0282d454c41e58e724e9e630ca8 6982 
fossil_2.15~rc1-1_source.buildinfo
Checksums-Sha256:
 f59f31e1b044925fc4f2f6902d50a38b38ebe869e0b07fba2eed92b09695ce53 1887 
fos

Bug#985377: CVE-2020-13327

2021-03-16 Thread Moritz Muehlenhoff
Source: gitlab-ci-multi-runner
Severity: grave
Tags: security
X-Debbugs-Cc: Debian Security Team 

Please see
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13327.json
https://gitlab.com/gitlab-org/gitlab-runner/-/issues/26833

There's also CVE-2020-13295, not sure if that also affects the version
in sid/bullseye:
https://gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13295.json
https://gitlab.com/gitlab-org/gitlab/-/issues/209096

Cheers,
Moritz





Bug#985309: CVE-2021-21235

2021-03-16 Thread kpcyrd
hi,

the package is likely too old to have this bug, but since this package
is currently not used by anything and not meant to be used by any users,
I'd recommend to remove it from testing (we're eventually going to close
it by uploading the latest version to unstable).

cheers



Bug#985376: CVE-2020-35459

2021-03-16 Thread Moritz Muehlenhoff
Package: crmsh
Severity: grave
Tags: security
X-Debbugs-Cc: Debian Security Team 

This was assigned CVE-2020-35459:
https://www.openwall.com/lists/oss-security/2021/01/12/3



Bug#985284: [Debian-med-packaging] Bug#985284: hyphy-common: unhandled symlink to directory conversion: /usr/lib/hyphy -> ../share/hyphy

2021-03-16 Thread Andreas Beckmann

On 16/03/2021 20.01, Étienne Mollier wrote:

Do you have more details on the arb issue ?  I tried reproducing
problems with piuparts tests, but I haven't seen anything
outstanding on first sight.


It's just a piuparts test of arb failing due to hyphy. It will be 
resolved when hyphy gets fixed. I just want to get an "affected" bug 
mark next to the failing log so that I don't look into it...


Andreas



Processed: Re: [Debian-med-packaging] Bug#985284: hyphy-common: unhandled symlink to directory conversion: /usr/lib/hyphy -> ../share/hyphy

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> affects -1 + hyphy-pt
Bug #985284 [hyphy-common] hyphy-common: unhandled symlink to directory 
conversion: /usr/lib/hyphy -> ../share/hyphy
Added indication that 985284 affects hyphy-pt
> tag -1 pending
Bug #985284 [hyphy-common] hyphy-common: unhandled symlink to directory 
conversion: /usr/lib/hyphy -> ../share/hyphy
Added tag(s) pending.

-- 
985284: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985284
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985284: [Debian-med-packaging] Bug#985284: hyphy-common: unhandled symlink to directory conversion: /usr/lib/hyphy -> ../share/hyphy

2021-03-16 Thread Étienne Mollier
Control: affects -1 + hyphy-pt
Control: tag -1 pending

Hi Andreas,

Andreas Beckmann, on 2021-03-16 11:30:11 +0100:
> This bug also affects hyphy-mpi:

Thanks for the notice, I spotted similar issues in hyphy-pt.
Remaining packages from hyphy source looked good.  I will upload
hyphy soon.

Do you have more details on the arb issue ?  I tried reproducing
problems with piuparts tests, but I haven't seen anything
outstanding on first sight.

Kind Regards,
-- 
Étienne Mollier 
Fingerprint:  8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
Sent from /dev/pts/2, please excuse my verbosity.


signature.asc
Description: PGP signature


Bug#982833: marked as done (man2html,man2html-base,manpages-it: manpage conflicts: man2html.1, hman.1)

2021-03-16 Thread Debian Bug Tracking System
Your message dated Tue, 16 Mar 2021 17:48:40 +
with message-id 
and subject line Bug#982833: fixed in manpages-l10n 4.9.3-4
has caused the Debian Bug report #982833,
regarding man2html,man2html-base,manpages-it: manpage conflicts: man2html.1, 
hman.1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
982833: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982833
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: man2html,man2html-base,manpages-it
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts
Control: found -1 1.6g-14
Control: found -1 4.9.1-2

Hi,

during a test with piuparts I noticed your package failed to install
because it tries to overwrite other packages files.

>From the attached log (scroll to the bottom...):

  Preparing to unpack .../manpages-it_4.9.1-2_all.deb ...
  Unpacking manpages-it (4.9.1-2) ...
  dpkg: error processing archive 
/var/cache/apt/archives/manpages-it_4.9.1-2_all.deb (--unpack):
   trying to overwrite '/usr/share/man/it/man1/hman.1.gz', which is also in 
package man2html 1.6g-14
  dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
  Errors were encountered while processing:
   /var/cache/apt/archives/manpages-it_4.9.1-2_all.deb

  Preparing to unpack .../manpages-it_4.9.1-2_all.deb ...
  Unpacking manpages-it (4.9.1-2) ...
  dpkg: error processing archive 
/var/cache/apt/archives/manpages-it_4.9.1-2_all.deb (--unpack):
   trying to overwrite '/usr/share/man/it/man1/man2html.1.gz', which is also in 
package man2html-base 1.6g-14
  dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
  Errors were encountered while processing:
   /var/cache/apt/archives/manpages-it_4.9.1-2_all.deb


cheers,

Andreas


man2html=1.6g-14_manpages-it=4.9.1-2.log.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---
Source: manpages-l10n
Source-Version: 4.9.3-4
Done: Helge Kreutzmann 

We believe that the bug you reported is fixed in the latest version of
manpages-l10n, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 982...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Helge Kreutzmann  (supplier of updated manpages-l10n 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Tue, 16 Mar 2021 17:27:58 +0100
Source: manpages-l10n
Architecture: source
Version: 4.9.3-4
Distribution: unstable
Urgency: medium
Maintainer: Dr. Tobias Quathamer 
Changed-By: Helge Kreutzmann 
Closes: 982833
Changes:
 manpages-l10n (4.9.3-4) unstable; urgency=medium
 .
   * Upstream did not remove all conflicting man pages in 4.9.3, remove them
 again manually for now. Closes: #982833
Checksums-Sha1:
 2b7020f6dfe12150041159bb02fc30a4f4811106 2773 manpages-l10n_4.9.3-4.dsc
 91aa06f1a9c56274eda22d883d47051729fab407 49736 
manpages-l10n_4.9.3-4.debian.tar.xz
 887f13891e85beb5277a410482def9e26c3117cb 9104 
manpages-l10n_4.9.3-4_amd64.buildinfo
Checksums-Sha256:
 df4bafa42be98fb4361fd959050f35834a2ec85740e326422ffd4fa135c09a2f 2773 
manpages-l10n_4.9.3-4.dsc
 13070473c9aaddfb7ddbd2c7970f158808956a9db16415063a98de9502981b28 49736 
manpages-l10n_4.9.3-4.debian.tar.xz
 7600aa9724bf52d7bc14c65fd9615a82b605a82fd3005121cc5429e8cd2845a0 9104 
manpages-l10n_4.9.3-4_amd64.buildinfo
Files:
 bf761abed86dce36134dd1e5d7811838 2773 doc optional manpages-l10n_4.9.3-4.dsc
 7d48897fd6cf52e072ba02ad5b1dbb86 49736 doc optional 
manpages-l10n_4.9.3-4.debian.tar.xz
 7096c4737c7f57489a1cc344691fcd53 9104 doc optional 
manpages-l10n_4.9.3-4_amd64.buildinfo

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEbZZfteMW0gNUynuwQbqlJmgq5nAFAmBQ6nAACgkQQbqlJmgq
5nD9ABAAldLlzEg3q3gKK1ovAgwwqRlGoLookZy/sLGj2pPm6CIkYprxVxbqZM6W
9+q9Ubyc9Vnup5DMsGVp0Y6gUyL1smkFpLv31PSfkr8fK0byES8f/edQmdLg0SMi
KTiabTVr+lsIfyE8oEI3wNFxSiq9Ay5G4BaLQrldufOeMJAY1vf1sdvC6PDWHi38
TGSelzZ+XVCGzpmNkp2WCVYD6ObSsdjluNvAiCBcxj6aixxLF2eMfsyhMpFDU5TS
GAXaKEsWFVxSsjazkTAMKIARWM4JZoiV0V70y6BbSXWDir/v2dbtVIqt36UmX+gp
w4DJYhvKkHPohy/D40aH7tf5c369bRrcHFpbcJo8QGf4nj7sw6sb09+Yog2dzmuQ
svvFBiZHLDL+K3uOZ0QSSg34NiSKUIiGsnYTr4WJ7sCQRM8WAK/wRsPe2S+t7IEK
b6VNal8bt3Ulj5mexVMJMbPLrd7ZjYMAk4e3xDYvJ5GrUIHMMn/Q1dqRKp

Bug#985356: marked as done (spamass-milter: all messages have score 0 UNPARSEABLE_RELAY)

2021-03-16 Thread Debian Bug Tracking System
Your message dated Tue, 16 Mar 2021 20:08:45 +0300
with message-id 
and subject line Re: Bug#985356: Acknowledgement (spamass-milter: all messages 
have score 0 UNPARSEABLE_RELAY)
has caused the Debian Bug report #985356,
regarding spamass-milter: all messages have score 0 UNPARSEABLE_RELAY
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
985356: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985356
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: spamass-milter
Version: 0.4.0-1+b1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

freshly installed postfix + spamassasin on buster, all messages come with score 
0, test message below

---
X-Test-Header4: t...@lelik.org
X-Test-Header3: This is a test header31.
Return-Path: 
X-Original-To: t...@lelik.org
Delivered-To: chan...@lelik.org
Received: from mhost22.ispserver.com (mhost22.ispserver.com [82.202.175.117])
by mail.lelik.us (Postfix) with ESMTPS id 4F0FD70d3Pz3xgk
for ; Tue, 16 Mar 2021 16:55:19 +0300 (MSK)
Received: from ip-79-111-14-215.bb.netbynet.ru ([79.111.14.215] 
helo=[192.168.4.6])
by mhost22.ispserver.com with esmtpsa  (TLS1.2) tls 
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.94)
(envelope-from )
id 1lMAAC-0006zf-Ei
for t...@lelik.org; Tue, 16 Mar 2021 16:55:12 +0300
To: t...@lelik.org
From: =?UTF-8?B?0JDQvdC00YDQtdC5INCb0LXQu9C40LrQvtCy?= 
Subject: s
Message-ID: <33552efc-71d0-8de3-1ec5-953fcbe66...@ulybkasnt.ru>
Date: Tue, 16 Mar 2021 16:55:12 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: ad...@ulybkasnt.ru
X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY
autolearn=unavailable autolearn_force=no version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.lelik.us

s
---


-- System Information:
Debian Release: 10.8
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'buster'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-14-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages spamass-milter depends on:
ii  adduser 3.118
ii  libc6   2.28-10
ii  libgcc1 1:8.3.0-6
ii  libmilter1.0.1  8.15.2-14~deb10u1
ii  libstdc++6  8.3.0-6
ii  spamc   3.4.2-1+deb10u2

Versions of packages spamass-milter recommends:
ii  postfix   3.4.14-0+deb10u1
ii  spamassassin  3.4.2-1+deb10u2

spamass-milter suggests no packages.

-- Configuration Files:
/etc/default/spamass-milter changed:
OPTIONS="-u spamass-milter -i 127.0.0.1"
OPTIONS="${OPTIONS} -- -s 10485760"


-- no debconf information
--- End Message ---
--- Begin Message ---

This appears to be a warning, my (submitter) mistake. Please close.

On 16.03.2021 17:21, Debian Bug Tracking System wrote:

Thank you for filing a new Bug report with Debian.

You can follow progress on this Bug here: 985356: 
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985356.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
  Don Armstrong 

If you wish to submit further information on this problem, please
send it to 985...@bugs.debian.org.

Please do not send mail to ow...@bugs.debian.org unless you wish
to report a problem with the Bug-tracking system.
--- End Message ---


Processed: tagging 985253

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> tags 985253 - upstream
Bug #985253 [s3ql] mount.s3ql: ERROR: Uncaught top-level exception, 
AttributeError: lowlevel
Bug #982381 [s3ql] AttributeError: lowlevel due to trio usage in 
s3ql/block_cache.py
Removed tag(s) upstream.
Removed tag(s) upstream.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
982381: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982381
985253: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985253
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#982381: AttributeError: lowlevel due to trio usage in s3ql/block_cache.py

2021-03-16 Thread Andrey Rahmatullin
On Thu, Feb 18, 2021 at 03:28:36PM +0100, Francesco P. Lovergine wrote:
> I'm pretty sure this release should depend on >= 0.15,
> even due to #981906. Unfortunately, it is not expressed in the package
From setup.py:

 # Need trio.lowlevel
 'trio >= 0.15',

So it's expressed upstream but ignored in the Debian package, because
dh_python3 ignores version reqs by default.


-- 
WBR, wRAR


signature.asc
Description: PGP signature


Processed: forcibly merging 985253 982381

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> forcemerge 985253 982381
Bug #985253 [s3ql] mount.s3ql: ERROR: Uncaught top-level exception, 
AttributeError: lowlevel
Bug #982381 [s3ql] AttributeError: lowlevel due to trio usage in 
s3ql/block_cache.py
Severity set to 'grave' from 'important'
Added tag(s) upstream.
Merged 982381 985253
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
982381: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982381
985253: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985253
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985358: pitivi: A/V out of sync in rendered videos

2021-03-16 Thread Antonio Terceiro
On Tue, Mar 16, 2021 at 04:45:39PM +0200, Sebastian Dröge wrote:
> On Tue, 2021-03-16 at 11:16 -0300, Antonio Terceiro wrote:
> 
> Dear Maintainer,
> 
> The version of pitivi in bullseye is affected by the bug listed above:
> rendered videos have A/V out of sync by a few seconds, while they sound
> just find in the preview.
> 
> I'm attaching the upstream patch that fixed the issue, already
> backported to the current Debian package. I rebuilt pitivi locally with
> this patch, and confirmed that it does fix the issue.
> 
> Yeah I'm aware of this and various other issues in the version
> currently in Debian, and which are fixed in the latest releases.
> 
> Due to Debian release freeze policies the latest release is not
> uploaded yet and I don't know how useful it is to just patch some of
> the issues.
> 
> In the end what we'd really want is the latest release.

As a user, I don't even know about all the stuff that could be better;
pitivi worked ok for me as an amateur video editor. It just failed at
the end of the process, rendering the video. So from my PoV, the version
in bullseye is fine once this is fixed.

Of course the latest and greatest if always better, but that's
incompatible with a stable release. We just have to cut it at some
point.


signature.asc
Description: PGP signature


Processed: unarchiving 914957

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> unarchive 914957
Bug #914957 {Done: Bálint Réczey } [login] login: 
removal of pts/* from /etc/securetty wasn't applied in stretch
Unarchived Bug 914957
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
914957: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914957
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985317: libgegl

2021-03-16 Thread Ivan Sergio Borgonovo

Culprit seems to be

[UPGRADE] libgegl-0.4-0:amd64 1:0.4.26-2 -> 1:0.4.28-1
[UPGRADE] libgegl-common:amd64 1:0.4.26-2 -> 1:0.4.28-1

Same problem with 1:0.4.28-2

this seems to be related

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971812

BTW I'm running a mix of testing/unstable and libc6 is at 2.31-9

downgrading fixed the problem.

thanks

--
Ivan Sergio Borgonovo
https://www.webthatworks.it https://www.borgonovo.net



Bug#985339: nauty: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andrius Merkys
Hello,

On 2021-03-16 12:39, Andreas Beckmann wrote:
> 1m40.0s ERROR: FAIL: silently overwrites files via directory symlinks:
>   /usr/share/doc/nauty/changelog.Debian.gz (nauty) != 
> /usr/share/doc/libnauty2/changelog.Debian.gz (libnauty2:amd64)
> /usr/share/doc/nauty -> /usr/share/doc/libnauty2
>   /usr/share/doc/nauty/changelog.gz (nauty) != 
> /usr/share/doc/libnauty2/changelog.gz (libnauty2:amd64)
> /usr/share/doc/nauty -> /usr/share/doc/libnauty2
>   /usr/share/doc/nauty/changes24-27.txt.gz (nauty) != 
> /usr/share/doc/libnauty2/changes24-27.txt.gz (libnauty2:amd64)
> /usr/share/doc/nauty -> /usr/share/doc/libnauty2
>   /usr/share/doc/nauty/copyright (nauty) != 
> /usr/share/doc/libnauty2/copyright (libnauty2:amd64)
> /usr/share/doc/nauty -> /usr/share/doc/libnauty2

I am trying to debug the issue, however, unsuccessfully. From the
attached log I gather that the break happens upon upgrading from buster
(2.6r10+ds-1) to bullseye (2.7r1+ds-1):

1m38.6s DUMP:
  PIUPARTS_DISTRIBUTION_PREV=buster
  PIUPARTS_DISTRIBUTION=bullseye

Affected binary packages are nauty and libnauty. The former has recently
(in 2.7r1+ds-1) switched from shipping a directory symlink to a real
directory, and this is accommodated in debian/nauty.maintscript:

symlink_to_dir /usr/share/doc/nauty libnauty2 2.7r1+ds-1~

>From this I gather that upgrades of nauty <= 2.7r1+ds-1 to this new
version should trigger the replacement of a symlink with real directory
before placing the files inside. Or am I wrong?

Best,
Andrius



Bug#985116: libgrokj2k: FTBFS on i386

2021-03-16 Thread Aaron Boxer
s/Ivor/Ivo/ :)

On Tue, Mar 16, 2021 at 11:04 AM Aaron Boxer  wrote:

> Thanks, Ivor. How would you recommend I test on i386?
>
> On Fri, Mar 12, 2021 at 6:33 PM Ivo De Decker  wrote:
>
>> package: src:libgrokj2k
>> version: 7.6.6-2
>> severity: serious
>> tags: ftbfs
>>
>> Hi,
>>
>> The latest upload of libgrokj2k to unstable fails on i386:
>>
>> https://buildd.debian.org/status/package.php?p=libgrokj2k
>>
>> Cheers,
>>
>> Ivo
>>
>


Bug#985116: libgrokj2k: FTBFS on i386

2021-03-16 Thread Aaron Boxer
Thanks, Ivor. How would you recommend I test on i386?

On Fri, Mar 12, 2021 at 6:33 PM Ivo De Decker  wrote:

> package: src:libgrokj2k
> version: 7.6.6-2
> severity: serious
> tags: ftbfs
>
> Hi,
>
> The latest upload of libgrokj2k to unstable fails on i386:
>
> https://buildd.debian.org/status/package.php?p=libgrokj2k
>
> Cheers,
>
> Ivo
>


Processed: Re: libuim-data: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> tag -1 patch pending
Bug #985352 [libuim-data] libuim-data: unhandled symlink to directory 
conversion: /usr/share/doc/PACKAGE
Added tag(s) patch and pending.

-- 
985352: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985352
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985352: libuim-data: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andreas Beckmann
Followup-For: Bug #985352
Control: tag -1 patch pending

buster-pu request including patch: https://bugs.debian.org/985359

Andreas



Bug#985358: pitivi: A/V out of sync in rendered videos

2021-03-16 Thread Sebastian Dröge
On Tue, 2021-03-16 at 11:16 -0300, Antonio Terceiro wrote:

Dear Maintainer,

The version of pitivi in bullseye is affected by the bug listed above:
rendered videos have A/V out of sync by a few seconds, while they sound
just find in the preview.

I'm attaching the upstream patch that fixed the issue, already
backported to the current Debian package. I rebuilt pitivi locally with
this patch, and confirmed that it does fix the issue.

Yeah I'm aware of this and various other issues in the version
currently in Debian, and which are fixed in the latest releases.

Due to Debian release freeze policies the latest release is not
uploaded yet and I don't know how useful it is to just patch some of
the issues.

In the end what we'd really want is the latest release.


signature.asc
Description: This is a digitally signed message part


Bug#985358: pitivi: A/V out of sync in rendered videos

2021-03-16 Thread Antonio Terceiro
Package: pitivi
Version: 2020.09.2-2
Severity: grave
Tags: upstream patch
Justification: renders package unusable
Forwarded: https://gitlab.gnome.org/GNOME/pitivi/-/issues/2498

Dear Maintainer,

The version of pitivi in bullseye is affected by the bug listed above:
rendered videos have A/V out of sync by a few seconds, while they sound
just find in the preview.

I'm attaching the upstream patch that fixed the issue, already
backported to the current Debian package. I rebuilt pitivi locally with
this patch, and confirmed that it does fix the issue.

-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'testing-debug'), (500, 
'unstable'), (500, 'testing'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: arm64

Kernel: Linux 5.10.0-4-amd64 (SMP w/4 CPU threads)
Locale: LANG=pt_BR.UTF-8, LC_CTYPE=pt_BR.UTF-8 (charmap=UTF-8), 
LANGUAGE=pt_BR:pt:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages pitivi depends on:
ii  gir1.2-gdkpixbuf-2.02.42.2+dfsg-1
ii  gir1.2-ges-1.0  1.18.3-1
ii  gir1.2-glib-2.0 1.66.1-1+b1
ii  gir1.2-gst-plugins-bad-1.0  1.18.3-1+b1
ii  gir1.2-gst-plugins-base-1.0 1.18.3-1
ii  gir1.2-gstreamer-1.01.18.3-1
ii  gir1.2-gtk-3.0  3.24.24-3
ii  gir1.2-pango-1.01.46.2-3
ii  gir1.2-peas-1.0 1.28.0-2+b1
pn  gstreamer1.0-audiosink  
ii  gstreamer1.0-gl [gstreamer1.0-videosink]1.18.3-1
ii  gstreamer1.0-gtk3 [gstreamer1.0-videosink]  1.18.3-1
ii  gstreamer1.0-plugins-bad [gstreamer1.0-videosink]   1.18.3-1+b1
ii  gstreamer1.0-plugins-base   1.18.3-1
ii  gstreamer1.0-plugins-good [gstreamer1.0-videosink]  1.18.3-1
ii  gstreamer1.0-x [gstreamer1.0-videosink] 1.18.3-1
ii  libc6   2.31-9
ii  libcairo2   1.16.0-5
ii  libglib2.0-02.66.7-2
ii  libgstreamer1.0-0   1.18.3-1
ii  libpython3.93.9.2-1
ii  python3 3.9.2-2
ii  python3-cairo   1.16.2-4+b2
ii  python3-dbus1.2.16-5
ii  python3-ges-1.0 1.18.3-1
ii  python3-gi  3.38.0-2
ii  python3-gi-cairo3.38.0-2
ii  python3-gst-1.0 1.18.3-1
ii  python3-matplotlib  3.3.4-1
ii  python3-numpy   1:1.19.5-1
ii  python3-xdg 0.27-2
ii  python3.9   3.9.2-1

pitivi recommends no packages.

Versions of packages pitivi suggests:
pn  frei0r-plugins 
ii  gir1.2-gnomedesktop-3.03.38.4-1
pn  gir1.2-gsound-1.0  
ii  gir1.2-notify-0.7  0.7.9-3
ii  gstreamer1.0-libav 1.18.3-1
ii  gstreamer1.0-plugins-ugly  1.18.3-1

-- no debconf information
From: Thibault Saunier 
Date: Mon, 11 Jan 2021 17:50:26 -0300
Subject: pipeline: Avoid committing the timeline while rendering

This can cause weird behavior and in particular it can lead to
de-synchronized audio/video streams.

Fixes https://gitlab.gnome.org/GNOME/pitivi/-/issues/2498
---
 pitivi/editorperspective.py | 3 +++
 pitivi/utils/pipeline.py| 8 
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/pitivi/editorperspective.py b/pitivi/editorperspective.py
index a25450c..49cbf61 100644
--- a/pitivi/editorperspective.py
+++ b/pitivi/editorperspective.py
@@ -128,6 +128,9 @@ class EditorPerspective(Perspective, Loggable):
 # Nothing to work with, Pitivi is starting up.
 return
 
+if self.app.project_manager.current_project.pipeline.rendering():
+return
+
 # Commit the timeline so its nested timelines assets are refreshed.
 ges_timeline.commit()
 
diff --git a/pitivi/utils/pipeline.py b/pitivi/utils/pipeline.py
index 95be106..c92c880 100644
--- a/pitivi/utils/pipeline.py
+++ b/pitivi/utils/pipeline.py
@@ -424,7 +424,7 @@ class SimplePipeline(GObject.Object, Loggable):
 Gst.debug_bin_to_dot_file_with_ts(self._pipeline,
   Gst.DebugGraphDetails.ALL,
   "pitivi.error")
-if not self._rendering():
+if not self.rendering():
 s

Bug#984439: Maybe related issue ...

2021-03-16 Thread Christian Ehrhardt
Hi,
I wasn't able to perfectly derive from the log that is linked here if
this is the same issue.
But it is the same package hitting the same "SigBus due to alignment"
issue at a similar time.
So I thought dropping a link as FYI might be worth even if eventually
they turn out to be different issues.

I've documented for Ubuntu in
https://bugs.launchpad.net/debian/+source/netgen/+bug/1919335
And filed the issue upstream at:
https://github.com/NGSolve/netgen/issues/89

-- 
Christian Ehrhardt
Staff Engineer, Ubuntu Server
Canonical Ltd



Bug#985356: spamass-milter: all messages have score 0 UNPARSEABLE_RELAY

2021-03-16 Thread Andrey L
Package: spamass-milter
Version: 0.4.0-1+b1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

freshly installed postfix + spamassasin on buster, all messages come with score 
0, test message below

---
X-Test-Header4: t...@lelik.org
X-Test-Header3: This is a test header31.
Return-Path: 
X-Original-To: t...@lelik.org
Delivered-To: chan...@lelik.org
Received: from mhost22.ispserver.com (mhost22.ispserver.com [82.202.175.117])
by mail.lelik.us (Postfix) with ESMTPS id 4F0FD70d3Pz3xgk
for ; Tue, 16 Mar 2021 16:55:19 +0300 (MSK)
Received: from ip-79-111-14-215.bb.netbynet.ru ([79.111.14.215] 
helo=[192.168.4.6])
by mhost22.ispserver.com with esmtpsa  (TLS1.2) tls 
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
(Exim 4.94)
(envelope-from )
id 1lMAAC-0006zf-Ei
for t...@lelik.org; Tue, 16 Mar 2021 16:55:12 +0300
To: t...@lelik.org
From: =?UTF-8?B?0JDQvdC00YDQtdC5INCb0LXQu9C40LrQvtCy?= 
Subject: s
Message-ID: <33552efc-71d0-8de3-1ec5-953fcbe66...@ulybkasnt.ru>
Date: Tue, 16 Mar 2021 16:55:12 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.7.1
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
Sender: ad...@ulybkasnt.ru
X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY
autolearn=unavailable autolearn_force=no version=3.4.2
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on mail.lelik.us

s
---


-- System Information:
Debian Release: 10.8
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'buster'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-14-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages spamass-milter depends on:
ii  adduser 3.118
ii  libc6   2.28-10
ii  libgcc1 1:8.3.0-6
ii  libmilter1.0.1  8.15.2-14~deb10u1
ii  libstdc++6  8.3.0-6
ii  spamc   3.4.2-1+deb10u2

Versions of packages spamass-milter recommends:
ii  postfix   3.4.14-0+deb10u1
ii  spamassassin  3.4.2-1+deb10u2

spamass-milter suggests no packages.

-- Configuration Files:
/etc/default/spamass-milter changed:
OPTIONS="-u spamass-milter -i 127.0.0.1"
OPTIONS="${OPTIONS} -- -s 10485760"


-- no debconf information



Bug#983859: bluefish: missing Breaks+Replaces on bluefish-data

2021-03-16 Thread Boyuan Yang
Hi Jonathan,

Since the testing autoremoval is kicking in, do you have a chance to
take a look at this bug? Or is it okay for others to NMU and fix it?

Thanks,
Boyuan Yang

On Tue, 2 Mar 2021 11:00:51 +0100 Sebastian Ramacher
 wrote:
> Package: bluefish
> Version: 2.2.12-1
> Severity: serious
> X-Debbugs-Cc: sramac...@debian.org
> 
> Between the version of bluefish in buster and bullsye,
> /usr/share/bluefish/jsbeautifier moved from bluefish-data to
bluefish.
> However, bluefish does not have the corresponding Breaks and Replaces
> reletionships defined to handle this properly and thus upgrades from
> buster to bullseye fail:
> | Preparing to unpack .../032-bluefish_2.2.12-1+b1_amd64.deb ...
> | Unpacking bluefish (2.2.12-1+b1) over (2.2.10-1) ...
> | dpkg: error processing archive /tmp/apt-dpkg-install-m8WUj5/032-
bluefish_2.2.12-1+b1_amd64.deb (--unpack):
> |  trying to overwrite
'/usr/share/bluefish/jsbeautifier/__init__.py', which is also in
package bluefish-data 2.2.10-1
> | Preparing to unpack .../033-bluefish-data_2.2.12-1_all.deb ...
> | Unpacking bluefish-data (2.2.12-1) over (2.2.10-1) ...
> 
> Found via the buster to bullseye upgrade tests running on
> jenkins.debian.net:
>
https://jenkins.debian.net/job/chroot-installation_buster_install_education-development_upgrade_to_bullseye/


signature.asc
Description: This is a digitally signed message part


Bug#985352: libuim-data: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andreas Beckmann
Package: libuim-data
Version: 1:1.8.8-4+deb10u3
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts

Hi,

an upgrade test with piuparts revealed that your package installs files
over existing symlinks and possibly overwrites files owned by other
packages. This usually means an old version of the package shipped a
symlink but that was later replaced by a real (and non-empty)
directory. This kind of overwriting another package's files cannot be
detected by dpkg.

This was observed on the following upgrade paths:

  stretch -> buster

For /usr/share/doc/PACKAGE this may not be problematic as long as both
packages are installed, ship byte-for-byte identical files and are
upgraded in lockstep. But once one of the involved packages gets
removed, the other one will lose its documentation files, too,
including the copyright file, which is a violation of Policy 12.5:
https://www.debian.org/doc/debian-policy/ch-docs.html#copyright-information

For other overwritten locations anything interesting may happen.

Note that dpkg intentionally does not replace directories with symlinks
and vice versa, you need the maintainer scripts to do this.
See in particular the end of point 4 in
https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html#details-of-unpack-phase-of-installation-or-upgrade

It is recommended to use the dpkg-maintscript-helper commands
'dir_to_symlink' and 'symlink_to_dir' (available since dpkg 1.17.14)
to perform the conversion, ideally using d/$PACKAGE.maintscript.
See dpkg-maintscript-helper(1) and dh_installdeb(1) for details.


>From the attached log (scroll to the bottom...):

0m36.2s ERROR: FAIL: silently overwrites files via directory symlinks:
  /usr/share/doc/libuim-data/NEWS.Debian.gz (libuim-data) != 
/usr/share/doc/uim-common/NEWS.Debian.gz (uim-common)
/usr/share/doc/libuim-data -> uim-common
  /usr/share/doc/libuim-data/changelog.Debian.gz (libuim-data) != 
/usr/share/doc/uim-common/changelog.Debian.gz (uim-common)
/usr/share/doc/libuim-data -> uim-common
  /usr/share/doc/libuim-data/changelog.gz (libuim-data) != 
/usr/share/doc/uim-common/changelog.gz (uim-common)
/usr/share/doc/libuim-data -> uim-common
  /usr/share/doc/libuim-data/copyright (libuim-data) != 
/usr/share/doc/uim-common/copyright (uim-common)
/usr/share/doc/libuim-data -> uim-common


I'll take care of fixing this in stable.


cheers,

Andreas


libuim-data_1:1.8.8-4+deb10u3.log.gz
Description: application/gzip


Bug#985347: marked as done (bmake: missing Conflicts: bsdowl (<< 2.2.2-1.2))

2021-03-16 Thread Debian Bug Tracking System
Your message dated Tue, 16 Mar 2021 12:48:24 +
with message-id 
and subject line Bug#985347: fixed in bmake 20200710-8
has caused the Debian Bug report #985347,
regarding bmake: missing Conflicts: bsdowl (<< 2.2.2-1.2)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
985347: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985347
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: bmake
Version: 20200710-7
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts
Control: affects -1 + bsdowl

Hi,

during a test with piuparts I noticed your package fails to upgrade from
'buster'.
It installed fine in 'buster', then the upgrade to 'bullseye' fails.

>From the attached log (scroll to the bottom...):

  Preparing to unpack .../021-bmake_20200710-7_amd64.deb ...
  rmdir: failed to remove '/usr/share/mk': No such file or directory
  Found a broken /usr/share/mk directory, unable to fix.
  bmake will not be able to find sys.mk
  Unpacking bmake (20200710-7) over (20160220-2+b1) ...
  dpkg: error processing archive 
/tmp/apt-dpkg-install-i1H4Us/021-bmake_20200710-7_amd64.deb (--unpack):
   trying to overwrite '/usr/share/mk', which is also in package bsdowl 2.2.2-1

Please add a versioned Conflicts in this case. We need to bsdowl package
to be removed (or upgraded) s.t. the conflicting files are removed. Just
deconfiguring the package (as could be done by apt with Breaks) is not
sufficient.
Lintian may give a warning about versioned Conflicts, you can override
that.
A bsdowl 2.2.2-1.2 package does not yet exist in the archive, but it
would be the earliest version that could fix these issues.

cheers,

Andreas


bsdowl_None.log.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---
Source: bmake
Source-Version: 20200710-8
Done: Andrej Shadura 

We believe that the bug you reported is fixed in the latest version of
bmake, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 985...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura  (supplier of updated bmake package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Tue, 16 Mar 2021 13:36:16 +0100
Source: bmake
Architecture: source
Version: 20200710-8
Distribution: unstable
Urgency: medium
Maintainer: Andrej Shadura 
Changed-By: Andrej Shadura 
Closes: 985347
Changes:
 bmake (20200710-8) unstable; urgency=medium
 .
   * preinst: Properly deal with other packages installing files under
 /usr/share/mk (Closes: #985347)
   * Fix day-of-week for changelog entry 1.45-7.
   * Update standards version to 4.5.0, no changes needed.
Checksums-Sha1:
 f96d956e3538fcdda2164f311922e4d15e9311ce 1339 bmake_20200710-8.dsc
 854f6a776fb657269c7f1588caeb0b19eac3a077 36896 bmake_20200710-8.debian.tar.xz
Checksums-Sha256:
 234636b3991c5e9b6adf10c82305002042d6644cb802c69dc4cb63f3232df9ea 1339 
bmake_20200710-8.dsc
 6aae79a89443166c6dd284ec4d1c0c4176e17f404be6d6992445a22aaef046f5 36896 
bmake_20200710-8.debian.tar.xz
Files:
 7cb56fc9b0396d3fef1881fb52c7334c 1339 devel optional bmake_20200710-8.dsc
 9191bf5e5be0ab0ea98970aac6ec2e72 36896 devel optional 
bmake_20200710-8.debian.tar.xz

-BEGIN PGP SIGNATURE-

iHUEARYIAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCYFCmegAKCRDoRGtKyMdy
YcpfAQDO2gPFE4d2TYiMGP4r0scMoeZ8Z+09xfX/D0/qtAHGRgD/Znj5D0JoKMJc
5r2FWhdVHWc6vaPQzr827Y6/xJHNnAc=
=/wnM
-END PGP SIGNATURE End Message ---


Bug#983874: gitaly: fails to install: Could not find gem 'rugged (~> 0.28)'

2021-03-16 Thread Kristof Csillag
Package: gitaly
Followup-For: Bug #983874

I am seeing the same thing. This also makes gitlab unusable.

Is there any update about this? A severe error has been reported,
and there is no reply for two weeks.

Is this package supposed to be actually used by people?

-- System Information:
Debian Release: 10.8
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'unstable'), (500, 'testing'), (500, 
'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-3-amd64 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=hu_HU.UTF-8, LC_CTYPE=hu_HU.UTF-8 (charmap=UTF-8), LANGUAGE= 
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled



Processed: found 928422 in 1.41.1+dfsg1-1~deb9u1, affects 985286 ..., fixed 978643 in 1.18.3-1, tagging 980429 ...

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> found 928422 1.41.1+dfsg1-1~deb9u1
Bug #928422 [rust-doc] rust-doc: unsatisfiable Depends: fonts-open-sans in 
jessie, stretch
There is no source info for the package 'rust-doc' at version 
'1.41.1+dfsg1-1~deb9u1' with architecture ''
Unable to make a source version for version '1.41.1+dfsg1-1~deb9u1'
Marked as found in versions 1.41.1+dfsg1-1~deb9u1.
> affects 985286 + libbatteries-ocaml-dev
Bug #985286 [libbatteries-ocaml-doc] libbatteries-ocaml-doc: unhandled symlink 
to directory conversion: /usr/share/doc/libbatteries-ocaml-dev/examples -> 
../libbatteries-ocaml-doc/examples
Added indication that 985286 affects libbatteries-ocaml-dev
> reassign 978643 src:gst-plugins-bad1.0-contrib 1.18.2-1
Bug #978643 {Done: Laurent Bigonville } 
[src:gst-plugins-bad1.0] Please build fdkaac and faac elements
Bug reassigned from package 'src:gst-plugins-bad1.0' to 
'src:gst-plugins-bad1.0-contrib'.
No longer marked as found in versions gst-plugins-bad1.0/1.18.2-1.
No longer marked as fixed in versions gst-plugins-bad1.0-contrib/1.18.3-1.
Bug #978643 {Done: Laurent Bigonville } 
[src:gst-plugins-bad1.0-contrib] Please build fdkaac and faac elements
The source 'gst-plugins-bad1.0-contrib' and version '1.18.2-1' do not appear to 
match any binary packages
Marked as found in versions gst-plugins-bad1.0-contrib/1.18.2-1.
> fixed 978643 1.18.3-1
Bug #978643 {Done: Laurent Bigonville } 
[src:gst-plugins-bad1.0-contrib] Please build fdkaac and faac elements
Marked as fixed in versions gst-plugins-bad1.0-contrib/1.18.3-1.
> tags 980429 - sid bullseye
Bug #980429 {Done: Matthias Klose } [src:gcc-10] g++-10: 
spurious c++17 mode segmentation fault in append_to_statement_list_1 
(tree-iterator.c:65)
Bug #980596 {Done: Matthias Klose } [src:gcc-10] mkvtoolnix: 
FTBFS: src/merge/reader_detection_and_creation.cpp:164:54: internal compiler 
error: Segmentation fault
Bug #980629 {Done: Matthias Klose } [src:gcc-10] nheko: FTBFS: 
internal compiler error
Removed tag(s) sid and bullseye.
Removed tag(s) bullseye and sid.
Removed tag(s) sid and bullseye.
> notfixed 960491 0.13.0-1
Bug #960491 {Done: Matthias Klumpp } [appstream] appstream: 
xml parser errors on package upgrade
There is no source info for the package 'appstream' at version '0.13.0-1' with 
architecture ''
Unable to make a source version for version '0.13.0-1'
No longer marked as fixed in versions appstream/0.13.0-1.
> fixed 960491 0.13.1-1
Bug #960491 {Done: Matthias Klumpp } [appstream] appstream: 
xml parser errors on package upgrade
Marked as fixed in versions appstream/0.13.1-1.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
928422: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=928422
960491: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960491
978643: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978643
980429: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980429
980596: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980596
980629: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=980629
985286: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985286
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985347: bmake: missing Conflicts: bsdowl (<< 2.2.2-1.2)

2021-03-16 Thread Andreas Beckmann
Package: bmake
Version: 20200710-7
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts
Control: affects -1 + bsdowl

Hi,

during a test with piuparts I noticed your package fails to upgrade from
'buster'.
It installed fine in 'buster', then the upgrade to 'bullseye' fails.

>From the attached log (scroll to the bottom...):

  Preparing to unpack .../021-bmake_20200710-7_amd64.deb ...
  rmdir: failed to remove '/usr/share/mk': No such file or directory
  Found a broken /usr/share/mk directory, unable to fix.
  bmake will not be able to find sys.mk
  Unpacking bmake (20200710-7) over (20160220-2+b1) ...
  dpkg: error processing archive 
/tmp/apt-dpkg-install-i1H4Us/021-bmake_20200710-7_amd64.deb (--unpack):
   trying to overwrite '/usr/share/mk', which is also in package bsdowl 2.2.2-1

Please add a versioned Conflicts in this case. We need to bsdowl package
to be removed (or upgraded) s.t. the conflicting files are removed. Just
deconfiguring the package (as could be done by apt with Breaks) is not
sufficient.
Lintian may give a warning about versioned Conflicts, you can override
that.
A bsdowl 2.2.2-1.2 package does not yet exist in the archive, but it
would be the earliest version that could fix these issues.

cheers,

Andreas


bsdowl_None.log.gz
Description: application/gzip


Processed: bmake: missing Conflicts: bsdowl (<< 2.2.2-1.2)

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> affects -1 + bsdowl
Bug #985347 [bmake] bmake: missing Conflicts: bsdowl (<< 2.2.2-1.2)
Added indication that 985347 affects bsdowl

-- 
985347: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985347
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Processed: block 979625 with 985001

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> block 979625 with 985001
Bug #979625 [src:python-cooler] autopkgtest: ModuleNotFoundError (ipytree) and 
AssertionError
979625 was not blocked by any bugs.
979625 was not blocking any bugs.
Added blocking bug(s) of 979625: 985001
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
979625: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=979625
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985343: libvigraimpex-doc: unhandled symlink to directory conversion: /usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html

2021-03-16 Thread Andreas Beckmann
Package: libvigraimpex-doc
Version: 1.11.1+dfsg-8
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts

Hi,

an upgrade test with piuparts revealed that your package installs files
over existing symlinks and possibly overwrites files owned by other
packages. This usually means an old version of the package shipped a
symlink but that was later replaced by a real (and non-empty)
directory. This kind of overwriting another package's files cannot be
detected by dpkg.

This was observed on the following upgrade paths:

  buster -> sid

For /usr/share/doc/PACKAGE this may not be problematic as long as both
packages are installed, ship byte-for-byte identical files and are
upgraded in lockstep. But once one of the involved packages gets
removed, the other one will lose its documentation files, too,
including the copyright file, which is a violation of Policy 12.5:
https://www.debian.org/doc/debian-policy/ch-docs.html#copyright-information

For other overwritten locations anything interesting may happen.

Note that dpkg intentionally does not replace directories with symlinks
and vice versa, you need the maintainer scripts to do this.
See in particular the end of point 4 in
https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html#details-of-unpack-phase-of-installation-or-upgrade

It is recommended to use the dpkg-maintscript-helper commands
'dir_to_symlink' and 'symlink_to_dir' (available since dpkg 1.17.14)
to perform the conversion, ideally using d/$PACKAGE.maintscript.
See dpkg-maintscript-helper(1) and dh_installdeb(1) for details.


>From the attached log (scroll to the bottom...):

0m30.4s ERROR: installs objects over existing directory symlinks:
  /usr/share/doc/libvigraimpex-dev/html/AlgebraicConcepts.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/AlgebraicConcepts.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html
  /usr/share/doc/libvigraimpex-dev/html/ArgumentObjectFactories.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/ArgumentObjectFactories.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html
  /usr/share/doc/libvigraimpex-dev/html/BorderTreatmentMode.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/BorderTreatmentMode.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html
[...]
  /usr/share/doc/libvigraimpex-dev/html/watersheds3d_8hxx_source.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/watersheds3d_8hxx_source.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html
  /usr/share/doc/libvigraimpex-dev/html/watersheds_8hxx_source.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/watersheds_8hxx_source.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html
  /usr/share/doc/libvigraimpex-dev/html/wigner-matrix_8hxx_source.html 
(libvigraimpex-doc) != 
/usr/share/doc/libvigraimpex-doc/html/wigner-matrix_8hxx_source.html (?)
/usr/share/doc/libvigraimpex-dev/html -> ../libvigraimpex-doc/html


cheers,

Andreas


libvigraimpex-doc_1.11.1+dfsg-8.log.gz
Description: application/gzip


Bug#985340: pki-base: fails to install, remove, and install again

2021-03-16 Thread Andreas Beckmann
Package: pki-base
Version: 10.10.2-2
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts
Control: found -1 10.10.2-1

Hi,

during a test with piuparts I noticed your package failed to install,
remove (but not purge), and install again.
Before the second installation the package is in config-files-remaining
state. The configuration is remaining from the last version that was
successfully configured - which is the same version that is going to be
installed again.

Like a plain failure on initial install this makes the package too buggy
for a release, thus the severity.

>From the attached log (scroll to the bottom...):

0m24.9s DEBUG: Starting command: ['chroot', '/srv/piuparts/tmp/tmpdZcVgQ', 
'apt-get', '-y', 'install', 'pki-base=10.10.2-2']
0m25.9s DUMP: 
  Reading package lists...
  Building dependency tree...
  Reading state information...
  The following NEW packages will be installed:
pki-base
  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  Need to get 239 kB of archives.
  After this operation, 2046 kB of additional disk space will be used.
  Get:1 http://ftp.de.debian.org/debian sid/main amd64 pki-base all 10.10.2-2 
[239 kB]
  debconf: delaying package configuration, since apt-utils is not installed
  Fetched 239 kB in 0s (3421 kB/s)
  Selecting previously unselected package pki-base.
  (Reading database ... 
(Reading database ... 8444 files and directories currently installed.)
  Preparing to unpack .../pki-base_10.10.2-2_all.deb ...
  Unpacking pki-base (10.10.2-2) ...
  Setting up pki-base (10.10.2-2) ...
0m25.9s DEBUG: Command ok: ['chroot', '/srv/piuparts/tmp/tmpdZcVgQ', 'apt-get', 
'-y', 'install', 'pki-base=10.10.2-2']

0m26.0s DEBUG: Starting command: ['chroot', '/srv/piuparts/tmp/tmpdZcVgQ', 
'apt-get', 'remove', 'pki-base']
0m26.9s DUMP: 
  Reading package lists...
  Building dependency tree...
  Reading state information...
  The following packages were automatically installed and are no longer 
required:
libexpat1 libmpdec3 libncursesw6 libnspr4 libnss3 libpython3-stdlib
libpython3.9-minimal libpython3.9-stdlib libreadline8 libsqlite3-0
media-types python3 python3-certifi python3-cffi-backend python3-chardet
python3-cryptography python3-idna python3-minimal python3-nss
python3-pkg-resources python3-pki-base python3-requests python3-six
python3-urllib3 python3.9 python3.9-minimal readline-common
  Use 'sudo apt autoremove' to remove them.
  The following packages will be REMOVED:
pki-base
  0 upgraded, 0 newly installed, 1 to remove and 0 not upgraded.
  After this operation, 2046 kB disk space will be freed.
  (Reading database ... 
(Reading database ... 8519 files and directories currently installed.)
  Removing pki-base (10.10.2-2) ...
0m26.9s DEBUG: Command ok: ['chroot', '/srv/piuparts/tmp/tmpdZcVgQ', 'apt-get', 
'remove', 'pki-base']

0m27.2s DEBUG: Starting command: ['chroot', '/srv/piuparts/tmp/tmpdZcVgQ', 
'apt-get', '-y', 'install', 'pki-base=10.10.2-2']
0m28.2s DUMP: 
  Reading package lists...
  Building dependency tree...
  Reading state information...
  The following NEW packages will be installed:
pki-base
  debconf: delaying package configuration, since apt-utils is not installed
  0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
  Need to get 0 B/239 kB of archives.
  After this operation, 2046 kB of additional disk space will be used.
  Selecting previously unselected package pki-base.
  (Reading database ... 
(Reading database ... 8446 files and directories currently installed.)
  Preparing to unpack .../pki-base_10.10.2-2_all.deb ...
  Unpacking pki-base (10.10.2-2) ...
  Setting up pki-base (10.10.2-2) ...
  dpkg: error processing package pki-base (--configure):
   installed pki-base package post-installation script subprocess returned 
error exit status 1
  Errors were encountered while processing:
   pki-base
  E: Sub-process /usr/bin/dpkg returned an error code (1)
0m28.2s ERROR: Command failed (status=100): ['chroot', 
'/srv/piuparts/tmp/tmpdZcVgQ', 'apt-get', '-y', 'install', 'pki-base=10.10.2-2']


cheers,

Andreas


pki-base_10.10.2-2.log.gz
Description: application/gzip


Processed: pki-base: fails to install, remove, and install again

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> found -1 10.10.2-1
Bug #985340 [pki-base] pki-base: fails to install, remove, and install again
Marked as found in versions dogtag-pki/10.10.2-1.

-- 
985340: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985340
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#983090: python-django: CVE-2021-23336

2021-03-16 Thread Chris Lamb
Hi,

> > ACK. Have filed #983526 for this purpose.
>
> Can you please add as well the fixes for the other open issues?

This was done on Feb 26th:

  https://bugs.debian.org/983526#22


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-



Bug#985339: nauty: unhandled symlink to directory conversion: /usr/share/doc/PACKAGE

2021-03-16 Thread Andreas Beckmann
Package: nauty
Version: 2.7r1+ds-1
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts

Hi,

an upgrade test with piuparts revealed that your package installs files
over existing symlinks and possibly overwrites files owned by other
packages. This usually means an old version of the package shipped a
symlink but that was later replaced by a real (and non-empty)
directory. This kind of overwriting another package's files cannot be
detected by dpkg.

This was observed on the following upgrade paths:

  jessie -> stetch -> buster -> bullseye

For /usr/share/doc/PACKAGE this may not be problematic as long as both
packages are installed, ship byte-for-byte identical files and are
upgraded in lockstep. But once one of the involved packages gets
removed, the other one will lose its documentation files, too,
including the copyright file, which is a violation of Policy 12.5:
https://www.debian.org/doc/debian-policy/ch-docs.html#copyright-information

For other overwritten locations anything interesting may happen.

Note that dpkg intentionally does not replace directories with symlinks
and vice versa, you need the maintainer scripts to do this.
See in particular the end of point 4 in
https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html#details-of-unpack-phase-of-installation-or-upgrade

It is recommended to use the dpkg-maintscript-helper commands
'dir_to_symlink' and 'symlink_to_dir' (available since dpkg 1.17.14)
to perform the conversion, ideally using d/$PACKAGE.maintscript.
See dpkg-maintscript-helper(1) and dh_installdeb(1) for details.


>From the attached log (scroll to the bottom...):

1m40.0s ERROR: FAIL: silently overwrites files via directory symlinks:
  /usr/share/doc/nauty/changelog.Debian.gz (nauty) != 
/usr/share/doc/libnauty2/changelog.Debian.gz (libnauty2:amd64)
/usr/share/doc/nauty -> /usr/share/doc/libnauty2
  /usr/share/doc/nauty/changelog.gz (nauty) != 
/usr/share/doc/libnauty2/changelog.gz (libnauty2:amd64)
/usr/share/doc/nauty -> /usr/share/doc/libnauty2
  /usr/share/doc/nauty/changes24-27.txt.gz (nauty) != 
/usr/share/doc/libnauty2/changes24-27.txt.gz (libnauty2:amd64)
/usr/share/doc/nauty -> /usr/share/doc/libnauty2
  /usr/share/doc/nauty/copyright (nauty) != /usr/share/doc/libnauty2/copyright 
(libnauty2:amd64)
/usr/share/doc/nauty -> /usr/share/doc/libnauty2


cheers,

Andreas


nauty_None.log.gz
Description: application/gzip


Processed: Re: hyphy-common: unhandled symlink to directory conversion: /usr/lib/hyphy -> ../share/hyphy

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> affects -1 + hyphy-mpi libarb arb-common
Bug #985284 [hyphy-common] hyphy-common: unhandled symlink to directory 
conversion: /usr/lib/hyphy -> ../share/hyphy
Added indication that 985284 affects hyphy-mpi, libarb, and arb-common

-- 
985284: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985284
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985284: hyphy-common: unhandled symlink to directory conversion: /usr/lib/hyphy -> ../share/hyphy

2021-03-16 Thread Andreas Beckmann
Followup-For: Bug #985284
Control: affects -1 + hyphy-mpi libarb arb-common

This bug also affects hyphy-mpi:

4m3.9s ERROR: installs objects over existing directory symlinks:
  /usr/lib/hyphy/bin (hyphy-mpi, hyphy-common) != /usr/share/hyphy/bin (?)
/usr/lib/hyphy -> ../share/hyphy
  /usr/lib/hyphy/bin/HYPHYMPI (hyphy-mpi) != /usr/share/hyphy/bin/HYPHYMPI (?)
/usr/lib/hyphy -> ../share/hyphy
  /usr/lib/hyphy/bin/HYPHYMPI-avx (hyphy-mpi) != 
/usr/share/hyphy/bin/HYPHYMPI-avx (?)
/usr/lib/hyphy -> ../share/hyphy
  /usr/lib/hyphy/bin/HYPHYMPI-sse3 (hyphy-mpi) != 
/usr/share/hyphy/bin/HYPHYMPI-sse3 (?)
/usr/lib/hyphy -> ../share/hyphy
  /usr/lib/hyphy/bin/simd-dispatch (hyphy-common) != 
/usr/share/hyphy/bin/simd-dispatch (?)
/usr/lib/hyphy -> ../share/hyphy


Andreas



Processed: found 900787 in 304.137-8

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> found 900787 304.137-8
Bug #900787 [src:nvidia-graphics-drivers-legacy-304xx] 
nvidia-graphics-drivers-legacy-304xx: does not support Xorg Xserver 1.20
Marked as found in versions nvidia-graphics-drivers-legacy-304xx/304.137-8.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
900787: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900787
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Processed: user debian...@lists.debian.org, usertagging 983859, affects 983859 ...

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> user debian...@lists.debian.org
Setting user to debian...@lists.debian.org (was a...@debian.org).
> usertags 983859 piuparts
Usertags were: piuparts.
Usertags are now: piuparts.
> affects 983859 + education-development
Bug #983859 [bluefish] bluefish: missing Breaks+Replaces on bluefish-data
Added indication that 983859 affects education-development
> retitle 968415 susv4: downloaded tarball no longer matches recorded checksum
Bug #968415 [susv4] susv4: Setting up susv4 fails
Changed Bug title to 'susv4: downloaded tarball no longer matches recorded 
checksum' from 'susv4: Setting up susv4 fails'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
968415: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968415
983859: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=983859
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#914315: libwebp-dev: New versions fix disclosed heap use-after-free

2021-03-16 Thread Laurence Parry
Tags: fixed-upstream

Using webp-dev on buster with test file bug.c from the second bug
mentioned above compiled with -lwebp, malloc reported: "free():
corrupted unsorted chunks" within WebPIDelete().

This suggests to me that the bug may be exploitable on systems with
libwebp6 installed - of which there are far more than when this
package was introduced.
https://qa.debian.org/popcon-graph.php?packages=libwebp-dev+libwebp6+libwebpmux3+libwebpdemux2+webp&show_installed=on&want_legend=on&want_ticks=on&from_date=2016-03-01&date_fmt=%25Y-%25m&beenhere=1

As such, I've raised the priority. I don't know which packages use
libwebp6 in threaded mode, but a change in this may not be noted in
changelogs anyway.

As the maintainer appears inactive, I request assistance from the
security team to address this issue.

Best regards,
-- 
Laurence "GreenReaper" Parry - Inkbunny administrator
https://www.greenreaper.co.uk/ - https://inkbunny.net/



Bug#985336: diaspora-installer-mysql: missing dependency on tzdata

2021-03-16 Thread Andreas Beckmann
Package: diaspora-installer-mysql
Version: 0.7.6.1+debian1+deb10u1
Severity: serious
User: debian...@lists.debian.org
Usertags: piuparts
Control: found -1 0.7.14.0+debian~bpo10+1
Control: found -1 0.7.4.0~bpo9+2

Hi,

during a test with piuparts I noticed your package failed to install. As
per definition of the release team this makes the package too buggy for
a release, thus the severity.

In sid (and bullseye), tzdata is pulled in via libpython3.9-stdlib.
For diaspora-installer (which uses postgresql), tzdata is pulled in via
postgresql.
So the error only show up for diaspora-installer-mysql in buster or
earlier releases (and in their -backports sections).

Given that diaspora seems to require tzdata to be installed, it should
not rely on some obscure dependency transitively pulling this in, but
should actively depend on it, probably in dispora-common or
diaspora-installer.

>From the attached log (scroll to the bottom...):

  

  rake aborted!
  TZInfo::DataSourceNotFound: No source of timezone data could be found.
  Please refer to http://tzinfo.github.io/datasourcenotfound for help resolving 
this error.
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/data_source.rb:182:in
 `rescue in create_default_data_source'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/data_source.rb:179:in
 `create_default_data_source'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/data_source.rb:40:in
 `block in get'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/data_source.rb:39:in
 `synchronize'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/data_source.rb:39:in
 `get'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/timezone.rb:661:in
 `data_source'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/timezone.rb:130:in
 `all_identifiers'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/tzinfo-1.2.5/lib/tzinfo/timezone.rb:124:in
 `all'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object/user_info.rb:30:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object/user_info.rb:3:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object/user_info.rb:2:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object/user_info.rb:1:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `block in require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:258:in
 `load_dependency'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object.rb:7:in
 `block in '
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object.rb:6:in
 `each'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/response_object.rb:6:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `block in require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:258:in
 `load_dependency'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect/connect_object.rb:52:in
 `'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `block in require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:258:in
 `load_dependency'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/activesupport-5.1.6/lib/active_support/dependencies.rb:292:in
 `require'
  
/var/lib/diaspora/vendor/bundle/ruby/2.5.0/gems/openid_connect-1.1.5/lib/openid_connect.rb:95:in
 `'
  
/usr/share/rubygems-integration/all/gems/bundler-1.17.3/lib/bundler/runtime.rb:81:in
 `require'
  
/usr/share/rubygems-integration/all/gems/bundler-1.17.3/lib/bundler/runtime.rb:81:in
 `block (2 levels) in require'
  
/usr/shar

Processed: diaspora-installer-mysql: missing dependency on tzdata

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> found -1 0.7.14.0+debian~bpo10+1
Bug #985336 [diaspora-installer-mysql] diaspora-installer-mysql: missing 
dependency on tzdata
Marked as found in versions diaspora-installer/0.7.14.0+debian~bpo10+1.
> found -1 0.7.4.0~bpo9+2
Bug #985336 [diaspora-installer-mysql] diaspora-installer-mysql: missing 
dependency on tzdata
Marked as found in versions diaspora-installer/0.7.4.0~bpo9+2.

-- 
985336: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985336
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985043: nagios4-cgi: fails to install with --install-recommends enabled

2021-03-16 Thread Andreas Beckmann

On 15/03/2021 12.05, Russell Stuart wrote:

I can't reproduce this.

I've tried running piuparts on the .changes file, I've manually 
installed it into a minimal chroot, and in fact I use it in production. 
  I used piuparts on bullseye, amd64.


Attached is the output of my run "piuparts --apt 
--logfile=/tmp/nagios4-cgi_4.46-2.log nagios4-cgi".  It passed, of course.


If you can give me a clue on how to reproduce it, I'd appreciate it.  I 
can't find a way to reproduce it in a few days, I'll reduce the severity.


I think --install-recommends is the key. The command line I used to 
invoke piuparts can be found at the beginning of the log, you may have 
to adjust some of the options for your local setup.


(and you can use --shell-on-error if you want to investigate the chroot 
after a failure)


Andreas



Processed: Re: Bug#985329: solved upgrading to experimental

2021-03-16 Thread Debian Bug Tracking System
Processing control commands:

> tags -1 + moreinfo
Bug #985329 [courier-mta] courier-mta not startable/configurable due 
mkesmtpdcert
Added tag(s) moreinfo.
> severity -1 normal
Bug #985329 [courier-mta] courier-mta not startable/configurable due 
mkesmtpdcert
Severity set to 'normal' from 'grave'

-- 
985329: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=985329
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#985329: solved upgrading to experimental

2021-03-16 Thread Markus Wanner

Control: tags -1 + moreinfo
Control: severity -1 normal

On 16.03.21 05:46, PICCORO McKAY Lenz wrote:

i have older packages yet in my install, i dont know how happened..
but do not close this bug until i found why happened

after check and forces proper upgraded in xperimental.. is working


please properly identify the bug you intend to report before filing it 
as grave, potentially marking the package as unfit for release.


Regards

Markus



Processed: your mail

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> retitle 914315 libwebp-dev: New versions fix disclosed heap use-after-free
Bug #914315 [libwebp-dev] libwebp-dev: New versions released, fix disclosed heap
Changed Bug title to 'libwebp-dev: New versions fix disclosed heap 
use-after-free' from 'libwebp-dev: New versions released, fix disclosed heap'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
914315: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914315
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Processed (with 1 error): your mail

2021-03-16 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> severity 914315 grave
Bug #914315 [libwebp-dev] libwebp-dev: New version v1.0.1 released
Severity set to 'grave' from 'wishlist'
> tags 914315 security
Bug #914315 [libwebp-dev] libwebp-dev: New version v1.0.1 released
Added tag(s) security.
> retitle 914315 libwebp-dev: New versions released, fix disclosed heap
Bug #914315 [libwebp-dev] libwebp-dev: New version v1.0.1 released
Changed Bug title to 'libwebp-dev: New versions released, fix disclosed heap' 
from 'libwebp-dev: New version v1.0.1 released'.
> use after free
Unknown command or malformed arguments to command.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
914315: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=914315
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#923500: snapd strict confinement

2021-03-16 Thread greengrasseyes
Is this going to be fixed in debian buster or is the plan to fix this
for bullseye? I have snapd installed as a snap and I tried the candidate
version and the edge version (2.49-1) but it did not appear to enable
strict confinement with debian buster. I tried the commands sudo snap
debug confinement and sudo snap debug sandbox-features. It still
displayed partial confinement and did not show strict confinement as an
option. I guess that maybe because this needs to fixed in the snapd apt
repo version? Which is why I asked the first question above.

Thanks.