Bug#901194: jessie-pu: package openldap/2.4.40+dfsg-1+deb8u4

2018-06-09 Thread Ryan Tandy
Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian@packages.debian.org
Usertags: pu

Dear OSRM,

Please consider this openldap update for jessie. I apologize for the 
late request and will understand if it doesn't make it.

  * Fix upgrade failure when olcSuffix contains a backslash. (Closes: #864719)

I would like to apply this fix in jessie to ensure that if openldap gets 
a security update during jessie LTS, affected systems will be able to 
install it. As well there may be some users who choose to upgrade from 
wheezy after its LTS ends. I have tested both upgrade scenarios 
(jessie->jessie and wheezy->jessie).

For avoidance of doubt: this includes the changes also proposed for 
stretch in #901192 (the affected code is always executed in 
wheezy->jessie upgrades).

  * Import upstream patches to fix memory corruption caused by calling
sasl_client_init() multiple times and possibly concurrently.
(ITS#8648) (Closes: #860947)

This issue affected several slapd users and came with a variety of 
symptoms. A typical example of an affected setup would be a multi-master 
setup where replication is authenticated using Kerberos (SASL/GSSAPI). 
These patches have been applied in stretch (in +deb9u1) and in Ubuntu 
xenial, with no regressions reported.

thanks,
Ryan

-- System Information:
Debian Release: 9.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500, 
'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-6-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
diff -u openldap-2.4.40+dfsg/debian/changelog 
openldap-2.4.40+dfsg/debian/changelog
--- openldap-2.4.40+dfsg/debian/changelog
+++ openldap-2.4.40+dfsg/debian/changelog
@@ -1,3 +1,12 @@
+openldap (2.4.40+dfsg-1+deb8u4) jessie; urgency=medium
+
+  * Fix upgrade failure when olcSuffix contains a backslash. (Closes: #864719)
+  * Import upstream patches to fix memory corruption caused by calling 
+sasl_client_init() multiple times and possibly concurrently.
+(ITS#8648) (Closes: #860947)
+
+ -- Ryan Tandy   Tue, 05 Jun 2018 20:16:25 -0700
+
 openldap (2.4.40+dfsg-1+deb8u3) jessie-security; urgency=high
 
   * debian/patches/ITS-8655-paged-results-double-free.patch: Fix a double free 
diff -u openldap-2.4.40+dfsg/debian/patches/series 
openldap-2.4.40+dfsg/debian/patches/series
--- openldap-2.4.40+dfsg/debian/patches/series
+++ openldap-2.4.40+dfsg/debian/patches/series
@@ -29,0 +30,2 @@
+ITS-8648-check-result-of-ldap_int_initialize-in-ldap.patch
+ITS-8648-init-SASL-library-in-global-init.patch
diff -u openldap-2.4.40+dfsg/debian/slapd.scripts-common 
openldap-2.4.40+dfsg/debian/slapd.scripts-common
--- openldap-2.4.40+dfsg/debian/slapd.scripts-common
+++ openldap-2.4.40+dfsg/debian/slapd.scripts-common
@@ -100,7 +100,7 @@
 }
 # }}}
 update_databases_permissions() {   # {{{
-   get_suffix | while read suffix; do
+   get_suffix | while read -r suffix; do
dbdir=`get_directory "$suffix"`
update_permissions "$dbdir"
done
@@ -163,11 +163,11 @@
 
dir=`database_dumping_destdir`
echo >&2 "  Dumping to $dir: "
-   (get_suffix | while read suffix; do
+   (get_suffix | while read -r suffix; do
dbdir=`get_directory "$suffix"`
if [ -n "$dbdir" ]; then
file="$dir/$suffix.ldif"
-   echo -n "  - directory $suffix... " >&2
+   printf '  - directory %s... ' "$suffix" >&2
# Need to support slapd.d migration from preinst
if [ -f "${SLAPD_CONF}" ]; then
slapcat_opts="-g -f ${SLAPD_CONF}"
@@ -194,7 +194,7 @@
 
dir=`database_dumping_destdir`
echo >&2 "  Loading from $dir: "
-   get_suffix | while read suffix; do
+   get_suffix | while read -r suffix; do
dbdir=`get_directory "$suffix"`
if [ -z "$dbdir" ]; then
continue
@@ -206,11 +206,11 @@
fi
 
file="$dir/$suffix.ldif"
-   echo -n "  - directory $suffix... " >&2
+   printf '  - directory %s... ' "$suffix" >&2
 
# If there is an old DB_CONFIG file, restore it before
# running slapadd
-   backupdir=`compute_backup_path -n "$dbdir" "$suffix"`
+   backupdir="$(compute_backup_path -n "$dbdir" "$suffix")"
if [ -e "$backupdir"/DB_CONFIG ]; then
cp -a "$backupdir"/DB_CONFIG "$dbdir"/
fi
@@ -249,7 +249,7 @@
 # }}}
 move_incompatible_databases_away() {   # {{{
echo >&2 "  Moving old database directories to /var/backups:"
-   

Bug#862030: jessie-pu: package rar/2:4.2.0+dfsg.1-0.1

2018-06-09 Thread Ben Hutchings
On Fri, 2018-06-08 at 21:39 +0100, Adam D. Barratt wrote:
> Control: tags -1 + confirmed
> 
> On Fri, 2017-11-24 at 17:14 +, Ben Hutchings wrote:
> > On Tue, 2017-06-27 at 22:55 +0200, Cyril Brulebois wrote:
> > > Control: tag -1 moreinfo
> > > 
> > > Ben Hutchings  (2017-05-07):
> > > > rar should be updated to fix #860952.
> > > > 
> > > > The orig tarballs need to be repacked to exclude
> > > > rar_static.  Then I
> > > > would apply the following source patch:
> > > > 
> 
> ...
> > > Based on the last line of context and the first line of the diff
> > > (marked
> > > with <=== above), I'm not sure whether you plan to remove
> > > default.sfx
> > > along with it, since the previous line still mentions it, and the
> > > rules
> > > file as well, see below.
> > 
> > That was intentional, although I forgot to mention it.  default.sfx
> > hasn't been statically linked since (I think) version 3.9.3-1.
> > 
> 
> Please go ahead; apologies for the long delay.

Done.

Ben.

-- 
Ben Hutchings
If at first you don't succeed, you're doing about average.



signature.asc
Description: This is a digitally signed message part


Bug#901192: stretch-pu: package openldap/2.4.44+dfsg-5+deb9u2

2018-06-09 Thread Ryan Tandy
Package: release.debian.org
Severity: normal
Tags: stretch
User: release.debian@packages.debian.org
Usertags: pu

Dear SRM,

Please consider this openldap update for stretch. I apologize for the 
late request and will understand if it doesn't make it.

Both fixes have already had some time in testing and stretch-backports.

  * Import upstream patch to fix an out-of-sync issue with delta-syncrepl
replication in multi-master environments, resulting from changes losing
tracking information and being applied multiple times.
(ITS#8) (Closes: #877166)

This issue impacts replication when the memberof overlay is used in a 
multi-master setup. Sven Mäder (in X-D-CC) has tested the proposed 
package on a stretch system and verified the fix.

  * Really fix upgrades when the config contains backslash-escaped special
characters. The previous fix was incomplete and didn't fully fix upgrades
involving a database reload. (Closes: #864719)

The first part of this, fixing simple upgrades that don't require a 
database reload, is already in stretch (as +deb9u1). This additional 
patch deals with code that is not executed in a typical upgrade but 
might be triggered based on the old version or the debconf settings.

thanks,
Ryan

-- System Information:
Debian Release: 9.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500, 
'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.9.0-6-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
diff -Nru openldap-2.4.44+dfsg/debian/changelog 
openldap-2.4.44+dfsg/debian/changelog
--- openldap-2.4.44+dfsg/debian/changelog   2017-08-10 12:12:46.0 
-0700
+++ openldap-2.4.44+dfsg/debian/changelog   2018-05-22 21:25:19.0 
-0700
@@ -1,3 +1,15 @@
+openldap (2.4.44+dfsg-5+deb9u2) stretch; urgency=medium
+
+  * Import upstream patch to fix an out-of-sync issue with delta-syncrepl
+replication in multi-master environments, resulting from changes losing
+tracking information and being applied multiple times.
+(ITS#8444) (Closes: #877166)
+  * Really fix upgrades when the config contains backslash-escaped special
+characters. The previous fix was incomplete and didn't fully fix upgrades
+involving a database reload. (Closes: #864719)
+
+ -- Ryan Tandy   Tue, 22 May 2018 21:25:19 -0700
+
 openldap (2.4.44+dfsg-5+deb9u1) stretch; urgency=medium
 
   * Relax the dependency of libldap-2.4-2 on libldap-common to also permit 
diff -Nru 
openldap-2.4.44+dfsg/debian/patches/ITS-8444-Do-not-clear-the-pending-operation-when-che.patch
 
openldap-2.4.44+dfsg/debian/patches/ITS-8444-Do-not-clear-the-pending-operation-when-che.patch
--- 
openldap-2.4.44+dfsg/debian/patches/ITS-8444-Do-not-clear-the-pending-operation-when-che.patch
  1969-12-31 16:00:00.0 -0800
+++ 
openldap-2.4.44+dfsg/debian/patches/ITS-8444-Do-not-clear-the-pending-operation-when-che.patch
  2018-05-22 21:25:19.0 -0700
@@ -0,0 +1,30 @@
+From bb6438fb7ae32a622f456af8c4c9b8d479d5b209 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ond=C5=99ej=20Kuzn=C3=ADk?= 
+Date: Fri, 25 Aug 2017 16:25:23 +0100
+Subject: [PATCH] ITS#8444 Do not clear the pending operation when
+ checkpointing
+
+When a checkpoint happens, if we remove the CSN from the pending list,
+accesslog won't pass it onto the accesslog DB. But in a delta-mmr
+scenario, an accesslog entry without a CSN faces a race where it might
+be applied twice - that usually fails and causes a full refresh, other
+times it can cause a silent desync - both are undesirable.
+---
+ servers/slapd/overlays/syncprov.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/servers/slapd/overlays/syncprov.c 
b/servers/slapd/overlays/syncprov.c
+index 3e7667336..4c2d939d4 100644
+--- a/servers/slapd/overlays/syncprov.c
 b/servers/slapd/overlays/syncprov.c
+@@ -1494,6 +1494,7 @@ syncprov_checkpoint( Operation *op, slap_overinst *on )
+   opm.o_bd->bd_info = on->on_info->oi_orig;
+   opm.o_managedsait = SLAP_CONTROL_NONCRITICAL;
+   opm.o_no_schema_check = 1;
++  opm.o_opid = -1;
+   opm.o_bd->be_modify( ,  );
+ 
+   if ( rsm.sr_err == LDAP_NO_SUCH_OBJECT &&
+-- 
+2.11.0
+
diff -Nru openldap-2.4.44+dfsg/debian/patches/series 
openldap-2.4.44+dfsg/debian/patches/series
--- openldap-2.4.44+dfsg/debian/patches/series  2017-08-09 22:07:34.0 
-0700
+++ openldap-2.4.44+dfsg/debian/patches/series  2018-05-22 21:25:19.0 
-0700
@@ -31,3 +31,4 @@
 ITS-8432-fix-infinite-looping-mods-in-delta-mmr.patch
 ITS-8648-check-result-of-ldap_int_initialize-in-ldap.patch
 ITS-8648-init-SASL-library-in-global-init.patch
+ITS-8444-Do-not-clear-the-pending-operation-when-che.patch
diff -Nru openldap-2.4.44+dfsg/debian/slapd.scripts-common 

Bug#888561: marked as done (jessie-pu: package nvidia-graphics-modules/340.106+3.16.0+1)

2018-06-09 Thread Debian Bug Tracking System
Your message dated Sat, 09 Jun 2018 23:46:39 +0100
with message-id <1528584399.2806.21.ca...@adam-barratt.org.uk>
and subject line Re: Bug#888561: jessie-pu: package 
nvidia-graphics-modules/340.106+3.16.0+1
has caused the Debian Bug report #888561,
regarding jessie-pu: package nvidia-graphics-modules/340.106+3.16.0+1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
888561: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=888561
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: jessie
User: release.debian@packages.debian.org
Usertags: pu
Control: block -1 with 887559

For the new kernel ABI (5) and the updated nvidia-graphics-drivers
(jessie-pu request #887559) we need to regenerate the prebuilt kernel
modules. Due to the kernel ABI change, some packages will get renamed.


Andreas
diff --git a/debian/changelog b/debian/changelog
index 4dca75f..65d68e9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+nvidia-graphics-modules (340.106+3.16.0+1) jessie; urgency=medium
+
+  * Build for Linux 3.16.0 (ABI 5).
+  * Use nvidia-kernel-source 340.106.
+  * Switch Vcs-* URLs to salsa.debian.org.
+  * Upload to jessie.
+
+ -- Andreas Beckmann   Sat, 27 Jan 2018 04:23:41 +0100
+
 nvidia-graphics-modules (340.102+3.16.0+1) jessie; urgency=medium
 
   * Use nvidia-kernel-source 340.102.
diff --git a/debian/control b/debian/control
index a86e969..28837b4 100644
--- a/debian/control
+++ b/debian/control
@@ -7,18 +7,18 @@ Uploaders:
  Andreas Beckmann ,
  Vincent Cheng 
 Build-Depends: debhelper (>= 9),
- linux-headers-3.16.0-4-amd64 [i386 amd64], linux-headers-3.16.0-4-586 [i386], 
linux-headers-3.16.0-4-686-pae [i386],
- nvidia-kernel-source (>= 340.102), nvidia-kernel-source (<< 340.102.~),
+ linux-headers-3.16.0-5-amd64 [i386 amd64], linux-headers-3.16.0-5-586 [i386], 
linux-headers-3.16.0-5-686-pae [i386],
+ nvidia-kernel-source (>= 340.106), nvidia-kernel-source (<< 340.106.~),
 Standards-Version: 3.9.6
 Homepage: http://www.nvidia.com/
-Vcs-Git: git://anonscm.debian.org/pkg-nvidia/nvidia-graphics-modules.git -b 
jessie
-Vcs-Browser: 
https://anonscm.debian.org/cgit/pkg-nvidia/nvidia-graphics-modules.git
+Vcs-Browser: https://salsa.debian.org/nvidia-team/nvidia-graphics-modules
+Vcs-Git: https://salsa.debian.org/nvidia-team/nvidia-graphics-modules.git -b 
jessie
 XS-Autobuild: yes
 
 Package: nvidia-kernel-dummy
 Architecture: amd64
 Priority: extra
-Depends: nvidia-kernel-source (>= 340.102), ${misc:Depends}
+Depends: nvidia-kernel-source (>= 340.106), ${misc:Depends}
 Description: NVIDIA kernel module for Linux (dummy package)
  This dummy package exists solely to ensure that the prebuilt modules do not
  migrate to testing before the corresponding driver is available. Nothing is
@@ -39,7 +39,7 @@ Description: NVIDIA kernel module for Linux (dummy package)
 
 Package: nvidia-kernel-amd64
 Architecture: i386 amd64
-Depends: ${misc:Depends}, nvidia-kernel-3.16.0-4-amd64 (>= 340.102)
+Depends: ${misc:Depends}, nvidia-kernel-3.16.0-5-amd64 (>= 340.106)
 Conflicts: nvidia-kernel-2.6-amd64
 Replaces: nvidia-kernel-2.6-amd64
 Description: NVIDIA kernel module for Linux (amd64 flavor)
@@ -48,7 +48,7 @@ Description: NVIDIA kernel module for Linux (amd64 flavor)
  Install this package to automatically install the latest NVIDIA module
  when new versions of the kernel are released.
 
-Package: nvidia-kernel-3.16.0-4-amd64
+Package: nvidia-kernel-3.16.0-5-amd64
 Architecture: i386 amd64
 Depends: ${misc:Depends}
 Description: NVIDIA binary kernel module (amd64 flavor)
@@ -57,7 +57,7 @@ Description: NVIDIA binary kernel module (amd64 flavor)
 
 Package: nvidia-kernel-586
 Architecture: i386
-Depends: ${misc:Depends}, nvidia-kernel-3.16.0-4-586 (>= 340.102)
+Depends: ${misc:Depends}, nvidia-kernel-3.16.0-5-586 (>= 340.106)
 Conflicts: nvidia-kernel-2.6-586
 Replaces: nvidia-kernel-2.6-586
 Description: NVIDIA kernel module for Linux (586 flavor)
@@ -66,7 +66,7 @@ Description: NVIDIA kernel module for Linux (586 flavor)
  Install this package to automatically install the latest NVIDIA module
  when new versions of the kernel are released.
 
-Package: nvidia-kernel-3.16.0-4-586
+Package: nvidia-kernel-3.16.0-5-586
 Architecture: i386
 Depends: ${misc:Depends}
 Description: NVIDIA binary kernel module (586 flavor)
@@ -75,7 +75,7 @@ Description: NVIDIA binary kernel module (586 flavor)
 
 Package: nvidia-kernel-686-pae
 Architecture: i386
-Depends: ${misc:Depends}, nvidia-kernel-3.16.0-4-686-pae (>= 340.102)
+Depends: ${misc:Depends}, 

Processed: Re: Bug#899006: stretch-pu: package intel-microcode/3.20180425.1~deb9u1

2018-06-09 Thread Debian Bug Tracking System
Processing control commands:

> tags -1 + confirmed
Bug #899006 [release.debian.org] stretch-pu: package 
intel-microcode/3.20180425.1~deb9u1
Added tag(s) confirmed.

-- 
899006: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=899006
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#899006: stretch-pu: package intel-microcode/3.20180425.1~deb9u1

2018-06-09 Thread Adam D. Barratt
Control: tags -1 + confirmed

On Fri, 2018-05-18 at 10:32 -0300, Henrique de Moraes Holschuh wrote:
> I'd like to update the intel-microcode package in Debian stretch.
> 
> This update adds the microcode-side fix for CVE-2017-5715 aka Spectre
> v2.
> 

Please go ahead.

Regards,

Adam



Bug#888561: jessie-pu: package nvidia-graphics-modules/340.106+3.16.0+1

2018-06-09 Thread Andreas Beckmann
On 2018-06-09 21:05, Adam D. Barratt wrote:
> Unfortunately I missed the fact that the upload had ended up in NEW due
>  to the kernel ABI change, and dak will no longer accept it because:

I could just rebuild ist in a current jessie-pu environment ... but
given the fact that this will be the final jessie point release, it's
probably better to RM the package, as it will probably not be updatable
within LTS. There is already #894123 for that.

I also don't plan to provide it via backports.


Andreas



Bug#900920: stretch-pu: package freedink-dfarc/3.12-1+deb9u1

2018-06-09 Thread beuc
On 09/06/2018 22:29, Adam D. Barratt wrote:
> On Fri, 2018-06-08 at 20:12 +0200, Sylvain wrote:
>> On 08/06/2018 19:55, Adam D. Barratt wrote:
>>> Control: tags -1 + confirmed
>>>
>>> On Wed, 2018-06-06 at 19:54 +0200, b...@debian.org wrote:
 Please consider this update to freedink-dfarc for stretch.
 It fixes a security issue that can overwrite arbitrary user
 files.
 Sending to stable following security team's directions from 2018-
 06-
 01.
>>> +freedink-dfarc (3.12-1+deb9u1) stable; urgency=high
>>>
>>> Please use "stretch" as the distribution.
>>>
>>> +  * Fix directory traversal in D-Mod extractor (CVE-2018-0496)
>>> +  * Upload to 'stable' as security team rejected a DSA to
>>> +'stretch-security' (no justification)
>>>
>>> The changelog is not the place for such commentary - please remove
>>> it.
>>>
>>> With the above changes made, and assuming that the resulting
>>> package
>>> has been tested on stretch, please feel free to upload.
>> As per Social Contract #3 I do have to explain to my users why they
>> get the security fix after the disclosure.
> As with basically all core teams, Debian's security team is generally
> stretched in terms of manpower and can't handle every possible update
> that's security-related. Things have to be prioritised and sometimes
> those updates end up being provided via proposed-updates. That's always
> going to be the case in a volunteer project, and even larger and/or
> commercially-backed projects will still have to decide which updates
> they handle before others. This isn't a problem as such, just the way
> things are.

Workload: that's not what they say. When asked on IRC, they said the
team was "fine".

Priorities: I do accept them. However I can report that they are neither
documented nor explained:
- "In the past, uploads to |stable| were used to address security
problems as well. However, this practice is deprecated"
 
https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#upload-stable
- "I don't think this warrants a DSA."
  is the sole explanation I could get.
Plus, as I'm learning this 2-tier security support after years in
Debian, I deemed this all-the-more relevant to the changelog.

Incidentally, are you part of the Security Team?
If yes, I'd appreciate that you say so.
If not, that you don't speak for them.


>> This is not a commentary, this is purely factual.
> It's not a description of a change made to the package, nor information
> that users need in order to decide whether they should be installing
> it. As such, it is commentary. That has nothing to do with its  
> factuality or otherwise.

It's a description of where the package is uploaded and why.
Moreover I fail to see how adding this information is causing any harm,
and in what way it's good to waste both our time complaining about it
rather than just accepting the upload as-is.

Since each question here needs a day or two to be answered, and since
I'm not going to stall the update any more, I'll apply what will only
look like helping hiding problems, as well as the AFAICS undocumented
(https://www.debian.org/doc/manuals/developers-reference/pkgs.html#upload-stable)
stable->stretch change.

Working on Debian is so depressing these days.

- Sylvain



Bug#900920: stretch-pu: package freedink-dfarc/3.12-1+deb9u1

2018-06-09 Thread Adam D. Barratt
On Fri, 2018-06-08 at 20:12 +0200, Sylvain wrote:
> Hi,
> 
> On 08/06/2018 19:55, Adam D. Barratt wrote:
> > Control: tags -1 + confirmed
> > 
> > On Wed, 2018-06-06 at 19:54 +0200, b...@debian.org wrote:
> > > Please consider this update to freedink-dfarc for stretch.
> > > It fixes a security issue that can overwrite arbitrary user
> > > files.
> > > Sending to stable following security team's directions from 2018-
> > > 06-
> > > 01.
> > 
> > +freedink-dfarc (3.12-1+deb9u1) stable; urgency=high
> > 
> > Please use "stretch" as the distribution.
> > 
> > +  * Fix directory traversal in D-Mod extractor (CVE-2018-0496)
> > +  * Upload to 'stable' as security team rejected a DSA to
> > +'stretch-security' (no justification)
> > 
> > The changelog is not the place for such commentary - please remove
> > it.
> > 
> > With the above changes made, and assuming that the resulting
> > package
> > has been tested on stretch, please feel free to upload.
> 
> As per Social Contract #3 I do have to explain to my users why they
> get the security fix after the disclosure.
> 

As with basically all core teams, Debian's security team is generally
stretched in terms of manpower and can't handle every possible update
that's security-related. Things have to be prioritised and sometimes
those updates end up being provided via proposed-updates. That's always
going to be the case in a volunteer project, and even larger and/or
commercially-backed projects will still have to decide which updates
they handle before others. This isn't a problem as such, just the way
things are.

(There's an argument that co-ordinated disclosure is in fact hiding
issues in and of itself. I don't particularly subscribe to that, nor do
I believe that any of this is what SC3 is actually trying to ensure.)

> This is not a commentary, this is purely factual.

It's not a description of a change made to the package, nor information
that users need in order to decide whether they should be installing
it. As such, it is commentary. That has nothing to do with its  
factuality or otherwise.

Regards,

Adam



Bug#888561: jessie-pu: package nvidia-graphics-modules/340.106+3.16.0+1

2018-06-09 Thread Adam D. Barratt
On Mon, 2018-05-07 at 14:14 +0200, Andreas Beckmann wrote:
> Followup-For: Bug #888561
> 
> Hi,
> 
> updated to ABI 6 and uploaded binaries for amd64 and i386.
> 
> Refreshed debdiff attached.
> 

Unfortunately I missed the fact that the upload had ended up in NEW due
 to the kernel ABI change, and dak will no longer accept it because:

ArchiveException: n/nvidia-graphics-modules/nvidia-kernel-3.16.0-6-686-
pae_340.106+1+1+3.16.56-1_i386.deb: Built-Using refers to package linux
(= 3.16.56-1) not in target archive ftp-master.

Regards,

Adam



Bug#901155: transition: octave-4.4

2018-06-09 Thread Emilio Pozuelo Monfort
Control: tags -1 confirmed

On 09/06/18 16:22, Sébastien Villemot wrote:
> Package: release.debian.org
> Severity: normal
> User: release.debian@packages.debian.org
> Usertags: transition
> Control: forwarded -1 
> https://release.debian.org/transitions/html/auto-octave.html
> 
> Dear Release Team,
> 
> Please schedule a transition for octave 4.4. The new package is already in
> experimental.
> 
> Few reverse dependencies will need sourceful NMUs. In any case, we stand ready
> to NMU.

Go ahead.

Emilio



Processed: Re: Bug#901155: transition: octave-4.4

2018-06-09 Thread Debian Bug Tracking System
Processing control commands:

> tags -1 confirmed
Bug #901155 [release.debian.org] transition: octave-4.4
Added tag(s) confirmed.

-- 
901155: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901155
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems



Bug#901155: transition: octave-4.4

2018-06-09 Thread Sébastien Villemot
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: transition
Control: forwarded -1 
https://release.debian.org/transitions/html/auto-octave.html

Dear Release Team,

Please schedule a transition for octave 4.4. The new package is already in
experimental.

Few reverse dependencies will need sourceful NMUs. In any case, we stand ready
to NMU.

Thanks!

-- 
⢀⣴⠾⠻⢶⣦⠀  Sébastien Villemot
⣾⠁⢠⠒⠀⣿⡁  Debian Developer
⢿⡄⠘⠷⠚⠋⠀  http://sebastien.villemot.name
⠈⠳⣄  http://www.debian.org


signature.asc
Description: PGP signature


Processed: transition: octave-4.4

2018-06-09 Thread Debian Bug Tracking System
Processing control commands:

> forwarded -1 https://release.debian.org/transitions/html/auto-octave.html
Bug #901155 [release.debian.org] transition: octave-4.4
Set Bug forwarded-to-address to 
'https://release.debian.org/transitions/html/auto-octave.html'.

-- 
901155: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901155
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems