[Group.of.nepali.translators] [Bug 918489] Re: duplicity allows a new, different passphrase if an archive cache exists
It escaped my attention at the time, but Ubuntu 18.04 released with both a version of duplicity that shows the new incremental-backups-also-have- this-issue behavior (see my comment 22) and a release of deja-dup that wasn't yet fixed to avoid it. Which means that deja-dup in Ubuntu 18.04 is still affected by this bug (for incremental backups). These two commits landed in deja-dup 39.1 and should work around it, if someone wanted to patch deja-dup in 18.04 (I've opened a target for bionic for this bug): https://gitlab.gnome.org/World/deja-dup/-/commit/4f325940dae7fc259b4be70fccec40c94617f4d4 https://gitlab.gnome.org/World/deja-dup/-/commit/135f4c83774b6dafe194236f99f1405f45032498 For users, you can also install the snap version of deja-dup to avoid this as well. ** Also affects: duplicity (Ubuntu Bionic) Importance: Undecided Status: New ** Also affects: deja-dup (Ubuntu Bionic) Importance: Undecided Status: New -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/918489 Title: duplicity allows a new, different passphrase if an archive cache exists Status in Déjà Dup: Fix Released Status in Duplicity: Fix Released Status in deja-dup package in Ubuntu: Fix Released Status in duplicity package in Ubuntu: Triaged Status in deja-dup source package in Trusty: Fix Released Status in duplicity source package in Trusty: Confirmed Status in deja-dup source package in Xenial: Fix Released Status in duplicity source package in Xenial: Confirmed Status in deja-dup source package in Yakkety: Fix Released Status in duplicity source package in Yakkety: Confirmed Status in deja-dup source package in Bionic: New Status in duplicity source package in Bionic: New Bug description: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. === Ubuntu deja-dup SRU information === [impact] Users may unwittingly re-set their backup password and not be able to restore their data. [test case] - $ deja-dup-preferences # set up a dummy backup - $ deja-dup --backup # complete first encrypted full backup - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* - $ deja-dup --backup # second backup, enter the wrong password - $ deja-dup --restore # try to restore with original password [regression potential] Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. It's possible if a full backup is being resumed, we might delete the current progress. That is a better bug to have than this bug, though. A more complicated patch would need to be investigated to prevent that. To manage notifications about this bug go to: https://bugs.launchpad.net/deja-dup/+bug/918489/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1564778] Re: package libsane-common 1.0.25+git20150528-1ubuntu2 failed to install/upgrade: trying to overwrite '/etc/sane.d/hp.conf', which is also in package libsan
I've just uploaded all three (zesty, yakkety, and xenial) fixes. Better to just fix this now while the number of uploads is even smaller. :) I agreed with Nish about the versions, so I fixed them. ** Also affects: sane-backends (Ubuntu Xenial) Importance: Undecided Status: New ** Also affects: sane-backends (Ubuntu Yakkety) Importance: Undecided Status: New ** Also affects: sane-backends (Ubuntu Zesty) Importance: High Status: In Progress ** Description changed: - Unknown error. I Don't know + [ Impact ] - ProblemType: Package - DistroRelease: Ubuntu 16.04 - Package: libsane-common 1.0.25+git20150528-1ubuntu2 - ProcVersionSignature: Ubuntu 4.4.0-16.32-generic 4.4.6 - Uname: Linux 4.4.0-16-generic i686 - NonfreeKernelModules: wl - ApportVersion: 2.20.1-0ubuntu1 - Architecture: i386 - Date: Fri Apr 1 13:53:51 2016 - ErrorMessage: trying to overwrite '/etc/sane.d/hp.conf', which is also in package libsane:i386 1.0.23-3ubuntu3.1 - InstallationDate: Installed on 2013-06-17 (1019 days ago) - InstallationMedia: Ubuntu 13.04 "Raring Ringtail" - Release i386 (20130424) - PackageArchitecture: all - RelatedPackageVersions: - dpkg 1.18.4ubuntu1 - apt 1.2.9 - SourcePackage: sane-backends - Title: package libsane-common 1.0.25+git20150528-1ubuntu2 failed to install/upgrade: trying to overwrite '/etc/sane.d/hp.conf', which is also in package libsane:i386 1.0.23-3ubuntu3.1 - UpgradeStatus: Upgraded to xenial on 2016-03-28 (3 days ago) + This is a packaging error when upgrading from trusty to xenial. You may + see a file conflict error because a file moved from libsane to libsane- + common. This is fairly common, as you can see from the dupes and + affect-count. + + [ Test Case ] + + Install libsane and libsane-common on trusty. Upgrade to xenial. + + [ Regression Potential ] + + Tiny. This is just a Breaks/Conflict packaging error. No code changes. ** Description changed: [ Impact ] This is a packaging error when upgrading from trusty to xenial. You may see a file conflict error because a file moved from libsane to libsane- common. This is fairly common, as you can see from the dupes and affect-count. + + As described in comment #4, only xenial really needs to be patched. But + since it shares the same version of sane-backends as yakkety and zesty, + it's nice to update both of those so that upgraders get a clean path. [ Test Case ] Install libsane and libsane-common on trusty. Upgrade to xenial. [ Regression Potential ] Tiny. This is just a Breaks/Conflict packaging error. No code changes. -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1564778 Title: package libsane-common 1.0.25+git20150528-1ubuntu2 failed to install/upgrade: trying to overwrite '/etc/sane.d/hp.conf', which is also in package libsane:i386 1.0.23-3ubuntu3.1 Status in sane-backends package in Ubuntu: In Progress Status in sane-backends source package in Xenial: New Status in sane-backends source package in Yakkety: New Status in sane-backends source package in Zesty: In Progress Bug description: [ Impact ] This is a packaging error when upgrading from trusty to xenial. You may see a file conflict error because a file moved from libsane to libsane-common. This is fairly common, as you can see from the dupes and affect-count. As described in comment #4, only xenial really needs to be patched. But since it shares the same version of sane-backends as yakkety and zesty, it's nice to update both of those so that upgraders get a clean path. [ Test Case ] Install libsane and libsane-common on trusty. Upgrade to xenial. [ Regression Potential ] Tiny. This is just a Breaks/Conflict packaging error. No code changes. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/sane-backends/+bug/1564778/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1612600] Re: backuppc 3.3.1-2ubuntu3 breaks pool graphs on the Status page
** Also affects: backuppc (Ubuntu Xenial)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1612600
Title:
backuppc 3.3.1-2ubuntu3 breaks pool graphs on the Status page
Status in backuppc package in Ubuntu:
Fix Released
Status in backuppc source package in Xenial:
New
Bug description:
Upgraded system from 14.04 LTS to 16.04.1 LTS.
As a result, the rrd pool size graphs stopped displaying, instead
showing "default image" icons.
Investigation has shown that this is due to the permissions conflict.
Whatever user executes backuppc/index.cgi cannot run /usr/bin/rrdtool.
The fix is as per
https://sourceforge.net/p/backuppc/mailman/message/18724263/.
Namely, here's a relevant code snapshot in
/usr/share/backuppc/lib/BackupPC/CGI/GeneralInfo.pm:
$In{image} =~ /([0-9]+)/;
my $weeks = $1;
my $real = $<;# NEW
$< = $>; # NEW
print "Content-type: image/png\n\n";
print `/usr/bin/rrdtool graph - --imgformat=PNG --start=end-${weeks}w
--end=-300 --title="BackupPC Pool Size (${weeks} weeks)" --base=1000
--height=100 --width=600 --alt-autoscale-max --lower-limit=0
--vertical-label="" --slope-mode --font TITLE:10:Times --font AXIS:8:Times
--font LEGEND:8:Times --font UNIT:8:Times -c BACK#FF
DEF:ao="$LogDir/pool.rrd":ckb:AVERAGE CDEF:a=ao,1024,* AREA:a#95B8DB:"CPool in
bytes" GPRINT:a:LAST:"Current\\:%8.2lf %s" GPRINT:a:AVERAGE:"Average\\:%8.2lf
%s" GPRINT:a:MAX:"Maximum\\:%8.2lf %s\\n"`;
$< = $real; # NEW
return;
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/backuppc/+bug/1612600/+subscriptions
___
Mailing list: https://launchpad.net/~group.of.nepali.translators
Post to : group.of.nepali.translators@lists.launchpad.net
Unsubscribe : https://launchpad.net/~group.of.nepali.translators
More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1447715] Re: dhclient -6: Can't bind to dhcp address: Cannot assign requested address
Thank you Dan, for the analysis. Per comment #23, I'll mark Won't Fix for xenial. ** Changed in: ifupdown (Ubuntu Xenial) Status: In Progress => Won't Fix -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1447715 Title: dhclient -6: Can't bind to dhcp address: Cannot assign requested address Status in ifupdown package in Ubuntu: Fix Released Status in ifupdown source package in Xenial: Won't Fix Status in ifupdown package in Debian: Fix Released Bug description: [Impact] When using dhcpv6 configured via ifupdown, the interface's dhcp client fails to start at boot with the error: Can't bind to dhcp address: Cannot assign requested address This is because ifupdown doesn't wait, after bringing the interface up, for it to complete its link-local Duplicate Address Detection (DAD), and the dhcp client can't bind to the link-local address because it's still in "tentative" state (until DAD completes). This is fixed upstream in debian ifupdown in version 0.8.11 by adding '-tentative' to the /lib/ifupdown/wait-for-ll6.sh script; before the script was only waiting for the link-local address to appear, now it waits until the link-local address appears and is not in 'tentative' state. [Test Case] Configure an interface, using ifupdown, with dhcpv6 (e.g. iface eth0 inet6 dhcp) and reboot. It will fail to get a dhcp address during boot. [Regression Potential] None [Other Info] After upgrading to Ubuntu 15.04 my computer is unable to obtain an IPv6 address via DHCPv6. The root cause is that dhclient is exiting with the following message: - Can't bind to dhcp address: Cannot assign requested address Please make sure there is no other dhcp server running and that there's no entry for dhcp or bootp in /etc/inetd.conf. Also make sure you are not running HP JetAdmin software, which includes a bootp server. If you think you have received this message due to a bug rather than a configuration issue please read the section on submitting bugs on either our web page at www.isc.org or in the README file before submitting a bug. These pages explain the proper process and the information we find helpful for debugging.. exiting. - The problem seems to exist in isc-dhcp-client 4.3.1-5ubuntu2 (15.04 version) because downgrading to isc-dhcp-client 4.2.4-7ubuntu14 (14.10 version) allows me to obtain an address. NetworkManager is the one launching dhclient. The two invocations (one for IPv4 and one for IPv6) are: dhclient_start(): running: /sbin/dhclient -d -q -sf /usr/lib/NetworkManager/nm-dhcp-helper -pf /run/sendsigs.omit.d /network-manager.dhclient-eth0.pid -lf /var/lib/NetworkManager /dhclient-c0a3dfde-5c0b-4cef-9c3b-563cfb1fb9d2-eth0.lease -cf /var/lib/NetworkManager/dhclient-eth0.conf eth0 dhclient_start(): running: /sbin/dhclient -d -q -6 -N -sf /usr/lib/NetworkManager/nm-dhcp-helper -pf /run/sendsigs.omit.d /network-manager.dhclient6-eth0.pid -lf /var/lib/NetworkManager/dhclient6-c0a3dfde-5c0b-4cef-9c3b- 563cfb1fb9d2-eth0.lease -cf /var/lib/NetworkManager/dhclient6-eth0.conf eth0 I do not see anything suspicious with the way both dhclients are invoked. Given that a downgrade allows me to obtain an IPv6 address I think this might be a bug in the ISC DHCP client rather than in NetworkManager. Related Bugs: * bug 1633479: dhclient does not wait for ipv6 dad (duplicate address detection) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ifupdown/+bug/1447715/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1628289] Re: snapd should depend on squashfuse (for use in containers)
Resetting bug status for MIR portion. I generally find it easier to follow MIR bugs when they are separate, but it's fine, we can do it here too. Doko, can you take this one? ** Changed in: squashfuse (Ubuntu) Status: Fix Released => New ** Changed in: squashfuse (Ubuntu) Assignee: Stéphane Graber (stgraber) => Matthias Klose (doko) -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1628289 Title: snapd should depend on squashfuse (for use in containers) Status in Snappy: Triaged Status in squashfuse package in Ubuntu: New Status in squashfuse source package in Xenial: Fix Released Bug description: We're finally making progress on the apparmor stacking and snapd in container front. The next LXD release will include the needed support as will the kernel soon afterwards. With that, one can finally get snaps to install inside containers, but for any of it to work, squashfuse must be present in the container so that snapd can use it to mount the filesystem. squashfuse is in the archive and I've contributed support to snapd a while back, so all that should be needed is for the snapd package to be updated to depend or at least recommend squashfuse. To manage notifications about this bug go to: https://bugs.launchpad.net/snappy/+bug/1628289/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1621972] Re: python-murano-dashboard does not contain all required files
** Also affects: murano-dashboard (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: murano-dashboard (Ubuntu Xenial) Importance: Undecided => Medium ** Changed in: murano-dashboard (Ubuntu Xenial) Status: New => Confirmed ** Changed in: murano-dashboard (Ubuntu) Status: Confirmed => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1621972 Title: python-murano-dashboard does not contain all required files Status in murano-dashboard package in Ubuntu: Fix Released Status in murano-dashboard source package in Xenial: Confirmed Bug description: Currently murano-dashboard package (1:2.0.0-1) in Xenial [1] does not contain templates. Specifically folder: "/usr/lib/python2.7/dist-packages/muranodashboard/templates" Here is the link to the file list: http://packages.ubuntu.com/xenial/all/python-murano-dashboard/filelist http://paste.ubuntu.com/23155732/ Debian already includes required files: https://packages.debian.org/sid/all/python-murano-dashboard/filelist http://paste.ubuntu.com/23155734/ Fix was proposed by Thomas Goirand (zigo): https://anonscm.debian.org/cgit/openstack/murano-dashboard.git/tree/debian/patches/install-missing-files.patch Also it is highly recommended sync code with the latest version in stable/mitaka branch: https://review.openstack.org/gitweb?p=openstack/murano-dashboard.git;a=shortlog;h=refs/heads/stable/mitaka As it contains fix of CVE-2016-4972: https://review.openstack.org/#/c/333439/ The detailed instruction how to reproduce the issue was written by my manager (Igor Yozhikov): https://docs.google.com/document/d/1zf4WROMtd2Miq57WHDRRC7Qt-GZ6AIpQIlL2S3FT6Qo/view [1] http://packages.ubuntu.com/xenial/all/python-murano-dashboard To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/murano-dashboard/+bug/1621972/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 1645698] Re: [SRU] network-manager 1.2.4
** Also affects: network-manager (Ubuntu Xenial) Importance: Undecided Status: New ** Changed in: network-manager (Ubuntu) Status: Triaged => Invalid ** Changed in: network-manager (Ubuntu Xenial) Assignee: (unassigned) => Aron Xu (happyaron) ** Changed in: network-manager (Ubuntu Xenial) Status: New => Triaged -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1645698 Title: [SRU] network-manager 1.2.4 Status in network-manager package in Ubuntu: Invalid Status in network-manager source package in Xenial: Triaged Bug description: [Impact] This SRU would try to have the latest upstream point release of 1.2.x land in Xenial, which is the successor of the current 1.2.2 version, fixing quite some bugs that's suitable to land in the sable branch. [Test Case] After installing the updated version, users should be able to avoid some mem leak in some cases and have generally improved DNS related experiences. [Regression Potential] This version has been in yakkety for sometime, and there's no report of regressions until now. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/network-manager/+bug/1645698/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 918489] Re: duplicity allows bad passphrase on full backup if archive cache exists
** Tags removed: verification-needed ** Tags added: verification-needed-xenial ** Description changed: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. === Ubuntu deja-dup SRU information === [impact] Users may unwittingly re-set their backup password and not be able to restore their data. [test case] - $ deja-dup-preferences # set up a dummy backup - $ deja-dup --backup # complete first encrypted full backup - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* - $ deja-dup --backup # second backup, enter the wrong password - $ deja-dup --restore # try to restore with original password [regression potential] Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. + + It's possible if a full backup is being resumed, we might delete the + current progress. That is a better bug to have than this bug, though. + A more complicated patch would need to be investigated to prevent that. ** No longer affects: deja-dup (Ubuntu Precise) -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/918489 Title: duplicity allows bad passphrase on full backup if archive cache exists Status in Déjà Dup: Fix Released Status in Duplicity: New Status in deja-dup package in Ubuntu: Fix Released Status in deja-dup source package in Trusty: New Status in deja-dup source package in Xenial: Fix Committed Status in deja-dup source package in Yakkety: Triaged Bug description: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. === Ubuntu deja-dup SRU information === [impact] Users may unwittingly re-set their backup password and not be able to restore their data. [test case] - $ deja-dup-preferences # set up a dummy backup - $ deja-dup --backup # complete first encrypted full backup - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* - $ deja-dup --backup # second backup, enter the wrong password - $ deja-dup --restore # try to restore with original password [regression potential] Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. It's possible if a full backup is being resumed, we might delete the current progress. That is a better bug to have than this bug, though. A more complicated patch would need to be investigated to prevent that. To manage notifications about this bug go to: https://bugs.launchpad.net/deja-dup/+bug/918489/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 918489] Re: duplicity allows bad passphrase on full backup if archive cache exists
** Also affects: deja-dup (Ubuntu Precise) Importance: Undecided Status: New ** Also affects: deja-dup (Ubuntu Trusty) Importance: Undecided Status: New -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/918489 Title: duplicity allows bad passphrase on full backup if archive cache exists Status in Déjà Dup: Fix Released Status in Duplicity: New Status in deja-dup package in Ubuntu: Fix Released Status in deja-dup source package in Trusty: New Status in deja-dup source package in Xenial: Fix Committed Status in deja-dup source package in Yakkety: Triaged Bug description: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. === Ubuntu deja-dup SRU information === [impact] Users may unwittingly re-set their backup password and not be able to restore their data. [test case] - $ deja-dup-preferences # set up a dummy backup - $ deja-dup --backup # complete first encrypted full backup - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* - $ deja-dup --backup # second backup, enter the wrong password - $ deja-dup --restore # try to restore with original password [regression potential] Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. It's possible if a full backup is being resumed, we might delete the current progress. That is a better bug to have than this bug, though. A more complicated patch would need to be investigated to prevent that. To manage notifications about this bug go to: https://bugs.launchpad.net/deja-dup/+bug/918489/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
[Group.of.nepali.translators] [Bug 918489] Re: duplicity allows bad passphrase on full backup if archive cache exists
** Description changed: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. + + === Ubuntu deja-dup SRU information === + + [impact] + Users may unwittingly re-set their backup password and not be able to restore their data. + + [test case] + - $ deja-dup-preferences # set up a dummy backup + - $ deja-dup --backup # complete first encrypted full backup + - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* + - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* + - $ deja-dup --backup # second backup, enter the wrong password + - $ deja-dup --restore # try to restore with original password + + [regression potential] + Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. ** Also affects: deja-dup (Ubuntu Xenial) Importance: Undecided Status: New -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/918489 Title: duplicity allows bad passphrase on full backup if archive cache exists Status in Déjà Dup: Fix Released Status in Duplicity: New Status in deja-dup package in Ubuntu: Fix Released Status in deja-dup source package in Xenial: New Bug description: when doing a backup for the first time, dejadup verifies your passphrase by having you enter it twice. on future incremental backups it doesn't need to do this because entering the wrong password will result in the backup failing. with the periodic 'full' backups that happen from time to time, however, any password will be accepted. this can lead to a situation where you accidentally type the wrong password once and are left in a situation where you don't know what you typed and have no way to get your files (or do another incremental backup on top of it). i think this is what happened to me recently. clearly, the fix is to explicitly verify the passphrase is correct when doing a new full backup. this may be a duplicity bug. === Ubuntu deja-dup SRU information === [impact] Users may unwittingly re-set their backup password and not be able to restore their data. [test case] - $ deja-dup-preferences # set up a dummy backup - $ deja-dup --backup # complete first encrypted full backup - $ rename 's/\.2016/\.2000/' /path/to/test/backup/* - $ rename 's/\.2016/\.2000/' ~/.cache/deja-dup/*/* - $ deja-dup --backup # second backup, enter the wrong password - $ deja-dup --restore # try to restore with original password [regression potential] Should be limited? The fix is to delete the duplicity cache files, which ought to be safe to delete. To manage notifications about this bug go to: https://bugs.launchpad.net/deja-dup/+bug/918489/+subscriptions ___ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp
