[Pkg-javascript-devel] requirejs-text_2.0.12-2_amd64.changes ACCEPTED into unstable

2014-11-15 Thread Debian FTP Masters


Accepted:

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sat, 05 Jul 2014 23:36:26 +0200
Source: requirejs-text
Binary: node-requirejs-text
Architecture: source all
Version: 2.0.12-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers 

Changed-By: Jelmer Vernooij 
Description:
 node-requirejs-text - RequireJS/AMD loader plugin for text resources
Changes:
 requirejs-text (2.0.12-2) unstable; urgency=medium
 .
   * Use canonical URL in Vcs-Git header.
   * Bump standards version to 3.9.6 (no changes).
   * Change maintainer to JavaScript maintainers team, move myself to
 uploaders.
Checksums-Sha1:
 b45bdbfbb3859205140e42e72b7a06abb6b1baa6 2041 requirejs-text_2.0.12-2.dsc
 9c7bc3ddd62eeddc857f09e696a2567946f02334 2844 
requirejs-text_2.0.12-2.debian.tar.xz
 2fe95f98fe549d9a0b2ad5a61f8646a1335f49fc 11928 
node-requirejs-text_2.0.12-2_all.deb
Checksums-Sha256:
 3de0726743393f2d02f6ebca035d2fe37005e8de0df3899f4a283d12b1a1e021 2041 
requirejs-text_2.0.12-2.dsc
 c4360340932f6529fd1db1367a949195ef3af029816732dd70857c9c6746e8e5 2844 
requirejs-text_2.0.12-2.debian.tar.xz
 ef0e4de7203282ea45ed8ca0cb07922fce6df315c499ac9139337b3beef1d416 11928 
node-requirejs-text_2.0.12-2_all.deb
Files:
 f383b8af656e9164048d81a3ad266f36 2041 web extra requirejs-text_2.0.12-2.dsc
 b01ccf8a2d7868c941cc56378f55b448 2844 web extra 
requirejs-text_2.0.12-2.debian.tar.xz
 e34834bc606fa65fd9c72ed525b076eb 11928 web extra 
node-requirejs-text_2.0.12-2_all.deb

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQIcBAEBCgAGBQJUZ/bNAAoJEACAbyvXKaRXznMP/3VRx9f+yfNeQ6CnXccqaS2s
L6OFNvfCON7xA85RSuGOi936hbr7WClIFVxrluY761e32Sgp/1Ko+hxyOkxg3huX
zN+p8YAfs1Yb/kBLujeqHYhjxCtGsOVOqBRH0L4VmjrEKcBK4qT5gX9DsUGmyK6a
iV7MEH5DqPkxnr5ynyaXbvsxHUIv0f4MDYtl0rvtQSFGusB0FrcWpC02bxmFX5vN
arVCd3MKuKHBRu602w8+AIimjIyStGMz2iCQj7zDbrTLrnmkukvJggMdjkmrpFFL
29+IEiw1Z7S2Lt+75Iwl/sTxmcuDCERqKW+4jj5vZ9qdj1XhguP+e3x3csFfR6N4
721IuLu5Mm5qfT5ZFcow7KgZkiarOSFUKZqg+3+teh066egRnSSib+61KwQdKRJz
GX6inWkkAdSO3goCVCNg7rQDfMF6KB/1AhdYle6/HvNGEOUbRQ4UifW74wKU67xT
/nVG7UjnY/7SPU8KozDHvVsPgx+R6dk256bgQgGMYgSNHe5lJpIz7ksZXAYOKzpP
qU/SUiG8l0RAoK+GF5qT0gN1z2w4cb5nzEmK9LOwXfqAu+StstPrDWpTL5DgXnAy
EpAUnG1WaJzDQDyvid1FPYYIZmOX7qD/gXRNvqiTyd+lgZvDdFZ/PbEw6tgyh3Kl
bumETIJbDvheAqtwKhIb
=JviG
-END PGP SIGNATURE-


Thank you for your contribution to Debian.

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel


[Pkg-javascript-devel] Processing of requirejs-text_2.0.12-2_amd64.changes

2014-11-15 Thread Debian FTP Masters
requirejs-text_2.0.12-2_amd64.changes uploaded successfully to localhost
along with the files:
  requirejs-text_2.0.12-2.dsc
  requirejs-text_2.0.12-2.debian.tar.xz
  node-requirejs-text_2.0.12-2_all.deb

Greetings,

Your Debian queue daemon (running on host franck.debian.org)

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel


[Pkg-javascript-devel] Bug#768681: nodejs: FTBFS in jessie: tests failures

2014-11-15 Thread Jean Baptiste Favre
Hello,
We had a look on it during Debian BSP in Paris this week-end.
As commented in bug #766484 [1], this test fails since last openssl
upgrade to 1.0.1j-1.

I used debsnap to downgrade libssl-dev and libssl1.0.0. Build is
successfull up to libssl-dev 1.0.1i.

A patch [2] has been provided upstream for 0.10.33 release of nodejs.
But since the patch hasn't been merged into upstream master branch, I'm
sure it's a good idea to include it in the Debian package.

Regards,
Jean Baptiste

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766484#15
[2]
https://github.com/joyent/node/commit/707cc25011d142fe4ade14ce2aa083a96ef15bcb



signature.asc
Description: OpenPGP digital signature
___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#760385: Fix for CVE-2014-5256

2014-11-15 Thread Jean Baptiste Favre
I meant "I'm *not* sure I'll be able to deal with lib8-3.14

Sorry,
Jean Baptiste

On 15/11/2014 21:28, Jean Baptiste Favre wrote:
> Hello Thomas,
> Thanks for your update.
> 
> I decided to have a look on this bug because it seemed quite easy to fix
> it: upstream patch was available and small anough for me.
> Unfortunatly, I'm sure I'll be able to deal with lib8-3.14. The more I
> dig into, the less I understand (more or less) :)
> 
> I'll try anyway,
> Regards,
> Jean Baptiste
> 
> On 15/11/2014 20:44, Thomas Viehmann wrote:
>> Hi Jean Baptiste,
>>
>> thank you for looking into this.
>> Note that the changelog entries for nodejs 0.10.31 and .32 include
>>   v8: backport CVE-2013-6668
>>   v8: fix a crash introduced by previous release
>> If libv8 in Debian is affected by those, you might also consider also
>> backporting those fixes when preparing a new v8 package.
>>
>> (Elsewhere in NodeJS .33 there is "crypto: Disable autonegotiation for
>> SSLv2/3 by default", not sure whether the release team would let
>> something like that through.)
>>
>> Best regards
>>
>> Thomas
> 




signature.asc
Description: OpenPGP digital signature
___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#760385: Fix for CVE-2014-5256

2014-11-15 Thread Jean Baptiste Favre
Hello Thomas,
Thanks for your update.

I decided to have a look on this bug because it seemed quite easy to fix
it: upstream patch was available and small anough for me.
Unfortunatly, I'm sure I'll be able to deal with lib8-3.14. The more I
dig into, the less I understand (more or less) :)

I'll try anyway,
Regards,
Jean Baptiste

On 15/11/2014 20:44, Thomas Viehmann wrote:
> Hi Jean Baptiste,
>
> thank you for looking into this.
> Note that the changelog entries for nodejs 0.10.31 and .32 include
>   v8: backport CVE-2013-6668
>   v8: fix a crash introduced by previous release
> If libv8 in Debian is affected by those, you might also consider also
> backporting those fixes when preparing a new v8 package.
>
> (Elsewhere in NodeJS .33 there is "crypto: Disable autonegotiation for
> SSLv2/3 by default", not sure whether the release team would let
> something like that through.)
>
> Best regards
>
> Thomas



signature.asc
Description: OpenPGP digital signature
___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#760385: Fix for CVE-2014-5256

2014-11-15 Thread Thomas Viehmann

Hi Jean Baptiste,

thank you for looking into this.
Note that the changelog entries for nodejs 0.10.31 and .32 include
  v8: backport CVE-2013-6668
  v8: fix a crash introduced by previous release
If libv8 in Debian is affected by those, you might also consider also 
backporting those fixes when preparing a new v8 package.


(Elsewhere in NodeJS .33 there is "crypto: Disable autonegotiation for 
SSLv2/3 by default", not sure whether the release team would let 
something like that through.)


Best regards

Thomas

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel


[Pkg-javascript-devel] Bug#768754: backbone: FTBFS in jessie: build-dependency not installable: phantomjs

2014-11-15 Thread Jonas Smedegaard
Quoting intrigeri (2014-11-15 16:38:18)
> Andrey Rahmatullin wrote (12 Nov 2014 18:20:30 GMT) :
>> On Sun, Nov 09, 2014 at 06:10:57PM +0100, Felix Gruber wrote:
>>> phantomjs is currently not in jessie due to two RC bugs (#679759 and
>>> #699435).
>> ... and thus it won't be in jessie at all.
>
> wordpress build-depends on libjs-backbone (built by the backbone
> source package) which itself build-depends on phantomjs.
>
> phantomjs was removed from testing more that two years ago. It has 
>
>   * an open security issue (CVE-2013-4549)
>   * FTBFS on kfreebsd (#679759, which isn't RC anymore)
>   * so many embedded code copies (#699435) that the security team
> doesn't want to see it in a stable release "as long as it's using
> a copy of QT"
>
> I don't see how we can fix this situation in time for Jessie.
>
> How important is wordpress' build-dependency on libjs-backbone?
> Can it be removed?

backbone uses phantomjs only for improved regression testing, so I 
believe the better workaround is to simply drop that build-dependency 
for Jessie.

I will look into that shortly...

 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private


signature.asc
Description: signature
___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#768754: backbone: FTBFS in jessie: build-dependency not installable: phantomjs

2014-11-15 Thread intrigeri
Hi wordpress maintainers,

Andrey Rahmatullin wrote (12 Nov 2014 18:20:30 GMT) :
> On Sun, Nov 09, 2014 at 06:10:57PM +0100, Felix Gruber wrote:
>> phantomjs is currently not in jessie due to two RC bugs (#679759 and
>> #699435).
> ... and thus it won't be in jessie at all.

wordpress build-depends on libjs-backbone (built by the backbone
source package) which itself build-depends on phantomjs.

phantomjs was removed from testing more that two years ago. It has 

  * an open security issue (CVE-2013-4549)
  * FTBFS on kfreebsd (#679759, which isn't RC anymore)
  * so many embedded code copies (#699435) that the security team
doesn't want to see it in a stable release "as long as it's using
a copy of QT"

I don't see how we can fix this situation in time for Jessie.

How important is wordpress' build-dependency on libjs-backbone?
Can it be removed?

Cheers,
--
intrigeri

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel



[Pkg-javascript-devel] Bug#760385: nodejs: V8 Memory Corruption and Stack Overflow

2014-11-15 Thread Jérémy Lal
Yes i think you can,
you have to build the package, run abi-compliance-checker,
patch, rebuild, rerun a-c-c and compare.

To run a-c-c you might find some example config at:
http://upstream.rosalinux.ru/versions/v8.html
(click [show log])


Le samedi 15 novembre 2014 à 15:50 +0100, Jean Baptiste Favre a écrit :
> Maybe I can help to check wether ABI changed or not.
> How can I check that ?
> 
> Regards,
> Jean Baptiste
> 
> On 15/11/2014 14:44, Jérémy Lal wrote:
> > reassign 760385 libv8-3.14
> > thanks
> >
> > The problem with that patch is that i can't tell if libv8-3.14 ABI
> > changes with it or not.
> > I had plans to use abi-compliance-checker in debian/rules, unfortunately
> > i need to spend my time on the paid job if i want to heat my house this
> > winter :(
> >
> > Jérémy.
> >
> >
> > Le samedi 15 novembre 2014 à 13:15 +0100, Jean Baptiste Favre a écrit :
> > > Hello,
> > > We added upstream patch provided from [1] during Debian BSP in Paris.
> > >
> > > Package build went well, even if we face an error during tests.
> > > This error is referenced and has been commented in bug #766484 and is
> > > related to libssl-dev version.
> > >
> > > Please find patch attached.
> > >
> > > Regards,
> > > Jean Baptiste
> > >
> > > [1] http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#760385: nodejs: V8 Memory Corruption and Stack Overflow

2014-11-15 Thread Jean Baptiste Favre
Maybe I can help to check wether ABI changed or not.
How can I check that ?

Regards,
Jean Baptiste

On 15/11/2014 14:44, Jérémy Lal wrote:
> reassign 760385 libv8-3.14
> thanks
>
> The problem with that patch is that i can't tell if libv8-3.14 ABI
> changes with it or not.
> I had plans to use abi-compliance-checker in debian/rules, unfortunately
> i need to spend my time on the paid job if i want to heat my house this
> winter :(
>
> Jérémy.
>
>
> Le samedi 15 novembre 2014 à 13:15 +0100, Jean Baptiste Favre a écrit :
> > Hello,
> > We added upstream patch provided from [1] during Debian BSP in Paris.
> >
> > Package build went well, even if we face an error during tests.
> > This error is referenced and has been commented in bug #766484 and is
> > related to libssl-dev version.
> >
> > Please find patch attached.
> >
> > Regards,
> > Jean Baptiste
> >
> > [1] http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#766484: FTBFS in a cowbuilder: Error: listen EADDRNOTAVAIL

2014-11-15 Thread Jean Baptiste Favre
Hello,
Thanks for your explanations.
I figured out tests have been modified upstream in branch 0.10.33-release, but 
not in master [1].

I can prepare and provide you with a patch so that nodejs could build on 
jessie, which could save you some time.
Would you mind sponsoring it ?

Regards,
Jean Baptiste

[1] 
https://github.com/joyent/node/commit/707cc25011d142fe4ade14ce2aa083a96ef15bcb

On 15/11/2014 14:40, Jérémy Lal wrote:
> Le samedi 15 novembre 2014 à 12:39 +0100, Jean Baptiste Favre a écrit :
> > Hello,
> > We had a look on it during Paris BSP. Here is a summary of what we found.
> >
> > - nodejs was uploaded and build against libssl-dev 1.0.1h-2 [1]. At
> > this time, build went well
> > - in the meantime, libssl-dev has been updated to 1.0.1j-1. This
> > verison of libbssl-dev makes the test fail.
> > - downgrading libssl-dev to wheezy version (1.0.1e-2+deb7u12) allows
> > nodejs tests to pass successfully.
>
> Hello,
>
> this is expected: openssl disabled some transport (for security reasons)
> that nodejs 0.10.29 still tests.
> I have nodejs 0.10.33 ready in collab-maint, unfortunately we are frozen
> and from what i read of the freeze policy it won't be accepted into
> testing (no new upstream releases). I won't spend the day making patches
> just to work around that strict policy.
>
> Jérémy.

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Processed: Re: Bug#760385: nodejs: V8 Memory Corruption and Stack Overflow

2014-11-15 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

> reassign 760385 libv8-3.14
Bug #760385 [nodejs] nodejs: CVE-2014-5256
Bug reassigned from package 'nodejs' to 'libv8-3.14'.
No longer marked as found in versions nodejs/0.10.29~dfsg-1.
Ignoring request to alter fixed versions of bug #760385 to the same values 
previously set
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
760385: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760385
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel


[Pkg-javascript-devel] Bug#760385: nodejs: V8 Memory Corruption and Stack Overflow

2014-11-15 Thread Jérémy Lal
reassign 760385 libv8-3.14
thanks

The problem with that patch is that i can't tell if libv8-3.14 ABI
changes with it or not.
I had plans to use abi-compliance-checker in debian/rules, unfortunately
i need to spend my time on the paid job if i want to heat my house this
winter :(

Jérémy.


Le samedi 15 novembre 2014 à 13:15 +0100, Jean Baptiste Favre a écrit :
> Hello,
> We added upstream patch provided from [1] during Debian BSP in Paris.
> 
> Package build went well, even if we face an error during tests.
> This error is referenced and has been commented in bug #766484 and is
> related to libssl-dev version.
> 
> Please find patch attached.
> 
> Regards,
> Jean Baptiste
> 
> [1] http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#766484: FTBFS in a cowbuilder: Error: listen EADDRNOTAVAIL

2014-11-15 Thread Jérémy Lal
Le samedi 15 novembre 2014 à 12:39 +0100, Jean Baptiste Favre a écrit :
> Hello,
> We had a look on it during Paris BSP. Here is a summary of what we found.
> 
> - nodejs was uploaded and build against libssl-dev 1.0.1h-2 [1]. At
> this time, build went well
> - in the meantime, libssl-dev has been updated to 1.0.1j-1. This
> verison of libbssl-dev makes the test fail.
> - downgrading libssl-dev to wheezy version (1.0.1e-2+deb7u12) allows
> nodejs tests to pass successfully.

Hello,

this is expected: openssl disabled some transport (for security reasons)
that nodejs 0.10.29 still tests.
I have nodejs 0.10.33 ready in collab-maint, unfortunately we are frozen
and from what i read of the freeze policy it won't be accepted into
testing (no new upstream releases). I won't spend the day making patches
just to work around that strict policy.

Jérémy.

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#760385: nodejs: V8 Memory Corruption and Stack Overflow

2014-11-15 Thread Jean Baptiste Favre
Hello,
We added upstream patch provided from [1] during Debian BSP in Paris.

Package build went well, even if we face an error during tests.
This error is referenced and has been commented in bug #766484 and is
related to libssl-dev version.

Please find patch attached.

Regards,
Jean Baptiste

[1] http://blog.nodejs.org/2014/07/31/v8-memory-corruption-stack-overflow/
diff -Nru nodejs-0.10.29~dfsg/debian/changelog nodejs-0.10.29~dfsg/debian/changelog
--- nodejs-0.10.29~dfsg/debian/changelog	2014-06-13 23:58:23.0 +0200
+++ nodejs-0.10.29~dfsg/debian/changelog	2014-11-15 13:00:42.0 +0100
@@ -1,3 +1,10 @@
+nodejs (0.10.29~dfsg-1.1) UNRELEASED; urgency=medium
+
+  * Non-maintainer upload.
+  * Add patch for CVE-2014-5256 (Closes: #760385)
+
+ -- Jean Baptiste Favre   Sat, 15 Nov 2014 13:00:13 +0100
+
 nodejs (0.10.29~dfsg-1) unstable; urgency=medium
 
   * Upstream update.
diff -Nru nodejs-0.10.29~dfsg/debian/patches/fix_CVE-2014-5256.patch nodejs-0.10.29~dfsg/debian/patches/fix_CVE-2014-5256.patch
--- nodejs-0.10.29~dfsg/debian/patches/fix_CVE-2014-5256.patch	1970-01-01 01:00:00.0 +0100
+++ nodejs-0.10.29~dfsg/debian/patches/fix_CVE-2014-5256.patch	2014-11-15 13:10:33.0 +0100
@@ -0,0 +1,27 @@
+Description: Fix for CVE-2014-5256
+Bug-Node: https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356
+Author: Fedor Indutny 
+Acked-by: Jean Baptiste Favre 
+Last-Update: 2014-11-15
+Applied-Upstream: https://github.com/joyent/node/commit/530af9cb8e700e7596b3ec812bad123c9fa06356
+Index: nodejs-0.10.29~dfsg/deps/v8/src/isolate.h
+===
+--- nodejs-0.10.29~dfsg.orig/deps/v8/src/isolate.h	2014-11-15 10:45:49.962023622 +0100
 nodejs-0.10.29~dfsg/deps/v8/src/isolate.h	2014-11-15 10:45:49.962023622 +0100
+@@ -1392,14 +1392,9 @@
+  public:
+   explicit StackLimitCheck(Isolate* isolate) : isolate_(isolate) { }
+ 
+-  bool HasOverflowed() const {
++  inline bool HasOverflowed() const {
+ StackGuard* stack_guard = isolate_->stack_guard();
+-// Stack has overflowed in C++ code only if stack pointer exceeds the C++
+-// stack guard and the limits are not set to interrupt values.
+-// TODO(214): Stack overflows are ignored if a interrupt is pending. This
+-// code should probably always use the initial C++ limit.
+-return (reinterpret_cast(this) < stack_guard->climit()) &&
+-   stack_guard->IsStackOverflow();
++return reinterpret_cast(this) < stack_guard->real_climit();
+   }
+  private:
+   Isolate* isolate_;
diff -Nru nodejs-0.10.29~dfsg/debian/patches/series nodejs-0.10.29~dfsg/debian/patches/series
--- nodejs-0.10.29~dfsg/debian/patches/series	2014-06-13 23:36:52.0 +0200
+++ nodejs-0.10.29~dfsg/debian/patches/series	2014-11-15 13:00:11.0 +0100
@@ -13,3 +13,4 @@
 2014_donotinclude_root_certs.patch
 1006_relax_timeouts_in_tests.patch
 1007_revert_invalid_utf8_fix.patch
+fix_CVE-2014-5256.patch


signature.asc
Description: OpenPGP digital signature
___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel

[Pkg-javascript-devel] Bug#766484: FTBFS in a cowbuilder: Error: listen EADDRNOTAVAIL

2014-11-15 Thread Jean Baptiste Favre
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hello,
We had a look on it during Paris BSP. Here is a summary of what we found.

- - nodejs was uploaded and build against libssl-dev 1.0.1h-2 [1]. At
this time, build went well
- - in the meantime, libssl-dev has been updated to 1.0.1j-1. This
verison of libbssl-dev makes the test fail.
- - downgrading libssl-dev to wheezy version (1.0.1e-2+deb7u12) allows
nodejs tests to pass successfully.

[1]
https://buildd.debian.org/status/fetch.php?pkg=nodejs&arch=i386&ver=0.10.29~dfsg-1&stamp=1402698980

Regards,
JB
-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQJ8BAEBCgBmBQJUZztoXxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ0RTg0NUJBMjMwQ0I0RDQ0ODkwNjk4NDdC
NERENTM2QUNGN0Q4NzM3AAoJELTdU2rPfYc3rT8QAIqkrRe2F7niHZga/AAncfBX
ftcxwUflSYHkvDgn03SHZJwz0NEWIUgmTzLxsZjHbxYELXTpMs645UJJ5LRR4GBW
5q1yn++0KocNtBuCh9BKaAK2w1JvX4lHfz8XZGyQa3yjdwKAkchJJFDDLFTvX6iy
NAzH3SOljoIbie1NxIO+MgIu01fMWn334KHnWbFB7W5Mloc0s5HUiMAlBxNw052f
o4b2oiGGdo4dssuSYtH+hd9IT7JPjA+bZOBhYkTgOMmaonzeXJSVZOrrdUp5F7Ae
Stv22Rx4yaqpGbP/uB5CAOkpn5+BesBur6GG/sEeSKojHgAwl3MLXEkH+7h4x5zz
bVnk43G4HXLkNUHe/XaWqKTE6r5/pY9FehKbFVOAkF+FsCd4u5e4PpgEWWm/WUA2
8NexkCVrStp0s/rEsuygtCtk9CgMvkL23meFr5TNPPVNUvpUS0McoUwH5TAklFoo
BeDjEAngqnP/cdZDf3OJxq7XvgVW755ebzYbMHYA6MI3fZv3FcikXCmBqZkjUibC
roZXA82TXUR3G9a0PE3tP4Lw5SgKFmgglQN44Oe1V7rkae5CRZBX53oGsdByj0MO
iYoQaz+x1on5BOjxfXO1rRVmn2yTxlfTHH3qHf+eCZ5S6++6MITbSSuEOo8bfj76
32Wol1GRjP8OE6L+cLTI
=ZPkp
-END PGP SIGNATURE-

___
Pkg-javascript-devel mailing list
Pkg-javascript-devel@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-javascript-devel