Bug#1042970: zoneminder: Embded cakephp

2023-08-03 Thread Bastien Roucariès
Source: zoneminder Severity: serious Justification: embded code copy Dear Maintainer, Your package include a copy of cake php. Could you use the packaged one ? Thanks signature.asc Description: This is a digitally signed message part.

Bug#976697: webext-umatrix: no longer developed upstream, remove or switch to LibreMatrix or?

2023-07-31 Thread Bastien Roucariès
Source: umatrix Followup-For: Bug #976697 Forwarded: https://gitlab.com/vannilla/ematrix/ Dear Maintainer, I have asked guidance to the last fork about firefox/chromium support. If not RM is the wayto go Bastien -- System Information: Debian Release: trixie/sid APT prefers testing-debug

Bug#1042757: ublock-origin: embded javascript lib

2023-07-31 Thread Bastien Roucariès
is due that for instance punycode was not in prefered form of modification due to being wepackaged (transpiled) in order to be an ES module. They may be other transpiled package in this subdirectory Bastien signature.asc Description: This is a digitally signed message part.

Bug#1042532: mediawiki: Vendoring a few javascript library without source

2023-07-31 Thread roucaries bastien
hi, Le lun. 31 juil. 2023 à 08:27, Kunal Mehta a écrit : > > Hi, > > On 7/29/23 16:44, Bastien Roucariès wrote: > > Dear Maintainer, > > > > resources/lib/ > > (https://sources.debian.org/src/mediawiki/1:1.39.4-2/resources/lib/) > > > > i

Bug#1042738: ruby-rails-assets-punycode: Do not ship libjs-punycode

2023-07-31 Thread Bastien Roucariès
Source: ruby-rails-assets-punycode Severity: serious Justification: source is missing Dear Maintainer, You package node-punycode without source... I plan to fix this Bastien signature.asc Description: This is a digitally signed message part.

Bug#1042715: php-horde-editor: Please drop ckeditor3

2023-07-30 Thread Bastien Roucariès
+ // Opera: 9.5+ After it will need to change if needed the config here in order to remove plugins https://sources.debian.org/src/php-horde- imp/6.2.27-3/imp-6.2.27/lib/Script/Package/Editor.php/?hl=33#L33 I could help if needed but I need a means to test the modification Bastien

Bug#1042536: firefox-esr: Please allow a smooth upgrade from webext-https-everywhere by providing/breaking/replace

2023-07-29 Thread Bastien Roucariès
Package: firefox-esr Version: 115.0.2esr-1 Severity: important control: clone -1 src:firefox control: clone -1 src:chromium Dear Maintainer, Could you allow by providing a webext-https-everywhere and correct break replace (versionned) a smooth upgrade for webext-https-everywhere

Bug#1042533: netdata: Please use packaged pako

2023-07-29 Thread Bastien Roucariès
also review the other js file and ask if needed help from debian javascript team to package Thanks Bastien signature.asc Description: This is a digitally signed message part.

Bug#1042532: mediawiki: Vendoring a few javascript library without source

2023-07-29 Thread Bastien Roucariès
pako). You could use the packaged library under debian Bastien signature.asc Description: This is a digitally signed message part.

Bug#1042531: novnc: Embded copy of node-pako

2023-07-29 Thread Bastien Roucariès
Source: novnc Severity: serious Justification: embed code copy Dear Maintainer, Your package include an embded code copy of node-pako (under vendor) Could you please use the packaged node-pako ? Thanks bastien signature.asc Description: This is a digitally signed message part.

Bug#1042529: sogo: Multiple embdeded and minified javascript library

2023-07-29 Thread Bastien Roucariès
point of view due to recent CVE for ckeditor) Could you deembed and use packaged library Thanks Bastien signature.asc Description: This is a digitally signed message part.

Bug#1042528: ldap-account-manager: Multiple embeded and minified javascript library

2023-07-29 Thread Bastien Roucariès
Source: ldap-account-manager Severity: serious Tags: ftbfs security Justification: FTBFS + security Dear Maintainer, Ldap-account-manager include a few vendored and outdated (without security support) javascript library Could you remove this depends and use packaged library Thanks

Bug#1042527: request-tracker5: Include ckeditor minimified

2023-07-29 Thread Bastien Roucariès
ckeditor. Note also that I am going to package ckeditor5 (ckeditor 4 is EOL) Bastien signature.asc Description: This is a digitally signed message part.

Bug#990028: /usr/bin/mogrify-im6.q16: raw support requires ufraw-batch which is no longer in Debian

2023-07-29 Thread Bastien ROUCARIES
ersion: 8:6.9.12.20+dfsg1-1 > > Done: Bastien Roucariès > > If just stumbled over this: > > ❯ identify -format "%f: %wx%h\n" "DSC_0597.NEF" > identify-im6.q16: delegate failed `'ufraw-batch' --silent --create-id=also > --out-type=png --out-dep

Bug#1042470: node-lodash: please add lodash-es

2023-07-28 Thread Bastien Roucariès
Package: node-lodash Version: 4.17.21+dfsg+~cs8.31.198.20210220-9 Severity: important Dear Maintainer, Could you add lodash-es mini package to lodash It is only running lodash modularize exports=es -o ./ and installing to right part. it is needed for ckeditor5 Thanks signature.asc

Bug#1041471: Reassign

2023-07-27 Thread Bastien Roucariès
as qemu bug Bastien signature.asc Description: This is a digitally signed message part.

Bug#1041552: HFS/HFS+ are insecure

2023-07-21 Thread Bastien Roucariès
Le vendredi 21 juillet 2023, 10:52:17 UTC Bastien Roucariès a écrit : > Le vendredi 21 juillet 2023, 08:55:39 UTC Marco d'Itri a écrit : > > efs > https://pypi.org/project/qnxmount/ claim to mount it. Check > > hfs > https://github.com/0x09/hfsfuse Corrected not supporte

Bug#1041552: HFS/HFS+ are insecure

2023-07-21 Thread Bastien Roucariès
Le vendredi 21 juillet 2023, 08:55:39 UTC Marco d'Itri a écrit : > efs https://pypi.org/project/qnxmount/ claim to mount it. Check > hfs https://github.com/0x09/hfsfuse > hfaplus https://github.com/0x09/hfsfuse > qnx6 Fuse ro filesystem https://pypi.org/project/qnxmount/ better support then

Bug#1041561: node-jszip-utils: Please create a dist version

2023-07-20 Thread Bastien Roucariès
Source: node-jszip-utils Severity: wishlist Dear Maintainer, Could you create a dist version and browserified version ? it is needed for some package in the tree Thanks bastien signature.asc Description: This is a digitally signed message part.

Bug#1041560: node-jszip: Please create a dist version

2023-07-20 Thread Bastien Roucariès
Source: node-jszip Severity: wishlist Dear Maintainer, Could you create a dist version and browerify version. It is needed for package in the tree Thanks Bastien signature.asc Description: This is a digitally signed message part.

Bug#1041471: src:isa-support: fails to migrate to testing for too long: new autopkgtest fails on armel

2023-07-19 Thread roucaries bastien
Hi Paul, It is a regression on qemu. I will disable the test but I will prefer qemu fixed. I could not reproduce on porter box, I get another qemu bug... Who is the specialist of qemu ? Bastien Le mer. 19 juil. 2023 à 10:45, Paul Gevers a écrit : > > Source: isa-support > Vers

Bug#923908: new upstream version available (9.2)

2023-07-18 Thread Bastien
consider automatically parsing for > notice of these kinds of changes? Not anymore. Regards, -- Bastien

Bug#1040488: CVE-2023-31606: REDOS

2023-07-06 Thread Bastien Roucariès
: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit origin: https://patch-diff.githubusercontent.com/raw/jgarber/redcloth/pull/75 bug-debian-security: https://security-tracker.debian.org/tracker/CVE-2023-31606 Signed-off-by: Bastien Roucari??s --- lib/redcloth/formatters/html.rb

Bug#1040141: FTBFS: FAIL: TestCheckoutGit

2023-07-02 Thread Bastien Roucariès
: exit status 128 I am currently debugging this regression. Bastien signature.asc Description: This is a digitally signed message part.

Bug#1040044: yajl: Move to better maintained fork

2023-07-01 Thread Bastien Roucariès
Source: yajl Version: 2.1.0-3 Severity: important Forwarded: https://github.com/lloyd/yajl/issues/252 Dear Maintainer, yajl upstream seems to be dead Could you please move to https://github.com/openEuler-BaseService/yajl Thanks rouca -- System Information: Debian Release: trixie/sid APT

Bug#1039518: fs-uae: please repack to not embed lua

2023-06-26 Thread Bastien Roucariès
Source: fs-uae Severity: important Dear Maintainer, Your package embed lua; It is best practice to repack in order to avoid accidental compilation Thanks Bastien -- System Information: Debian Release: trixie/sid APT prefers testing-debug APT policy: (900, 'testing-debug'), (900

Bug#1039505: freedroidrpg: Please remove external/lua

2023-06-26 Thread Bastien Roucariès
Source: freedroidrpg Version: 1.0-1 Severity: important Dear Maintainer, Cher julien Could you repack and remove the external lua (+ds suffix) ? It is best pratice to remove code embed old version of packaged software. Bastien -- System Information: Debian Release: trixie/sid APT prefers

Bug#1039119: darktable: use packaged lua

2023-06-26 Thread roucaries bastien
Le lun. 26 juin 2023 à 14:16, David Bremner a écrit : > > roucaries bastien writes: > > > > Yes in your case i cheched by grepping thé build log. Lua ils compiléd what > > why i set rc severity. > > I suspect that you saw a different package with Lua in the name, na

Bug#1039119: darktable: use packaged lua

2023-06-26 Thread roucaries bastien
Le lun. 26 juin 2023 à 06:45, David Bremner a écrit : > Bastien Roucariès writes: > > > Source: darktable > > Version: Use packaged lua > > Severity: serious > > Justification: embded code copy > > > > Dear Maintainer, > > > > It appear that

Bug#1039438: enigma: Embded and use lua copy (outdated)

2023-06-25 Thread Bastien Roucariès
Source: enigma Severity: serious Tags: security Justification: embded X-Debbugs-Cc: Debian Security Team Dear Maintainer, You ship a outdated and embed lua: - could you use the system library - repack in order to avoid compiling accidentally the embded version Bastien -- System Information

Bug#1039437: emscripten: Status of tests/third_party/

2023-06-25 Thread Bastien Roucariès
Source: src:emscripten Severity: important Dear Maintainer, A few system library are embdeded in tests/third_party/ and seems to be shipped as example. It is not really good for a security point of view Could you: - try to repack and avoid this - use embded library if possible rouca --

Bug#1039257: reassign

2023-06-25 Thread Bastien Roucariès
control: reassign -1 src:eja

Bug#1039257: eja: Please repack in order to avoid lua

2023-06-25 Thread Bastien Roucariès
Source: src:eja Severity: important Dear Maintainer, Could you repack in order to avoid to ship lua. It will avoid false positive for shipping lua and avoid to accidentally compile local lua instead of packaged lua Thanks Rouca -- System Information: Debian Release: trixie/sid APT prefers

Bug#1039119: darktable: use packaged lua

2023-06-25 Thread Bastien Roucariès
Source: darktable Version: Use packaged lua Severity: serious Justification: embded code copy Dear Maintainer, It appear that your package embded and compile lua Could you: - use the packaged lua lib - repack in order to avoid accidental reintroduction of compiling lua rouca -- System

Bug#1039118: blobby: Please repack in order to avoid to ship source copy of lua

2023-06-25 Thread Bastien Roucariès
Source: blobby Severity: important Dear Maintainer, Could you consider to repack in order to avoid to ship a non compiled lua ? It is alway better to repack in this case, it avoid accidental compilation of this embded library. Rouca -- System Information: Debian Release: trixie/sid APT

Bug#1039117: bam: Please repack in order to avoid lua

2023-06-25 Thread Bastien Roucariès
Source: bam Severity: important Dear Maintainer, Could you consider to repack in order to avoid third party library like lua. Even if they are not compiled, it could be accidentally compiled and thus is not best pratice Thanks Rouca -- System Information: Debian Release: trixie/sid APT

Bug#1039116: ardour: Please repack without third party library

2023-06-25 Thread Bastien Roucariès
Source: ardour Version: Please repack without third party library Severity: important Dear Maintainer, I was checking if your are affected by a lua security bug. It will be nice if you could strip (repack with +ds suffix) third party library. It is a good pratice to not ship third party library

Bug#1034847: First commit

2023-06-25 Thread Bastien Roucariès
Hi, I found the commit that remove the stack overlfow check line 688 https://github.com/lua/lua/commit/287b302acb8d925178e9edb800f0a8d18c7d35f6 Thus first introduced (if no backport) after 5.4.2 Bastien signature.asc Description: This is a digitally signed message part.

Bug#1039088: whitedb: embed yajl

2023-06-25 Thread Bastien Roucariès
Source: whitedb Version: embed yajl Severity: serious Justification: devref Dear Maintainer, Your package embed a copy of yajl. Could you: - compile against debian yajl package - remove by repacking the yajl code copy in order to accidentally compile the embed code copy Thanks Rouca --

Bug#1039087: epic-base: embed yajl

2023-06-25 Thread Bastien Roucariès
Source: epic-base Severity: serious Justification: devref Dear Maintainer, Your package embed a copy of yajl. Could you: - compile against the packaged yajl package - remove by repacking the embded code copy in order to avoid accidental compilation of the embed code copy Thanks Rouca --

Bug#1039086: collada2gltf: Embed yajl

2023-06-25 Thread Bastien Roucariès
Source: collada2gltf Severity: serious Justification: devref Dear Maintainer, Your package embed a copy a yajl Could you: - build against yajl package - remove by repacking the code copy in order to avoid in the future accidental code compilation against the embed code copy Thanks Bastien

Bug#1039085: burp: embed yajl

2023-06-25 Thread Bastien Roucariès
Source: burp Severity: serious Justification: devref Dear Maintainer, Your package embed a code copy of yajl. Could you: - build against yajl debian package - repack your package removing the emded code copy in order to avoid accidental compilation in future. Thanks rouca -- System

Bug#1039083: crun: Embed yajl

2023-06-25 Thread Bastien Roucariès
Source: crun Severity: serious Justification: embed code copy devref Dear Maintainer, Your package include an embed code copy of yajl Could you please: - deembed - the repack (+ds source if needed) in order to be sure it will be not compiled in by accident in newer release Thanks Bastien

Bug#1039082: r-cran-jsonlite: Include embed yajl library

2023-06-25 Thread Bastien Roucariès
Source: r-cran-jsonlite Severity: important Dear Maintainer, Your package include a embded copy of yajl (patched). You should try to use the upstream library if needed by using a thin layer of compatibility Thanks rouca -- System Information: Debian Release: trixie/sid APT prefers

Bug#1038902: docker.io: FTBFS skip btrfs

2023-06-23 Thread Bastien Roucariès
Le vendredi 23 juin 2023, 08:42:54 UTC Shengjing Zhu a écrit : > Control: severity -1 wishlist > Control: tags -1 patch > > On Fri, Jun 23, 2023 at 5:33 AM Bastien Roucariès wrote: > > > > Source: docker.io > > Severity: serious > > Tags: ftbfs > >

Bug#1038902: docker.io: FTBFS skip btrfs

2023-06-22 Thread Bastien Roucariès
Source: docker.io Severity: serious Tags: ftbfs control: tags -1 + patch Justification: FTBFS Dear Maintainer, I had applied the following patch for compiling under btrfs for buster. Could you refresh and apply for other version BastienFrom: =?utf-8?q?Bastien_Roucari=C3=A8s?= Date: Thu, 22

Bug#984748: gettext is wrongly marked Multi-Arch: foreign

2023-06-18 Thread roucaries bastien
Hi, Time to get to unstable post release Bastien Le dim. 26 févr. 2023 à 14:44, Bastien Roucariès a écrit : > > Source: gettext > Followup-For: Bug #984748 > Control: tags -1 + patch > > Dear Maintainer, > > I havve done a few patches for improving the situation. Pa

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-06-08 Thread Bastien Durel
Le mercredi 31 mai 2023 à 13:15 +0200, Stefan Eissing a écrit : > Hi Bastien, > > I was finally able to reproduce here what looks like the crashes you > see with mod_proxy_http2 (notice the careful wording). And I fixed it > in https://github.com/icing/mod_h2/releases/tag/v2.0.

Bug#1037219: bullseye-pu: package imagemagick/8:6.9.11.60+dfsg-1.3+deb11u2

2023-06-08 Thread Bastien Roucariès
the range of unsigned char +(Closes: #1016442) + * Fix CVE-2022-32546: Value outside the range of representable +values of type 'unsigned long' at coders/pcl.c, + * Use Salsa CI + + -- Bastien Roucariès Fri, 26 May 2023 07:10:27 + + imagemagick (8:6.9.11.60+dfsg-1.3+deb11u1) bullseye

Bug#1037176: ITP: typesense -- Fast, typo-tolerant search engine

2023-06-07 Thread Bastien ROUCARIES
data via a search UI in a site or app. > > I plan to package this under https://salsa.debian.org/debian/typesense. > If there's a matching packaging team, more than happy to move there! > It is useful for dyslexic people. Maybe accessibilty related team ? Bastien >

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-31 Thread Bastien Durel
Le 31/05/2023 à 13:15, Stefan Eissing a écrit : Hi Bastien, I was finally able to reproduce here what looks like the crashes you see with mod_proxy_http2 (notice the careful wording). And I fixed it in https://github.com/icing/mod_h2/releases/tag/v2.0.18 Looking forward to hear how it fares

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-24 Thread Bastien Durel
ok weird. Sorry. Hello, I've put it in use on my server. Do you need the configuration I use to serve these requests ? Thanks, -- Bastien

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-22 Thread Bastien Durel
Le lundi 22 mai 2023 à 16:36 +0200, Stefan Eissing a écrit : > > > > Am 19.05.2023 um 18:50 schrieb Bastien Durel : > > > > Le 19/05/2023 à 18:11, Stefan Eissing a écrit : > > > Hi Bastien, > > Hello > > > > > I am looking into the

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-19 Thread Bastien Durel
Le 19/05/2023 à 18:11, Stefan Eissing a écrit : Hi Bastien, Hello I am looking into the failures of mod_proxy_http2 and seeing an issue with connection reuse and subsequent handling of requests. Going back to the original issue, do you still see those with mod_h2 v2.0.15? That would

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-19 Thread Bastien Durel
Le jeudi 18 mai 2023 à 15:04 +0200, Bastien Durel a écrit : > Le 18/05/2023 à 14:41, Stefan Eissing a écrit : > > Did you have an warning message like "AH03516: unexpected NN > > streams in hold" at that time in out error log? > > No (grepping AH03516 in *.log ret

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-18 Thread Bastien Durel
Le 18/05/2023 à 14:41, Stefan Eissing a écrit : Did you have an warning message like "AH03516: unexpected NN streams in hold" at that time in out error log? No (grepping AH03516 in *.log returns nothing (nor does "streams in hold")) -- Bastien Durel

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-18 Thread Bastien Durel
n at any time during request processing > and > this makes it hard to reproduce issues in test cases. We have load > tests > with well-behaving clients. Tests with mis-behaving ones are the > tricky part. > > It would be helpful if you could try > https://github.com/icing/mod_h2/r

Bug#1036213: apache2: frequent SIGSEGV in mod_http2.so (purge_consumed_buckets)

2023-05-17 Thread Bastien Durel
Package: apache2 Version: 2.4.56-1~deb11u2 Severity: important Dear Maintainer, I see many segmentation faults in apache2, for exemple in the last 24h I got: Tue 2023-05-16 13:40:59 CEST 7757403333 11 present /usr/sbin/apache2 Tue 2023-05-16 13:52:44 CEST 7983293333 11

Bug#1034135: dnsmasq: Add autopkgtest for dnsmasq

2023-04-10 Thread Bastien Roucariès
Source: dnsmasq Severity: important Tags: patch Dear Maintainer, Please found a basic autopkgtest suite for dnsmasq from debian ELTS The udp packet size fail (and is incomplete) with older dnsmasq Thanks Bastien tests.tar.xz Description: application/xz-compressed-tar signature.asc

Bug#977027: [Pkg-javascript-devel] Bug#977027: rhino breaks dojo autopkgtest: Cannot set property "dojo" of null to "[object Object]"

2023-04-06 Thread Bastien ROUCARIES
Le jeu. 6 avr. 2023 à 11:24, Paul Gevers a écrit : > > Control: tags -1 pending patch > > On 06-04-2023 12:54, Paul Gevers wrote: > > I'm going to prepare NMU's for rhino and dojo and upload to DELAYED/5 > > Please find the debdiffs attached. Go ahead > > Paul > -- > Pkg-javascript-devel mailing

Bug#977027: [Pkg-javascript-devel] Bug#977027: rhino breaks dojo autopkgtest: Cannot set property "dojo" of null to "[object Object]"

2023-03-27 Thread Bastien ROUCARIES
smb and tt-rss can be > affected by the new rhino version. Wouldn't those packages depend on rhino > in > some way? To me it seems rhino is only required to build shrinksafe which > can > be used for compressing Javascript files. But maybe the dojo maintainers > can > chim

Bug#1033223: chromium: #ozone-platform-hint should be set to auto

2023-03-20 Thread Bastien Roucariès
? At least at this freeze time could you add a note on README.Debian ? Note that in order to change the flags manually, I have executed "chromium --ozone-platform=wayland" Bastien PS: set to patch because changing an option is like a patch -- System Information: Debian Release: bo

Bug#1033187: dpkg-dev: dpkg-buildpackage bissect will be helpful for regression testing

2023-03-19 Thread Bastien Roucariès
bissect patch queue by adding # to debian/patches/series Bastien -- Package-specific info: This system uses merged-usr-via-aliased-dirs, going behind dpkg's back, breaking its core assumptions. This can cause silent file overwrites and disappearances, and its general tools misbehavior. See <ht

Bug#1033162: Document proper strict depends like main-dev (= ${source:Version})) but NMU, backport and piupart safe

2023-03-18 Thread Bastien Roucariès
pratice ? gpg use something like: Depends: dirmngr (<< ${source:Version}.1~), dirmngr (>= ${source:Version}), Breaks: dirmngr (<< ${binary:Version}) What do you think ? That is the consensus ? Bastien signature.asc Description: This is a digitally signed message part.

Bug#1032299: bullseye-pu: package node-css-what/4.0.0-3

2023-03-03 Thread Bastien Roucariès
-2021-33587 (Closes: #989264, #1032188) + + -- Bastien Roucariès Wed, 01 Mar 2023 13:47:23 + + node-css-what (4.0.0-3) unstable; urgency=medium * Team upload diff -Nru node-css-what-4.0.0/debian/patches/0001-Partial-fix-of-reDos-CVE-2022-21222-CVE-2021-33587-a.patch node-css-what-4.0.0

Bug#1032188: old old stable debdiff

2023-03-01 Thread Bastien Roucariès
be triggered +via the parse function. +Fix CVE-2022-21222, CVE-2021-33587 (Closes: #989264, #1032188) + + -- Bastien Roucariès Wed, 01 Mar 2023 15:33:15 + + node-css-what (2.1.0-1) unstable; urgency=medium * new upstream version diff -Nru node-css-what-2.1.0/debian/patches/0001-Partial

Bug#1032188: Old stable debdiff

2023-03-01 Thread Bastien Roucariès
expression in the +re_attr variable. +The exploitation of this vulnerability could be triggered +via the parse function. +Fix CVE-2022-21222, CVE-2021-33587 (Closes: #989264, #1032188) + + -- Bastien Roucariès Wed, 01 Mar 2023 15:33:15 + + node-css-what (2.1.0-1) unstable

Bug#1032188: debdiff

2023-03-01 Thread Bastien Roucariès
in the +re_attr variable. +The exploitation of this vulnerability could be triggered +via the parse function. +Fix CVE-2022-21222, CVE-2021-33587 (Closes: #989264, #1032188) + + -- Bastien Roucariès Wed, 01 Mar 2023 13:47:23 + + node-css-what (4.0.0-3) unstable; urgency=medium * Team

Bug#1032188: node-css-what: CVE-2022-21222/CVE-2021-33587

2023-03-01 Thread Bastien Roucariès
Package: node-css-what Version: 4.0.0-3 Severity: serious Tags: security Justification: security X-Debbugs-Cc: Debian Security Team Dear Maintainer, Find the minimal ReDoS fix for 4.0.0, checked with recheck Bastien>From eeb1fafd26a9f09114b6f8282a9569f99d52d716 Mon Sep 17 00:00:00 2001 F

Bug#992150: Please allow symlink in system extension

2023-02-27 Thread Bastien Roucariès
They are other and this should be avoided Bastien -- Package-specific info: -- Addons package information -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386, armel Kernel: Linux

Bug#883179: dash: compiles in signals from build architecture when cross-compiled

2023-02-27 Thread Bastien Roucariès
Package: dash Followup-For: Bug #883179 Control: User debian-cr...@lists.debian.org Control: Usertags -1 + ftcbfs Add to the cross compile list of bug not really a ftcbfs but it is will lead to ftcbfs -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy:

Bug#1030991: lintian: checking intel-mkl takes 18 hours

2023-02-27 Thread Bastien Roucariès
> good to know. Performance is one thing we managed to get much better > in the past ¾ year or so, especially thanks to Bastien. But there is > obviously (and not only known since this bug report) place for > improvement. :-) Please note that cruft source could be run in parallel if

Bug#1032011: Fwd: Bug#1032011: gettext: Private library should go to private subdir under lib

2023-02-26 Thread Bastien Roucariès
Le dimanche 26 février 2023, 15:49:52 UTC Bruno Haible a écrit : > Santiago Vila wrote: > > Mensaje reenviado > > Asunto: Bug#1032011: gettext: Private library should go to private subdir > > under lib > > Fecha: Sun, 26 Feb 2023 14:57:45 +000

Bug#1032010: gettext: binary in /usr/lib should move to libexec

2023-02-26 Thread Bastien Roucariès
Le dimanche 26 février 2023, 15:16:03 UTC Santiago Vila a écrit : > El 26/2/23 a las 15:53, Bastien Roucariès escribió: > > Package: gettext > > Version: 0.21-11 > > Severity: minor > > Tags: upstream > > > > Dear Maintainer, > > > > As lin

Bug#1032011: gettext: Private library should go to private subdir under lib

2023-02-26 Thread Bastien Roucariès
This is an upstream bug that should be reported Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386, armel Kernel: Linux 6.1.0-1-rt-amd64 (SMP w/4 CPU threads; PREEMPT) Locale

Bug#1031859: false positive of embedded expat library leads to ftp-master rejection

2023-02-26 Thread Bastien Roucariès
control: tags -1 + moreinfo Le dimanche 26 février 2023, 13:17:54 UTC Matthias Klose a écrit : Hi, > control: tags -1 -moreinfo > > On 25.02.23 15:14, Bastien Roucariès wrote: > > control: tags -1 +moreinfo > > Le vendredi 24 février 2023, 11:28:18 UTC Matthias Klose a

Bug#1032010: gettext: binary in /usr/lib should move to libexec

2023-02-26 Thread Bastien Roucariès
Package: gettext Version: 0.21-11 Severity: minor Tags: upstream Dear Maintainer, As lintian reported binary in usr/lib/arm-linux-gnueabihf/gettext/ should move to usr/libexec/arm-linux-gnueabihf/gettext/ See https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s07.html -- System Information:

Bug#984748: gettext is wrongly marked Multi-Arch: foreign

2023-02-26 Thread Bastien Roucariès
Source: gettext Followup-For: Bug #984748 Control: tags -1 + patch Dear Maintainer, I havve done a few patches for improving the situation. Patch 2 may be reported upstream. From de101b8978f1612ea77d2a28d00fd3437158a95a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bastien=20Roucari=C3=A8s?= Date

Bug#1032009: gettext: Please add repo under gitlab salsa

2023-02-26 Thread Bastien Roucariès
Package: gettext Version: 0.21-11 Severity: wishlist Dear Maintainer, Could you add gettext under salsa. I could therefore create merge request for you Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64

Bug#1031952: gettext: Missing source for an installed windows binary

2023-02-25 Thread Bastien Roucariès
Package: gettext Version: 0.21-11 Severity: serious Tags: ftbfs upstream Justification: DFSG #2 User: lintian-ma...@debian.org Usertags: source-is-missing X-Debbugs-Cc: ftpmas...@debian.org Hi, your package includes some files that seem to lack sources in preferred forms of modification:

Bug#1031859: false positive of embedded expat library leads to ftp-master rejection

2023-02-25 Thread Bastien Roucariès
r/bin/python3.12d] > E: python3.12-minimal: embedded-library expat [usr/bin/python3.12] > E: python3.12-nopie: embedded-library expat [usr/bin/python3.12] Hi doko; Could you check why the "requested feature requires XML_DTD support in Expat" string is on the binary ? Bastien > > The

Bug#1023239: dracut: [regression] missing grep

2022-10-31 Thread Bastien Roucariès
from upstream ? Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386, armel Kernel: Linux 5.19.0-2-rt-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=fr_FR.UTF-8, LC_CTYPE

Bug#903158: Multi-Arch: foreign and -dbgsym: too weak dependency

2022-10-08 Thread Bastien ROUCARIES
er keep the status quo and > close the bug as wontfix or close the bug by removing the dependencies. > If you hoping for another outcome, I expect you to be ready to put the > effort and patches required to reach the outcome. > I think wontfix is the way to go but document also in devref.

Bug#1020747: AM_PATH_PYTHON

2022-09-30 Thread Bastien Roucariès
control: reassign -1 automake control: affects -1 autoconf-archive Hi, The macro AM_PATH_PYTHON dos not support 3 level python version... The bug lie in automake not autoconf-archive Could be workarround by a little sed script in order remove micro version on graph tool side Bastien

Bug#1020405: lintian: Tag license-problem-json-evil reports wrongly

2022-09-21 Thread Bastien Roucariès
control: tags -1 + moreinfo Le mercredi 21 septembre 2022, 10:00:40 UTC Hilmar Preusse a écrit : > Package: lintian > Version: 2.115.3 > Severity: normal > > Dear Maintainer, > > the upstream source code of package "asymptote" contains the rapidjson. > Lintian correctly complains:

Bug#1018966: widelands-data: RC

2022-09-06 Thread Bastien Roucariès
Package: widelands-data Version: 2:1.0-2 Followup-For: Bug #1018966 Control: severity -1 serious Control: tags -1 + patch Control: tags -1 - unreproducible Dear Maintainer, This is in fact an RC bug that should have been catch by piuparts Patch here not tested please test by runing CI on salsa

Bug#1019247: qemu-system-common: qemu-cpu-models documentation should be improved

2022-09-06 Thread Bastien Roucariès
36-r2" is actually the 1136 r0p2, i.e. an older core than plain "arm1136". In particular this does not have the v6K features. Thanks Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign

Bug#1018076: Add depends to armv6-support

2022-08-27 Thread Bastien Roucariès
Hi, adding support to armv6-support will help here Bastien

Bug#996415: mark libnghttp2-dev Multi-Arch: same

2022-08-20 Thread Bastien Roucariès
control: severity -1 important Hi Tomasz, Could you made a release of libnghttp2-dev by applying this patch ? We plan to boostrap nodejs on a new architecture and it will help us a lot. Thanks Bastien signature.asc Description: This is a digitally signed message part.

Bug#1012289: RFH: lintian -- Debian package checker

2022-08-18 Thread Bastien Roucariès
Le mardi 16 août 2022, 13:37:39 UTC Axel Beckert a écrit : Hi, I have just reinstanced the sliding windows on master. could you please check why autotest fail BTW I am really supprised that test are not run at build time Bastien > Hi Bastien, > > Bastien Roucariès wrote: > >

Bug#1017530: lintian: dwz generated file false positive

2022-08-17 Thread Bastien Roucariès
variation of false positive #955752... Because the tag is ftpmaster reject tag important. Thanks bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 5.18.0-2-rt

Bug#1017513: isa-support: mktemp on /usr/lib and base64 encoded binary in preinst are evil

2022-08-17 Thread Bastien Roucariès
Source: isa-support Version: 7 Severity: grave Tags: patch Justification: causes non-serious data loss Dear Maintainer, mktemp could fail and base64 is preinst is not nice -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture:

Bug#1017446: debian-policy: stress that preinst script that install by using base64 decode on self an elf binary is not a good stuff

2022-08-17 Thread roucaries bastien
Le mar. 16 août 2022 à 13:22, Sam Hartman a écrit : > > >>>>> "Bastien" == Bastien Roucariès writes: > Bastien> I will like to stress that this kind of stuff is bad: > Bastien> > https://salsa.debian.org/debian/isa-support/-/blob/master/deb

Bug#1017446: debian-policy: stress that preinst script that install by using base64 decode on self an elf binary is not a good stuff

2022-08-16 Thread Bastien Roucariès
have no idea about documentating why it is bad. But for the sake of history we must learn of mistake, and document it Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel

Bug#1012289: RFH: lintian -- Debian package checker

2022-08-16 Thread Bastien Roucariès
Source: lintian Version: 2.115.2 Followup-For: Bug #1012289 Dear Maintainer, I will restep to be a lintian maint.Could you please prepare a list of urgent action ? Bastien -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture

Bug#1014892: ITA: isa-support -- prevent installation on processors without required instructions

2022-08-15 Thread Bastien Roucariès
Source: isa-support Version: 7 Followup-For: Bug #1014892 Control: owner -1 ro...@debian.org Dear Maintainer, Ok for me to sponsor and comaintain -- System Information: Debian Release: bookworm/sid APT prefers testing APT policy: (900, 'testing') Architecture: amd64 (x86_64) Foreign

Bug#1017213: cross-toolchain-base: Patch for gcc11 support

2022-08-15 Thread Bastien Roucariès
Source: cross-toolchain-base Version: 59 Followup-For: Bug #1017213 Control: tags -1 + patch Dear Maintainer, Could you apply https://salsa.debian.org/toolchain-team/cross-toolchain- base/-/merge_requests/7 Thanks Rouca -- System Information: Debian Release: bookworm/sid APT prefers

Bug#1017398: glibc: Please create a virtual package gcc-glibcversion-source for easing crosstool

2022-08-15 Thread Bastien Roucariès
Source: glibc Version: 2.31-13+deb11u3 Severity: important Tags: patch Dear Maintainer, Could you please apply the https://salsa.debian.org/glibc- team/glibc/-/merge_requests/9 It will ease crossbuilding Thanks -- System Information: Debian Release: bookworm/sid APT prefers testing APT

Bug#1017213: Need gcc11

2022-08-15 Thread Bastien Roucariès
control: tags -1 + confirmed Need gcc11 ... Bastien /build/cross-toolchain-base-59.1/glibc-2.34/configure: line 2671: x86_64-linux- gnu-gcc-11: command not found configure:2673: $? = 127 configure: failed program was: | /* confdefs.h */ | #define PACKAGE_NAME "GNU C Library"

Bug#1017366: RFH: imagemagick -- image manipulation programs -- binaries

2022-08-14 Thread Bastien Roucariès
popcon. I will also need help in order to configure by debconf if user want to disable or not treatment of pdf/ps file for security reasons. Help is welcome Bastien

<    1   2   3   4   5   6   7   8   9   10   >