Bug#767253: Please provide hashes for uncompressed Translation-*

2014-10-29 Thread Michael Vogt
Package: debian-cd Version: 3.1.15 Please include the uncompressed hashes for the i18n/Translation-* files in the cdrom Release file in addition to the compressed ones. This is required so that apt can ensure that the hashes are correct after uncompressing and will also allow us to unify the code

Bug#767253: Acknowledgement (Please provide hashes for uncompressed Translation-* )

2014-10-29 Thread Michael Vogt
Hi, I had a quick look at the debian-cd scripts and something like the attached (and totally untested) patch is probably sufficient. The idea is that we keep both Translation-* and Translation-*.gz around, then generate the Release file with the hashes and then remove the uncompressed files

Bug#767253: Please provide hashes for uncompressed Translation-*

2014-10-29 Thread Michael Vogt
On Wed, Oct 29, 2014 at 04:28:42PM +, Steve McIntyre wrote: Hi Michael! Hi Steve, thanks for your quick reply! On Wed, Oct 29, 2014 at 04:31:13PM +0100, Michael Vogt wrote: Package: debian-cd Version: 3.1.15 Please include the uncompressed hashes for the i18n/Translation-* files

Bug#759693: unattended-upgrades: please document how to configure the logging options

2014-10-28 Thread Michael Vogt
On Wed, Oct 22, 2014 at 07:35:40AM +0200, Alexandre Detiste wrote: control: reopen -1 Since this change, the mail I receive contains the changes from all previous days. See multiple 'Log Started' in attached mail. Thanks for your bugreport. The attached patch should fix this problem. It

Bug#753892: Regular expressions are indeed mandatory

2014-10-28 Thread Michael Vogt
On Wed, Oct 22, 2014 at 02:08:19PM +0200, Kai Storbeck wrote: Dear Maintainer, Hi Kai, thanks for your bugreport. I tried adding this package to the package-blacklist: libstdc++6 This will fail, as it is an invalid regular expression: [..] File /usr/lib/python2.7/re.py, line

Bug#767126: python-couchdb: [patch] ship couchdb-replicate as well and fix install failure

2014-10-28 Thread Michael Vogt
Package: python-couchdb Version: 0.10-1 Severity: normal Tags: patch User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu ubuntu-patch *** /tmp/tmp8IDN70/bug_body In Ubuntu, the attached patch was applied to achieve the following: * Merged from debian, remaining changes: - ship

Bug#766524: dpkg: Please provide a way to install/unpack/configure without using argv[]

2014-10-23 Thread Michael Vogt
Package: dpkg Severity: wishlist Dear Dpkg Maintainer, apt is currently unpacking/configuring packages by running dpkg --unpack pkg1.deb pkg2.deb ... pkgN.deb dpkg --configure pkg1 pkg2 ... pkgN this can be problematic for big installations when the commandline gets very long and exceeds

Bug#764678: dh-systemd: Please support systemd user services

2014-10-10 Thread Michael Vogt
Package: dh-systemd Severity: wishlist It would be very nice if dh-systemd would support systemd user units (both for detecting them during build time and to add something like systemctl --global enable my-user-unit to the debian/postinst). My use case is that the package installs a unit that

Bug#763780: apt-get: Insecure temporary changelog handling

2014-10-08 Thread Michael Vogt
On Thu, Oct 02, 2014 at 06:29:45PM +0200, Guillem Jover wrote: Package: apt Version: 0.8.7 Severity: serious Tags: security patch Thanks for your bugreport and your patch! I've found an instance of insecure temporary filenames handling. The problem is that the code correctly creates a

Bug#764442: apt: String overrun in RSHConn::WriteMsg() (transports rsh: and ssh:)

2014-10-08 Thread Michael Vogt
On Wed, Oct 08, 2014 at 02:49:40AM -0400, David Garfield wrote: Package: apt Version: 1.0.9.2 Severity: normal Thanks for your bugreport. In examining the sources in method/rsh.cc I ran across the function RSHConn::WriteMsg() The first thing it does is make a buffer of 512 bytes,

Bug#763399: Hardening dpkg/apt

2014-10-01 Thread Michael Vogt
On Mon, Sep 29, 2014 at 09:24:35PM +, ban...@openmailbox.org wrote: Package: apt Version: all Thanks for your bugreport. Sometimes apt/dpkg can contain vulnerable, remotely exploitable bugs which s a big risk when used over the untrusted internet. As it happens, anyone could have

Bug#710924: bug still exists

2014-09-29 Thread Michael Vogt
On Sun, Sep 28, 2014 at 11:21:29AM +0800, 積丹尼 Dan Jacobson wrote: # aptitude update [..] Err http://ftp.tw.debian.org experimental/main i386 Packages 406 Not Acceptable Err http://ftp.tw.debian.org experimental/contrib i386 Packages [..] E: Some index files failed to download. They have

Bug#762178: apt: massive a-g update slowdowns due to recent security fixes

2014-09-20 Thread Michael Vogt
On Fri, Sep 19, 2014 at 09:00:43AM +, Thorsten Glaser wrote: Package: apt Version: 1.0.9.1 Severity: minor Thanks for your bugreport. Michael Vogt requested I file this as official bugreport: The recent revalidation changes lead to a simple apt-get update on my buildd machine (m68k

Bug#762160: apt: [regression] 406 Not acceptable errors

2014-09-19 Thread Michael Vogt
On Fri, Sep 19, 2014 at 01:31:04PM +0800, Paul Wise wrote: Package: apt Version: 0.9.7.9+deb7u4 Severity: important Thanks for your bugreport and sorry for the trouble this is causing you. The recent apt security updates broke the Debian derivatives census scripts, various sites now return

Bug#762160: apt: [regression] 406 Not acceptable errors

2014-09-19 Thread Michael Vogt
On Fri, Sep 19, 2014 at 01:31:04PM +0800, Paul Wise wrote: The recent apt security updates broke the Debian derivatives census scripts, various sites now return 406 Not acceptable errors. The set of instructions below produces the errors on the second apt-get update run with apt

Bug#762079: apt: Hash Sum mismatch while sum checks since security update

2014-09-18 Thread Michael Vogt
On Thu, Sep 18, 2014 at 10:26:41AM +0200, b...@debian.org wrote: Package: apt Version: 0.9.7.9+deb7u3 Severity: important Thanks for your bugreport. [..] W: Failed to fetch file:/usr/src/debian-repository/local/Packages Hash Sum mismatch E: Some index files failed to download. They

Bug#757438: exposes entire dpkg upgrade log to non-root users

2014-09-11 Thread Michael Vogt
On Fri, Aug 08, 2014 at 03:00:19AM -0400, Joey Hess wrote: Package: unattended-upgrades Version: 0.79.5 Severity: normal Tags: security Thanks for your bugreport and sorry for my slow reply. /var/log/unattended-upgrades/ is readable by all, so when this package is run on a multi-user

Bug#759693: unattended-upgrades: please document how to configure the logging options

2014-09-11 Thread Michael Vogt
On Fri, Aug 29, 2014 at 05:21:02PM +0300, Martin-Éric Racine wrote: Package: unattended-upgrades Version: 0.82.8 Severity: normal Thanks for your bugreport. [..] While the number of older files kept as unattended-upgrades.log.[1-7].gz and unattended-upgrades-shutdown.log.[1-7].gz remains

Bug#759264: This change broke proxy support in apt for me

2014-09-11 Thread Michael Vogt
On Wed, Sep 10, 2014 at 05:24:37PM -0400, Lennart Sorensen wrote: After this change proxy handling is completely broken for me. I have this for a config: Acquire::http::Proxy-Auto-Detect /usr/local/sbin/getproxy; Acquire::http::Proxy::rceng02.eng.lan DIRECT;

Bug#760666: squid-deb-proxy writes to /var/log/squid3/netdb.state

2014-09-10 Thread Michael Vogt
On Sat, Sep 06, 2014 at 12:45:11PM -0500, Vagrant Cascadian wrote: Control: tag -1 patch On 2014-09-06 12:27:42 -0500, Vagrant Cascadian wrote: It seems like it should probably be writing to /var/log/squid-deb-proxy/netdb.state instead. Thanks a lot for the bugreport and the patch (and

Bug#283718: no_proxy variable not honored by apt-transport-https

2014-09-09 Thread Michael Vogt
On Tue, Sep 09, 2014 at 04:27:32PM +0200, Raoul Bhatia wrote: I'm seeing this issue with correctly working no_proxy settings via /etc/environment and/or /root/.bashrc, which are correctly working for e.g. w3m but are not honored via apt-transport-https. Thanks for your bugreport. [..]

Bug#753297: apt list --upgradable gives lot of false positives: possible solution

2014-09-05 Thread Michael Vogt
On Mon, Jul 21, 2014 at 05:52:11PM +0200, Michael Musenbrock wrote: Package: apt Version: 1.0.6 Followup-For: Bug #753297 Thanks for your patch! [..] for me the problem (listing packages as upgradable if they are not) occurs for all packages, which have a newer version in an archive with

Bug#755874: gobject-introspection: [patch] use multi-arch pathes for the .typelib files

2014-09-04 Thread Michael Vogt
On Sun, Aug 24, 2014 at 10:04:43PM +0100, Iain Lane wrote: Hi mvo, Hi Ian, On Thu, Jul 24, 2014 at 09:05:48AM +0200, Michael Vogt wrote: […] With this change most packages that ship a gir1.2-* package need a small change to their debian/gir1.2-foo.install file: - usr/lib/girepository

Bug#758615: [patch] more error handling remove global state

2014-09-02 Thread Michael Vogt
On Sun, Aug 31, 2014 at 06:10:36AM +0200, Guillem Jover wrote: Hi! Hello, On Tue, 2014-08-19 at 11:23:41 +0200, Michael Vogt wrote: [..] Some comments on the points raised in the review, although it's true that dpkg itself should only be dealing with “trusted” data, otherwise you are going

Bug#759612: apt: apt-cache segfaults when given some options

2014-09-02 Thread Michael Vogt
On Fri, Aug 29, 2014 at 10:45:09AM -0700, Dima Kogan wrote: David Kalnischkies da...@kalnischkies.de writes: [..] Hi David. Thank you for looking at this. Looking a bit more deeply, it looks like my shell was expanding ^xxx- to a list of all files in the local directory, and the cause of the

Bug#759655: tests fail with proxy

2014-09-02 Thread Michael Vogt
On Fri, Aug 29, 2014 at 09:13:00AM +0200, Martin Pitt wrote: Package: apt Version: 1.0.4 Thanks for your bugreport. Hello, In our CI environment we need to use a proxy to get to most internet sites: http_proxy=http://squid.internal:3128 https_proxy=http://squid.internal:3128

Bug#759264: apt: Please help with PAC support - proxy autoconfiguration files

2014-08-26 Thread Michael Vogt
On Mon, Aug 25, 2014 at 07:17:18PM -0700, Michael Vogt wrote: It would be useful to support PAC (proxy autoconfiguration files) with apt. Specifically, PAC files are simple javascript files that given a URL and HOST output a proxy setting. This can be trivially hooked up with Acquire::http

Bug#759264: apt: Please help with PAC support - proxy autoconfiguration files

2014-08-25 Thread Michael Vogt
On Mon, Aug 25, 2014 at 06:18:22PM +0100, Dimitri John Ledkov wrote: Package: apt Version: 1.0.4ubuntu6 Severity: wishlist Thanks for your bugreport. It would be useful to support PAC (proxy autoconfiguration files) with apt. Specifically, PAC files are simple javascript files that given a

Bug#758826: [patch] fix if $HOME is not writable

2014-08-22 Thread Michael Vogt
On Fri, Aug 22, 2014 at 05:12:53PM +0200, Guillem Jover wrote: Hi! Hi, On Thu, 2014-08-21 at 21:12:20 +0200, Michael Vogt wrote: Package: debsig-verify Version: 0.10 I ran into a issue today that debsig-verify would fail if $HOME was not writable to the debsig-verify progress

Bug#758826: updated patch

2014-08-22 Thread Michael Vogt
:00 2001 From: Michael Vogt m...@ubuntu.com Date: Fri, 22 Aug 2014 18:08:47 +0200 Subject: [PATCH] run gpg with its own temporary GNUPGHOME directory --- gpg-parse.c | 39 +-- 1 file changed, 33 insertions(+), 6 deletions(-) diff --git a/gpg-parse.c b/gpg

Bug#758826: [patch] fix if $HOME is not writable

2014-08-21 Thread Michael Vogt
Package: debsig-verify Version: 0.10 Hi, I ran into a issue today that debsig-verify would fail if $HOME was not writable to the debsig-verify progress. The reason is that gpg tries to create/read a ~/.gnupg/{pubring,secring}.gpg. Attached is a patch that run gpg with its own GNUPGHOME instead

Bug#758615: new patch

2014-08-20 Thread Michael Vogt
6db400f2d938dc967e657d29e483420636d5080d Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@ubuntu.com Date: Wed, 20 Aug 2014 14:13:29 +0200 Subject: [PATCH] use new struct debsig_ctx instead of a global state --- Makefile| 4 +-- ar-parse.c | 20 +++--- debsig-verify.c | 82

Bug#758525: Acknowledgement ([patch] Please allow a alternative policy directory)

2014-08-19 Thread Michael Vogt
My previous patch contained a missing instance of DEBSIG_KEYRINGS_FMT, I'm sorry for that. Attached is a updated version. From f2e7429cbc583d878f369498984729c7dc67126b Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@ubuntu.com Date: Mon, 18 Aug 2014 15:55:41 +0200 Subject: [PATCH] Add a new

Bug#758615: [patch] more error handling remove global state

2014-08-19 Thread Michael Vogt
/ubuntu/+source/debsig-verify/+bug/1358272/comments/2 From 8b89723dc6618d2718b4fa83d01c5df03ac83fca Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@ubuntu.com Date: Tue, 19 Aug 2014 10:09:24 +0200 Subject: [PATCH 1/5] add error checking on fork() --- gpg-parse.c | 12 +--- 1 file changed, 9

Bug#756357: squid-deb-proxy: refresh_pattern for .tar.xz and .tar.bz2

2014-08-18 Thread Michael Vogt
On Tue, Jul 29, 2014 at 12:34:00AM -0700, Vagrant Cascadian wrote: Package: squid-deb-proxy Version: 0.8.8 Severity: wishlist Tags: patch Thanks for your bugreport and your patch. I added this to the bzr tree and it will be part of the next upload. Thanks, Michael squid-deb-proxy.conf

Bug#758525: [patch] Please allow a alternative policy directory

2014-08-18 Thread Michael Vogt
meant for :). The man-page update is also missing but I'm happy to add that too if you are fine with the general idea. Thanks, Michael From da91646d4e910360eced3650732e4d2cdcd72296 Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@ubuntu.com Date: Mon, 18 Aug 2014 15:55:41 +0200 Subject: [PATCH] Add

Bug#755088: please show removals *last* in dist-upgrade

2014-07-29 Thread Michael Vogt
On Thu, Jul 17, 2014 at 12:28:09PM -0400, Joey Hess wrote: Package: apt Version: 1.0.5 Severity: wishlist Thanks for your bugreport. Many of apt's users are human, and thus prone to making mistakes. A common mistake seems to be running apt-get dist-upgrade and not noticing that it wants

Bug#756056: apt(8) manpage: bad grammar in description of upgrade

2014-07-29 Thread Michael Vogt
On Fri, Jul 25, 2014 at 09:02:27PM +0200, Jakub Wilk wrote: Package: apt Version: 1.1~exp2 Severity: minor Thanks a bunch! The apt(8) manpage reads: New package will be installed, but existing package will never removed. It should be s/will never/will be never/. Perhaps also

Bug#756162: nonexistent target release makes apt update segfault

2014-07-29 Thread Michael Vogt
On Sun, Jul 27, 2014 at 01:10:19AM +0200, Jakub Wilk wrote: Package: apt Version: 1.0.6 Thanks for your bugreport. # apt -t moostable update Hit http://ftp.debian.org unstable InRelease Hit http://ftp.debian.org experimental InRelease Hit http://ftp.debian.org unstable/main amd64

Bug#756200: apt: [INTL:pt] Updated Portuguese translation of manpage

2014-07-29 Thread Michael Vogt
On Sun, Jul 27, 2014 at 02:17:27PM +0100, Américo Monteiro wrote: Package: apt Version: 1.0.6 Tags: l10n, patch Severity: wishlist Updated Portuguese translation for apt's manpage. Translator: Américo Monteiro a_monte...@gmx.com Feel free to use it. For translation updates please

Bug#755874: gobject-introspection: [patch] use multi-arch pathes for the .typelib files

2014-07-24 Thread Michael Vogt
Package: gobject-introspection Version: 1.40.0-1ubuntu0.1 Severity: wishlist Tags: patch Hello, to install a cross build environment it would be great if the typelibs could be co-installed in a multiarch environment. Right now all foo-dev packages depend on gir1.2-foo. So when trying to install

Bug#755389: synaptic: List remaining files for package Not installed (residual config)

2014-07-21 Thread Michael Vogt
On Sun, Jul 20, 2014 at 11:19:06AM +0200, Christophe wrote: Package: synaptic Version: 0.81.2 Severity: wishlist Tags: upstream Thanks for your bugreport. After un-installing some packages, they end up in the Not installed (residual config) state. In general case, this is ok as is and

Bug#754817: apt-doc: [INTL:ja] New Japanese document translation

2014-07-16 Thread Michael Vogt
On Tue, Jul 15, 2014 at 01:15:04AM +0900, victory wrote: Package: apt-doc Version: 1.0.6 Severity: wishlist Tags: patch l10n Dear apt package maintainer, Here's Japanese document translation (ja.po) file that reviewed by several Japanese Debian developers and users. Could you

Bug#754904: apt-get install /dev/null segfaults

2014-07-16 Thread Michael Vogt
On Tue, Jul 15, 2014 at 09:26:31PM +0200, Jakub Wilk wrote: Package: apt Version: 1.1~exp2 Severity: minor Thanks for your bugreport. # apt-get install -qq /dev/null Segmentation fault It would be nice if apt could print a helpful error message instead of segfaulting. For example, this

Bug#742882: apt: Does not support LFS .deb packages on 32-bit systems

2014-07-08 Thread Michael Vogt
On Sat, Jul 05, 2014 at 01:17:24AM +0200, Guillem Jover wrote: [..] Ok, here's a first rough go at a patch. It breaks ABI, and just noticed an ABI breaking release was recently uploaded to experimental. :( Just wanted to publish it for now, in case your policy allows to merge this in the ABI

Bug#753531: apt-get clean executes 'rm /*' if Dir::Cache is set to

2014-07-08 Thread Michael Vogt
On Sun, Jul 06, 2014 at 01:05:16PM +0200, Cédric Barboiron wrote: On Thu, 3 Jul 2014 08:59:57 +0200 [..] Hi Michael, and thanks for your answer. The use-case was indeed to disable the bin cache. Your patch is a good protection against misreading the manual. Btw, I tried with '/dev/null'

Bug#754124: Error in `apt-extracttemplates': double free or corruption (fasttop)

2014-07-08 Thread Michael Vogt
On Mon, Jul 07, 2014 at 08:20:41PM +0200, Jakub Wilk wrote: Package: apt-utils Version: 1.1~exp1 Severity: important Thanks for your bugreport. $ apt-extracttemplates -h apt 1.1~exp1 for i386 compiled on Jun 22 2014 10:39:33 Usage: apt-extracttemplates file1 [file2 ...]

Bug#754041: apt-get build-dep pkgname no longer secure when cwd=/tmp

2014-07-08 Thread Michael Vogt
On Sun, Jul 06, 2014 at 11:49:26PM +0200, Jakub Wilk wrote: Package: apt Version: 1.1~exp1 Severity: minor Tags: security Thanks for your bugreport. First of all, thanks for bringing new exciting features to apt! I'm afraid, however, that one of these features, namely * add support

Bug#753297: apt list --upgradable gives lot of false positives

2014-07-08 Thread Michael Vogt
On Mon, Jun 30, 2014 at 03:27:01PM +0530, shirish शिरीष wrote: Package: apt Version: 1.0.5 Severity: normal Thanks for your bugreport. [..] apt list --upgradable gives lot of false positives. I did a run of index update and it said :- Reading package lists... Done Building dependency

Bug#752702: apt: please add a way to to retrieve the location of Packages/Sources files in /var/lib/apt/lists/

2014-07-08 Thread Michael Vogt
On Thu, Jun 26, 2014 at 11:13:28PM +0200, Johannes Schauer wrote: Hi, Hi, [..] I was thinking that it would nice if apt would provide an API to retrieve the location and properties of Packages and Sources files in /var/lib/apt/lists If apt had such an interface, then third party

Bug#753531: apt-get clean executes 'rm /*' if Dir::Cache is set to

2014-07-03 Thread Michael Vogt
On Wed, Jul 02, 2014 at 09:41:07PM +0200, Cédric Barboiron wrote: Package: apt Version: 1.0.5 Severity: important Thanks for your bugreport. (warning: attached patch is not a solution, it is just intended to show the problem) Setting Dir::Cache::archives and Dir::Cache to the empty

Bug#752327: apt: Passes full path to .deb to mkstemp

2014-06-25 Thread Michael Vogt
On Sun, Jun 22, 2014 at 06:25:12PM +0200, Axel Beckert wrote: Package: apt Version: 1.1~exp1 Severity: normal Thanks for your bugreport. first let me say Yay for apt install file.deb. We can finally get rid of gdebi! ;-) :) Playing around with this new feature, I ran into the following

Bug#705995: squid-deb-proxy: unowned files after purge (policy 6.8, 10.8): /etc/squid-deb-proxy/*.d/10-default

2014-06-24 Thread Michael Vogt
On Thu, Jun 19, 2014 at 02:44:48PM -0700, Vagrant Cascadian wrote: [..] The following patch should fix this, using the same variable names in postinst: [..] Though simply rm -f /etc/squid-deb-proxy/*.d/10-default would be simpler, at risk of deleting some randomly created file dropped in some

Bug#749795: apt: no authentication checks for source packages

2014-06-18 Thread Michael Vogt
On Mon, Jun 16, 2014 at 11:18:27AM +0200, Jakub Wilk wrote: * Michael Vogt m...@debian.org, 2014-06-16, 09:35: + _error-Warning(_(The data from '%s' is not signed. All packages from + that repository can not be authenticated.), s/can not/cannot/ Also, All

Bug#751388: apt: Run 'apt list --upgradable' to see them. when no packages can be upgraded

2014-06-18 Thread Michael Vogt
On Thu, Jun 12, 2014 at 01:54:16PM +0200, Jakub Wilk wrote: Package: apt Version: 1.0.4 Severity: minor Thanks for your bugreport. apt update has just told me: 0 packages can be upgraded. Run 'apt list --upgradable' to see them. Technically this is true that I can run 'apt list

Bug#749795: apt: no authentication checks for source packages

2014-06-16 Thread Michael Vogt
On Mon, Jun 16, 2014 at 02:58:28PM +0200, Christoph Anton Mitterer wrote: On Mon, 2014-06-16 at 09:35 +0200, Michael Vogt wrote: I think for the future we actually should not allow a apt-get update of untrusted repos without --allow-unauthenticated or [trusted=no]. But this will probably

Bug#749795: apt: no authentication checks for source packages

2014-06-16 Thread Michael Vogt
On Fri, May 30, 2014 at 03:21:20PM +0200, Michael Vogt wrote: [..] Hmm. There is no warning suggesting that anything fishy is going on, and the exit code indicates success. (Perhaps the Igns could raise suspicion of an observant sysadmin. But who knows what Ign exactly means? At least

Bug#749795: apt: no authentication checks for source packages

2014-06-12 Thread Michael Vogt
On Thu, Jun 12, 2014 at 11:44:20AM +0200, Thijs Kinkhorst wrote: Hi, apt: no authentication checks for source packages The Debian security team has assigned CVE-2014-0478 to this issue. APT developers: we should fix this in wheezy. Are you able to provide an update for wheezy for this

Bug#749795: apt: no authentication checks for source packages

2014-06-12 Thread Michael Vogt
/changelog 2013-11-16 12:47:12.0 +0100 +++ apt-0.9.7.9+deb7u2/debian/changelog 2014-06-12 13:22:44.0 +0200 @@ -1,3 +1,10 @@ +apt (0.9.7.9+deb7u2) wheezy; urgency=low + + * SECURITY UPDATE: apt-get source validation +- CVE-2014-0478 + + -- Michael Vogt m...@debian.org Thu, 12 Jun 2014

Bug#749795: apt: no authentication checks for source packages

2014-06-12 Thread Michael Vogt
source validation (closes: #749795) +- CVE-2014-0478 + * SECURITY UPDATE: sensitive information disclosure via incorrect +hostname validation (LP: #868353) +- methods/https.cc: properly set CURLOPT_SSL_VERIFYHOST. +- CVE-2011-3634 + + -- Michael Vogt m...@debian.org Thu, 12 Jun 2014

Bug#747498: python-apt: Please consider adding information templates for blankon

2014-06-06 Thread Michael Vogt
On Fri, May 09, 2014 at 11:36:23AM +, Rahman Yusri Aftian wrote: Package: python-apt Version: 0.9.3.6 Severity: normal Tags: patch Thanks for your bugreport. Dear Maintainer, I notice that you include settings for debian and ubuntu in the debian source package. Please consider

Bug#750120: python-apt: Some locales use no-breaking space for LC_NUMBER, so return unicode for SizeToStr

2014-06-06 Thread Michael Vogt
On Sun, Jun 01, 2014 at 09:18:45PM +0200, Odin Hørthe Omdal wrote: Package: python-apt Version: 0.9.3.5 Severity: normal Tags: upstream l10n patch Thanks for your bugreport and your patch! this is on Ubuntu, but this was the closest I could find to the python-apt upstream :) This is

Bug#748922: python-apt: TagFile doesnt close file

2014-06-06 Thread Michael Vogt
On Thu, May 22, 2014 at 11:57:12AM +0200, Johannes Schauer wrote: Package: python-apt Version: 0.9.3.5 Severity: normal Thanks for your bugreport. Consider the following snippet: --%--- import gc import os import sys import apt_pkg

Bug#750528: celery: build-depend on python-sphinxcontrib.issuetracker no longer needed(?)

2014-06-04 Thread Michael Vogt
Source: celery Version: 3.1.11-1 Severity: minor Hi, it appears that with the latest version of shpinx the build-depend on python-sphinxcontrib.issuetracker is no longer needed. It builds fine without and it was removed from requirements/docs.txt too. Thanks, Michael -- System Information:

Bug#749795: apt: no authentication checks for source packages

2014-06-02 Thread Michael Vogt
On Sat, May 31, 2014 at 12:07:48AM +0200, David Kalnischkies wrote: On Fri, May 30, 2014 at 03:21:20PM +0200, Michael Vogt wrote: From b7f501b5cc8583f61467f0c7a0282acbb88e4b29 Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@debian.org Date: Fri, 30 May 2014 14:47:56 +0200 Subject: [PATCH

Bug#749795: apt: no authentication checks for source packages

2014-05-30 Thread Michael Vogt
that needs fixing. Attached is a patch that addresses the issue. Cheers, Michael From b7f501b5cc8583f61467f0c7a0282acbb88e4b29 Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@debian.org Date: Fri, 30 May 2014 14:47:56 +0200 Subject: [PATCH] Show unauthenticated warning for source packages as well

Bug#748389: apt: verbose option

2014-05-22 Thread Michael Vogt
On Fri, May 16, 2014 at 10:10:07PM +0200, Reiner wrote: Package: apt Version: 1.0.3 Severity: wishlist Thanks for your bugreport. it would be nice to get a verbose option in apt similar aptitude -v update like this: apt -v update Hit ... Hit ... Current status: 0 broken [+0], 3

Bug#747566: synaptic: Filtered list rendered incorrectly after refresh

2014-05-10 Thread Michael Vogt
On Fri, May 09, 2014 at 09:22:44PM -0400, Scott Talbert wrote: Package: synaptic Version: 0.81.1 Severity: normal Thanks for your bugreport. Problem originally reported in Ubuntu (#1309369) but reproducible in Debian unstable: 1) Open Synaptic 2) (with apt-xapian-index) Search for

Bug#726163: multiarch upgrade issue

2014-05-05 Thread Michael Vogt
+ to support multiarch upgrades of e.g. libsmbclient + (LP: #1308657) + + -- Michael Vogt michael.v...@ubuntu.com Mon, 05 May 2014 08:07:41 +0200 + talloc (2.1.0-2) unstable; urgency=medium * Change maintainer to Samba Debian maintainers. diff -Nru talloc-2.1.0/debian/control talloc-2.1.0

Bug#747094: bash-completion: [patch] add support for the new apt command

2014-05-05 Thread Michael Vogt
Package: bash-completion Version: 1:2.1-4 Severity: wishlist Tags: patch Hi, please consider adding bash completion support for the new apt command. I filed a bug upstream with a patch some days ago: https://alioth.debian.org/tracker/index.php?func=detailaid=314652group_id=100114atid=413095 The

Bug#746200: apt: Apt-get install doesn't respect /target_release

2014-04-30 Thread Michael Vogt
On Sun, Apr 27, 2014 at 06:15:21PM -0500, Wayne Rowcliffe wrote: Package: apt Version: 1.0.2 Severity: normal Thanks for your bugreport. With the recent upgrade of apt to 1.0, /target_release flags do not seem to have any effect. For my particuluar situation, I am trying to upgrade

Bug#746434: apt: new apt breaks a shell script by reading from standard input when it shouldn't

2014-04-30 Thread Michael Vogt
On Tue, Apr 29, 2014 at 10:40:52PM +, Gianluca Borello wrote: Package: apt Version: 1.0.2 Severity: normal Thanks for your bugeport. I have an automated installation script that doesn't work anymore on Sid. This is a snippet of code: #!/bin/bash apt-get -qq -y install iftop

Bug#726163: multiarch upgrade issue

2014-04-30 Thread Michael Vogt
Hi, just wanted to mention that the current dependency of libsmbclient to python-talloc cause a regression when upgrading from a samba3 based libsmbclient to a samba4 based libsmbclient in certain multiarch environments. The problem is that libsmbclient:i386 and libsmbclient:amd64 can be

Bug#745992: Please add the attached systemd service file

2014-04-28 Thread Michael Vogt
On Sun, Apr 27, 2014 at 12:12:05AM +0200, Michael Stapelberg wrote: Package: unattended-upgrades Version: 0.82.6 Severity: wishlist User: pkg-systemd-maintain...@lists.alioth.debian.org Usertags: systemd-units Thanks for your bugreport and your patch! Dear maintainer, please add the

Bug#745726: apt: shell is left colored when abborting colored output of apt

2014-04-25 Thread Michael Vogt
On Thu, Apr 24, 2014 at 03:44:28PM +0200, Sven Bartscher wrote: Package: apt Version: 1.0.1 Severity: minor Thanks for your bugreport. When pressing ctrl+c to interrupt apt while downloading packages the color doesn't get reset for the rest of the shell session. So the shell is colored

Bug#745487: apt python library leak memory and file descriptors

2014-04-23 Thread Michael Vogt
On Tue, Apr 22, 2014 at 11:23:24AM +0200, Petter Reinholdtsen wrote: Package: python-apt Version: 0.8.8.2 Severity: important Thanks for your bugreport. Since I wrote the isenkram package, it have been plagued with a nasty resourse leak. It leak memory and file descriptors every time some

Bug#744297: apt: doesn't reset colors after Ctrl+C

2014-04-22 Thread Michael Vogt
On Sat, Apr 12, 2014 at 05:48:55PM +0200, Jakub Wilk wrote: Package: apt Version: 1.0.1 Severity: minor Thanks for your bugreport. When I press Ctrl+C when apt is working, it doesn't reset colors, leaving my shell prompt yellowish. See the attached screenshot. This is fixed in the git

Bug#745120: apt: [INTL] Updated Thai program translation

2014-04-22 Thread Michael Vogt
On Sun, Apr 20, 2014 at 09:42:52AM +0700, Theppitak Karoonboonyanan wrote: On Fri, Apr 18, 2014 at 9:31 PM, David Kalnischkies da...@kalnischkies.de wrote: Refreshing the po file (attached) with the latest git reveals a fuzzy string (changing 'record' to 'version'), so I would like to ask

Bug#745452: apt: Consistently use Dpkg::Progress* in documentation

2014-04-22 Thread Michael Vogt
On Mon, Apr 21, 2014 at 04:54:04PM -0400, James McCoy wrote: Package: apt Version: 1.0.1 Severity: minor Thanks for your bugreport and your patch. Dear Maintainer, Apt's documentation refers to DpkgPM::Progress, Dpkg::Progress-Fancy, and DpkgPM::Progress-Fancy. DpkgPM::Progress was

Bug#745130: apt should tell if updates are available

2014-04-22 Thread Michael Vogt
agree with Davids concerns, that we need to be careful about the message displayed to avoid confusing the users. Cheers, Michael From 72610548d2993e30fb5b8d633044c7f2af3fb392 Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@debian.org Date: Tue, 22 Apr 2014 16:07:32 +0200 Subject: [PATCH] show

Bug#743616: Adding sun-java 5,6-jdk in breaks / replaces forces removal of apt on oracle 7 and 8 package install

2014-04-07 Thread Michael Vogt
openjdk-6-jdk (which is against a very old version so its probably not needed). Cheers, Michael From a75a293f19d315b491972b688747702e017a5625 Mon Sep 17 00:00:00 2001 From: Michael Vogt m...@ubuntu.com Date: Mon, 7 Apr 2014 08:18:14 +0200 Subject: [PATCH] make Replaces/Breaks for sun-java-{5,6

Bug#743594: +1

2014-04-07 Thread Michael Vogt
On Sun, Apr 06, 2014 at 08:16:30AM -0700, Martin Gallant wrote: Same here on all 3 of my jessie machines, amd64 i386 Thanks everyone, I have a testcase now and work on a fix. Cheers, Michael -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of

Bug#743771: synaptic: fix french translation : History Historique des opérations

2014-04-07 Thread Michael Vogt
On Sun, Apr 06, 2014 at 10:57:38AM +0200, Ghent wrote: Package: synaptic Version: 0.81.1 Severity: minor Tags: l10n Dear Maintainer, In the french translation, History of File menu is translate Historique des recherches, search history in english but it's the history of actions

Bug#743594: +1

2014-04-06 Thread Michael Vogt
Thanks for your bugreport. Could you please attach or mail privately the /var/lib/dpkg/stautus file? This should help me to reproduce the bug. Thanks, Michael On 6 April 2014 17:16:30 CEST, Martin Gallant mar...@goodbit.net wrote: Same here on all 3 of my jessie machines, amd64 i386 --

Bug#743413: 'apt list' seg-faults if sources.list file is unreadable

2014-04-04 Thread Michael Vogt
On Wed, Apr 02, 2014 at 02:22:50PM +0100, Ben Hutchings wrote: Package: apt Version: 1.0 Severity: normal Thanks for your bugreport. I accidentally gave /etc/apt/sources.list permissions 640 rather than 644. 'apt list' would then consistently seg-fault. This is fixed in git and will be

Bug#743295: RM: vdkxdb2, vdkbuilder2 - old unmaintained software

2014-04-02 Thread Michael Vogt
On Tue, Apr 01, 2014 at 04:10:41PM +0200, Matthias Klose wrote: Package: ftp.debian.org According to the maintainer (CCed Michael Vogt), these packages are old and unmaintained, and should be removed from the archive. #726232 already suggests removing vdkbuilder2. I agree

Bug#740551: documentation for APT::Periodic::MaxSize v.s. processing in apt.cron.daily

2014-03-27 Thread Michael Vogt
On Sun, Mar 02, 2014 at 01:09:55PM -0500, Nathan Stratton Treadway wrote: Package: apt Severity: minor Version: 0.9.15.5 Thanks for your bugreport. Near the top of /etc/cron.daily/apt, the documentation for the MaxSize variable says: # APT::Periodic::MaxSize 0; (new) # - Set maximum

Bug#741867: apt: [INTL:it] Updated Italian translation of apt po4a docs

2014-03-27 Thread Michael Vogt
On Sun, Mar 16, 2014 at 07:00:03PM +0100, Beatrice Torracca wrote: Package: apt Version: 0.9.15.5 Severity: wishlist Tags: l10n patch Hi! I updated the po4a docs of apt. You can find the gzipped file attached here. Please include it in your next upload. Thanks for your translation

Bug#741627: insecure temporary file usage in apt-extracttemplates

2014-03-27 Thread Michael Vogt
On Fri, Mar 14, 2014 at 05:10:05PM +, Steve Kemp wrote: Package: apt Version: 0.9.7.9+deb7u1 Severity: important Tags: security Thanks for your bugreport. [..] Anyway given that the generated file names are output to the console it feels like we should use mkstemp and do it properly,

Bug#742166: closed by Michael Vogt m...@debian.org (Bug#742166: fixed in synaptic 0.81.1)

2014-03-27 Thread Michael Vogt
On Wed, Mar 26, 2014 at 09:45:06PM -0400, Filipus Klutiero wrote: [..] Their explanation is attached below along with your original report. If this explanation is unsatisfactory and you have not received a better one in a separate message then please contact Michael Vogt m...@debian.org

Bug#741154: fixed in bzr

2014-03-23 Thread Michael Vogt
Thanks for your bugreport and your description how to reproduce the issue. This is fixed in bzr now and the fix will be part of the next upload. Cheers, Michael -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact

Bug#742212: synaptic: Quick search field is missing

2014-03-23 Thread Michael Vogt
On Thu, Mar 20, 2014 at 08:02:14PM +0100, Piotr Jurkiewicz wrote: Package: synaptic Version: 0.80.4 Severity: important Thanks for your bugreport. As in topic, on the present Jessie preview quick search field in toolbar is missing. Do you have apt-xapian-index installed? This is what is

Bug#742166: [synaptic] Visit Homepage has no effect (KDE)

2014-03-23 Thread Michael Vogt
On Wed, Mar 19, 2014 at 11:00:07PM -0400, Filipus Klutiero wrote: Package: synaptic Version: 0.81 Severity: normal Thanks for your bugreport. Many packages define their homepage. For example, filelight does. Synaptic now displays a curious Visit Homepage link for these packages (initially

Bug#741109: can not open synaptic package manager

2014-03-23 Thread Michael Vogt
On Sun, Mar 09, 2014 at 12:01:57AM +0700, gil79 wrote: Package: synaptic Version: 0.70~pre1+b1 Severity: important Thanks for your bugreport. I can not open synaptic, and a message window appears, stated: E: The package needs to be reinstalled giada, but I can not find an archive for

Bug#735385: synaptic: quick search / xapian not installed by default in jessie

2014-03-23 Thread Michael Vogt
On Thu, Jan 16, 2014 at 04:46:21PM +0100, Andreas Cadhalpun wrote: On 15.01.2014 04:33, Lars Cebulla wrote: On a new installed Debian Jessie, I can't see the quick search input field in synaptic. After searching on the internet, I've found a solution: apt-get install apt-xapian-index

Bug#276655: [synaptic] Bug#276655: replace 'lock version' with dpkg holds

2014-03-23 Thread Michael Vogt
On Fri, Nov 15, 2013 at 06:07:30PM +0100, Andreas Cadhalpun wrote: Package: synaptic Version: 0.80.4 Thanks for your mail. I want to second Daniel Hartwig: synaptic should really use the universal dpkg holds. Anything else is quite confusing. Back when the locks got implemented in synaptic

Bug#720605: [synaptic] Bug#720605: Gtk-CRITICAL: assertion `iter_is_valid (iter, list_store)' failed

2014-03-23 Thread Michael Vogt
On Fri, Nov 15, 2013 at 05:44:53PM +0100, Andreas Cadhalpun wrote: Package: synaptic Version: 0.80.4 Thanks for the mail. for me the error in the terminal has one more line, which I suspect is the main problem, since it is called 'CRITICAL': (synaptic:30019): Gtk-CRITICAL **:

Bug#724709: [synaptic] Bug#724709: custom filters are quite broken

2014-03-23 Thread Michael Vogt
On Fri, Nov 15, 2013 at 05:35:24PM +0100, Andreas Cadhalpun wrote: Package: synaptic Version: 0.80.4 Thanks for your mail. I can confirm this problem and report another, probably closely related bug, that can be reproduced as follows: * Create a custom filter and change any setting. *

Bug#682365: Possible dpkg fix?

2014-03-20 Thread Michael Vogt
Hi, I stumbled on this today and was wondering if something like the attached patch might help. It will allow packages that are normally not co-installable on the system if the other package(s) are in stat_configfiles. The patch is a bit of a proof-of-concept for now, but I'm happy to clean it

Bug#742012: dpkg fails to upgrade gyp (symlink gets replaced with dir)

2014-03-18 Thread Michael Vogt
Package: dpkg Version: 1.17.6 I got the following error when upgrading the gyp package. I ran into this from a ubuntu machine but I reproduced it in a minimal sid chroot as well: # dpkg -i gyp_0.1~svn1654-1_all.deb (Reading database ... 12267 files and directories currently installed.)

<    1   2   3   4   5   6   7   8   9   10   >