Bug#994583: buster-pu: package node-axios/0.17.1+dfsg-2+deb10u1

[Yadd]

Package: release.debian.org
Severity: normal
Tags: buster
User: release.debian@packages.debian.org
Usertags: pu

[ Reason ]
Another regex denial of service

[ Impact ]
Medium vulnerability

[ Tests ]
test passed

[ Risks ]
No risk, patch is trivial

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Use trim() instead of a regex

Cheers,
Yadd
diff --git a/debian/changelog b/debian/changelog
index 88ae229..d73d015 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+node-axios (0.17.1+dfsg-2+deb10u1) buster; urgency=medium
+
+  * Team upload
+  * Fix reDoS (Closes: CVE-2021-3749)
+
+ -- Yadd   Sat, 18 Sep 2021 07:31:53 +0200
+
 node-axios (0.17.1+dfsg-2) unstable; urgency=medium
 
   * Team upload
diff --git a/debian/patches/CVE-2021-3749.patch 
b/debian/patches/CVE-2021-3749.patch
new file mode 100644
index 000..802174f
--- /dev/null
+++ b/debian/patches/CVE-2021-3749.patch
@@ -0,0 +1,19 @@
+Description: fix ReDoS
+Author: ready-research <72916209+ready-resea...@users.noreply.github.com>
+Origin: upstream, https://github.com/axios/axios/commit/eef56014
+Bug: https://github.com/axios/axios/pull/3980
+Forwarded: not-needed
+Reviewed-By: Yadd 
+Last-Update: 2021-09-18
+
+--- a/lib/utils.js
 b/lib/utils.js
+@@ -162,7 +162,7 @@
+  * @returns {String} The String freed of excess whitespace
+  */
+ function trim(str) {
+-  return str.replace(/^\s*/, '').replace(/\s*$/, '');
++return str.trim ? str.trim() : str.replace(/^\s+|\s+$/g, '');
+ }
+ 
+ /**
diff --git a/debian/patches/series b/debian/patches/series
index 877fd7a..1f39c51 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,4 @@
 skip-unneeded-modules.patch
 use-webpack3.patch
 CVE-2019-10742.diff
+CVE-2021-3749.patch
diff --git a/debian/patches/skip-unneeded-modules.patch 
b/debian/patches/skip-unneeded-modules.patch
index 9c63950..6f69f30 100644
--- a/debian/patches/skip-unneeded-modules.patch
+++ b/debian/patches/skip-unneeded-modules.patch
@@ -2,7 +2,7 @@ These are optional modules
 
 --- a/package.json
 +++ b/package.json
-@@ -38,10 +38,6 @@
+@@ -39,10 +39,6 @@
  "grunt-cli": "^1.2.0",
  "grunt-contrib-clean": "^1.0.0",
  "grunt-contrib-nodeunit": "^1.0.0",
diff --git a/debian/patches/use-webpack3.patch 
b/debian/patches/use-webpack3.patch
index 43e264b..8f140f7 100644
--- a/debian/patches/use-webpack3.patch
+++ b/debian/patches/use-webpack3.patch
@@ -10,7 +10,7 @@ Subject: [PATCH] Updating webpack to v3.x
 
 --- a/package.json
 +++ b/package.json
-@@ -38,7 +38,7 @@
+@@ -39,7 +39,7 @@
  "grunt-cli": "^1.2.0",
  "grunt-contrib-clean": "^1.0.0",
  "grunt-contrib-nodeunit": "^1.0.0",
@@ -19,7 +19,7 @@ Subject: [PATCH] Updating webpack to v3.x
  "istanbul-instrumenter-loader": "^1.0.0",
  "jasmine-core": "^2.4.1",
  "karma": "^1.3.0",
-@@ -58,10 +58,10 @@
+@@ -59,10 +59,10 @@
  "minimist": "^1.2.0",
  "phantomjs-prebuilt": "^2.1.7",
  "sinon": "^1.17.4",

Bug#992668: ricochet-im: does not start

[Paul Wise]

Control: usertatgs -1 + confirmed

On Sat, 21 Aug 2021 23:57:06 -0400 The Hermit wrote:

> hermit@~:ricochet 
> /usr/include/c++/9/bits/move.h:194:7: runtime error: load of value 279, which 
> is not a valid value for type 'Type'

I get this too and I noticed that rebuilding ricochet fixes it.
I'll request the release team to rebuild it in bullseye/bookworm.
Until that happens, you can rebuild it using these commands:

sudo apt install devscripts
sudo apt build-dep ricochet-im
apt source --build ricochet-im
sudo debi --upgrade

-- 
bye,
pabs

https://wiki.debian.org/PaulWise


signature.asc
Description: This is a digitally signed message part

Bug#992563: transition: gdal

[Sebastiaan Couwenberg]

On 9/12/21 7:54 PM, Sebastiaan Couwenberg wrote:
> grass & otb in experiment still need to be rebuilt.

grass had a source upload, only otb in experimental needs a binNMU now.

Quite a few packages on mipsel may need a binNMU for the recent glibc
changes, it allowed libgdal-grass to migrate, but there a still quite a
few packages with remaining issues:

 https://linuxminded.nl/debian/gis-transitions/testing/html/gdal.html

Kind Regards,

Bas

-- 
 GPG Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1

Bug#993499: RFS: python-marshmallow-polyfield/5.10-1 -- marshmallow extension for polymorphic fields

[Jeroen Ploemen]

On Fri, 17 Sep 2021 14:09:54 +0200
"Diego M. Rodriguez"  wrote:

> On Fri, 17 Sep 2021 11:30:24 +0200 Jeroen Ploemen 
> wrote:
> > In that case, for lack of a better option, the upstream git commits
> > could serve as a basis for the years.  
> 
> Noted - in this instance, 2015 is also the date of the initial git
> commit in the upstream repo. Could you let me know if your mention of
> "years" implies also declaring the year of the last commit for this
> release in d/copyright (ie. 2015-2021)?

It does. Copyrights have expiry dates too, so the most recent year matters.


pgpUEB42mVL_T.pgp
Description: OpenPGP digital signature

Bug#747181: xpdf: too many warning messages

[Vincent Lefevre]

Control: reassign -1 libpoppler102 20.09.0-3.1
Control: retitle -1 poppler: many incorrect messages "Syntax Warning: Bad 
bounding box in Type 3 glyph"
Control: affects -1 xpdf

On 2021-09-18 10:14:03 +0900, Masanori Goto wrote:
> Thanks for the check.  It sounds more poppler side.  I just read this
> email, but are you OK to reassign it to poppler?

Doing it now.

> Also it might be better to annotate a prefix like "poppler" in the error in
> general - though it's a bit of a large change...

Yes, but if this can be done in the error() function, that would
be quite a small change.

> 2021年9月17日(金) 22:30 Vincent Lefevre :
> 
> > On 2021-09-17 14:40:06 +0200, Vincent Lefevre wrote:
> > > The warning comes from xpdf/SplashOutputDev.cc
> > >
> > >   if (xMin - xt < t3Font->glyphX ||
> > >   yMin - yt < t3Font->glyphY ||
> > >   xMax - xt > t3Font->glyphX + t3Font->glyphW ||
> > >   yMax - yt > t3Font->glyphY + t3Font->glyphH) {
> > > if (t3Font->validBBox) {
> > >   error(errSyntaxWarning, -1, "Bad bounding box in Type 3 glyph");
> > > }
> > > return;
> > >   }
> >
> > Actually it doesn't (commenting out this line doesn't change
> > anything). Perhaps a bug in poppler, then, as it has similar
> > code in poppler/SplashOutputDev.cc:
> >
> > if (xMin - xt < t3Font->glyphX || yMin - yt < t3Font->glyphY || xMax -
> > xt > t3Font->glyphX + t3Font->glyphW || yMax - yt > t3Font->glyphY +
> > t3Font->glyphH) {
> > if (t3Font->validBBox) {
> > error(errSyntaxWarning, -1, "Bad bounding box in Type 3
> > glyph");
> > }
> > return;
> > }

-- 
Vincent Lefèvre  - Web: 
100% accessible validated (X)HTML - Blog: 
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

Bug#994575: dipy: autopkgtest idea

[Étienne Mollier]

Source: dipy
Version: 1.3.0-3
Severity: wishlist
Tags: newcomer

Dear Maintainer,

While working on #983840, I needed to do some testing of the
package, and notice examples in doc/examples/.  Maybe they could
be a source of inspiration for building an autopkgtest test
suite?

Have a nice day,  :)
-- 
Étienne Mollier 
Fingerprint:  8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
Sent from /dev/pts/7, please excuse my verbosity.


signature.asc
Description: PGP signature

Bug#983840: dipy: move documentation dependencies to Build-Depends-Indep

[Étienne Mollier]

Hi Helmut,

On Tue, 2 Mar 2021 08:32:21 +0100 Helmut Grohne  wrote:
> Thank you for applying my last Build-Depends reduction. Unfortunately,
> there are more unsatisfiable cross Build-Depends left. I've found
> another opportunity for reduction though: Skipping the documentation
> build during arch-only. Once doing so, we can demode sphinx and numpydoc
> to Build-Depends-Indep. Doing so requires changing debian/rules though.
> Please consider applying the attached patch as well.

Thank you for your patch, I am including it into the dipy
package.  I also took that opportunity to lookup the remaining
steps to enable cross compilation, and it turned out I could
evacuate the three build-dependencies still preventing my
attempt on build=amd64 host=arm64.

Manual testing of the build result by running the quick start
guide shown me the binaries were most likely operating properly.
I will push these changes soon to salsa and upload.

Thank you for your work on cross compilation!
Have a nice day,  :)
-- 
Étienne Mollier 
Fingerprint:  8f91 b227 c7d6 f2b1 948c  8236 793c f67e 8f0d 11da
Sent from /dev/pts/4, please excuse my verbosity.


signature.asc
Description: PGP signature

Bug#747181: xpdf: too many warning messages

[Masanori Goto]

Thanks for the check.  It sounds more poppler side.  I just read this
email, but are you OK to reassign it to poppler?
Also it might be better to annotate a prefix like "poppler" in the error in
general - though it's a bit of a large change...

2021年9月17日(金) 22:30 Vincent Lefevre :

> On 2021-09-17 14:40:06 +0200, Vincent Lefevre wrote:
> > The warning comes from xpdf/SplashOutputDev.cc
> >
> >   if (xMin - xt < t3Font->glyphX ||
> >   yMin - yt < t3Font->glyphY ||
> >   xMax - xt > t3Font->glyphX + t3Font->glyphW ||
> >   yMax - yt > t3Font->glyphY + t3Font->glyphH) {
> > if (t3Font->validBBox) {
> >   error(errSyntaxWarning, -1, "Bad bounding box in Type 3 glyph");
> > }
> > return;
> >   }
>
> Actually it doesn't (commenting out this line doesn't change
> anything). Perhaps a bug in poppler, then, as it has similar
> code in poppler/SplashOutputDev.cc:
>
> if (xMin - xt < t3Font->glyphX || yMin - yt < t3Font->glyphY || xMax -
> xt > t3Font->glyphX + t3Font->glyphW || yMax - yt > t3Font->glyphY +
> t3Font->glyphH) {
> if (t3Font->validBBox) {
> error(errSyntaxWarning, -1, "Bad bounding box in Type 3
> glyph");
> }
> return;
> }
>
> --
> Vincent Lefèvre  - Web: 
> 100% accessible validated (X)HTML - Blog: 
> Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)
>

Bug#994580: Re Zenity bug 994580

[pub1336]

Additional information (Fixed/Move/Update?):

 

Examining bug further, it seems that the bug only affects certain circumstances such as subshell. For example:

user@pc: zenity --question --title="title" --ok-label="Yes" --cancel-label="No" --text="Text"

# Click Yes

user@pc: echo $?

0


 

user@pc: zenity --question --title="title" --ok-label="Yes" --cancel-label="No" --text="Text"

# Click No

user@pc: echo $?

1

 

### However ###

 


user@pc: aa=$(zenity --question --title="title" --ok-label="Yes" --cancel-label="No" --text="Text")

# Click Yes

user@pc: echo $aa

# Returns \n\n


 

user@pc: aa=$(zenity --question --title="title" --ok-label="Yes" --cancel-label="No" --text="Text")

# Click No

user@pc: echo $aa

# Returns \n\n

 

### Finally ###

 user@pc: zenity --question --title="title" --ok-label="Yes" --cancel-label="NO" --text="Delete $1"; echo "$?"

# Click Yes

0

 

user@pc: zenity --question --title="title" --ok-label="Yes" --cancel-label="NO" --text="Delete $1"; echo "$?"

# Click No

1

 

user@pc: zenity --question --title="title" --ok-label="Yes" --cancel-label="NO" --text="Delete $1" && echo "$?"

# Click Yes

# Returns \n

 

user@pc zenity --question --title="title" --ok-label="Yes" --cancel-label="NO" --text="Delete $1" && echo "$?"

# Click No

0

 


### Conclusion ###

 

Zenity does not output a return value reliably for scripting.

However, knowing this, it is easy to script around it without further conflict.

 

Possibly closed and moved to Wishlist: Please make Zenity more consistent?

 

J

 

Bug#994582: deluge-gtk: Deluge-GTK will only start in Thin mode

[SDA]

Package: deluge-gtk
Version: 2.0.3-3.1
Severity: important
X-Debbugs-Cc: marathon.duran...@gmail.com

Dear Maintainer,

Starting Deluge results in a message box stating that Deluge cannot run in 
consolidated mode, only in thin mode.


-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.13.18-xanmod1 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=en_CA.UTF-8, LC_CTYPE=en_CA.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_CA:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages deluge-gtk depends on:
ii  deluge-common 2.0.3-3.1
ii  gir1.2-gtk-3.03.24.30-3
ii  libnotify40.7.9-3
ii  librsvg2-common   2.50.7+dfsg-2
ii  python3   3.9.2-3
ii  python3-gi3.40.1-2
ii  python3-gi-cairo  3.40.1-2
ii  xdg-utils 1.1.3-4.1

Versions of packages deluge-gtk recommends:
pn  gir1.2-appindicator3-0.1  
ii  python3-pygame1.9.6+dfsg-4+b1

deluge-gtk suggests no packages.

-- no debconf information
Output from starting in a terminal:
(deluge:15788): Gtk-CRITICAL **: 20:01:28.524: gtk_widget_get_scale_factor: 
assertion 'GTK_IS_WIDGET (widget)' failed
Unhandled error in Deferred:
20:01:32 [CRITICAL][twisted   :154 ] Unhandled error in 
Deferred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/deluge/log.py", line 87, in exception
yield LoggingLoggerClass.exception(self, msg, *args, **kwargs)
  File "/usr/lib/python3.9/logging/__init__.py", line 1481, in exception
self.error(msg, *args, exc_info=exc_info, **kwargs)
  File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 1613, 
in unwindGenerator
return _cancellableInlineCallbacks(gen)
  File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 1529, 
in _cancellableInlineCallbacks
_inlineCallbacks(None, g, status)
---  ---
  File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 1418, 
in _inlineCallbacks
result = g.send(result)
  File "/usr/lib/python3/dist-packages/deluge/log.py", line 79, in error
yield LoggingLoggerClass.error(self, msg, *args, **kwargs)
  File "/usr/lib/python3.9/logging/__init__.py", line 1475, in error
self._log(ERROR, msg, args, **kwargs)
  File "/usr/lib/python3.9/logging/__init__.py", line 1577, in _log
fn, lno, func, sinfo = self.findCaller(stack_info, stacklevel)
builtins.TypeError: findCaller() takes from 1 to 2 positional arguments but 3 
were given

Temporarily disabling observer LegacyLogObserverWrapper(>) due to exception: [Failure instance: Traceback: : findCaller() takes from 1 to 2 positional arguments but 3 were 
given
/usr/lib/python3/dist-packages/twisted/internet/_glibbase.py:326:_reschedule
/usr/lib/python3/dist-packages/twisted/internet/defer.py:962:__del__
/usr/lib/python3/dist-packages/twisted/logger/_logger.py:190:failure
/usr/lib/python3/dist-packages/twisted/logger/_logger.py:144:emit
---  ---
/usr/lib/python3/dist-packages/twisted/logger/_observer.py:131:__call__
/usr/lib/python3/dist-packages/twisted/logger/_legacy.py:93:__call__
/usr/lib/python3/dist-packages/deluge/log.py:204:emit
/usr/lib/python3.9/logging/__init__.py:1493:critical
/usr/lib/python3.9/logging/__init__.py:1577:_log
]
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/twisted/internet/_glibbase.py", line 
326, in _reschedule
priority=self._glib.PRIORITY_DEFAULT_IDLE)
  File "/usr/lib/python3/dist-packages/twisted/internet/defer.py", line 962, in 
__del__
log.failure(format,
  File "/usr/lib/python3/dist-packages/twisted/logger/_logger.py", line 190, in 
failure
self.emit(level, format, log_failure=failure, **kwargs)
  File "/usr/lib/python3/dist-packages/twisted/logger/_logger.py", line 144, in 
emit
self.observer(event)
---  ---
  File "/usr/lib/python3/dist-packages/twisted/logger/_observer.py", line 131, 
in __call__
observer(event)
  File "/usr/lib/python3/dist-packages/twisted/logger/_legacy.py", line 93, in 
__call__
self.legacyObserver(event)
  File "/usr/lib/python3/dist-packages/deluge/log.py", line 204, in emit
getattr(LoggingLoggerClass, event_dict['log_level'].name)(
  File "/usr/lib/python3.9/logging/__init__.py", line 1493, in critical
self._log(CRITICAL, msg, args, **kwargs)
  File "/usr/lib/python3.9/logging/__init__.py", line 1577, in _log
fn, lno, func, sinfo = self.findCaller(stack_info, stacklevel)
builtins.TypeError: findCaller() takes from 1 to 2 positional arguments but 3 
were given

Bug#509068: cryptsetup: improving passdev

[Christoph Anton Mitterer]

Control: retitle -1 cryptsetup: improving passdev

One further idea for future work on passdev



VIII) Not blindly trying through fstypes in the mount

Right now it goes through a fixed list and tries them one after
another.
In principle that works, but it can leave ugly messages in the kernel
log, e.g.:
Sep 18 01:33:53 heisenberg kernel: EXT4-fs (sdb2): VFS: Can't find ext4 
filesystem
Sep 18 01:33:53 heisenberg kernel: EXT4-fs (sdb2): VFS: Can't find ext4 
filesystem
Sep 18 01:33:53 heisenberg kernel: EXT4-fs (sdb2): VFS: Can't find ext4 
filesystem
Sep 18 01:33:53 heisenberg kernel: FAT-fs (sdb2): bogus number of reserved 
sectors
Sep 18 01:33:53 heisenberg kernel: FAT-fs (sdb2): Can't find a valid FAT 
filesystem

until it finally works when finding the right one:
Sep 18 01:33:53 heisenberg kernel: BTRFS info (device sdb2): disk space caching 
is enabled
Sep 18 01:33:53 heisenberg kernel: BTRFS info (device sdb2): has skinny extents

One idea would be to use libblkid.


I do however quite like the idea of having a fixed list of types which
are considered.

Bug#993180: Make matrix-mirage unusable

[Scorpion2185]

I upgraded it to the testing version:

apt install python3-matrix-nio
[...]
python3-matrix-nio is already the newest version (0.18.6-1).

And it solved the problem so it is fault of that package if matrix -mirage 
doesn't work.

Bug#994581: please migrate from python3-llfuse-dbg to its -dbgsym variant

[Nicholas D Steeves]

Source: s3ql
Version: 3.7.0+dfsg-2
Severity: normal

Dear Francesco,

I've initiated the dbgsym transition in python-llfuse (1.4.1+dfsg-1),
so at some point it will become necessary for s3ql to migrate away
from the old llfuse -dbg package.  I'm not sure what the timeline will
be for this, but a recent message to the DPT mailing list has lead me
to believe that there will soon be a hard push to transition to
automatic dbgsym packages.

'hope this email finds you well!
Regards,
Nicholas

Bug#994543: Workaround glibc bug BZ#26401 (regression in lchmod and fchmodat when /proc is not mounted)

[Samuel Henrique]

Hello Salvatore,

On Fri, 17 Sept 2021 at 14:38, Salvatore Bonaccorso  wrote
> > For rsync the following where applied:
> >
> > https://github.com/WayneD/rsync/commit/85b8dc8abaca96fc3ea7421e09101b6ac41b6718
> > https://github.com/WayneD/rsync/commit/9dd62525f3b98d692e031f22c02be8f775966503
>
> FWIW, the autopkgtest regresssons are maybe related to this. I
> encountered it while perfoming a linux build in a chroot where /proc
> was not mounted.
>
> Tested cherry-picking the workaround on top of 3.2.3-6.

That's great, I was wondering what was causing those failures, I have
uploaded a new revision with the last patch only (the first one is
being reverted in the second one).

Thank you!


--
Samuel Henrique 

Bug#994580: zenity: Zenity --question return values inconsistent

[Anon1336]

Package: zenity
Version: 3.30.0-2
Severity: normal
Tags: a11y upstream

Dear Maintainer,

When calling Zenity with --question the return values SHOULD be 0 or 1 (or
ever-increasing numbers if buttons are added). However, the return value is
either nothing or 0. Example:

someVar=$(zenity --question [blah] [blah]) && echo $someVar
OR
zenity --question [blah blah] && echo $?

Please note: I have tried the latest Zenity version from sid and the problem
persists.

This can affect shell scripts for which Zenity was designed. There
is an obvious workaround, [[ -z "$someVar" ]], the trouble will come when/if
this is fixed. The better workaround, when considering more than two buttons
as well, is a case statement so that any return except what which is fixed or
unfixed, is handled instead. It will obviously still cause a little conflict,
but it needs to be fixed, the sooner, the better. Obviously this an upstream
problem, but it's an easy fix.

Regards,
J


-- System Information:
Debian Release: 10.10
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-0.bpo.8-amd64 (SMP w/12 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=en_ZA.UTF-8, LC_CTYPE=en_ZA.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_ZA:en (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages zenity depends on:
ii  libc6 2.28-10
ii  libgdk-pixbuf2.0-02.38.1+dfsg-1
ii  libglib2.0-0  2.58.3-2+deb10u3
ii  libgtk-3-03.24.5-1
ii  libnotify40.7.7-4
ii  libpango-1.0-01.42.4-8~deb10u1
ii  libwebkit2gtk-4.0-37  2.30.6-1~deb10u1
ii  libx11-6  2:1.6.7-1+deb10u2
ii  zenity-common 3.32.0-6

zenity recommends no packages.

zenity suggests no packages.

-- no debconf information

Bug#994544: [Pkg-javascript-devel] Bug#994544: Bug#994544: Bug#994544: npm2deb: nodejs:any for arch:all package

[Jonas Smedegaard]

Quoting Bastien ROUCARIES (2021-09-17 21:30:16)
> Le ven. 17 sept. 2021 à 16:06, Yadd  a écrit :
> >
> > Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
> > > In order to help cross build nodejs depends should be nodejs:any 
> > > for purejs module in depends field.
> > >
> > > In build-depends field we should use nodejs:native in order to 
> > > help crossbuilt
> > you should clone this and reassign to pkg-js-tools (build depends on 
> > nodejs).
> > npm2deb should not set a run dependency to nodejs except if there is 
> > a /usr/bin file
> Not sure perl set perl:any on every package.
> 
> It is sensible to do so

It is *not* sensible for Node.js packages to depend on nodejs, 
regardless of what is done in perl packages:

Package relations are directional, and libraries do not depend on their 
interpreter, it is the other way around: Scripts or other libraries 
loading a library (through their interpreter) depend on that library.


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

signature.asc
Description: signature

Bug#991989: libclang-13-dev: dead symlink to shared library

[Christian Göttsche]

Control: reopen 991989
Control: retitle libclang-13-dev: cmake find_package implementation broken

The previously dead symlink issue has been resolved, but the cmake
script does still not work;
it references the non-existing file
'/usr/lib/llvm-13/lib/libclang-13.so.13.0.0':


-- IWYU: out-of-tree configuration
CMake Error at /usr/lib/llvm-13/lib/cmake/clang/ClangTargets.cmake:706
(message):
 The imported target "libclang" references the file

"/usr/lib/llvm-13/lib/libclang-13.so.13.0.0"

 but this file does not exist.  Possible reasons include:

 * The file was deleted, renamed, or moved to another location.

 * An install or uninstall procedure did not complete successfully.

 * The installation package was faulty and contained

"/usr/lib/llvm-13/lib/cmake/clang/ClangTargets.cmake"

 but not all the files it references.

Call Stack (most recent call first):
 /usr/lib/cmake/clang-13/ClangConfig.cmake:20 (include)
 CMakeLists.txt:20 (find_package)

Bug#993471: mc crashes if ftp server specified on cmdline requires authentication

[Bernhard Übelacker]

Dear Maintainer,
I tried to have a look and received the backtrace below [3].

As far as I see is 4.8.27 in current testing not affected.

And a 'git bisect' led to the upstream commit [1], which
is tracked in upstream bug [2].
A package 4.8.26 built with this commit is also
working as expected (see attached patch).

Kind regards,
Bernhard



[1] 
https://github.com/MidnightCommander/mc/commit/0375997c789eef9b6355aadd80aaf4aced68c560

[2] https://midnight-commander.org/ticket/4244

[3]
Program terminated with signal SIGSEGV, Segmentation fault.
#0  widget_set_size (w=0x0, y=y@entry=59, x=, 
lines=lines@entry=1, cols=cols@entry=19) at widget-common.c:450
450 if (w->owner != NULL && widget_get_state (WIDGET (w->owner), 
WST_ACTIVE))
(gdb) set width 0
(gdb) set pagination off
(gdb) bt
#0  widget_set_size (w=0x0, y=y@entry=59, x=, 
lines=lines@entry=1, cols=cols@entry=19) at widget-common.c:450
#1  0x55d9c539ae14 in setup_cmdline () at layout.c:999
#2  0x55d9c53f54d0 in set_prompt_string () at common.c:728
#3  set_prompt_string () at common.c:720
#4  read_subshell_prompt () at common.c:1575
#5  0x55d9c539be56 in do_load_prompt () at layout.c:1473
#6  0x55d9c539bee6 in load_prompt (fd=, unused=) at layout.c:1502
#7  0x55d9c5397a4a in check_selects 
(select_set=select_set@entry=0x7ffe62e65cd0) at key.c:618
#8  0x55d9c53998e1 in tty_get_event (event=event@entry=0x7ffe62e65da0, 
redo_event=0, block=block@entry=1) at key.c:2055
#9  0x55d9c5380d01 in frontend_dlg_run (h=0x55d9c66744c0) at dialog.c:318
#10 dlg_run (h=h@entry=0x55d9c66744c0) at dialog.c:575
#11 0x55d9c53ad165 in quick_dialog_skip 
(quick_dlg=quick_dlg@entry=0x7ffe62e65ed0, nskip=, 
nskip@entry=1) at quick.c:581
#12 0x55d9c53c01c6 in quick_dialog (quick_dlg=0x7ffe62e65ed0) at 
../../lib/widget/quick.h:353
#13 fg_input_dialog_help (header=0x55d9c66732c0 "FTP: Passwort benötigt für ftpuser", text=, help=0x55d9c5428833 "[Input Line Keys]", history_name=, def_text=0x55d9c542e960 
"", strip_password=0, completion_flags=INPUT_COMPLETE_NONE) at wtools.c:226
#14 0x55d9c53c0eeb in input_dialog (header=header@entry=0x55d9c66732c0 "FTP: Passwort benötigt für 
ftpuser", text=, history_name=history_name@entry=0x55d9c542872a 
"mc.vfs.password", def_text=def_text@entry=0x , completion_flags=completion_flags@entry=INPUT_COMPLETE_NONE) at wtools.c:506
#15 0x55d9c53be3f4 in vfs_get_password (msg=msg@entry=0x55d9c66732c0 "FTP: 
Passwort benötigt für ftpuser") at utilvfs.c:365
#16 0x55d9c53c5d21 in ftpfs_login_server (me=me@entry=0x55d9c5479e60 
, super=super@entry=0x55d9c6673210, 
netrcpass=netrcpass@entry=0x0) at ftpfs.c:643
#17 0x55d9c53c7bb8 in ftpfs_open_archive_int (super=0x55d9c6673210, 
me=0x55d9c5479e60 ) at ftpfs.c:973
#18 ftpfs_open_archive (super=0x55d9c6673210, vpath=, 
vpath_element=) at ftpfs.c:1028
#19 0x55d9c53ccb1b in vfs_s_get_path (vpath=vpath@entry=0x55d9c6672f10, 
archive=archive@entry=0x7ffe62e66450, flags=flags@entry=0) at direntry.c:1207
#20 0x55d9c53ccc29 in vfs_s_inode_from_path 
(vpath=vpath@entry=0x55d9c6672f10, flags=flags@entry=5) at direntry.c:398
#21 0x55d9c53cce01 in vfs_s_opendir (vpath=0x55d9c6672f10) at direntry.c:426
#22 0x55d9c53cce86 in vfs_s_chdir (vpath=) at direntry.c:496
#23 0x55d9c5397167 in mc_chdir (vpath=vpath@entry=0x55d9c6672d20) at 
interface.c:678
#24 0x55d9c5387f95 in create_panels () at filemanager.c:665
#25 create_file_manager () at filemanager.c:924
#26 do_nc () at filemanager.c:1836
#27 0x55d9c53754d1 in main (argc=, argv=) at 
main.c:463

commit 0375997c789eef9b6355aadd80aaf4aced68c560
Author: Andrew Borodin 
Date:   Tue May 18 10:09:33 2021 +0300

Ticket #4244: fix segfault on dialog before panels get visible.

If some small dialog (error message or password request) is displayed
before main mc window gets visible, the segfault occures.

The cause of segfault is update of prompt that is not created yet.

(setup_mc, create_file_manager): move creation of event channel from
setup_mc() to create_file_manager(), make that after creation of all
file manager widgets.

Signed-off-by: Andrew Borodin 

Index: mc-4.8.26/src/filemanager/filemanager.c
===
--- mc-4.8.26.orig/src/filemanager/filemanager.c
+++ mc-4.8.26/src/filemanager/filemanager.c
@@ -858,11 +858,6 @@ setup_mc (void)
 #endif /* HAVE_CHARSET */
 #endif /* HAVE_SLANG */
 
-#ifdef ENABLE_SUBSHELL
-if (mc_global.tty.use_subshell)
-add_select_channel (mc_global.tty.subshell_pty, load_prompt, NULL);
-#endif /* !ENABLE_SUBSHELL */
-
 if ((tty_baudrate () < 9600) || mc_global.tty.slow_terminal)
 verbose = FALSE;
 }
@@ -941,6 +936,13 @@ create_file_manager (void)
 the_bar = buttonbar_new (mc_global.keybar_visible);
 group_add_widget (g, the_bar);
 midnight_set_buttonbar (the_bar);
+
+#ifdef ENABLE_SUBSHELL
+/* Must 

Bug#685506: debian-policy: Please add field Files-Excluded to machine readable copyright files definition

[Sean Whitton]

Hello,

On Fri 17 Sep 2021 at 06:24PM -04, Nicholas D Steeves wrote:

> Hi,
>
> Sean Whitton  writes:
>
>> Hello,
>>
>> On Sun 25 Oct 2020 at 09:40PM -04, Joe Nahmias wrote:
>>
>>> Is this truly the case that all that's needed is a new patch? Can we get
>>> an official ACK from one of the policy editors? I'd be happy to re-write
>>> the original patch to apply against HEAD if that's all that is required.
>>
>> Well, it would need seconding, but otherwise, ACK.
>>
>> Thank you for your interest.
>>
>
> Gentle ping to Policy editors for that seconding :-)  It would be really
> nice to move this info from tribal knowledge to documentation.

There's no patch to be seconded ...?

-- 
Sean Whitton


signature.asc
Description: PGP signature

Bug#987372: buster-pu: package distro-info-data/0.41+deb10u3 OR (distro-info/1.0~deb10u1 AND distro-info-data/0.47~deb10u1)

[Stefano Rivera]

Hi SRMs (2021.04.22_09:57:49_-0700)

Given the lack of reply here, let's stick with the minimal option.

There have been more changes since the last patch, so here's an updated
debdiff. Uploaded to buster-proposed-updates.

> [ Checklist ]
>   [x] *all* changes are documented in the d/changelog
>   [x] I reviewed all changes and I approve them
>   [x] attach debdiff against the package in stable
>   [x] the issue is verified as fixed in unstable

Still true.

Changes:

distro-info-data (0.41+deb10u4) buster; urgency=medium

  * Update data to 0.51, without new columns:
- Add estimated date for Buster EOL.
- Correct the EOL date for Debian Jessie.
- Add Debian 13 "Trixie", with a rough date.
- Add Ubuntu 21.10, Impish Indri.
- Move Ubuntu EoLs off weekends.
- Validate that Ubuntu EoLs occur during the week.
- Set bullseye's release date, bookworm's creation date, and buster's EoL
  date based on the updated planned bullseye release date.

 -- Stefano Rivera   Fri, 17 Sep 2021 15:30:21 -0700

SR

-- 
Stefano Rivera
  http://tumbleweed.org.za/
  +1 415 683 3272
diff -Nru distro-info-data-0.41+deb10u3/debian/changelog 
distro-info-data-0.41+deb10u4/debian/changelog
--- distro-info-data-0.41+deb10u3/debian/changelog  2020-11-02 
12:44:14.0 -0800
+++ distro-info-data-0.41+deb10u4/debian/changelog  2021-09-17 
15:30:21.0 -0700
@@ -1,3 +1,17 @@
+distro-info-data (0.41+deb10u4) buster; urgency=medium
+
+  * Update data to 0.51, without new columns:
+- Add estimated date for Buster EOL.
+- Correct the EOL date for Debian Jessie.
+- Add Debian 13 "Trixie", with a rough date.
+- Add Ubuntu 21.10, Impish Indri.
+- Move Ubuntu EoLs off weekends.
+- Validate that Ubuntu EoLs occur during the week.
+- Set bullseye's release date, bookworm's creation date, and buster's EoL
+  date based on the updated planned bullseye release date.
+
+ -- Stefano Rivera   Fri, 17 Sep 2021 15:30:21 -0700
+
 distro-info-data (0.41+deb10u3) buster; urgency=medium
 
   * Update data to 0.45:
diff -Nru distro-info-data-0.41+deb10u3/debian.csv 
distro-info-data-0.41+deb10u4/debian.csv
--- distro-info-data-0.41+deb10u3/debian.csv2020-11-02 12:44:14.0 
-0800
+++ distro-info-data-0.41+deb10u4/debian.csv2021-09-17 15:30:21.0 
-0700
@@ -11,10 +11,11 @@
 5.0,Lenny,lenny,2007-04-08,2009-02-14,2012-02-06
 6.0,Squeeze,squeeze,2009-02-14,2011-02-06,2014-05-31
 7,Wheezy,wheezy,2011-02-06,2013-05-04,2016-04-26
-8,Jessie,jessie,2013-05-04,2015-04-25,2018-06-06
+8,Jessie,jessie,2013-05-04,2015-04-25,2018-06-17
 9,Stretch,stretch,2015-04-25,2017-06-17,2020-07-06
-10,Buster,buster,2017-06-17,2019-07-06
-11,Bullseye,bullseye,2019-07-06
-12,Bookworm,bookworm,2021-08-01
+10,Buster,buster,2017-06-17,2019-07-06,2022-08-14
+11,Bullseye,bullseye,2019-07-06,2021-08-14,2024-08-14
+12,Bookworm,bookworm,2021-08-14
+13,Trixie,trixie,2023-08-01
 ,Sid,sid,1993-08-16
 ,Experimental,experimental,1993-08-16
diff -Nru distro-info-data-0.41+deb10u3/ubuntu.csv 
distro-info-data-0.41+deb10u4/ubuntu.csv
--- distro-info-data-0.41+deb10u3/ubuntu.csv2020-11-02 12:44:14.0 
-0800
+++ distro-info-data-0.41+deb10u4/ubuntu.csv2021-09-17 15:30:21.0 
-0700
@@ -32,4 +32,5 @@
 19.10,Eoan Ermine,eoan,2019-04-18,2019-10-17,2020-07-17
 20.04 LTS,Focal Fossa,focal,2019-10-17,2020-04-23,2025-04-23
 20.10,Groovy Gorilla,groovy,2020-04-23,2020-10-22,2021-07-22
-21.04,Hirsute Hippo,hirsute,2020-10-22,2021-04-22,2022-01-22
+21.04,Hirsute Hippo,hirsute,2020-10-22,2021-04-22,2022-01-20
+21.10,Impish Indri,impish,2021-04-22,2021-10-14,2022-07-14
diff -Nru distro-info-data-0.41+deb10u3/validate-csv-data 
distro-info-data-0.41+deb10u4/validate-csv-data
--- distro-info-data-0.41+deb10u3/validate-csv-data 2020-11-02 
12:44:14.0 -0800
+++ distro-info-data-0.41+deb10u4/validate-csv-data 2021-09-17 
15:30:21.0 -0700
@@ -21,6 +21,7 @@
 import optparse
 import os
 import sys
+from datetime import date
 
 _COLUMNS = {
 "debian": ("version", "codename", "series", "created", "release", "eol"),
@@ -121,6 +122,17 @@
"to the given date in column `%s'")
 error(filename, csvreader.line_num, msg, date1, date2)
 failures += 1
+# Check that Ubuntu EOL lands on a weekday
+if distro == 'ubuntu':
+for column, eol_date in row.items():
+if not column.startswith('eol'):
+continue
+if not eol_date:
+continue
+if eol_date.weekday() > 5 and eol_date >= date(2021, 1, 1):
+msg = '%s for %s lands on a weekend (%s)'
+error(filename, csvreader.line_num, msg, column,
+  row['codename'], date)
 
 return failures == 0
 

Bug#685506: debian-policy: Please add field Files-Excluded to machine readable copyright files definition

[Nicholas D Steeves]

Hi,

Sean Whitton  writes:

> Hello,
>
> On Sun 25 Oct 2020 at 09:40PM -04, Joe Nahmias wrote:
>
>> Is this truly the case that all that's needed is a new patch? Can we get
>> an official ACK from one of the policy editors? I'd be happy to re-write
>> the original patch to apply against HEAD if that's all that is required.
>
> Well, it would need seconding, but otherwise, ACK.
>
> Thank you for your interest.
>

Gentle ping to Policy editors for that seconding :-)  It would be really
nice to move this info from tribal knowledge to documentation.

Best,
Nicholas


signature.asc
Description: PGP signature

Bug#994579: node-node-sass: Please use packaged node-get-stdin

[Bastien Roucariès]

Package: node-node-sass
Severity: wishlist

Dear Maintainer,

Please use package node-get-stdin

Thanks

Bug#994578: node-node-sass: Please split between arch:all arch:any package

[Bastien Roucariès]

Package: node-node-sass
Severity: important

Dear Maintainer,


node-node-sass should be split between arch:all and arch:any package.

The first one should be ma:foreign (if possible), the second one ma: same

It will improve crossbuilt and moreover be ma friendly

Bastien

Bug#992058: opensysusers: uses `eval` on data that is not supposed to be safe to eval

[Lorenzo]

Control: tags -1 patch

Hi,

On Tue, 10 Aug 2021 11:07:24 +0200 Ansgar  wrote:
> Package: opensysusers
> Version: 0.6-2
> Severity: serious
> Tags: security upstream
> X-Debbugs-Cc: Debian Security Team 
> 
> opensysusers uses the shell's `eval` on everything in sysusers.d like
> there is no tomorrow. These files can contain shell meta-characters
> that should not result in code execution, e.g., in the GECOS field.
> 
> +---
> | # mkdir /etc/sysusers.d
> | # echo 'u test-user - "Do not $(rm /etc/bash.bashrc)"
> /var/lib/test-users /bin/sh' > /etc/sysusers.d/test.conf | # ls -l
> /etc/bash.bashrc | -rw-r--r-- 1 root root 1994 Jun 22 02:26
> /etc/bash.bashrc | # systemd-sysusers # this is opensysusers
> | # ls -l /etc/bash*
> | ls: cannot access '/etc/bash*': No such file or directory
> +---[ opensysusers 0.6-2 ]
> 
> systemd's systemd-sysuser behaves differently:
> 
> +---
> | # mkdir /etc/sysusers.d
> | # echo 'u test-user - "Do not $(rm /etc/bash.bashrc)"
> /var/lib/test-users /bin/sh' > /etc/sysusers.d/test.conf | # ls -l
> /etc/bash.bashrc | -rw-r--r-- 1 root root 1994 Jun 22 02:26
> /etc/bash.bashrc | # systemd-sysusers
> | Creating group systemd-coredump with gid 999.
> | Creating user systemd-coredump (systemd Core Dumper) with uid 999
> and gid 999. | Creating group test-user with gid 998.
> | Creating user test-user (Do not $(rm /etc/bash.bashrc)) with uid
> 998 and gid 998. | # ls -l /etc/bash.bashrc
> | -rw-r--r-- 1 root root 1994 Jun 22 02:26 /etc/bash.bashrc
> | # getent passwd test-user
> | test-user:x:998:998:Do not $(rm
> /etc/bash.bashrc):/var/lib/test-users:/bin/sh +---[ systemd 247.3-6 ]
> 
> As opensysusers is supposed to be a drop-in requirement for
> systemd-sysusers it *must* behave as systemd does and not execute
> data.
> 
> Ansgar
> 

Attached is a patch that sets the GECOS field without using eval: under
the assumption that the double quote character is not valid for
Type,Name,ID field it should work. Did not have the time to test it yet.
If someone has a better idea I do welcome suggestion.

Lorenzo



--- ./sysusers  2020-12-22 12:41:37.754884910 +0100
+++ ./sysusers.new  2021-09-17 19:38:32.927974348 +0200 @@ -66,10
+66,30 @@ 
 parse_string() {
[ -n "${1%%#*}" ] || return
+   full_line=$1
 
-   eval "set -- $1"
+   #eval "set -- $1" # do not eval, see #992058 and CVE-2021-40084
+   set -- $1
type="$1" name="$2" id="$3" gecos="$4" home="$5"
 
+   # and now set the GECOS field without eval
+   if [ "${type}" = u ]; then
+   if  [ ! -z "$4" ] && [  "$4" != '-' ]; then
+   # strip everything before the first "
+   gecosplus=${full_line#*\"}
+   # now strip everything after the last "
+   gecos=${gecosplus%\"*}
+   # check if there are other valid fields after
GECOS
+   gecostest=$(echo $gecosplus | grep -o '".*' -)
+   if [ "$gecostest" = '"' ]; then
+   home=
+   else
+   set -- $gecostest
+   home=$2
+   fi
+   fi
+   fi
+
case "${type}" in
[gu])
case "${id}" in 65535|4294967295) warninvalid;
return; esac

Bug#994577: lintian: node-* arch:all package should depends on nodejs:any and b-d on nodejs:native

[Bastien Roucariès]

Package: lintian
Version: 2.104.0
Severity: wishlist

Dear Maintainer,


In order to improve cross build of nodejs ecosystem, node-* arch:all package
should depends on nodejs:any and b-d on nodejs:native

Maybe this test should be restricted to ma: foreign package

Bastien

Bug#983505: Help progress for doas persistence

[Andrea Pappacoda]

> The bug is lingering for 7 months and I want to help this to 
progress if I can..


This was fixed 6 months ago in the packaging Git repository (see 
https://salsa.debian.org/debian/doas/-/commit/4686a00819d963b88b5982fe57cf6cf717765997), 
but the maintainer never pushed the update to the Debian archive (maybe 
Scupake thought that he already did that?).


You could try building the package from the repository if you really 
want to use the persist feature.

Bug#992870: transition: GNOME 40 (libmutter-8-0 and friends)

[Simon McVittie]

On Fri, 17 Sep 2021 at 22:52:45 +0200, Sebastian Ramacher wrote:
> glibc is still not able to migrate, but I have scheduled binNMUs of
> packages involved against the version with the fixed symbols files.
> mutter should be able to migrate in the next run.
> 
> If there are other uploads blocked by glibc and I missed to binNMU them,
> please let me know.

I think gnome-settings-daemon:mipsel and gnome-shell:mipsel would also
benefit from binNMUs:

nmu gnome-settings-daemon_40.0.1-2 gnome-shell_40.4-3 . mipsel . -m 'Rebuild 
against glibc with #994232 fixed'

and while you're there, there seems to be an extension containing
architecture-specific code that isn't critical for the transition but
does need an update for the new Shell, which might as well skip past
glibc as well:

nmu gnome-shell-mailnag_40.0-1 . mipsel . -m 'Rebuild against glibc with 
#994232 fixed'

Thanks,
smcv


signature.asc
Description: PGP signature

Bug#994576: node-* package should not depends on nodejs except if it include an executable file under /usr/bin

[Bastien Roucariès]

Package: lintian
Version: 2.104.0
Severity: wishlist

Dear Maintainer,

node-* package should not depend on nodejs except if they ship a script under
/usr/bin

This is the current javascript policy and here lintian could help

Bastien

Bug#986015: opensysusers: does not create groups implicitly with "m" action

[Lorenzo]

Control: tags -1 patch

Hi,

On Sat, 27 Mar 2021 15:03:02 -0700 Vagrant Cascadian
 wrote:
> Package: opensysusers
> Version: 0.6-2
> Severity: normal
> X-Debbugs-Cc: vagr...@debian.org
> 
> With /etc/sysusers.d/test.conf:
>   #Type Name  ID GECOS Home
> directory Shell u _testuser0 -   "test user 0"
> /var/empty  /usr/sbin/nologin m _testuser0 _testgroup
> 
>   $ sudo opensysusers-sysusers
>   groupadd: invalid group ID '4:65534'
>   groupadd: invalid group ID '65534:65534'
>   usermod: group '_testgroup' does not exist

I think I found the problem, see the patch at the bottom
> 
> According the the opensysusers.d man page:
> 
>m
>Add a user to a group. If the user or group do not exist
> yet, they will be implicitly created.
> 
> The systemd implementation does implicitly create groups that do not
> exist yet, but the opensysusers version does not appear to do so.
> 
> 
> live well,
>   vagrant
> 

Lorenzo

--- ./sysusers  2020-12-22 12:41:37.754884910 +0100
+++ ./sysusers.new  2021-09-17 19:14:06.090291921 +0200
@@ -80,7 +80,7 @@
fi
;;
m)
-   add_group "${name}" '-'
+   add_group "${id}" '-'
if id "${name}" >/dev/null 2>&1; then
usermod -a -G "${id}" "${name}"
else

Bug#994571: lintian: please warn javascript package including .node files "*/nodejs/.*\.node$' and ma:foreign

[Bastien ROUCARIES]

Le ven. 17 sept. 2021 à 21:20, Felix Lechner
 a écrit :
>
> Hi,
>
> On Fri, Sep 17, 2021 at 1:39 PM Bastien Roucariès
>  wrote:
> >
> > Package that include "/usr/(?:lib|share)/(?:[^/]+/)?/nodejs/.*\.node$' are
> > arch:any package (include node plugin) and thus should be arch:any
>
> Thank you for this suggestion!
>
> The files in question are shipped in installable packages that do not
> contain the Arch:any designation. (It appears in d/control in the
> sources.) The installable architecture in DEBIAN/control is either the
> actual port or 'all'. Furthermore, I believe the wildcarded directory
> level before 'nodejs' must be a known multi-arch triplet.

yes it is
> Is it okay
> if Lintian instead requires that the multi-arch component of the file
> paths found matches the target architecture of the installable package
> in which they were shipped?
Yes it is

> If that is acceptable, Lintian already has checks to constrain the
> installation paths for shared libraries, although they may need to be
> expanded. (And we have to watch out for -cross packages.) Do you have
> candidates for examination besides node-iconv (which I found locally)
> that should trigger the condition?

I am fixing node-expat-expat that ship under /usr/lib/


> > Moreover in this case ma:foreign is a error (they are plugins)
>
> That will be addressed at the same time, although I am not yet sure how.

Thanks

> Kind regards
> Felix Lechner

Bug#994571: lintian: please warn javascript package including .node files "*/nodejs/.*\.node$' and ma:foreign

[Felix Lechner]

Hi,

On Fri, Sep 17, 2021 at 1:39 PM Bastien Roucariès
 wrote:
>
> Package that include "/usr/(?:lib|share)/(?:[^/]+/)?/nodejs/.*\.node$' are
> arch:any package (include node plugin) and thus should be arch:any

Thank you for this suggestion!

The files in question are shipped in installable packages that do not
contain the Arch:any designation. (It appears in d/control in the
sources.) The installable architecture in DEBIAN/control is either the
actual port or 'all'. Furthermore, I believe the wildcarded directory
level before 'nodejs' must be a known multi-arch triplet. Is it okay
if Lintian instead requires that the multi-arch component of the file
paths found matches the target architecture of the installable package
in which they were shipped?

If that is acceptable, Lintian already has checks to constrain the
installation paths for shared libraries, although they may need to be
expanded. (And we have to watch out for -cross packages.) Do you have
candidates for examination besides node-iconv (which I found locally)
that should trigger the condition?

> Moreover in this case ma:foreign is a error (they are plugins)

That will be addressed at the same time, although I am not yet sure how.

Kind regards
Felix Lechner

Bug#994556: RFS: cpp-httplib/0.9.4+ds-1 [ITP] -- C++ HTTP/HTTPS server and client library

[Andrea Pappacoda]

Package: sponsorship-requests
Severity: wishlist

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Dear mentors,

I am looking for a sponsor for my package "cpp-httplib":

 * Package name: cpp-httplib
   Version : 0.9.4+ds-1
   Upstream Author : Yuji Hirose 
 * URL : https://github.com/yhirose/cpp-httplib
 * License : Expat
 * Vcs : https://github.com/yhirose/cpp-httplib
   Section : libs

It builds those binary packages:

  libcpp-httplib-dev - C++ HTTP/HTTPS server and client library - development
files
  libcpp-httplib0 - C++ HTTP/HTTPS server and client library

To access further information about this package, please visit the following
URL:

  https://mentors.debian.net/package/cpp-httplib/

Alternatively, one can download the package with dget using this command:

  dget -x https://mentors.debian.net/debian/pool/main/c/cpp-httplib/cpp-
httplib_0.9.4+ds-1.dsc

Changes for the initial release:

 cpp-httplib (0.9.4+ds-1) UNRELEASED; urgency=low
 .
   * Initial release. Closes: #994547

Regards,
- --
  Andrea Pappacoda


-BEGIN PGP SIGNATURE-

iIoEARYIADIWIQSlw/BqXszDGx3GlQz/yQfijUdG7QUCYUTLcRQcYW5kcmVhQHBh
cHBhY29kYS5pdAAKCRD/yQfijUdG7Vt+AQDPUIZ5fXlYxJ7INpcAOqydJJgMKVNa
sq4Hqr2rKsIFOQD8DKqcDsxEfetYV5U8XIl/aydnwCpvGOBIBGpAFNyTtgU=
=hS/v
-END PGP SIGNATURE-

Bug#992870: transition: GNOME 40 (libmutter-8-0 and friends)

[Sebastian Ramacher]

On 2021-09-15 20:09:26 +0200, Sebastian Ramacher wrote:
> On 2021-09-14 09:12:34 +0100, Simon McVittie wrote:
> > On Sun, 12 Sep 2021 at 20:17:36 +0100, Simon McVittie wrote:
> > > According to
> > > https://release.debian.org/transitions/html/auto-upperlimit-gnome-shell.html
> > > it might be necessary to remove
> > > gnome-shell-extension-easyscreencast_1.1.0+git20210116.3252312-1 from
> > > testing if #993061 cannot be fixed soon. The other packages with an upper
> > > limit have already been uploaded to unstable and will hopefully transition
> > > reasonably smoothly.
> > 
> > Looking at the migration excuses for gnome-shell, I think we will need
> > something more like this:
> > 
> > remove gnome-shell-extension-dashtodock/69-1
> > remove gnome-shell-extension-desktop-icons/20.04.0+git20200908-8
> > remove gnome-shell-extension-easyscreencast/1.1.0+git20210116.3252312-1
> 
> Removal hints added
> 
> > 
> > I'm not sure why the first two would block migration since they don't have
> > an upper limit on their version numbers, but those extensions haven't been
> > ported to gnome-shell 40, so they aren't going to work in practice anyway.
> > 
> > Unfortunately this transition has got caught behind glibc, so will likely
> > take a while to migrate. This seems to be a bug in glibc's mipsel symbols
> > file (I'll open a bug for that).
> 
> Thanks. The latest upload of glibc looks like it would soon be able to
> migrate and fixed the symbols file. If there are new regressions that
> prevent migration of some of the ongoing transtions, I will look at some
> additional binNMUs

glibc is still not able to migrate, but I have scheduled binNMUs of
packages involved against the version with the fixed symbols files.
mutter should be able to migrate in the next run.

If there are other uploads blocked by glibc and I missed to binNMU them,
please let me know.

Cheers

> 
> Cheers
> 
> > 
> > smcv
> > 
> 
> -- 
> Sebastian Ramacher



-- 
Sebastian Ramacher


signature.asc
Description: PGP signature

Bug#994574: bullseye-pu: package dazzdb/1.0+git20201103.8d98c37-1+deb11u1

[Sebastian Ramacher]

Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian@packages.debian.org
Usertags: pu
X-Debbugs-Cc: sramac...@debian.org, daz...@packages.debian.org

[ Reason ]
glibc 2.32 uncovered a use-after-free issue in dazzdb (#993770). While
dazzdb technically does not crash on bullseye, a fix for the issue helps
us in avoiding a Breaks in glibc for bullseye -> bookworm upgrades.

[ Tests ]
The code is covered by autopkgtests

[ Risks ]
It's the exact same patch as in unstable.

[ Checklist ]
  [x] *all* changes are documented in the d/changelog
  [x] I reviewed all changes and I approve them
  [x] attach debdiff against the package in (old)stable
  [x] the issue is verified as fixed in unstable

Cheers
-- 
Sebastian Ramacher
diff -Nru dazzdb-1.0+git20201103.8d98c37/debian/changelog 
dazzdb-1.0+git20201103.8d98c37/debian/changelog
--- dazzdb-1.0+git20201103.8d98c37/debian/changelog 2021-01-19 
10:02:03.0 +0100
+++ dazzdb-1.0+git20201103.8d98c37/debian/changelog 2021-09-17 
20:48:03.0 +0200
@@ -1,3 +1,10 @@
+dazzdb (1.0+git20201103.8d98c37-1+deb11u1) bullseye; urgency=medium
+
+  [ Aurelien Jarno ]
+  * Fix a use-after-free in DBstats (Closes: #993770)
+
+ -- Sebastian Ramacher   Fri, 17 Sep 2021 20:48:03 +0200
+
 dazzdb (1.0+git20201103.8d98c37-1) unstable; urgency=medium
 
   * New upstream version
diff -Nru dazzdb-1.0+git20201103.8d98c37/debian/patches/series 
dazzdb-1.0+git20201103.8d98c37/debian/patches/series
--- dazzdb-1.0+git20201103.8d98c37/debian/patches/series2021-01-19 
10:02:03.0 +0100
+++ dazzdb-1.0+git20201103.8d98c37/debian/patches/series2021-09-14 
20:49:54.0 +0200
@@ -2,3 +2,4 @@
 compiler-flags.patch
 destdir.patch
 cross.patch
+use-after-free.patch
diff -Nru dazzdb-1.0+git20201103.8d98c37/debian/patches/use-after-free.patch 
dazzdb-1.0+git20201103.8d98c37/debian/patches/use-after-free.patch
--- dazzdb-1.0+git20201103.8d98c37/debian/patches/use-after-free.patch  
1970-01-01 01:00:00.0 +0100
+++ dazzdb-1.0+git20201103.8d98c37/debian/patches/use-after-free.patch  
2021-09-14 20:49:57.0 +0200
@@ -0,0 +1,16 @@
+Description: fix a use-after-free causing a segmentation fault with glibc 2.32
+Author: Aurelien Jarno 
+Forwarded: https://github.com/thegenemyers/DAZZ_DB/issues/41 
+Last-Update: 2021-09-14
+
+--- dazzdb-1.0+git20201103.8d98c37.orig/DBstats.c
 dazzdb-1.0+git20201103.8d98c37/DBstats.c
+@@ -346,8 +346,6 @@ int main(int argc, char *argv[])
+   }
+   }
+ printf("\n");
+-
+-Close_Track(db,track);
+   }
+   }
+ 


signature.asc
Description: PGP signature

Bug#994256: django-axes: autopkgtest needs update for new version of python-django: warnings changed

[Sunil Mohan Adapa]

tags 994256 + pending
thanks

New version of the package is ready for upload and will be uploaded 
after some manual testing.


Thanks,

--
Sunil

Bug#994573: qemu: Please enable (e)bpf support

[Laurent Bigonville]

Source: qemu
Version: 1:6.1+dfsg-5
Severity: wishlist

Hello,

Apparently qemu support eBPF to speedup the RSS (Receive Side Scaling)
hash calculation in the virtio-net drive.

It might be intresting to enable this.

It requires libbpf-dev that is only available on linux-architectures

Kind regards,
Laurent Bigonville


-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable'), (1, 
'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=fr_BE.UTF-8, LC_CTYPE=fr_BE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: SELinux: enabled - Mode: Permissive - Policy name: refpolicy

Bug#994572: cfrpki: CVE-2021-3761

[Salvatore Bonaccorso]

Source: cfrpki
Version: 1.2.2-1
Severity: grave
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team 

Hi,

The following vulnerability was published for cfrpki.

CVE-2021-3761[0]:
| Any CA issuer in the RPKI can trick OctoRPKI prior to 1.3.0 into
| emitting an invalid VRP "MaxLength" value, causing RTR sessions to
| terminate. An attacker can use this to disable RPKI Origin Validation
| in a victim network (for example AS 13335 - Cloudflare) prior to
| launching a BGP hijack which during normal operations would be
| rejected as "RPKI invalid". Additionally, in certain deployments RTR
| session flapping in and of itself also could cause BGP routing churn,
| causing availability issues.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-3761
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3761
[1] 
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422
[2] https://github.com/cloudflare/cfrpki/security/advisories/GHSA-c8xp-8mf3-62h9

Regards,
Salvatore

Bug#994571: lintian: please warn javascript package including .node files "*/nodejs/.*\.node$' and ma:foreign

[Bastien Roucariès]

Package: lintian
Version: 2.104.0
Severity: minor

Dear Maintainer,

Package that include "/usr/(?:lib|share)/(?:[^/]+/)?/nodejs/.*\.node$' are
arch:any package (include node plugin) and thus should be arch:any

Moreover in this case ma:foreign is a error (they are plugins)

Bastien

Bug#994544: [Pkg-javascript-devel] Bug#994544: Bug#994544: npm2deb: nodejs:any for arch:all package

[Bastien ROUCARIES]

Le ven. 17 sept. 2021 à 20:24, Yadd  a écrit :
>
>
>
> Le 17 septembre 2021 21:30:16 GMT+02:00, Bastien ROUCARIES 
>  a écrit :
> >Le ven. 17 sept. 2021 à 16:06, Yadd  a écrit :
> >>
> >> Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
> >> > Package: npm2deb
> >> > Version: 0.3.0-6
> >> > Severity: important
> >> >
> >> > Dear Maintainer,
> >> >
> >> >
> >> > In order to help cross build nodejs depends should be nodejs:any for 
> >> > purejs
> >> > module in depends field.
> >> >
> >> > In build-depends field we should use nodejs:native in order to help 
> >> > crossbuilt
> >> >
> >> > Bastien
> >>
> >> Hi Bastien,
> >>
> >> you should clone this and reassign to pkg-js-tools (build depends on
> >> nodejs).
> >> npm2deb should not set a run dependency to nodejs except if there is a
> >> /usr/bin file
> >Not sure perl set perl:any on every package.
> >
> >It is sensible to do so
> >
> >Bastien
>
> A Perl file is usable only with Perl, not a JS one. We decided to remove 
> nodejs dependency some months ago.
Ok thanks look sensible nevertheless, nodejs:any is also sensible if needed.

Will open a lintian bug also
>
> Cheers,
> Yadd
>
> --
> Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma 
> brièveté.

Bug#977320: linux-image-4.19.0-9-amd64: Enable CONFIG_BACKLIGHT_PWM

[Vincent Blut]

Package: src:linux
Followup-For: Bug #977320

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Hi Pablo,

Were you able to diagnosed this issue?

Cheers,
Vincent

-BEGIN PGP SIGNATURE-

iHUEARYKAB0WIQSRJQjHKbAUfuoc+DAQn1qAt/bgAQUCYUT7HgAKCRAQn1qAt/bg
AdpBAQDGv+E83P4C0+T9+G8jlohi3RhhiGjWfPnB5PAtV+hGaQD+NtuUuqXx/Iip
H8FXkRu4VlZ82BLw5H9WhpfSlGFpDQ4=
=5Vml
-END PGP SIGNATURE-

Bug#994544: [Pkg-javascript-devel] Bug#994544: Bug#994544: npm2deb: nodejs:any for arch:all package

[Yadd]

Le 17 septembre 2021 21:30:16 GMT+02:00, Bastien ROUCARIES 
 a écrit :
>Le ven. 17 sept. 2021 à 16:06, Yadd  a écrit :
>>
>> Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
>> > Package: npm2deb
>> > Version: 0.3.0-6
>> > Severity: important
>> >
>> > Dear Maintainer,
>> >
>> >
>> > In order to help cross build nodejs depends should be nodejs:any for purejs
>> > module in depends field.
>> >
>> > In build-depends field we should use nodejs:native in order to help 
>> > crossbuilt
>> >
>> > Bastien
>>
>> Hi Bastien,
>>
>> you should clone this and reassign to pkg-js-tools (build depends on
>> nodejs).
>> npm2deb should not set a run dependency to nodejs except if there is a
>> /usr/bin file
>Not sure perl set perl:any on every package.
>
>It is sensible to do so
>
>Bastien

A Perl file is usable only with Perl, not a JS one. We decided to remove nodejs 
dependency some months ago.

Cheers,
Yadd

-- 
Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma 
brièveté.

Bug#991989: libclang-13-dev: dead symlink to shared library

[Sylvestre Ledru]

Please report a different bug as it is a different issue. Thanks

S


Le 17/09/2021 à 21:09, Christian Göttsche a écrit :
> Control: reopen 991989
> Control: retitle libclang-13-dev: cmake find_package implementation broken
>
> The previously dead symlink issue has been resolved, but the cmake
> script does still not work;
> it references the non-existing file
> '/usr/lib/llvm-13/lib/libclang-13.so.13.0.0':
>
>
> -- IWYU: out-of-tree configuration
> CMake Error at /usr/lib/llvm-13/lib/cmake/clang/ClangTargets.cmake:706
> (message):
>  The imported target "libclang" references the file
>
> "/usr/lib/llvm-13/lib/libclang-13.so.13.0.0"
>
>  but this file does not exist.  Possible reasons include:
>
>  * The file was deleted, renamed, or moved to another location.
>
>  * An install or uninstall procedure did not complete successfully.
>
>  * The installation package was faulty and contained
>
> "/usr/lib/llvm-13/lib/cmake/clang/ClangTargets.cmake"
>
>  but not all the files it references.
>
> Call Stack (most recent call first):
>  /usr/lib/cmake/clang-13/ClangConfig.cmake:20 (include)
>  CMakeLists.txt:20 (find_package)
>

Bug#994570: mitmproxy: CVE-2021-39214

[Salvatore Bonaccorso]

Source: mitmproxy
Version: 6.0.2-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team 

Hi,

The following vulnerability was published for mitmproxy.

CVE-2021-39214[0]:
| mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In
| mitmproxy 7.0.2 and below, a malicious client or server is able to
| perform HTTP request smuggling attacks through mitmproxy. This means
| that a malicious client/server could smuggle a request/response
| through mitmproxy as part of another request/response's HTTP message
| body. While a smuggled request is still captured as part of another
| request's body, it does not appear in the request list and does not go
| through the usual mitmproxy event hooks, where users may have
| implemented custom access control checks or input sanitization. Unless
| one uses mitmproxy to protect an HTTP/1 service, no action is
| required. The vulnerability has been fixed in mitmproxy 7.0.3 and
| above.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-39214
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39214
[1] 
https://github.com/mitmproxy/mitmproxy/security/advisories/GHSA-22gh-3r9q-xf38

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Bug#994569: libxml-security-java: CVE-2021-40690

[Salvatore Bonaccorso]

Source: libxml-security-java
Version: 2.0.10-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: car...@debian.org, Debian Security Team 

Hi,

The following vulnerability was published for libxml-security-java.

CVE-2021-40690[0]:
| Bypass of the secureValidation property

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-40690
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40690
[1] https://santuario.apache.org/secadv.data/CVE-2021-40690.txt.asc

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Bug#994568: node-ansi-regex: CVE-2021-3807

[Salvatore Bonaccorso]

Source: node-ansi-regex
Version: 5.0.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: car...@debian.org, Debian Security Team 
Control: found -1 5.0.0-1

Hi,

The following vulnerability was published for node-ansi-regex.

CVE-2021-3807[0]:
| ansi-regex is vulnerable to Inefficient Regular Expression Complexity


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2021-3807
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
[1] https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
[2] https://github.com/chalk/ansi-regex/pull/37

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Bug#994558: [INTL:sv] Swedish strings for libdvd-pkg debconf

[Anders Jonsson]

Hi Martin,
this file fixes a place in the translation where a word was mistakenly 
split ("version er"->"versioner").


/Anders
# Translation of libdvd-pkg debconf template to Swedish
# Copyright (C) 2021 Martin Bagge 
# This file is distributed under the same license as the libdvd-pkg package.
#
# Martin Bagge , 2021
msgid ""
msgstr ""
"Project-Id-Version: libdvd-pkg\n"
"Report-Msgid-Bugs-To: libdvd-...@packages.debian.org\n"
"POT-Creation-Date: 2020-12-13 17:44+0100\n"
"PO-Revision-Date: 2021-09-17 19:53+0200\n"
"Last-Translator: Martin Bagge \n"
"Language-Team: Swedish \n"
"Language: sv\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"

#. Type: note
#. Description
#. Type: boolean
#. Description
#. Type: note
#. Description
#: ../templates:2001 ../templates:4001 ../templates:6001
msgid ""
"This package automates the process of launching downloads of the source "
"files for ${PKGG} from videolan.org, compiling them, and installing the "
"binary packages (${PKGG_ALL})."
msgstr ""
"Detta paket automatiserar processen för att hämta källkodsfiler för ${PKGG} "
"från videolan.org, kompilera dessa och slutligen installera binärpaketen "
"(${PKGG_ALL})."

#. Type: note
#. Description
#: ../templates:2001
msgid ""
"Please run \"sudo dpkg-reconfigure ${PKGI}\" to launch this process for the "
"first time."
msgstr ""
"Vänligen kör \"sudo dpkg-reconfigure ${PKGI}\" för att köra processen första "
"gången."

#. Type: title
#. Description
#: ../templates:3001
msgid "Download, build and install ${PKGG}${VER}"
msgstr "Hämta, bygg och installera ${PKGG}${VER}"

#. Type: boolean
#. Description
#: ../templates:4001
msgid "Download, build, and install ${PKGG}${VER}?"
msgstr "Hämta, bygg och installera ${PKGG}${VER}?"

#. Type: boolean
#. Description
#: ../templates:4001
msgid "Please confirm whether you wish this to happen."
msgstr "Bekräfta att det är detta du vill genomföra."

#. Type: title
#. Description
#: ../templates:5001
msgid "Upgrade available for ${PKGG}"
msgstr "Uppgradering tillgänglig för ${PKGG}"

#. Type: note
#. Description
#: ../templates:6001
msgid ""
"An update to version ${VER} is available, but automatic upgrades are "
"disabled."
msgstr ""
"En uppdatering till version ${VER} finns tillgänglig men automatiska "
"uppdateringar är inte aktiverat."

#. Type: note
#. Description
#: ../templates:6001
msgid ""
"Please run \"sudo dpkg-reconfigure ${PKGI}\" to launch this process manually "
"and/or activate automatic upgrades in future."
msgstr ""
"Kör \"sudo dpkg-reconfigure ${PKGI}\" för att starta processen manuellt och/"
"eller aktivera automatiska uppgraderingar."

#. Type: boolean
#. Description
#: ../templates:7001
msgid "Enable automatic upgrades for ${PKGG}?"
msgstr "Ska automatiska uppgraderingar aktiveras för ${PKGG}?"

#. Type: boolean
#. Description
#. Type: boolean
#. Description
#: ../templates:7001 ../templates:8001
msgid ""
"If activated, the APT post-invoke hook takes care of future automatic "
"upgrades of ${PKGG} (which may be triggered by new versions of ${PKGI}). "
"When updates are available, the hook will launch the process of downloading "
"the source, recompiling it, and (if \"apt-get check\" reports no errors) "
"using \"dpkg -i\" to install the new versions."
msgstr ""
"Om detta aktiveras kommer APT-utlösaren post-invoke att ta hand om kommande "
"automatiska uppgraderingar för ${PKGG} (som kan komma att initieras av nya "
"versioner av ${PKGI}). När uppdateringar är tillgängliga kommer utlösaren "
"att starta processen med att hämta källkoden, kompilera den och (om \"apt-"
"get check\" inte rapporterar några fel) använda \"dpkg -i\" för att "
"installera nya versioner."

#. Type: boolean
#. Description
#. Type: boolean
#. Description
#: ../templates:7001 ../templates:8001
msgid ""
"Alternatively, the process can be launched manually by running \"sudo dpkg-"
"reconfigure ${PKGI}\"."
msgstr ""
"Alternativt kan denna process startas manuellt genom att köra \"sudo dpkg-"
"reconfigure ${PKGI}\"."

#. Type: boolean
#. Description
#: ../templates:8001
msgid "Disable automatic upgrades for ${PKGG}?"
msgstr "Avaktivera automatiska uppgraderingar för ${PKGG}?"

Bug#994474: altree bug fixed but autopkgtest causes Segmentation fault (Was: Bug#994474: please update recommends on openblas)

[Andreas Tille]

On Fri, Sep 17, 2021 at 03:40:33PM +0200, Vincent Danjean wrote:
> > > altree recommends libopenblas-base, which is a transitional dummy package.
> > > Please replace it by libopenblas0.
> > 
> > this is fixed in Git but when rebuilding (with more recent gcc) I get
> 
>   I built the package locally, installed it and executed the
> debian/tests/run-unit-test manually.
>   No errors occurred (with gcc from up-to-date unstable, ie
> gcc=4:10.2.1-1 and gcc-10=10.3.0-10).
> 
>   Did you try with gcc from experimental ?

No,  I was building in unstable chroot and was executing autopkgtest in
the same chroot.  I admit salsa-ci did not reproduced my local problem
here.

Kind regards

   Andreas.
 
> > 
> > autopkgtest [12:08:54]: test run-unit-test: [---
> > Analyzing file number 1
> > read done
> > Starting tree analysis
> > Starting permutations
> > /tmp/autopkgtest.BGTBdL/tree/debian/tests/run-unit-test: line 26:   150 
> > Segmentation fault  altree -i test.res.log -j nb_cas_control.txt -a -t 
> > SNP -p paup -r 1 --tree-to-analyse 1 -o 1_caco.asso -q qualitative
> > autopkgtest [12:08:55]: test run-unit-test: ---]
> > autopkgtest [12:08:55]: test run-unit-test:  - - - - - - - - - - results - 
> > - - - - - - - - -
> > run-unit-testFAIL non-zero exit status 139
> > 
> > 
> > I'd love if someone could have a look
> > 
> >   Andreas.
> > 
> 
> 

-- 
http://fam-tille.de

Bug#994567: black: autopkgtest regression: ModuleNotFoundError: No module named 'aiohttp_cors'

[Paul Gevers]

Source: black
Version: 21.4b2-1
X-Debbugs-CC: debian...@lists.debian.org
Severity: serious
User: debian...@lists.debian.org
Usertags: regression

Dear maintainer(s),

With a recent upload of black the autopkgtest of black fails in testing
on amd64 when that autopkgtest is run with the binary packages of black
from unstable. It passes when run with only packages from testing. In
tabular form:

   passfail
black  from testing21.4b2-1
all others from testingfrom testing

I copied some of the output at the bottom of this report, are you
missing (test) dependencies? On top of fixing amd64, can you please stop
"PASSING" on the other architectures? If you can't test there, please
use the (relatively new) Architecture [0] field in the autopkgtest
control file to skip testing on those architectures, or add the
skippable restriction and exit with code 77.

Currently this regression is blocking the migration to testing [1]. Can
you please investigate the situation and fix it?

More information about this bug and the reason for filing it can be found on
https://wiki.debian.org/ContinuousIntegration/RegressionEmailInformation

Paul

[0]
https://salsa.debian.org/ci-team/autopkgtest/-/raw/master/doc/README.package-tests.rst
[1] https://qa.debian.org/excuses.php?package=black

https://ci.debian.net/data/autopkgtest/testing/amd64/b/black/15301566/log.gz

 ERRORS

 ERROR collecting tests/test_blackd.py
_
/usr/lib/python3/dist-packages/blackd/__init__.py:12: in 
import aiohttp_cors
E   ModuleNotFoundError: No module named 'aiohttp_cors'

During handling of the above exception, another exception occurred:
tests/test_blackd.py:10: in 
import blackd
/usr/lib/python3/dist-packages/blackd/__init__.py:20: in 
sys.exit(-1)
E   SystemExit: -1
--- Captured stderr

aiohttp dependency is not installed: No module named 'aiohttp_cors'.
Please re-install black with the '[d]' extra install to obtain
aiohttp_cors: `pip install black[d]`
 ERROR collecting tests/test_format.py
_
ImportError while importing test module
'/tmp/autopkgtest-lxc.nc2rafez/downtmp/autopkgtest_tmp/tests/test_format.py'.
Hint: make sure your test modules/packages have valid Python names.
Traceback:
/usr/lib/python3.9/importlib/__init__.py:127: in import_module
return _bootstrap._gcd_import(name[level:], package, level)
tests/test_format.py:4: in 
from parameterized import parameterized
E   ModuleNotFoundError: No module named 'parameterized'
=== short test summary info

ERROR tests/test_blackd.py - SystemExit: -1
ERROR tests/test_format.py
!!! Interrupted: 2 errors during collection

=== 1 deselected, 2 errors in 0.44s

autopkgtest [03:10:26]: test testsuite: ---]



OpenPGP_signature
Description: OpenPGP digital signature

Bug#994544: [Pkg-javascript-devel] Bug#994544: Bug#994544: npm2deb: nodejs:any for arch:all package

[Bastien ROUCARIES]

control: clone -1 -2
control: reassign -2 pkg-js-tools

Le ven. 17 sept. 2021 à 16:06, Yadd  a écrit :
>
> Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
> > Package: npm2deb
> > Version: 0.3.0-6
> > Severity: important
> >
> > Dear Maintainer,
> >
> >
> > In order to help cross build nodejs depends should be nodejs:any for purejs
> > module in depends field.
> >
> > In build-depends field we should use nodejs:native in order to help 
> > crossbuilt
> >
> > Bastien
>
> Hi Bastien,
>
> you should clone this and reassign to pkg-js-tools (build depends on
> nodejs).
> npm2deb should not set a run dependency to nodejs except if there is a
> /usr/bin file
>
> --
> Pkg-javascript-devel mailing list
> pkg-javascript-de...@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel

Bug#994544: [Pkg-javascript-devel] Bug#994544: Bug#994544: npm2deb: nodejs:any for arch:all package

[Bastien ROUCARIES]

Le ven. 17 sept. 2021 à 16:06, Yadd  a écrit :
>
> Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
> > Package: npm2deb
> > Version: 0.3.0-6
> > Severity: important
> >
> > Dear Maintainer,
> >
> >
> > In order to help cross build nodejs depends should be nodejs:any for purejs
> > module in depends field.
> >
> > In build-depends field we should use nodejs:native in order to help 
> > crossbuilt
> >
> > Bastien
>
> Hi Bastien,
>
> you should clone this and reassign to pkg-js-tools (build depends on
> nodejs).
> npm2deb should not set a run dependency to nodejs except if there is a
> /usr/bin file
Not sure perl set perl:any on every package.

It is sensible to do so

Bastien

>
> --
> Pkg-javascript-devel mailing list
> pkg-javascript-de...@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel

Bug#512265: #512265: clarifying the intent of the bug report

[Felix Lechner]

Control: retitle -1 lintian: flag upstream tests missing from autopkgtest

Hi Andrius,

On Fri, Sep 17, 2021 at 9:21 AM Andrius Merkys  wrote:
>
> I doubt this reflects the original intent of this bug
> report.

I agree with you, and picked yet another title. Please let me know
what you think.

> * lintian: Warn about unused autopkgtests

Upon reflection and refactoring the code [1] I do not think it can be
implemented. With Test-Directory set to '.' all files in the source
package are candidates, and would produce hints for not being used.

> * lintian: Warn about unused build time tests

I am not sure how to implement the original request. Your suggestions
are welcome.

Thank you for figuring out the purpose of this report!

Kind regards
Felix Lechner

[1] 
https://salsa.debian.org/lintian/lintian/-/commit/7428997ded64b57ccf9a7c5874c683b7b8fd188e#02c42ce39affeca72ca4ed5d708e75a7bc945171_203_207

Bug#981402: jinja-vanish: diff for NMU version 0.2~git20160124.8980cb2-1.1

[Boyuan Yang]

Control: tags 981402 + patch
Control: tags 981402 + pending

Dear maintainer,

I've prepared an NMU for jinja-vanish (versioned as 0.2~git20160124.8980cb2-
1.1) and
uploaded it to DELAYED/14. Please feel free to tell me if I
should delay it longer.

For the change around missing debian/.gitignore: I don't know why, but this
file is keep getting deleted when I am building the source package using
sbuild. If you have any clue on it, please let me know.

Regards,
Boyuan Yang

diff -Nru jinja-vanish-0.2~git20160124.8980cb2/debian/changelog jinja-vanish-
0.2~git20160124.8980cb2/debian/changelog
--- jinja-vanish-0.2~git20160124.8980cb2/debian/changelog   2020-04-25
11:10:28.0 -0400
+++ jinja-vanish-0.2~git20160124.8980cb2/debian/changelog   2021-09-17
14:51:48.0 -0400
@@ -1,3 +1,11 @@
+jinja-vanish (0.2~git20160124.8980cb2-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * No change source-only upload to allow testing migration.
+(Closes: #981402)
+
+ -- Boyuan Yang   Fri, 17 Sep 2021 14:51:48 -0400
+
 jinja-vanish (0.2~git20160124.8980cb2-1) unstable; urgency=medium
 
   * Initial package for Debian (Closes: #958812)
diff -Nru jinja-vanish-0.2~git20160124.8980cb2/debian/.gitignore jinja-vanish-
0.2~git20160124.8980cb2/debian/.gitignore
--- jinja-vanish-0.2~git20160124.8980cb2/debian/.gitignore  2020-04-25
11:10:28.0 -0400
+++ jinja-vanish-0.2~git20160124.8980cb2/debian/.gitignore  1969-12-31
19:00:00.0 -0500
@@ -1,4 +0,0 @@
-/.debhelper
-/debhelper-build-stamp
-/files
-/jinja-vanish/


signature.asc
Description: This is a digitally signed message part

Bug#994563: unattended-upgrades: include the content of /etc/debian_chroot in mail Subject

[Martin-Éric Racine]

Package: unattended-upgrades
Version: 2.8
Severity: wishlist

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

The current format of the Subject line mailed by unattended-upgrades:

unattended-upgrades result for hostname.domain: SUCCESS

It would be desirable to add the content of /etc/debian_chroot, if it exists 
e.g.:

unattended-upgrades result for hostname.domain (stable chroot i386): SUCCESS

...similar to what the Bourne shell prompt does.

Thanks!

- -- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (900, 'unstable')
Architecture: i386 (x86_64)

Kernel: Linux 5.10.0-8-amd64 (SMP w/8 CPU threads)
Locale: LANG=fi_FI.UTF-8, LC_CTYPE=fi_FI.UTF-8 (charmap=UTF-8), LANGUAGE=fi:en
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages unattended-upgrades depends on:
ii  debconf [debconf-2.0]  1.5.77
ii  lsb-base   11.1.0
ii  lsb-release11.1.0
ii  python33.9.2-3
ii  python3-apt2.2.1
ii  python3-dbus   1.2.18-3
ii  python3-distro-info1.0
ii  ucf3.0043
ii  xz-utils   5.2.5-2

Versions of packages unattended-upgrades recommends:
ii  systemd-cron [cron-daemon]  1.5.17-3
ii  systemd-sysv247.9-1

Versions of packages unattended-upgrades suggests:
ii  bsd-mailx  8.1.2-0.20180807cvs-2
ii  needrestart3.5-4
ii  nullmailer [mail-transport-agent]  1:2.2-3
ii  powermgmt-base 1.36
ii  python3-gi 3.40.1-2

- -- debconf information:
* unattended-upgrades/enable_auto_updates: true

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdFiEEyJACx3qL7GpObXOQrh+Cd8S017YFAmFE5cUACgkQrh+Cd8S0
17Z92w//daBoiPrMiU/BvDRnzUR4MwMbUrDZqxRAZ0CuskMaGHKapn0Sb/bFjbCX
RgXervK8O4OLsyP7ijYhRQRMA8O+F+upyGDlQIcE9xogJYEvg5YfCxd4yxM3CGJC
NJHWEoTzSrezh9zwb/Nn+v2FIIuDZ3ZZd1u+QmGuC/G+bH9cx5im8p3a95AZWc7E
N/9CL6//9hDFc+Dmyiktvqin+jTO/irSddfVsDm4Ve0qwrc2I9jW3CHAlbsccwF2
4ZQYBvNMzb69xpYcCHW4x3KYmitKngrmm/QrPP7P8pi9//yKRA5lYUyDB7rKKGk3
5Zf1V6D6ag2HCcm9r4V/M/DyuoZfaWnHaIpRvJJI2Wq6K5SzcsSEmf/RzR0yEg1k
+8/7mmLVCWLIz1EhhbNpPosnu3JRchtNZWPOd9ZJ9jYgqIgzXxnXGR05EwjgsZmf
N+MUSqylJdMmJNYaynukmZMoKqSvxhs6HIX74Pkw13b0aZe/Hb/ix+XPk7IPfYfE
/TxXI14auTwozKBSzqUVolzwfpGnYTo3xncIlU+p1BtChrGNnoAdbspRB3mVtdMJ
v00emZ85afRSGZYtkSX+cs5tz0XM+Zd88fcK34GhMDGBxlwfup2V6J+LGlYipT/e
JH3QYfKq8nKn+r+ONuX15L59zHt7Is27XuNBEmutzgZjNi8fmhE=
=kGBp
-END PGP SIGNATURE-

Bug#994564: RFS: sosreport/4.2-1 -- Set of tools to gather troubleshooting data from a system

[Eric Desrochers]

Package: sponsorship-requests
Severity: normal

Dear mentors,

I am looking for a sponsor for my package "sosreport":

 * Package name: sosreport
   Version : 4.2-1
   Upstream Author : Bryn M. Reeves 
 * URL : https://github.com/sosreport/sos
 * License : GPL-2+, GPL-2
 * Vcs : https://salsa.debian.org/sosreport-team/sosreport
   Section : admin

It builds those binary packages:

  sosreport - Set of tools to gather troubleshooting data from a system

To access further information about this package, please visit the
following URL:

  https://mentors.debian.net/package/sosreport/

Alternatively, one can download the package with dget using this command:

  dget -x 
https://mentors.debian.net/debian/pool/main/s/sosreport/sosreport_4.2-1.dsc

Changes since the last upload:

 sosreport (4.2-1) unstable; urgency=medium
 .
   * New 4.2 upstream release.
 - This release contains numerous improvements
   and bug fixes to several components within sos,
   including an overhaul to the project's test suite
   and infrastructure.
 .
   * For more details, full release note is available here:
 - https://github.com/sosreport/sos/releases/tag/4.2
 .
   * Former patches, now fixed:
 - d/p/0002-fix-dict-order-py38-incompatibility.patch
 - d/p/0003-systemd-prefer-resolvectl-over-systemd-resolve.patch
 .
   * Remaining patches:
 - d/p/0001-debian-change-tmp-dir-location.patch

Regards,
-- 
  Eric Desrochers

Bug#994547: ITP: cpp-httplib -- C++ HTTP/HTTPS server and client library

[Andrea Pappacoda]

Package: wnpp
Severity: wishlist
Owner: Andrea Pappacoda 
X-Debbugs-Cc: debian-de...@lists.debian.org

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

* Package name: cpp-httplib
  Version : 0.9.3+ds-1
  Upstream Author : Yuji Hirose 
* URL : https://github.com/yhirose/cpp-httplib
* License : Expat
  Programming Lang: C++
  Description : C++ HTTP/HTTPS server and client library

cpp-httplib is a C++11 cross platform HTTP/HTTPS library, with a focus on ease
of use. This is a multi-threaded 'blocking' HTTP library. If you are looking
for a 'non-blocking' library, this is not the one that you want.

This is a dependency of the yuzu emulator, see https://bugs.debian.org/947399

I'll upload the package to mentors soon.


-BEGIN PGP SIGNATURE-

iIoEARYIADIWIQSlw/BqXszDGx3GlQz/yQfijUdG7QUCYUSp3xQcYW5kcmVhQHBh
cHBhY29kYS5pdAAKCRD/yQfijUdG7Yg/AQC0RAnyhQjCJWJRATBAn12rlEuoHGKW
yiNk/M0MNaQLbgD/YzUq2w429BNNi/fl6hAUUjHYunaLjh2IvQh37bpL3Ao=
=iguS
-END PGP SIGNATURE-

Bug#994256: [Freedombox-pkg-team] Bug#994256: django-axes: autopkgtest needs update for new version of python-django: warnings changed

[Sunil Mohan Adapa]

On 9/17/21 10:54 AM, Carsten Schoenert wrote:

Hi,

Am Tue, Sep 14, 2021 at 09:18:18PM +0200 schrieb Paul Gevers:
...

Currently this regression is blocking the migration of python-django to
testing [1]. Of course, python-django shouldn't just break your
autopkgtest (or even worse, your package), but it seems to me that the
change in python-django was intended and your package needs to update to
the new situation.

If this is a real problem in your package (and not only in your
autopkgtest), the right binary package(s) from python-django should
really add a versioned Breaks on the unfixed version of (one of your)
package(s). Note: the Breaks is nice even if the issue is only in the
autopkgtest as it helps the migration software to figure out the right
versions to combine in the tests.


I did a quick import of the currently most recent version 5.24.0 and did
afterwards a rebuild of this version.

The built of the binary packages and also the autopkgtest works without
further needed adjustments so updating django-axes to a recent version
would be enough to fix this issue.



Thanks! I have also checked for the compatibility of axes code with 
Django 3.2. All the changes need seem to be already in 
place[1][2][3][4]. I will work to update the packaging to newer version.


Links:

1) 
https://github.com/jazzband/django-axes/commit/b4a71de81fd2d1c316c819fff4c68581ada6208d


2) 
https://github.com/jazzband/django-axes/commit/876b6f3dc4377daa6e1d2a1244ea7a86bf952695


3) 
https://github.com/jazzband/django-axes/commit/2e074eebc5752dbedde5f66ece0d9a38bc8694cd


4) 
https://github.com/jazzband/django-axes/commit/4986c240a6ccea6f52c1a18ca08f56ad2d6fa6de#diff-b8833de46a20430033cf627e5843a9a394547e8d6dd62d1a6c05e1f31039244e


--
Sunil

Bug#994474: altree bug fixed but autopkgtest causes Segmentation fault (Was: Bug#994474: please update recommends on openblas)

[Vincent Danjean]

On 17/09/2021 19:45, Nilesh Patra wrote:

On Fri, 17 Sept 2021 at 22:48, Vincent Danjean mailto:vdanj...@debian.org>> wrote:
    I cannot push to salsa (yet) because I'm not in the Debian-Med groups
nor in the members of the altree project. I just requested the Debian-Med
group membership on salsa. I'm waiting for approval.


Granted access, welcome.


Thanks.



PS: I made two MR (for master and pristine-tar) if someone wants to 
see/merge
before I gain write access.


I think it is much more cleaner if you push directly.


Done.

  Regards,
Vincent

Bug#994097: bullseye-pu: package osmpbf/1.5.0-1+deb11u1

[Jonathan Wiltshire]

Control: tag -1 moreinfo

On Sat, Sep 11, 2021 at 07:34:27PM +0200, Bas Couwenberg wrote:
> [ Reason ]
> As reported in #993895, the update of protobuf to 3.12.4 requires
> regenerating the header files.
> 
> [ Impact ]
> Headers provided by libosmpbf-dev are unusuable.

Is that the only package affected? If so (i.e. no arch-indep packages need
rebuilding) we can deal with it through a binNMU instead.

Thanks,

-- 
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51



signature.asc
Description: PGP signature

Bug#993899: bullseye-pu: package btrbk/0.27.1-1.1+deb11u1

[Jonathan Wiltshire]

Control: tag -1 confirmed moreinfo

On Tue, Sep 07, 2021 at 09:09:33PM +, Thorsten Alteholz wrote:
> The attached debdiff for btrbk fixes CVE-2021-38173 in Bullseye.
> 
> This CVE is marked as no-dsa by the security team.
> 
> The same patch was already uploaded to unstable with version 0.27.1-2.

Please go ahead, and remove the moreinfo tag from this bug when uploaded.

Thanks,


-- 
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51



signature.asc
Description: PGP signature

Bug#994562: cryptsetup: consider exit statuses of keyscripts

[Christoph Anton Mitterer]

Package: cryptsetup
Version: 2:2.4.0-1
Severity: important



Hey.

First a question, which I couldn't answer myself on a quick glance on the code:

When a keyscript is run, do the functions cache it's output and only execute
cryptsetup (with the key) when the keyscript's exit status is also 0?

Or is the output just piped through and the exit status ignored?


AFAICS it does the later.


First, I think this is generally problematic:
What if the keyscript actually wasn't able to obtain the key but still printed
out something?
For LUKS this might be no problem as that can be checked for. But for plain
dm-crypt? Checking for a fs may not work there either (it may not contain a fs).

So ideally I think, cryptsetup should only be executed, when the keyscript
succeded.


Simple test case:
# truncate image --size=1G  #(never written to)
# cryptsetup plainOpen image XXX
  
# hd /dev/mapper/XXX | head
  89 fb be 33 ed 33 86 3a  d8 96 db 52 37 f2 41 d9  |...3.3.:...R7.A.|
0010  5e 7e 95 62 19 59 e3 eb  db ad 42 ad 76 07 42 66  |^~.b.YB.v.Bf|
...

# cryptsetup plainClose XXX
# cryptsetup plainOpen image XXX
  
# hd /dev/mapper/XXX | head
  e2 2b f6 f5 7f 73 4c d9  1c bf 10 ad d5 bf d5 4b  |.+...sLK|
0010  b8 66 33 94 a1 c6 50 13  50 66 6a 36 bb b9 9e a0  |.f3...P.Pfj6|
...


And I guess it would just behave the same when cryptdisks_start or the 
initramfs-
code was used?


What I do in my own keyscript is, that I store the results (base64-encoded)
in a variable and only when the final status is clear, I decode that and print 
it
to stdout andexit 0.

Maybe that's something you could do as well, e.g. something like.

key=$( keyscript | base64 -w 0 )
...
if [ $magic -eq 0]; then
printf '$s' "$key" | base64 -d | cryptsetup ...
fi


Problem is obviously how to get the exit status of keyscript, rather than 
base64.
I do it as I describe here: https://unix.stackexchange.com/a/668853/474076

That seems to be even POSIX comptaible. ;-)


I'd say one can ignore the exit status of printf and base64 (even with -d, as 
we know
that the input has been correctly encoded), ... I guess these could only fail in
extreme cases like out of resources.



Second, and that was the actual reason for writing this ticket ;-) ...

Different exit statuses should be defined for keyscripts.
0 = obviously, everything worked, key shall be used
1 = some error occurred, please retry (as long as you tries=n is fulfilled)
2 = retry, but sleep 1s
3 = retry, but sleep 10s
4 = retry, but sleep 30s
5 = retry, but sleep 1m
6 = retry, but sleep 5m
10 = catatrophic failure, don't retry regardless of tries=n
(all others I'd reserve and handle for now like 1)

Something like 10 seems missing right now and is how I came to this:
E.g. my keyscript needs some parameters in the 3rd field of crypttab. If that's 
missing
it will always fail and there will be no recovery from that (i.e. it doesn't 
help
just to re-enter another passphrase).

In that case and with tries=0 it just goes into an endless loop right now, 
which is
always bad.

So in that case I'd wish I could exit 10 and cryptsetup would simply stop and 
indicate
some error status itself.
During the initramfs, that may of course mean unbootable system (which it is 
however
anyway).


Cheers,
Chris.

Bug#993523: bullseye-pu: package osmcoastline/2.3.0-1+deb11u1

[Jonathan Wiltshire]

Control: tag -1 confirmed moreinfo

On Thu, Sep 02, 2021 at 04:04:32PM +0200, Bas Couwenberg wrote:
> [ Reason ]
> As reported on the GIS list by the upstream author, osmcoastline in
> bullseye doesn't work with projections other than WGS84.

Please go ahead, and remove the moreinfo tag from this bug when uploaded.

Thanks,


-- 
Jonathan Wiltshire  j...@debian.org
Debian Developer http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51



signature.asc
Description: PGP signature

Bug#994561: cheesecutter ftbfs with gdc-11

[Matthias Klose]

Source: src:cheesecutter
Version: 2.9+git20191210-2
Severity: important
Tags: sid bookworm
User: debian-...@lists.debian.org
Usertags: ftbfs-gcc-11

[...]
   debian/rules override_dh_auto_build
make[1]: Entering directory '/<>/cheesecutter-2.9+git20191210'
/usr/bin/make
make[2]: Entering directory '/<>/cheesecutter-2.9+git20191210'
Makefile:29: warning: ignoring prerequisites on suffix rule definition
Makefile:26: warning: ignoring prerequisites on suffix rule definition
acme -f cbm --outfile src/c64/player.bin src/c64/player_v4.acme
Warning - File src/c64/player_v4.acme, line 1687 (Zone ): Found old
"!for" syntax.
Warning - File src/c64/player_v4.acme, line 1693 (Zone ): Found old
"!for" syntax.
Warning - File src/c64/player_v4.acme, line 1699 (Zone ): Found old
"!for" syntax.
Warning - File src/c64/player_v4.acme, line 1707 (Zone ): Found old
"!for" syntax.
Warning - File src/c64/player_v4.acme, line 1721 (Zone ): Found old
"!for" syntax.
gdc -O2 -g -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed
-I./src -J./src/c64 -J./src/font -c -o src/ct2util.o src/ct2util.d
gdc -O2 -g -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed
-I./src -J./src/c64 -J./src/font -c -o src/ct/base.o src/ct/base.d
src/ct/base.d:385:41: warning: function ct.base.Track.dup is deprecated
[-Wdeprecated]
  385 | list[i+1] = list[i].dup;
  | ^
src/ct/base.d:397:39: warning: function ct.base.Track.dup is deprecated
[-Wdeprecated]
  397 | list[i] = list[i+1].dup;
  |   ^
gdc -O2 -g -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed
-I./src -J./src/c64 -J./src/font -c -o src/com/cpu.o src/com/cpu.d
gdc -O2 -g -Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed
-I./src -J./src/c64 -J./src/font -c -o src/com/util.o src/com/util.d
src/com/util.d:142:17: error: undefined identifier ‘munch’
  142 | munch(strvalue, "\r\n\t");
  | ^
make[2]: *** [Makefile:75: src/com/util.o] Error 1
make[2]: Leaving directory '/<>/cheesecutter-2.9+git20191210'
make[1]: *** [debian/rules:16: override_dh_auto_build] Error 2
make[1]: Leaving directory '/<>/cheesecutter-2.9+git20191210'
make: *** [debian/rules:13: build] Error 2

Bug#994255: djangorestframework: autopkgtest needs update for new version of python-django: error changed

[Carsten Schoenert]

Control: forwarded -1 
https://github.com/encode/django-rest-framework/issues/8160
Control: tags -1 upstream

Hi,

Am Tue, Sep 14, 2021 at 09:14:46PM +0200 schrieb Paul Gevers:
...
> _
> TestNaiveDayLightSavingTimeTimeZoneDateTimeField.test_invalid_inputs _
> 
> self =
>  object at 0x7fe05e8d3b80>
> 
> def test_invalid_inputs(self):
> """
> Ensure that invalid values raise the expected validation error.
> """
> for input_value, expected_failure in get_items(self.invalid_inputs):
> with pytest.raises(serializers.ValidationError) as exc_info:
> self.field.run_validation(input_value)
> >   assert exc_info.value.detail == expected_failure, \
> 'input value: {}'.format(repr(input_value))
> E   AssertionError: input value: '2017-03-12T02:30:00'
> E   assert [ErrorDetail(...de='invalid')] == ['Invalid
> dat...a/New_York".']
> E At index 0 diff: ErrorDetail(string='Datetime has wrong
> format. Use one of these formats instead:
> -MM-DDThh:mm[:ss[.uu]][+HH:MM|-HH:MM|Z].', code='invalid') !=
> 'Invalid datetime for the timezone "America/New_York".'
> E Use -v to get the full diff
> 

there is an upstream issue opened which seems to be the same topic.

https://github.com/encode/django-rest-framework/issues/8160

Regards
Carsten

Bug#993523: bullseye-pu: package osmcoastline/2.3.0-1+deb11u1

[Sebastiaan Couwenberg]

Control: tags -1 - moreinfo

On 9/17/21 7:46 PM, Jonathan Wiltshire wrote:
> On Thu, Sep 02, 2021 at 04:04:32PM +0200, Bas Couwenberg wrote:
>> [ Reason ]
>> As reported on the GIS list by the upstream author, osmcoastline in
>> bullseye doesn't work with projections other than WGS84.
> 
> Please go ahead, and remove the moreinfo tag from this bug when uploaded.

Done, thanks!

Kind Regards,

Bas

-- 
 GPG Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1

Bug#994560: transition: libffi

[Matthias Klose]

Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: transition

Update libffi to version 3.4.2.  The transition was done for Ubuntu, a handful
of bugs regarding build failures (mostly due to GCC 11) are filed in Debian. I
would like to get this done before the ghc version in unstable changes, due to
the rather large number of ghc related no-change uploads.

Bug#994097: bullseye-pu: package osmpbf/1.5.0-1+deb11u1

[Sebastiaan Couwenberg]

Control: tags -1 - moreinfo

On 9/17/21 7:56 PM, Jonathan Wiltshire wrote:
> On Sat, Sep 11, 2021 at 07:34:27PM +0200, Bas Couwenberg wrote:
>> [ Reason ]
>> As reported in #993895, the update of protobuf to 3.12.4 requires
>> regenerating the header files.
>>
>> [ Impact ]
>> Headers provided by libosmpbf-dev are unusuable.
> 
> Is that the only package affected? If so (i.e. no arch-indep packages need
> rebuilding) we can deal with it through a binNMU instead.

libosmpbf-java seems fine, mkgmap-splitter in bullseye was able to parse
a pbf file and osmosis was able to read and write pbf files too.

Kind Regards,

Bas

-- 
 GPG Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1

Bug#994429: gimp: missing SANE option under File > Create menu

[Simon McVittie]

Control: reassign 994429 xsane 0.999-12
Control: merge 993293 994429
Control: affects 994429 + gimp

On Fri, 17 Sep 2021 at 13:31:13 -0400, Eric Cooper wrote:
> On Thu, Sep 16, 2021 at 11:39:55AM +0200, Bernhard Übelacker wrote:
> > this might be the same as reported
> > in #993293 against the xsane package.
> 
> I downgraded xsane and xsane-common to 0.999-10 and this fixes my
> problem, so I think this confirms Bernhard's idea.

Reassigning to xsane, then.

smcv

Bug#994559: dub ftbfs with gdc-11

[Matthias Klose]

Source: src:dub
Version: 1.24.0-1
Severity: important
Tags: sid bookworm
User: debian-...@lists.debian.org
Usertags: ftbfs-gcc-11

[...]
dh binary
   dh_update_autotools_config
   dh_autoreconf
   debian/rules override_dh_auto_build
make[1]: Entering directory '/<>'
gdmd -run /<>/build.d \
-g -O -w -release
Wrote version_.d` file with version: 1.24.0-1build1
Building dub using gdmd (dflags: ["-g", "-O", "-w", "-release", "-frelease"]),
this may take a while...
Command `["gdmd", "-of/<>/bin/dub", "-I/<>/source",
"-version=DubUseCurl", "-version=DubApplication", "-g", "-O", "-w", "-release",
"-frelease", "@build-files.txt"]` failed, output was:
source/dub/internal/sdlang/parser.d:121:21: error: module std.variant is not
accessible here, perhaps add 'static import std.variant;'
  121 | alias ParserEvent = std.variant.Algebraic!(
  | ^

make[1]: *** [debian/rules:14: override_dh_auto_build] Error 1
make[1]: Leaving directory '/<>'
make: *** [debian/rules:11: binary] Error 2
dpkg-buildpackage: error: debian/rules binary subprocess returned exit status 2

Bug#994256: django-axes: autopkgtest needs update for new version of python-django: warnings changed

[Carsten Schoenert]

Hi,

Am Tue, Sep 14, 2021 at 09:18:18PM +0200 schrieb Paul Gevers:
... 
> Currently this regression is blocking the migration of python-django to
> testing [1]. Of course, python-django shouldn't just break your
> autopkgtest (or even worse, your package), but it seems to me that the
> change in python-django was intended and your package needs to update to
> the new situation.
> 
> If this is a real problem in your package (and not only in your
> autopkgtest), the right binary package(s) from python-django should
> really add a versioned Breaks on the unfixed version of (one of your)
> package(s). Note: the Breaks is nice even if the issue is only in the
> autopkgtest as it helps the migration software to figure out the right
> versions to combine in the tests.

I did a quick import of the currently most recent version 5.24.0 and did
afterwards a rebuild of this version.

The built of the binary packages and also the autopkgtest works without
further needed adjustments so updating django-axes to a recent version
would be enough to fix this issue.

Regards
Carsten

Bug#993275: ng: stores wrong paths to cp and ls if built on merged-/usr system

[Simon McVittie]

On Fri, 17 Sep 2021 at 10:46:31 -0700, Vagrant Cascadian wrote:
> On 2021-08-29, Simon McVittie wrote:
> > If gnunet is built on a merged-/usr system
> 
> gnunet -> ng ? ... Or should this be reassigned to gnunet?

Sorry, that was copypasta from a previously-reported bug. ng and gnunet
both have bugs of this class. This one, #993275, is about ng's use of
cp and ls. The similar bug about gnunet's use of ifconfig is #993249.

> Since ng is maintained by QA, you could upload the fix yourself, or I
> may get to it in the coming weeks...

I don't know what ng is or how to test it, only how to build it and
throw it at diffoscope, so I'm unlikely to do a QA upload.

Looking at its package tracker page, it seems to be an Emacs-style
editor with CJK input support, and hasn't had an upstream release since
2003. I have to question whether this is something we really want in
the distribution, if nobody either inside or outside Debian wants to
maintain it...

smcv


signature.asc
Description: PGP signature

Bug#994558: [INTL:sv] Swedish strings for libdvd-pkg debconf

[Martin Bagge / brother]

package: ircd-hybrid
severity: wishlist
tags: patch l10n

Please consider to add this file to translation of debconf.
--
brother
# Translation of libdvd-pkg debconf template to Swedish
# Copyright (C) 2021 Martin Bagge 
# This file is distributed under the same license as the libdvd-pkg package.
#
# Martin Bagge , 2021
msgid ""
msgstr ""
"Project-Id-Version: libdvd-pkg\n"
"Report-Msgid-Bugs-To: libdvd-...@packages.debian.org\n"
"POT-Creation-Date: 2020-12-13 17:44+0100\n"
"PO-Revision-Date: 2021-09-17 19:53+0200\n"
"Last-Translator: Martin Bagge \n"
"Language-Team: Swedish \n"
"Language: sv\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"

#. Type: note
#. Description
#. Type: boolean
#. Description
#. Type: note
#. Description
#: ../templates:2001 ../templates:4001 ../templates:6001
msgid ""
"This package automates the process of launching downloads of the source "
"files for ${PKGG} from videolan.org, compiling them, and installing the "
"binary packages (${PKGG_ALL})."
msgstr ""
"Detta paket automatiserar processen för att hämta källkodsfiler för ${PKGG} "
"från videolan.org, kompilera dessa och slutligen installera binärpaketen "
"(${PKGG_ALL})."

#. Type: note
#. Description
#: ../templates:2001
msgid ""
"Please run \"sudo dpkg-reconfigure ${PKGI}\" to launch this process for the "
"first time."
msgstr ""
"Vänligen kör \"sudo dpkg-reconfigure ${PKGI}\" för att köra processen första "
"gången."

#. Type: title
#. Description
#: ../templates:3001
msgid "Download, build and install ${PKGG}${VER}"
msgstr "Hämta, bygg och installera ${PKGG}${VER}"

#. Type: boolean
#. Description
#: ../templates:4001
msgid "Download, build, and install ${PKGG}${VER}?"
msgstr "Hämta, bygg och installera ${PKGG}${VER}?"

#. Type: boolean
#. Description
#: ../templates:4001
msgid "Please confirm whether you wish this to happen."
msgstr "Bekräfta att det är detta du vill genomföra."

#. Type: title
#. Description
#: ../templates:5001
msgid "Upgrade available for ${PKGG}"
msgstr "Uppgradering tillgänglig för ${PKGG}"

#. Type: note
#. Description
#: ../templates:6001
msgid ""
"An update to version ${VER} is available, but automatic upgrades are "
"disabled."
msgstr ""
"En uppdatering till version ${VER} finns tillgänglig men automatiska "
"uppdateringar är inte aktiverat."

#. Type: note
#. Description
#: ../templates:6001
msgid ""
"Please run \"sudo dpkg-reconfigure ${PKGI}\" to launch this process manually "
"and/or activate automatic upgrades in future."
msgstr ""
"Kör \"sudo dpkg-reconfigure ${PKGI}\" för att starta processen manuellt och/"
"eller aktivera automatiska uppgraderingar."

#. Type: boolean
#. Description
#: ../templates:7001
msgid "Enable automatic upgrades for ${PKGG}?"
msgstr "Ska automatiska uppgraderingar aktiveras för ${PKGG}?"

#. Type: boolean
#. Description
#. Type: boolean
#. Description
#: ../templates:7001 ../templates:8001
msgid ""
"If activated, the APT post-invoke hook takes care of future automatic "
"upgrades of ${PKGG} (which may be triggered by new versions of ${PKGI}). "
"When updates are available, the hook will launch the process of downloading "
"the source, recompiling it, and (if \"apt-get check\" reports no errors) "
"using \"dpkg -i\" to install the new versions."
msgstr ""
"Om detta aktiveras kommer APT-utlösaren post-invoke att ta hand om kommande "
"automatiska uppgraderingar för ${PKGG} (som kan komma att initieras av nya "
"version er av ${PKGI}). När uppdateringar är tillgängliga kommer utlösaren "
"att starta processen med att hämta källkoden, kompilera den och (om \"apt-"
"get check\" inte rapporterar några fel) använda \"dpkg -i\" för att "
"installera nya versioner."

#. Type: boolean
#. Description
#. Type: boolean
#. Description
#: ../templates:7001 ../templates:8001
msgid ""
"Alternatively, the process can be launched manually by running \"sudo dpkg-"
"reconfigure ${PKGI}\"."
msgstr ""
"Alternativt kan denna process startas manuellt genom att köra \"sudo dpkg-"
"reconfigure ${PKGI}\"."

#. Type: boolean
#. Description
#: ../templates:8001
msgid "Disable automatic upgrades for ${PKGG}?"
msgstr "Avaktivera automatiska uppgraderingar för ${PKGG}?"

Bug#994474: altree bug fixed but autopkgtest causes Segmentation fault (Was: Bug#994474: please update recommends on openblas)

[Nilesh Patra]

On Fri, 17 Sept 2021 at 22:48, Vincent Danjean  wrote:

> On 17/09/2021 15:40, Vincent Danjean wrote:
> >I built the package locally, installed it and executed the
> > debian/tests/run-unit-test manually.
> >No errors occurred (with gcc from up-to-date unstable, ie
> > gcc=4:10.2.1-1 and gcc-10=10.3.0-10).
> >
> >Did you try with gcc from experimental ?
>
>I applied debian patches to upstream where I also fixed a missing
> include. Then, I generated a new (upstream) version, updated the Debian
> package (fixing the watch file) and upload it.
>I cannot push to salsa (yet) because I'm not in the Debian-Med groups
> nor in the members of the altree project. I just requested the Debian-Med
> group membership on salsa. I'm waiting for approval.
>

Granted access, welcome.


> PS: I made two MR (for master and pristine-tar) if someone wants to
> see/merge
> before I gain write access.
>

I think it is much more cleaner if you push directly.

Cheers,

Bug#993275: ng: stores wrong paths to cp and ls if built on merged-/usr system

[Vagrant Cascadian]

On 2021-08-29, Simon McVittie wrote:
> If gnunet is built on a merged-/usr system (as created by new
> installations of Debian >= 10, debootstrap --merged-usr, or installing
> the usrmerge package into an existing installation), the paths to cp and
> ls are recorded in the binary package as being in /usr/bin, rather than the
> canonical /bin.

gnunet -> ng ? ... Or should this be reassigned to gnunet?

> From 483dd087b93e02d30a7bf1f022c35d3f88f74d07 Mon Sep 17 00:00:00 2001
> From: Simon McVittie 
> Date: Sun, 29 Aug 2021 22:15:25 +0100
> Subject: [PATCH] d/rules: Specify canonical paths of cp, ls, mv, rmdir
>
> When ng is built on a system where both /usr/bin/cp and /bin/cp
> exist (either merged-/usr or via a symlink farm), this results in storing
> /usr/bin/cp in the installed programs, which will not work as intended
> on systems where only the traditional path /bin/cp exists.
>
> ls is in a similar situation. mv and rmdir are checked by ./configure
> but not hard-coded anywhere; give them the same treatment for symmetry.

Thanks for the patch!

Since ng is maintained by QA, you could upload the fix yourself, or I
may get to it in the coming weeks...


live well,
  vagrant


signature.asc
Description: PGP signature

Bug#994557: sway: Wine program windows don't update

[Pelle]

Package: sway
Version: 1.6-1
Severity: normal

Dear Maintainer,

When I run a Wine program, such as explorer.exe,

$ wine explorer.exe

it shows up, but the window content isn't updated. The mouse cursor is 
not displayed when hovering over, and it doesn't change size on resize 
so contents don't fit the window. You can interact with keyboard 
although the GUI is only updated on some occasions, like close 
confirmation dialog when closing notepad.exe; but when typing name for 
the file to save, the text field is not updated.

I expected Wine application GUIs to update correctly in Sway, so that I 
can browse the web with iexplore.exe and play winemine.exe

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-8-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages sway depends on:
ii  libc62.32-2
ii  libcairo21.16.0-5
ii  libevdev21.11.0+dfsg-1
ii  libgdk-pixbuf-2.0-0  2.42.6+dfsg-2
ii  libgl1-mesa-dri  21.2.1-2
ii  libgles2 1.3.4-1
ii  libglib2.0-0 2.68.4-1
ii  libinput10   1.16.4-3
ii  libjson-c5   0.15-2
ii  libpango-1.0-0   1.48.9+ds1-2
ii  libpangocairo-1.0-0  1.48.9+ds1-2
ii  libpcre3 2:8.39-13
ii  libpixman-1-00.40.0-1
ii  libsystemd0  247.9-1
ii  libudev1 247.9-1
ii  libwayland-client0   1.19.0-2
ii  libwayland-cursor0   1.19.0-2
ii  libwayland-server0   1.19.0-2
ii  libwlroots8  0.13.0-1
ii  libxcb1  1.14-3
ii  libxkbcommon01.0.3-2
ii  policykit-1  0.105-31
ii  swaybg   1.0-2+b1

Versions of packages sway recommends:
ii  foot  1.6.4-1
ii  suckless-tools46-1
ii  sway-backgrounds  1.5.1-2

Versions of packages sway suggests:
ii  swayidle1.7-1
ii  swaylock1.5-2+b1
ii  xdg-desktop-portal-wlr  0.4.0-1

-- no debconf information

Bug#994429: gimp: missing SANE option under File > Create menu

[Eric Cooper]

On Thu, Sep 16, 2021 at 11:39:55AM +0200, Bernhard Übelacker wrote:
> Dear Maintainer,
> this might be the same as reported
> in #993293 against the xsane package.
>
> Kind regards,
> Bernhard
>
> https://bugs.debian.org/993293

I downgraded xsane and xsane-common to 0.999-10 and this fixes my
problem, so I think this confirms Bernhard's idea.

--
Eric Cooper e c c @ c m u . e d u

Bug#993604: freeradius 3.0.21+dfsg-2.2+deb11u1 flagged for acceptance

[Jonathan Wiltshire]

package release.debian.org
tags 993604 = bullseye pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into 
the proposed-updates queue for Debian bullseye.

Thanks for your contribution!

Upload details
==

Package: freeradius
Version: 3.0.21+dfsg-2.2+deb11u1

Explanation: fix thread crash, sample configuration

Bug#994474: altree bug fixed but autopkgtest causes Segmentation fault (Was: Bug#994474: please update recommends on openblas)

[Vincent Danjean]

On 17/09/2021 15:40, Vincent Danjean wrote:

   I built the package locally, installed it and executed the
debian/tests/run-unit-test manually.
   No errors occurred (with gcc from up-to-date unstable, ie
gcc=4:10.2.1-1 and gcc-10=10.3.0-10).

   Did you try with gcc from experimental ?


  I applied debian patches to upstream where I also fixed a missing
include. Then, I generated a new (upstream) version, updated the Debian
package (fixing the watch file) and upload it.
  I cannot push to salsa (yet) because I'm not in the Debian-Med groups
nor in the members of the altree project. I just requested the Debian-Med
group membership on salsa. I'm waiting for approval.

  Andreas: can you check if the missing header fix makes autopkg tests
to succeed?

  Regards,
Vincent

PS: I made two MR (for master and pristine-tar) if someone wants to see/merge
before I gain write access.



   Regards,
     Vincent




autopkgtest [12:08:54]: test run-unit-test: [---
Analyzing file number 1
read done
Starting tree analysis
Starting permutations
/tmp/autopkgtest.BGTBdL/tree/debian/tests/run-unit-test: line 26:   150 
Segmentation fault  altree -i test.res.log -j nb_cas_control.txt -a -t SNP 
-p paup -r 1 --tree-to-analyse 1 -o 1_caco.asso -q qualitative
autopkgtest [12:08:55]: test run-unit-test: ---]
autopkgtest [12:08:55]: test run-unit-test:  - - - - - - - - - - results - - - 
- - - - - - -
run-unit-test    FAIL non-zero exit status 139


I'd love if someone could have a look

  Andreas.

Bug#926714: Old Gradle version

[Philippe De Neve]

Hi,

Got the hint :-). I was not able to compile Gradle 6.4.1 due to a missing
dependency, but it was possible for the latest release 7.2.0. I removed
the gradle-enterprise-gradle-plugin and I've put the adapted code on my
gitlab . The changes are on the
remove_enterprise_features branch, which is on top of the 7.2.0 release
commit.

Best regards,

Philippe


On Wed, 15 Sept 2021 at 14:12, Phil Morrell  wrote:

> On Tue, Sep 14, 2021 at 11:59:55PM +0200, Philippe De Neve wrote:
> > I was wondering why the Gradle version in buster/bullseye/bookworm/sid is
> > 4.4.1. Latest release is 7.2.
>
> Gradle 4.4.1 is the latest version before kotlin was added as a
> build-dependency, which has been a known problem since 2019. However,
> kotlin 1.3.31 has finally been packaged and is currently sitting in the
> NEW queue for review.
>
> Gradle 6.4.1 packaging work is currently stalled in offline mode. It
> needs someone to work out how to build it without the proprietary
> gradle-enterprise-gradle-plugin that upstream uses. Note that this
> doesn't require any familiarity with debian packaging!
>
>
> https://salsa.debian.org/freexian-team/project-funding/-/blob/master/proposed/2021-08-gradle-enterprise.md
>
> BCC'd 926714 since it hasn't been updated with recent developments.
> --
> emorrp1
>

Bug#983170: s3ql: High load causes "Transport endpoint is not connected"

[Graham Cobb]

Package: s3ql
Version: 3.7.0+dfsg-2
Followup-For: Bug #983170

Now that bullseye has shipped, and I have moved on to bookworm, I am keen to do
anything I can to help resolve this. Is there anything I can do? For example
testing with packages? Or is there an upstream fix available for testing?

-- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (900, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-8-amd64 (SMP w/8 CPU threads)
Locale: LANG=en_IE.utf8, LC_CTYPE=en_IE.utf8 (charmap=UTF-8) (ignored: LC_ALL 
set to en_IE.utf8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages s3ql depends on:
ii  fuse3 [fuse]  3.10.4-1
ii  libc6 2.31-17
ii  libjs-sphinxdoc   3.5.4-2
ii  libsqlite3-0  3.36.0-2
ii  procps2:3.3.17-5
ii  psmisc23.4-2
ii  python3   3.9.2-3
ii  python3-apsw  3.36.0-r1-1
ii  python3-cryptography  3.3.2-1
ii  python3-defusedxml0.6.0-2
ii  python3-dugong3.8.1+dfsg-1
ii  python3-google-auth   1.5.1-3
ii  python3-google-auth-oauthlib  0.4.2-1
ii  python3-pkg-resources 52.0.0-4
ii  python3-pyfuse3   3.2.0-2
ii  python3-requests  2.25.1+dfsg-2
ii  python3-systemd   234-3+b4
ii  python3-trio  0.13.0-2

s3ql recommends no packages.

s3ql suggests no packages.

-- debconf-show failed

Bug#994555: bullseye-pu: package node-object-path/0.11.5-3+deb11u1

[Yadd]

Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian@packages.debian.org
Usertags: pu

[ Reason ]
node-object-path is vulnerable to prototye pollution (CVE-2021-23434 and
CVE-2021-3805

[ Impact ]
Medium vulnerability

[ Tests ]
Test passed with these patches, including new checks

[ Risks ]
Low risk, package is not really different than the one pushed to
unstable (only doc differs).

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
Better checks

[ Other info ]
Note that we could upload a 0.11.8-1~deb11u1: there is no differences
except a documentation update. If you agree, I prefer this way.

Cheers,
Yadd
diff --git a/debian/changelog b/debian/changelog
index f1e6929..ce9339e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+node-object-path (0.11.5-3+deb11u1) bullseye; urgency=medium
+
+  * Team upload
+  * Fix prototype pollution (Closes: CVE-2021-23434)
+  * Fix prototype pollution (Closes: CVE-2021-3805)
+
+ -- Yadd   Fri, 17 Sep 2021 18:38:10 +0200
+
 node-object-path (0.11.5-3) unstable; urgency=medium
 
   * Team upload
diff --git a/debian/gbp.conf b/debian/gbp.conf
index b713356..e11bcb5 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,5 +1,6 @@
 [DEFAULT]
 pristine-tar = True
+debian-branch = bullseye
 
 [import-orig]
 filter = [ '.gitignore', '.travis.yml', '.git*' ]
diff --git a/debian/patches/CVE-2021-23434.patch 
b/debian/patches/CVE-2021-23434.patch
new file mode 100644
index 000..8d08d2e
--- /dev/null
+++ b/debian/patches/CVE-2021-23434.patch
@@ -0,0 +1,67 @@
+Description: Fix prototype pollution when path components are not strings
+Author: Mario Casciaro https://github.com/mariocasciaro/object-path/commit/7bdf4abef
+Bug: https://snyk.io/vuln/SNYK-JS-OBJECTPATH-1569453
+Forwarded: not-needed
+Reviewed-By: Yadd 
+Last-Update: 2021-09-17
+
+--- a/index.js
 b/index.js
+@@ -111,6 +111,9 @@
+ return set(obj, path.split('.').map(getKey), value, doNotReplace);
+   }
+   var currentPath = path[0];
++  if (typeof currentPath !== 'string' && typeof currentPath !== 'number') 
{
++currentPath = String(currentPath)
++  }
+   var currentValue = getShallowProperty(obj, currentPath);
+   if (options.includeInheritedProps && (currentPath === '__proto__' ||
+ (currentPath === 'constructor' && typeof currentValue === 
'function'))) {
+--- a/test.js
 b/test.js
+@@ -241,12 +241,18 @@
+ objectPath.set({}, '__proto__.injected', 'this is bad')
+ expect(Object.prototype.injected).to.be.undefined
+ 
++objectPath.set({}, [['__proto__'], 'injected'], 'this is bad')
++expect(Object.prototype.injected).to.be.undefined
++
+ function Clazz() {}
+ Clazz.prototype.test = 'original'
+ 
+ objectPath.set(new Clazz(), '__proto__.test', 'this is bad')
+ expect(Clazz.prototype.test).to.be.equal('original')
+ 
++objectPath.set(new Clazz(), [['__proto__'], 'test'], 'this is bad')
++expect(Clazz.prototype.test).to.be.equal('original')
++
+ objectPath.set(new Clazz(), 'constructor.prototype.test', 'this is bad')
+ expect(Clazz.prototype.test).to.be.equal('original')
+   })
+@@ -256,6 +262,11 @@
+   .to.throw('For security reasons')
+ expect(Object.prototype.injected).to.be.undefined
+ 
++expect(function() {
++  objectPath.withInheritedProps.set({}, [['__proto__'], 'injected'], 
'this is bad')
++  expect(Object.prototype.injected).to.be.undefined
++}).to.throw('For security reasons')
++
+ function Clazz() {}
+ Clazz.prototype.test = 'original'
+ 
+@@ -267,8 +278,11 @@
+   .to.throw('For security reasons')
+ expect(Clazz.prototype.test).to.be.equal('original')
+ 
+-const obj = {}
+-expect(function() {objectPath.withInheritedProps.set(obj, 
'constructor.prototype.injected', 'this is OK')})
++expect(function() {objectPath.withInheritedProps.set({}, 
'constructor.prototype.injected', 'this is OK')})
++  .to.throw('For security reasons')
++expect(Object.prototype.injected).to.be.undefined
++
++expect(function() {objectPath.withInheritedProps.set({}, 
[['constructor'], 'prototype', 'injected'], 'this is bad')})
+   .to.throw('For security reasons')
+ expect(Object.prototype.injected).to.be.undefined
+   })
diff --git a/debian/patches/CVE-2021-3805.patch 
b/debian/patches/CVE-2021-3805.patch
new file mode 100644
index 000..daa56ff
--- /dev/null
+++ b/debian/patches/CVE-2021-3805.patch
@@ -0,0 +1,837 @@
+Description: Fix prototype pollution vulnerability
+Author: Mario Casciaro 
+Origin: upstream, https://github.com/mariocasciaro/object-path/commit/4f0903fd7
+Bug: https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053
+Forwarded: not-needed
+Reviewed-By: Yadd 
+Last-Update: 2021-09-17
+
+--- a/README.md
 

Bug#512265: #512265: clarifying the intent of the bug report

[Andrius Merkys]

Hi Felix,

I noticed you changed the title of the bug report from "lintian: Warn if
a test suite exists but is not run" to "lintian: Warn about unused
autopkgtests", and I doubt this reflects the original intent of this bug
report.

I read the initial Raphael's message as asking to detect test suites not
run at the build time (as per the subject of the message). Not run
autopkgtests are not less important, but this is a separate topic. I
suggest splitting this bug report into two:

* lintian: Warn about unused autopkgtests
* lintian: Warn about unused build time tests

What do you think?

Best wishes,
Andrius

Bug#994544: [Pkg-javascript-devel] Bug#994544: npm2deb: nodejs:any for arch:all package

[Yadd]

Le 17/09/2021 à 16:36, Bastien Roucariès a écrit :
> Package: npm2deb
> Version: 0.3.0-6
> Severity: important
> 
> Dear Maintainer,
> 
> 
> In order to help cross build nodejs depends should be nodejs:any for purejs
> module in depends field.
> 
> In build-depends field we should use nodejs:native in order to help crossbuilt
> 
> Bastien

Hi Bastien,

you should clone this and reassign to pkg-js-tools (build depends on
nodejs).
npm2deb should not set a run dependency to nodejs except if there is a
/usr/bin file

Bug#994554: wannier90: FTBFS due to test failure on several architectures

[Adrian Bunk]

Source: wannier90
Version: 3.1.0+ds-5
Severity: serious
Tags: ftbfs

https://buildd.debian.org/status/logs.php?pkg=wannier90=3.1.0%2Bds-5

...
tests/testw90_example11_2 - silicon.win: **FAILED**.
final_spreads
ERROR: absolute error 3.54e-06 greater than 3.00e-06. (Test: 7.20268752.  
Benchmark: 7.20269106.)
final_spreads
ERROR: absolute error 3.54e-06 greater than 3.00e-06. (Test: 7.20268752.  
Benchmark: 7.20269106.)
final_spreads
ERROR: absolute error 3.55e-06 greater than 3.00e-06. (Test: 7.20268754.  
Benchmark: 7.20269109.)
final_spreads
ERROR: absolute error 3.55e-06 greater than 3.00e-06. (Test: 7.20268754.  
Benchmark: 7.20269109.)
final_spreads
ERROR: absolute error 3.55e-06 greater than 3.00e-06. (Test: 8.46395018.  
Benchmark: 8.46394663.)
final_spreads
ERROR: absolute error 3.56e-06 greater than 3.00e-06. (Test: 8.46395022.  
Benchmark: 8.46394666.)
final_spreads
ERROR: absolute error 3.55e-06 greater than 3.00e-06. (Test: 8.46395024.  
Benchmark: 8.46394669.)
final_spreads
ERROR: absolute error 3.53e-06 greater than 3.00e-06. (Test: 8.46395016.  
Benchmark: 8.46394663.)
...
All done. ERROR: only 56 out of 57 tests passed.
Failed test in:
/<>/test-suite/tests/testw90_example11_2/
make[2]: *** [Makefile:194: test-serial] Error 1

Bug#994553: maven-debian-helper: provide autopkgtest runner

[Andrius Merkys]

Package: maven-debian-helper
Severity: wishlist
Owner: Andrius Merkys 
Tags: patch

Hello,

With this bug report I want to document my ongoing attempt to create an
autopkgtest runner for maven-built packages. The PR which would ideally
add the runner is here [1], and some more description of my thought
process is here [2]. As of now [3] the runner is already usable, but
certain projects with several interdependent artifacts still fail.

[1]
https://salsa.debian.org/java-team/maven-debian-helper/-/merge_requests/2
[2] https://lists.debian.org/debian-java/2020/12/msg00048.html
[3] git commit 74b53be3ac7c9cc5e9c0fe807cf993ddf47a436a

Andrius

Bug#994552: ircii: Segfault after /help ircii

[Parodper]

Package: ircii
Version: 20210314+really20190117-1
Severity: normal
Tags: patch
X-Debbugs-Cc: parod...@gmail.com

Dear Maintainer,

The command /help ircii (and also /help irc) immediately segfaults. For what I
can tell, if the topic is the name of a folder and /help does not find a file
with the same name as it's parent folder, it tries to find the gzipped version.

The SIGSEGV comes from a call to vsnprintf (from malloc_snprintf), that has a
format string which needs 3 values, but it only gets 2. The attached patch
should fix that.

-- System Information:
Debian Release: 11.0
  APT prefers stable-security
  APT policy: (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-8-amd64 (SMP w/12 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, 
TAINT_UNSIGNED_MODULE
Locale: LANG=gl_ES.UTF-8, LC_CTYPE=gl_ES.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages ircii depends on:
ii  libc6  2.31-13
ii  libcrypt1  1:4.4.18-4
ii  libssl1.1  1.1.1k-1+deb11u1
ii  libtinfo6  6.2+20201114-2

ircii recommends no packages.

ircii suggests no packages.

-- no debconf information
--- a/source/help.c 2019-01-18 11:29:41.0 +0100
+++ b/source/help.c 2021-09-17 16:24:47.748766099 +0200
@@ -311,7 +311,7 @@
 #ifdef ZCAT
if (my_strcmp(name + (my_strlen(name) - my_strlen(ZSUFFIX)), 
ZSUFFIX))
{
-   malloc_snprintf(, "%s/%s%s", path, ZSUFFIX);
+   malloc_snprintf(, "%s/%s%s", path, name, 
ZSUFFIX);
if (stat(CP(filename), ) == -1)
{
new_free();

Bug#994551: libcifpp1: please split off static files to separate package

[Andrius Merkys]

Package: libcifpp1
Version: 1.0.1-3
Severity: serious

Hello,

I have just noticed that libcifpp1 violates section 8.2 of Debian policy:

> If your package contains files whose names do not change with each
> change in the library shared object version, you must not put them in
> the shared library package. Otherwise, several versions of the shared
> library cannot be installed at the same time without filename clashes,
> making upgrades and transitions unnecessarily difficult.

So far, there has not been other libcifppX binary package, thus no
damage is done. However, future libcifppX packages should not contain
static files, in particular these:

/etc/cron.weekly/libcifpp
/usr/share/libcifpp/isomers.txt.gz
/usr/share/libcifpp/mmcif_ddl.dic.gz
/usr/share/libcifpp/mmcif_pdbx_v50.dic.gz

I suggest splitting them off to a separate Architecture: all package,
for example, libcifpp-data. This package would then be responsible for
keeping mmCIF dictionary via cron, and other packages requiring these
dictionaries would then depend on libcifpp-data.

Andrius

Bug#804235: carla packaging

[Víctor Cuadrado Juan]

On Wed, 2021-09-08 at 16:08 +0200, Yuri D'Elia wrote:
> Hi everyone, any progress on this?
> 
> I noticed carla is now packaged in ubuntu
> (https://launchpad.net/ubuntu/+source/carla) and I wonder if we could
> reuse that effort to bring carla to debian too.

Hello, On debbug #798490 (ITP bug merged with this one) I noted that
upstream (falkTX) is consciously bundling dependencies, therefore I lost
all will to tackle this RFP.

If one looks at the Ubuntu packages, it seems that they are not taking
care of that. Such a package would not get accepted in the Debian repos
as it violates the policies, and is overall detrimental to the
ecosystem.

I do not expect this situation to change, as it hasn't changed in the
last ~8 years, as Upstream (falkTX) seems to have a vetted interest,
since they receive remuneration for their work on audio-focused
distributions.



signature.asc
Description: This is a digitally signed message part

Bug#986882: Info received (workaround)

[Kuro Kurosaka]

Please disregard my earlier message. 
I found out that this information
was already in the bug record.
It wasn't shown to me at the time I sent
my message, for some reason.

Kuro

On Fri, 17 Sep 2021 07:03:03 +
"Debian Bug Tracking System"  wrote:

> Thank you for the additional information you have supplied regarding
> this Bug report.
> 
> This is an automatically generated reply to let you know your message
> has been received.
> 
> Your message is being forwarded to the package maintainers and other
> interested parties for their attention; they will reply in due course.
> 
> Your message has been sent to the package maintainer(s):
>  HIGUCHI Daisuke (VDR dai) 
> 
> If you wish to submit further information on this problem, please
> send it to 986...@bugs.debian.org.
> 
> Please do not send mail to ow...@bugs.debian.org unless you wish
> to report a problem with the Bug-tracking system.
> 

Bug#994543: reply confusion

[Salvatore Bonaccorso]

Hi

Apoligies I mixed up the cloned bug while replying for the rsync
workaround. Fixed up now as well the broken retitlings in the BTS.

994542 for glibc
994543 accordingly for rsync.

Regards,
Salvatore

Bug#968670: Unknown DWARF DW_OP_1 persists in dwz/0.14-1

[Andrius Merkys]

Control: found -1 0.14-1
Control: block 994548 by -1

Hello,

I am attempting building liboqs 0.7.0 and also experiencing this bug. My
packaging attempt is here [1]. After having read the discussion here and
on upstream tracker [2] I am of opinion that libiberty might have gotten
out of sync again, but I may be wrong.

[1] https://salsa.debian.org/merkys/liboqs
[2] https://sourceware.org/bugzilla/show_bug.cgi?id=27357

Andrius

Bug#944886: Please enable CONFIG_SND_SOC_SOF_NOCODEC_SUPPORT

[Vincent Blut]

Package: src:linux
Followup-For: Bug #944886

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Control: tags -1 moreinfo

Hi,

Debian Bullseye should provide a much better experience on machines equipped
with this kind of audio controllers without having to enable
CONFIG_SND_SOC_SOF_NOCODEC_SUPPORT, which is not recommended.

If you still have this laptop, it would be nice to hear how it behaves on a
"modern" kernel.

Cheers,
Vincent

-BEGIN PGP SIGNATURE-

iHUEARYKAB0WIQSRJQjHKbAUfuoc+DAQn1qAt/bgAQUCYUSweAAKCRAQn1qAt/bg
AZEkAPsE1p7I0KEmLEnxHZ1yh5hWeKDPKmrkd0o2e9h0FIBG4AD/c3d/2+bgXKrN
Me740IT+3NBm002WTYrsQn+BWs+I2g8=
=4ypf
-END PGP SIGNATURE-


signature.asc
Description: PGP signature

Bug#994503: [Pkg-fonts-devel] Bug#994503: cannot make such installations stick

[Jonas Smedegaard]

Quoting 積丹尼 Dan Jacobson (2021-09-17 15:21:45)
> So one needs to unmarkauto each of the recommends packages.

One needs to realize that suppressing recommendations is not, well, 
recommended: Doing so leads to an unusual system where one quite likely 
"needs" to mess about with the fallout in various ways.


 - Jonas

-- 
 * Jonas Smedegaard - idealist & Internet-arkitekt
 * Tlf.: +45 40843136  Website: http://dr.jones.dk/

 [x] quote me freely  [ ] ask before reusing  [ ] keep private

signature.asc
Description: signature

Bug#991155: 0.5 for amd64

[Osamu Aoki]

Hi,

Thanks for providing source  package.  That was buildable under libc6 (= 
2.31-17)
(now in bullseye).  So I can play with new lua based packages on my normal set 
up.

As I checked the current git head:
c2a65921d ("fix(diagnostic): don't override existing highlight groups #15682", 
2021-
09-16)

Your patch for experimental package seems to be already applied.
With a simple patch to skip one test which upstream disable for CI set up, it 
build
fine.  One problem is the generated package requires libc6 2.32 in unstable.

I don't know how quickly libc6 2.32 comes to testing. 

So if anyone try building neovim for current unstable, try attached patch.

(I used dgit maint merge style packaging and "git-deborig -f master" .  So may 
not be
easy drop in but at least you see things are improving.)

Osamu
 

From c2a65921d762929a1b8e740aeb92c7970d025736 Mon Sep 17 00:00:00 2001
From: Gregory Anders 
Date: Thu, 16 Sep 2021 15:51:29 -0600
Subject: [PATCH] fix(diagnostic): don't override existing highlight groups
 #15682

Use the 'default' keyword to prevent overriding existing highlight groups.

ref #15585
---
 runtime/plugin/diagnostic.vim | 80 +--
 1 file changed, 40 insertions(+), 40 deletions(-)

diff --git a/runtime/plugin/diagnostic.vim b/runtime/plugin/diagnostic.vim
index 569c63bdb..45d75b79b 100644
--- a/runtime/plugin/diagnostic.vim
+++ b/runtime/plugin/diagnostic.vim
@@ -1,48 +1,48 @@
 " :help vim.diagnostic
 
-hi DiagnosticError ctermfg=1 guifg=Red
-hi DiagnosticWarn ctermfg=3 guifg=Orange
-hi DiagnosticInfo ctermfg=4 guifg=LightBlue
-hi DiagnosticHint ctermfg=7 guifg=LightGrey
+hi default DiagnosticError ctermfg=1 guifg=Red
+hi default DiagnosticWarn ctermfg=3 guifg=Orange
+hi default DiagnosticInfo ctermfg=4 guifg=LightBlue
+hi default DiagnosticHint ctermfg=7 guifg=LightGrey
 
-hi DiagnosticUnderlineError cterm=underline gui=underline guisp=Red
-hi DiagnosticUnderlineWarn cterm=underline gui=underline guisp=Orange
-hi DiagnosticUnderlineInfo cterm=underline gui=underline guisp=LightBlue
-hi DiagnosticUnderlineHint cterm=underline gui=underline guisp=LightGrey
+hi default DiagnosticUnderlineError cterm=underline gui=underline guisp=Red
+hi default DiagnosticUnderlineWarn cterm=underline gui=underline guisp=Orange
+hi default DiagnosticUnderlineInfo cterm=underline gui=underline guisp=LightBlue
+hi default DiagnosticUnderlineHint cterm=underline gui=underline guisp=LightGrey
 
-hi link DiagnosticVirtualTextError DiagnosticError
-hi link DiagnosticVirtualTextWarn DiagnosticWarn
-hi link DiagnosticVirtualTextInfo DiagnosticInfo
-hi link DiagnosticVirtualTextHint DiagnosticHint
+hi default link DiagnosticVirtualTextError DiagnosticError
+hi default link DiagnosticVirtualTextWarn DiagnosticWarn
+hi default link DiagnosticVirtualTextInfo DiagnosticInfo
+hi default link DiagnosticVirtualTextHint DiagnosticHint
 
-hi link DiagnosticFloatingError DiagnosticError
-hi link DiagnosticFloatingWarn DiagnosticWarn
-hi link DiagnosticFloatingInfo DiagnosticInfo
-hi link DiagnosticFloatingHint DiagnosticHint
+hi default link DiagnosticFloatingError DiagnosticError
+hi default link DiagnosticFloatingWarn DiagnosticWarn
+hi default link DiagnosticFloatingInfo DiagnosticInfo
+hi default link DiagnosticFloatingHint DiagnosticHint
 
-hi link DiagnosticSignError DiagnosticError
-hi link DiagnosticSignWarn DiagnosticWarn
-hi link DiagnosticSignInfo DiagnosticInfo
-hi link DiagnosticSignHint DiagnosticHint
+hi default link DiagnosticSignError DiagnosticError
+hi default link DiagnosticSignWarn DiagnosticWarn
+hi default link DiagnosticSignInfo DiagnosticInfo
+hi default link DiagnosticSignHint DiagnosticHint
 
 " Link LspDiagnostics for backward compatibility
-hi link LspDiagnosticsDefaultHint DiagnosticHint
-hi link LspDiagnosticsVirtualTextHint DiagnosticVirtualTextHint
-hi link LspDiagnosticsFloatingHint DiagnosticFloatingHint
-hi link LspDiagnosticsSignHint DiagnosticSignHint
-hi link LspDiagnosticsDefaultError DiagnosticError
-hi link LspDiagnosticsVirtualTextError DiagnosticVirtualTextError
-hi link LspDiagnosticsFloatingError DiagnosticFloatingError
-hi link LspDiagnosticsSignError DiagnosticSignError
-hi link LspDiagnosticsDefaultWarning DiagnosticWarn
-hi link LspDiagnosticsVirtualTextWarning DiagnosticVirtualTextWarn
-hi link LspDiagnosticsFloatingWarning DiagnosticFloatingWarn
-hi link LspDiagnosticsSignWarning DiagnosticSignWarn
-hi link LspDiagnosticsDefaultInformation DiagnosticInfo
-hi link LspDiagnosticsVirtualTextInformation DiagnosticVirtualTextInfo
-hi link LspDiagnosticsFloatingInformation DiagnosticFloatingInfo
-hi link LspDiagnosticsSignInformation DiagnosticSignInfo
-hi link LspDiagnosticsUnderlineError DiagnosticUnderlineError
-hi link LspDiagnosticsUnderlineWarning DiagnosticUnderlineWarn
-hi link LspDiagnosticsUnderlineInformation DiagnosticUnderlineInfo
-hi link LspDiagnosticsUnderlineHint DiagnosticUnderlineHint
+hi default link LspDiagnosticsDefaultHint 

Bug#994549: ITP: clpeak -- Profile OpenCL devices to find peak capacities

[Neil Williams]

Package: wnpp
Severity: wishlist
Owner: Neil Williams 
X-Debbugs-Cc: debian-de...@lists.debian.org, codeh...@debian.org

* Package name: clpeak
  Version : 1.1.0-1
  Upstream Author : Krishnaraj Bhat 
* URL : https://github.com/krrishnarraj/clpeak
* License : The Unlicense
  Programming Lang: C, C++
  Description : Profile OpenCL devices to find peak capacities

 Clpeak is a synthetic benchmarking tool to measure peak capabilities
 of opencl devices. It only measures the peak metrics that can be
 achieved using vector operations and does not represent a real-world
 use case

This package is to be maintained with the Debian OpenCL maintainers
in Salsa.

The Unlicence text:
A license with no conditions whatsoever which dedicates works to the
public domain. Unlicensed works, modifications, and larger works may
be distributed under different terms and without source code.

Bug#994550: squashfs-tools: dependency on libgcc-s1

[Daniel Bungert]

Package: squashfs-tools
Version: 1:4.5-2
Severity: normal
X-Debbugs-Cc: daniel.bung...@canonical.com

Dear Maintainer,

mksquashfs does require libgcc-s1 for normal functionality.  If you
coerce a system into not having libgcc-s1, which admittedly would be
pretty broken for probably many reasons, then mksquashfs will fail like
follows:

$ mkdir a
$ touch a/b.txt
$ mksquashfs a a.squashfs
...
libgcc_s.so.1 must be installed for pthread_cancel to work
Aborted (core dumped) mksquashfs a a.squashfs

-Dan

-- System Information:
Debian Release: bookworm/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.11.0-35-generic (SMP w/16 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages squashfs-tools depends on:
ii  libc6  2.32-3
ii  liblz4-1   1.9.3-2
ii  liblzma5   5.2.5-2
ii  liblzo2-2  2.10-2
ii  libzstd1   1.4.8+dfsg-2.1
ii  zlib1g 1:1.2.11.dfsg-2

squashfs-tools recommends no packages.

squashfs-tools suggests no packages.

-- no debconf information

Bug#994548: ITP: liboqs -- library for quantum-safe cryptographic algorithms

[Andrius Merkys]

Package: wnpp
Owner: Andrius Merkys 
Severity: wishlist

* Package name: liboqs
  Version : 0.7.0.12.g001a3aa3
  Upstream Author : , Open Quantum Safe project
* URL : https://github.com/open-quantum-safe/liboqs
* License : Expat
  Programming Lang: C
  Description : library for quantum-safe cryptographic algorithms

liboqs is an open source C library for quantum-safe cryptographic algorithms

I am interested in packaging it just for the sake of it. As of 0.7.0 the
authors do not recommend using this library in production environment or
protection of sensitive data. I hope that in near future these things
will change.

For now I will keep the packaging at [1] as I am not part of any
appropriate team. Should there be any intent for team maintenance, I
will gladly transfer.

I am aware of other packaging attempts on GitHub [2].

[1] https://salsa.debian.org/merkys/liboqs
[2] https://github.com/lacchain/liboqs-debian

Andrius

Bug#743694: lintian: Downgrade most of privacy-breach* tags from severity: error to pedantic

[Felix Lechner]

Control: severity -1 normal

Hi,

On Fri, Sep 10, 2021 at 6:21 AM Daniel Leidert  wrote:
>
> I would doubt our FTP masters if they accept packages with
> lintian errors

Actually, they do! The FTP Masters publish the list of tags they do
not accept. [1] The privacy tags are not on it. Lintian offers a
command line option ('--ftp-master-rejects') to check prospective
uploads against the list. For convenience, we also dedicated a page to
it on our website. [2]

When this bug was filed over seven years ago, the potential rejection
of uploads supported an elevated severity. The cited reason holds no
longer. Somewhat sadly, the privacy topic also does not resonate with
contributors. [3][4] As another point of evidence Bug#765503—filed
half a year later and then merged into this report—reached us with a
more appropriate 'normal' severity. [5]

In consideration of the changed circumstances, the present report is
likewise downgraded to 'normal'.

Kind regards
Felix Lechner

[1] https://ftp-master.debian.org/static/lintian.tags
[2] https://lintian.debian.org/autoreject
[3] https://lists.debian.org/debian-vote/2021/09/msg1.html
[4] https://lists.debian.org/debian-vote/2021/09/msg5.html
[5] https://bugs.debian.org/765503

Bug#994531: celluloid: Request new 0.21 upstream version

[navycat]

Package: celluloid
Version: 0.20-2
Severity: important

Dear Maintainer,

new upstream 0.21 release version available on 
https://github.com/celluloid-player/celluloid.git.
Please update the package for future versions (like a debian sid, ubuntu 21.10 
impish).
Thanks.


-- System Information:
Debian Release: 11.0
  APT prefers impish
  APT policy: (500, 'impish')
Architecture: amd64 (x86_64)

Kernel: Linux 5.13.0-14-generic (SMP w/12 CPU threads)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages celluloid depends on:
ii  dconf-gsettings-backend [gsettings-backend]  0.40.0-1
ii  libc62.34-0ubuntu2
ii  libcairo21.16.0-5ubuntu1
ii  libepoxy01.5.7-1
ii  libglib2.0-0 2.68.3-1ubuntu1
ii  libgtk-3-0   3.24.30-1ubuntu1
ii  libmpv1  0.32.0-3ubuntu1
ii  libpango-1.0-0   1.48.9+ds1-1
ii  libpangocairo-1.0-0  1.48.9+ds1-1

Versions of packages celluloid recommends:
ii  youtube-dl  2021.06.06-1

celluloid suggests no packages.

-- no debconf information

Bug#985017: python3-whoosh: SyntaxWarning during package installation

[Imre Jonk]

This issue also affects users of mailman3-web. The warning is issued
when running the hourly cronjob:

$ sudo -u www-data flock -n /var/run/mailman3-web/cron.hourly
/usr/share/mailman3-web/manage.py runjobs hourly
/usr/lib/python3/dist-packages/haystack/backends/whoosh_backend.py:734:
SyntaxWarning: "is" with a literal. Did you mean "=="?
  if value is None or len(value) is 0:
/usr/lib/python3/dist-packages/whoosh/codec/whoosh3.py:1116:
SyntaxWarning: "is" with a literal. Did you mean "=="?
  elif fixedsize is 0:

Both issues can be fixed by replacing "is" with "==" on the respective
lines.

Imre


signature.asc
Description: This is a digitally signed message part

Bug#985018: python3-django-haystack: SyntaxWarning during package installation

[Imre Jonk]

This issue also affects users of mailman3-web. The warning is issued
when running the hourly cronjob:

$ sudo -u www-data flock -n /var/run/mailman3-web/cron.hourly
/usr/share/mailman3-web/manage.py runjobs hourly
/usr/lib/python3/dist-packages/haystack/backends/whoosh_backend.py:734:
SyntaxWarning: "is" with a literal. Did you mean "=="?
  if value is None or len(value) is 0:
/usr/lib/python3/dist-packages/whoosh/codec/whoosh3.py:1116:
SyntaxWarning: "is" with a literal. Did you mean "=="?
  elif fixedsize is 0:

Both issues can be fixed by replacing "is" with "==" on the respective
lines.

Imre


signature.asc
Description: This is a digitally signed message part