Bug#765512: general: distrust old crypto algos and protocols perdefault

2014-10-15 Thread Florian Weimer
* Christoph Anton Mitterer: Not sure if there is already some concentrated effort, but I think there should be one, i.e.: Fedora is currently working on this: https://fedoraproject.org/wiki/Changes/CryptoPolicy However, it is an ongoing effort to make applications adhere to the system

Re: bash exorcism experiment ('bug' 762923 763012)

2014-10-12 Thread Florian Weimer
* Russell Stuart: - array variables. Array variables practically imply arithmetic evaluation, amd this is a shell feature which is rather difficult to use correctly because compatibility with other shell encourages both recursive evaluation and access to the full shell language in a few

Accepted bash 4.3-9.1 (source all amd64) into unstable

2014-09-24 Thread Florian Weimer
-By: Florian Weimer f...@deneb.enyo.de Description: bash - GNU Bourne Again SHell bash-builtins - Bash loadable builtins - headers examples bash-doc - Documentation and examples for the GNU Bourne Again SHell bash-static - GNU Bourne Again SHell (static version) Changes: bash (4.3-9.1

Re: About a mass bug report not based on Sid or Jessie.

2014-04-21 Thread Florian Weimer
* Russ Allbery: Florian Weimer f...@deneb.enyo.de writes: * Russ Allbery: This doesn't regenerate the other files from scratch. This only addresses config.{sub,guess}, which is only a small part of the problem. Is the generated libtool file dependent on the package configuration

Re: About a mass bug report not based on Sid or Jessie.

2014-04-20 Thread Florian Weimer
* Russ Allbery: The correct long-term fix is to change autotools to check a list of well-known paths for more recent versions of the scripts and use them instead of what is provided in the package. This doesn't regenerate the other files from scratch. This only addresses

Re: Conflicting package names

2014-04-20 Thread Florian Weimer
* Julien Cristau: There's no reason the binary packages can't be named conquest-postgres and conquest-mysql even if the source is conquest-dicom-server. And the source package name is mostly user-invisible. A shorter name is very much not a better one. Agreed, we had quite a bit fun with

Re: Arm64 port live on debian-ports

2014-04-20 Thread Florian Weimer
You may or may not have noticed that 'arm64' is coming. This a 64-bit arm architecture also known as 'aarch64' and implemented in the ARM CPU architecture 'v8'. Apart from iphones there is no publically available 64-bit silicon yet, but that'll be changing rapidly later this year and this

Re: About a mass bug report not based on Sid or Jessie.

2014-04-17 Thread Florian Weimer
* Steve Langasek: But I think we ought to switch to autoreconfing by default. It's a bit risky if we don't do a mass rebuild after a new autotools-related package upload. I still see quite a lot of warnings if I re-run the tools on older sources, but these days, most builds seem to work out

Re: About a mass bug report not based on Sid or Jessie.

2014-04-17 Thread Florian Weimer
* Russ Allbery: It's an interesting question whether we should just force dh-autoreconf in debhelper unless the package maintainer explicitly turns it off. It would save me work, just as I've now been able to take overrides back out of all of my packages now that dpkg defaults to xz

Accepted debsecan 0.4.17 (source all)

2014-03-18 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Tue, 18 Mar 2014 10:18:37 +0100 Source: debsecan Binary: debsecan Architecture: source all Version: 0.4.17 Distribution: unstable Urgency: low Maintainer: Florian Weimer f...@deneb.enyo.de Changed-By: Florian Weimer f

Re: Bits from the Security Team

2014-03-08 Thread Florian Weimer
* Moritz Muehlenhoff: I agree we should stick with dpkg-buildflags until this is fixed upstream. Gentoo Hardened tried to upstream this a year ago, but apparently this didn't make the cut yet: http://gcc.gnu.org/ml/gcc-patches/2012-09/msg00473.html This is interesting. One potential

Re: Better pdiff handling for apt

2014-01-05 Thread Florian Weimer
* Anthony Towns: Some time ago (*cough* 2009), I had a play with working out how to apply pdiffs more efficiently than apt currently does, and implemented a proof of concept in python [0]. There weren't any replies (even a ooo, cool) when I posted to the deity list, so I left it at that;

Re: GnuTLS in Debian

2013-12-30 Thread Florian Weimer
* Bastien ROUCARIES: Fedora created a open SSL compat library based on libnss. It doesn't work all that well because there is no way to implement host name checking. The OpenSSL API it's based on did not have an interface for host name verification, and the compatibility library does not

Re: Move awk implementations from /usr/bin to /bin

2013-12-30 Thread Florian Weimer
* Laurent Bigonville: In order to fix #729704[0] (optional feature of /sbin/auditd using awk) I would like to have awk (all the implementations) moved to /bin instead of /usr/bin. It seems quite a bit easier to reimplement this awk snippet in bash. -- To UNSUBSCRIBE, email to

Re: GPLv2-only considered harmful

2013-12-29 Thread Florian Weimer
* Stephen M. Webb: Nope. An organization that will not accept the GPLv3 because of the tivoization and patent clauses will not accept GPLv2 or later. Apple allegedly rejects the GPLv3, but continues to distribute GPLv2-or-later code. Microsoft distributes GPLv2-or-later code, too. -- To

Re: GPLv2-only considered harmful

2013-12-29 Thread Florian Weimer
* Clint Adams: The only theoretical advantage I see to GPLv2 is in the termination clause, and in practice that seems to be really more trouble than it's worth. Beyond that you have substandard and unclear wording, tivoization, lesser patent protection, and incompatibility with Apache 2.0.

Re: GnuTLS in Debian

2013-12-29 Thread Florian Weimer
* Andreas Metzler: In July 2011 with version 3.0 [1] GnuTLS switched to Nettle as only supported crypto backend. Nettle requires GMP. GnuTLS and Nettle are available under LGPLv2.1+. GMP used to be licensed LGPLv2.1+ ages ago but upgraded to LGPLv3+ in version 4.2.2 (released September

Re: Bug#727708: tech-ctte: Decide which init system to default to in Debian.

2013-11-06 Thread Florian Weimer
* Thorsten Glaser: On Thu, 31 Oct 2013, Florian Weimer wrote: Curiously, a lot of system administrators do not do this correctly using sysvinit, causing system daemons to start unexpectedly after installing package updates. What *is* the correct way, anyway? Renaming the S symlinks to K

Re: Bug#727708: tech-ctte: Decide which init system to default to in Debian.

2013-10-31 Thread Florian Weimer
* Theodore Ts'o: The most basic is the idea that whether you can control (via shell scrpit fragments) whether or not a service should start at all, and what options or environments should be enabled by pasing some file. Curiously, a lot of system administrators do not do this correctly using

Re: let's split the systemd binary package

2013-10-27 Thread Florian Weimer
* Simon McVittie: On 26/10/13 21:23, Florian Weimer wrote: Session tracking includes suspending/hibernating, because logind has a mechanism to let apps delay suspend, which is necessary for things like closing the inherent race condition in lock the screensaver when we suspend... oh, oops

Re: let's split the systemd binary package

2013-10-26 Thread Florian Weimer
* Simon McVittie: Session tracking includes suspending/hibernating, because logind has a mechanism to let apps delay suspend, which is necessary for things like closing the inherent race condition in lock the screensaver when we suspend... oh, oops, it didn't get scheduled until after we

Accepted mlton 20100608-5.1 (source all amd64)

2013-10-24 Thread Florian Weimer
mlton-runtime-s390-linux-gnu mlton-runtime-sparc-linux-gnu Architecture: source all amd64 Version: 20100608-5.1 Distribution: unstable Urgency: low Maintainer: Wesley W. Terpstra (Debian) terps...@debian.org Changed-By: Florian Weimer f...@deneb.enyo.de Description: mlton - Optimizing

Bug#726393: general: Possible malware infections in source packages

2013-10-16 Thread Florian Weimer
* Dominik George: It isn't a false positive in that regard that the package *does* in fact contain the virus sample. That's non-free code and not suitable for main, so it must be removed from the source tarball anyway. -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a

Re: tlsa for smtp to @bugs.debian.org

2013-09-14 Thread Florian Weimer
* Bastian Blank: On Fri, Sep 13, 2013 at 10:51:06PM +0200, Kurt Roeckx wrote: I think gnutls by default has a minimum size of 727 for the DH size while openssl doesn't have any check for this. But if you're using DH you really want to move to something like 2048 if possible. This prime

Re: Survey answers part 3: systemd is not portable and what this means for our ports

2013-07-17 Thread Florian Weimer
* Steve Langasek: Like? - Reliable, low-maintenance system startup (no races / ordering bugs) - Reliable service supervision - Fast startup - Sensible dynamic service management in response to post-boot events (network up/down, device add/remove, etc). - Simple, declarative syntax We

Re: Survey answers part 3: systemd is not portable and what this means for our ports

2013-07-16 Thread Florian Weimer
* Thomas Goirand: On 07/15/2013 04:32 PM, Josselin Mouette wrote: And now people who want to stick with buggy shell scripts instead of migrating to a much simpler, declarative mechanism. Please point at a single person on any threads about init systems over the last year who wishes that. I

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-14 Thread Florian Weimer
* Scott Kitterman: Sorry, I can't quite let this pass. I just went and looked at the AGPL v3 again and one implication of the license is that you can't locally fix a security issue without immediate disclosure. This doesn't fit my personal ethics at all and at least IMO makes it pretty

Re: Survey answers part 3: systemd is not portable and what this means for our ports

2013-07-14 Thread Florian Weimer
* David Kalnischkies: GSoC in Debian was announced a long time ago, enough time to raise any objections against any proposed project. Not really, a GSoC project doesn't come with any guarantee, implied or otherwise, that any deliverable is actually used by the mentoring organization. (Of the

Re: DFSG claims BSD, not BSD 2/3-clause, is DFSG-free

2013-07-14 Thread Florian Weimer
* Richard Hartmann: Something that _can_ easily be changed (afaik) is that the DFSG[1] states that 'The GPL, BSD, and Artistic licenses are examples of licenses that we consider free.' It's quite obvious that this refers to 2- and 3- clause BSD, not 4-clause BSD. The BSD hyperlink in

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-06 Thread Florian Weimer
* Philipp Kern: On 2013-07-04 10:04, Florian Weimer wrote: * Stefano Zacchiroli: I mean, sure, it *is* more tricky to provide such a URL for users that will be running a *modified* version of INN. But it is exactly the same kind of difficulties that people distributing modified copylefted

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-06 Thread Florian Weimer
* Howard Chu: LMDB doesn't need dirty tricks to look good. (And at only 6KLOCs of source, there's nowhere to hide any tricks anyway.) Okay, I found a snag: the 511 bytes limit on the key size. Berkeley DB's disk format does not impose a limit on key or value size (at least for B-trees). For

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-04 Thread Florian Weimer
* Stefano Zacchiroli: I mean, sure, it *is* more tricky to provide such a URL for users that will be running a *modified* version of INN. But it is exactly the same kind of difficulties that people distributing modified copylefted software will have to face to uphold GPL (or equivalent)

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-02 Thread Florian Weimer
* Paul Tagliamonte: On Tue, Jul 02, 2013 at 09:44:10AM +0200, Ondřej Surý wrote: Florian Weimer has correctly pointed out that Oracle has decided to change the BDB 6.0 license to AGPLv3 (https://oss.oracle.com/pipermail/bdb/2013-June/ 56.html). This hasn't been reflected in release

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-02 Thread Florian Weimer
* Julien Cristau: On Tue, Jul 2, 2013 at 18:58:34 +0200, Nick Andrik wrote: Since AGPLv3 is really similar to GPLv3 but mostly oriented for webapplications, would it make sense to contact Oracle with the concerns raised in this thread and ask for clarification and possible consideration to

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-02 Thread Florian Weimer
* Howard Chu: We can provide plenty more documentation on LMDB performance and reliability if desired. Can you cope with incompletely written pages (e.g., only the first 512 bytes of a page is written) or write reordering between fsyncs? Berkeley DB doesn't deal with torn writes, either, but

Re: Berkeley DB 6.0 license change to AGPLv3

2013-07-02 Thread Florian Weimer
* Howard Chu: We require that fsync() (actually fdatasync()) doesn't lie. Data pages can be written in any order, as long as all outstanding data pages are actually written by the time fsync returns. Given this constraint, you can pull the power on a drive and the DB will still be fine. And

Re: system-wide crypto policies

2013-06-30 Thread Florian Weimer
* Daniel Pocock: Just out of interest, a CA can re-issue their root cert with the same key pair but a stronger hash. This type of thing has happened before. That's possible because the self-signature is not actually meaningful. 8-) It's different further down the tree, and some protocols

Re: system-wide crypto policies

2013-06-27 Thread Florian Weimer
* Daniel Pocock: However, are such issues at the discretion of package maintainers and upstream, or is it useful to have a uniform Debian approach to cryptographic strength? Keep in mind that RFC 4880 (OpenPGP) hard-codes SHA-1 in several places, notably for key fingerprints. If there's a

libnss consolidation (was: Re: X.509 and CA certificates for other purposes (i.e. the IGTF))

2013-06-09 Thread Florian Weimer
* Bastien ROUCARIES: Maybe crypto consolidation arround libnss will greatly help here. jessie release goal ? NSS has lots of global state, and its proper initialization from another library is difficult. Switching over to it is probably doable, but it's not really straightforward. On the

Re: Switching to mozilla ESR in stable-security

2013-06-01 Thread Florian Weimer
* Thomas Goirand: Maybe the best way forward is to have backports activated by default (there's already a patch available for that, not sure if it has been applied to d-i yet). Then when installing a desktop (since backports are now fully part of Debian), we could provide browsers from there

Re: GNU config (config.sub/guess) is now GPLv3 with additional permission

2013-06-01 Thread Florian Weimer
* Henrique de Moraes Holschuh: The above covers the vast majority of packages, as it is very rare for any build system to need config.sub or config.guess and _not_ use GNU autoconf. The exception does not require that the configuration script generated by Autoconf is actually used for

Re: Switching to mozilla ESR in stable-security

2013-05-30 Thread Florian Weimer
* Didier Raboud: If we can't handle the backporting of serious security issues on top of our stable version (in order to maximise the avoidance of regressions), then maybe said software shouldn't be shipped in stable in the first place. Thoughts ? Which web browsers would remain in stable if

Re: systemd .service file conversion

2013-05-24 Thread Florian Weimer
* Helmut Grohne: * supervision/service restart/heartbeat sysv simply does not provide this functionality. Actually, it does, through /etc/inittab. But this capability is rarely used. Curiously, Fedora doesn't use systemd's service restart functionality much, either. (By default, systemd

Re: Debianizing the Java world?

2013-05-12 Thread Florian Weimer
* Daniel Pocock: Specifically, I was thinking that some kind of Maven plugin could be developed to scan the dependency graphs of projects and, where possible, extract the SCM details from pom.xml manifests and then recursively (a) clone their repositories, (b) branch each repo and remove

Re: Current and upcoming toolchain changes for jessie

2013-05-08 Thread Florian Weimer
* Matthias Klose: glibc's version bump to 2.17 should be mostly uneventful, with the exception of a few more compiler warnings and errors, and the long overdue removal of gets() from the API. FTBFS bugs for the above have already been filed, and patches submitted for many of the new build

Re: Current and upcoming toolchain changes for jessie

2013-05-08 Thread Florian Weimer
* Roger Leigh: On Tue, May 07, 2013 at 03:25:29PM +0200, Matthias Klose wrote: The decision when to make GCC 4.8 the default for other architectures is left to the Debian port maintainers. This makes using C++11 and other features only in 4.8 rather difficult. C++11 hasn't got a stable API

Re: Current and upcoming toolchain changes for jessie

2013-05-08 Thread Florian Weimer
* Roger Leigh: On Wed, May 08, 2013 at 08:08:31AM +0200, Florian Weimer wrote: * Roger Leigh: On Tue, May 07, 2013 at 03:25:29PM +0200, Matthias Klose wrote: The decision when to make GCC 4.8 the default for other architectures is left to the Debian port maintainers. This makes

Re: adduser Pre-Depends for qemu-system-common

2013-03-14 Thread Florian Weimer
* Ansgar Burchardt: Couldn't postint tell udev explicitly to reload rules after the kvm group was added? udev does not support this: http://lists.fedoraproject.org/pipermail/devel/2013-January/177046.html (The discussion extends into February 2013.) -- To UNSUBSCRIBE, email to

Re: NDEBUG when building packages?

2013-02-24 Thread Florian Weimer
* Ian Jackson: Mathieu Malaterre writes (Re: NDEBUG when building packages?): On Tue, Feb 19, 2013 at 5:30 PM, Ian Jackson ijack...@chiark.greenend.org.uk wrote: Daniel Pocock writes (NDEBUG when building packages?): I notice some upstreams hack NDEBUG into their Makefile, while others

Re: Go (golang) packaging, part 2

2013-02-07 Thread Florian Weimer
* Hilko Bengen: I drew a different conclusion from Ian's messages the thread you mentioned (see the quotes below). Apparently, one *can* build shared libraries using gccgo, but they are not currently usable using dlopen(). My impression was that this means that regular use of shared libraries

Re: socket-based activation has unmaintainable security?

2013-02-07 Thread Florian Weimer
* Thomas Goirand: Which would be the wrong way of doing things / wrong reason for using root as running user, since you can set the CAP_NET_BIND_SERVICE capability... (man capabilities ...) This allows to bind to all lower ports, which in some cases is equivalent to root privileges. A more

Re: Go (golang) packaging, part 2

2013-02-07 Thread Florian Weimer
* Steve Langasek: Actually, if you look closely, you'll find that the traditional Java .jar linking resolver precisely mirrors the behavior of the C linker on Solaris from the same era (allows you to link dynamically, but requires top-level objects to be linked at build time with all the

Re: Linux Future

2013-01-23 Thread Florian Weimer
* Jon Dowland: On Wed, Jan 23, 2013 at 10:46:33AM +0100, Josselin Mouette wrote: You might find this useful: http://np237.livejournal.com/33449.html I made this presentation in the hope to make such things easier to understand for the sysadmin. Just for the record I found it a good read,

Re: [RFC] Go (golang) packaging

2013-01-03 Thread Florian Weimer
* Wouter Verhelst: Strictly speaking, if you're only using static libraries this is not really true; once you've compiled something against a static library, the static library might change in whatever way it sees fit, the compiled binary will continue to work, with or without recompilation.

Re: [RFC] Go (golang) packaging

2013-01-03 Thread Florian Weimer
* Michael Stapelberg: Florian Weimer f...@deneb.enyo.de writes: My main worry is that, for example, a fix in another, otherwise unrelated dependency prompts a rebuild, and this picks up behavioral changes which haven't been visible before, but lingering in the static library. Essentially

Re: [RFC] Go (golang) packaging

2013-01-03 Thread Florian Weimer
* Sune Vuorela: On 2013-01-03, Alastair McKinstry alastair.mckins...@sceal.ie wrote: (1) pkg-config files for libraries, in particular all those that ship static libs, to be a release goal for jessie. rather get rid of static libs. We might want to extend static libraries with LTO data one

Re: [RFC] Go (golang) packaging

2013-01-03 Thread Florian Weimer
* Michael Stapelberg: Hi Florian, Florian Weimer f...@deneb.enyo.de writes: Could you provide an example please? I don’t understand how this is different with static linking than with dynamic linking yet. With dynamic linking, you pick up the behavior change along with apt-get upgrade, so

Re: [RFC] Go (golang) packaging

2013-01-02 Thread Florian Weimer
* Paul Wise: On Wed, Jan 2, 2013 at 12:14 AM, Michael Stapelberg wrote: Only when not using the “official” compiler (gc), e.g. gccgo has support for dynamic linking. Then we should use gccgo until the official compiler supports this. gccgo supports dynamic linking, but Go 1 API changes may

Re: Contributor agreements and copyright assignment

2012-12-18 Thread Florian Weimer
* Thomas Goirand: On 12/07/2012 05:39 AM, Florian Weimer wrote: The FSF can release your code under permissive free software licenses Can you explain how this is possible? As far as I know, the FSF is not contractually obliged to license contributors under copyleft licenses only

Re: Contributor agreements and copyright assignment

2012-12-06 Thread Florian Weimer
* Ian Jackson: Barry Warsaw writes (Re: Contributor agreements and copyright assignment (was Re: Really, about udev, not init sytsems)): FTR: http://www.canonical.com/contributors That allows Canonical to make proprietary forks of the code (eg, to engage in the dual licensing business

Re: Bug#691624: ITP: dput-ng -- next generation Debian package upload tool

2012-10-28 Thread Florian Weimer
* Arno Töll: dput-ng features many enhancements over dput, such as more comprehensive checks, an easy to use plugin system, and code designed to handle the numerous archives that any Debian package hacker will interact with. Does it prevent uploading security updates to the main archive by

Re: Discarding uploaded binary packages

2012-10-21 Thread Florian Weimer
* Steve Langasek: I am aware that other such packages exist. I just don't think we should support them if they can't be bootstrapped properly. Ocaml is in this category as well, and it addresses it by bootstrapping off an upstream-provided binary blob. I'm not sure if this is the right

Re: Discarding uploaded binary packages

2012-10-21 Thread Florian Weimer
* Joerg Jaspert: The most important is being able to deal with arch all packages. And worse - arch all packages able to build only on certain architectures. Could we instruct the buildd for the upload architecture to build arch-all packages, and let the others operate as before? This should

Re: Gnome classic mode

2012-09-11 Thread Florian Weimer
* Ian Jackson: So if it works just fine without the 3D I don't understand what the warning is for. It's a separate desktop environment, and not lust a lack of visual effects. None of the Javascript parts work in fallback mode because GNOME Shell isn't running. -- To UNSUBSCRIBE, email to

Re: big .debian.tar.xz - EG Wordpress

2012-05-19 Thread Florian Weimer
* Jon Dowland: So if I understand the situation correctly; wordpress ships a pre-build binary which cannot be generated in Debian? Whether the source is in a separate package or not, this does not feel right. It's not without precedent. Ocaml bootstraps off a binary blob to avoid a cyclic

Re: On init in Debian

2012-03-19 Thread Florian Weimer
* Thomas Goirand: I just had a look, and no, that's not what metainit does. What it does is *generating* an init.d script, using the metainit syntax as input. IMO, just a normal shell script tiny library to simplify our init.d scripts would be enough. If it's embedded into shell, people will

Re: On init in Debian

2012-03-19 Thread Florian Weimer
* Russ Allbery: I would dearly like to stop using sysv init scripts for the trivial cases as soon as I can, since they just introduce a bunch of possible bugs without much real benefit. Same here. I haven't examined the situation too closely (maybe a more robust variant of start-stop-daemon

Re: libidn re-license

2012-03-07 Thread Florian Weimer
* Simon Josefsson: It wouldn't hurt, but I'm also not sure if it is worth the work. If any significant application triggered this particular code path, people should have noticed the problem a long time ago. It is at worst an easily diagnozed DoS causing the library to busy-loop forever.

Re: libidn re-license

2012-03-07 Thread Florian Weimer
* Simon Josefsson: Florian Weimer f...@deneb.enyo.de writes: (GPLv2-only and LGPLv3+ are incompatible.) Nowadays, almost all GPLv2-only programs link to library code licensed under the GPLv3 (with a linking exception on the library side), so we pretend that they are, at least to some

Re: libidn re-license

2012-03-06 Thread Florian Weimer
* Simon Josefsson: I co-maintain the libidn package. As upstream, I recently relicensed it from LGPLv2+ to GPLv2+|LGPLv3+. I'd like to upload the latest version into Debian before Wheezy since a pretty nasty inifinte-loop bug has been fixed. Should we get that into stable-security, under

Re: upstart: please update to latest upstream version

2012-03-03 Thread Florian Weimer
* Matthias Klumpp: He does not want portability patches in systemd, because much invasive changes would be needed, making the code more difficult to read (which might even lead to buggy code). It seems that this also applies to older Linux versions. According to the documentation, the

Re: Do symbols make sense for C++

2012-01-26 Thread Florian Weimer
* Russ Allbery: I'm currently working on the Policy modification to document (and recommend) use of symbols instead of shlibs, but I'd only personally used symbols with C libraries. Today I decided that I should try adding a symbols file to a C++ library, particularly if I'm going to

Archive upload tools

2011-12-05 Thread Florian Weimer
Are there any other archive upload tools besides dput and dupload? (Not counting generic file transfer clients.) -- To UNSUBSCRIBE, email to debian-devel-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive:

Accepted debsecan 0.4.16 (source all)

2011-10-06 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Thu, 06 Oct 2011 15:03:37 +0200 Source: debsecan Binary: debsecan Architecture: source all Version: 0.4.16 Distribution: unstable Urgency: low Maintainer: Florian Weimer f...@deneb.enyo.de Changed-By: Florian Weimer f

Re: Bits from dpkg developers - dpkg 1.16.1

2011-10-03 Thread Florian Weimer
* Henrique de Moraes Holschuh: On Sun, 02 Oct 2011, Florian Weimer wrote: Couldn't we get rid of static libraries altogether, replacing static linking with ahead-of-time dynamic linking? Well, the normal usecase for static libraries and static linking is to produce self-contained objects

Re: Bits from dpkg developers - dpkg 1.16.1

2011-10-03 Thread Florian Weimer
* Adam Borowski: I would defend static libs for scientific apps. Static libs show a significant performance benefit (2-40%, median around 5-10% but sometimes far more with C++ apps) and so are standard in HPC still; If you see that big a difference, you do a lot of cross-file calls in tight

Re: Bits from dpkg developers - dpkg 1.16.1

2011-10-03 Thread Florian Weimer
* Bastien ROUCARIES: On Mon, Oct 3, 2011 at 3:02 PM, Florian Weimer f...@deneb.enyo.de wrote: * Adam Borowski: I would defend static libs for scientific apps. Static libs show a significant performance benefit (2-40%, median around 5-10% but sometimes far more with C++ apps) and so

Re: Bits from dpkg developers - dpkg 1.16.1

2011-10-02 Thread Florian Weimer
* Kees Cook: When we decide to build an entire architecture as PIE, then we'll also need to build those static libs with -fPIE too. Couldn't we get rid of static libraries altogether, replacing static linking with ahead-of-time dynamic linking? There's still a theoretical difference between

Re: Bug#642005: general: maximum size of SHM memory blocks to low

2011-09-19 Thread Florian Weimer
with kernel defaults. The default configuration works fine, but in most cases, you want to increase the size of its shared memory pool. -- Florian Weimerfwei...@bfk.de BFK edv-consulting GmbH http://www.bfk.de/ Kriegsstraße 100 tel: +49-721-96201-1 D-76133

Accepted openjdk-6 6b18-1.8.9-0.1 (source all amd64)

2011-07-28 Thread Florian Weimer
amd64 all Version: 6b18-1.8.9-0.1 Distribution: unstable Urgency: high Maintainer: OpenJDK Team open...@lists.launchpad.net Changed-By: Florian Weimer f...@deneb.enyo.de Description: icedtea-6-jre-cacao - Alternative JVM for OpenJDK, using Cacao openjdk-6-dbg - Java runtime based on OpenJDK

Accepted debsecan 0.4.15 (source all)

2011-06-02 Thread Florian Weimer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Format: 1.8 Date: Thu, 02 Jun 2011 14:11:56 +0200 Source: debsecan Binary: debsecan Architecture: source all Version: 0.4.15 Distribution: unstable Urgency: low Maintainer: Florian Weimer f...@deneb.enyo.de Changed-By: Florian Weimer f

Python code for parsing .deb files

2011-04-24 Thread Florian Weimer
Is there some Python module to extract metadata from .deb files (package name, version, source package, source version, architecture)? What about parsing package list files? dak probably contains such code, but is a bit unwieldy. -- To UNSUBSCRIBE, email to

Re: Python code for parsing .deb files

2011-04-24 Thread Florian Weimer
* Julien Valroff: Le dimanche 24 avril 2011 à 14:31:03 (+0200 CEST), Florian Weimer a écrit : Is there some Python module to extract metadata from .deb files (package name, version, source package, source version, architecture)? Looks like the DebFile class from the debian module does all

Re: Release file changes

2011-02-21 Thread Florian Weimer
* Joerg Jaspert: I additionally opened a bug with apt to add support for SHA512SUM, so we can start using them. As soon as that is possible I intend to drop SHA256 and end up with SHA1/SHA512 only. Please don't. I have more faith in SHA-256 than SHA-512. -- To UNSUBSCRIBE, email to

Re: Release file changes

2011-02-21 Thread Florian Weimer
* Joerg Jaspert: I additionally opened a bug with apt to add support for SHA512SUM, so we can start using them. As soon as that is possible I intend to drop SHA256 and end up with SHA1/SHA512 only. Please don't. I have more faith in SHA-256 than SHA-512. Uhh, fine - why? I think this

Re: Anybody else having problems w/ DNSSEC and ftp.debian.org?

2011-02-06 Thread Florian Weimer
* Heiko Schlittermann: before filing a bug report I'd like to ask here, since I'd expect some experts here :-) Using a current lenny with bind9 I can't validate (www|ftp).debian.org anymore. Is anybody else experiencing this problem? not working: 1:9.6.ESV.R3+dfsg-0+lenny1 This has been

Re: Anybody else having problems w/ DNSSEC and ftp.debian.org?

2010-12-20 Thread Florian Weimer
* Heiko Schlittermann: Can you show us the output from: dig +cd +dnssec ftp.debian.org DS Same here. dig +cd +dnssec ftp.debian.org DNSKEY DNSKEYs are the same, but then we've got this: ftp.debian.org.IN DNSKEY 256 3 5

Re: Anybody else having problems w/ DNSSEC and ftp.debian.org?

2010-12-18 Thread Florian Weimer
* Heiko Schlittermann: Could this somehow trigger this (unexpected) behaviour of a failing validation? But why does it work for somebody (anybody?) else using this version of bind? (output of the CHAOS version.bind query: 9.6-ESV-R3) Obviously, it works for me, in quite a similar setup

Re: Squeeze can't fit on 512MiB

2010-10-27 Thread Florian Weimer
* Samuel Thibault: - Base+Standard grew from 397MiB to 491MiB (we install libdb4.{5,6,7,8} !?, I suspect that this is caused primarily by API and ABI incompatibility, and in part by the lack of response to bug reports from upstream. Everybody who uses Berkeley DB extensively has once been

Re: A Look In the Mirror: Attacks on Package Managers

2010-06-06 Thread Florian Weimer
* Fernando Lemos: 1. Man-in-the-middle attacks between clients and security update servers 2. Denial-of-service attacks to the security updates infrastructure 3. No trusted servers for security updates for testing and unstable Using HTTPS for the security update infrastructure could solve

Re: APT do not work with Squid as a proxy because of pipelining default

2010-05-17 Thread Florian Weimer
* Petter Reinholdtsen: I am bothered by URL: http://bugs.debian.org/56 , and the fact that apt(-get,itude) do not work with Squid as a proxy. I would very much like to have apt work out of the box with Squid in Squeeze. To fix it one can either change Squid to work with pipelining the

Re: perl: 64-bit integers and long doubles

2010-05-09 Thread Florian Weimer
* Stefan Fritsch: I may be a bit late to this discussion, but aren't 64bit ints (and especially pack/unpack Q) very useful for 64bit file pointers and such? IMHO, this means that they would also be very useful on smaller architectures like arm. Yes, they are, and that's where I have run

Re: perl: 64-bit integers and long doubles

2010-05-09 Thread Florian Weimer
* Niko Tyni: I wasn't initially going for long doubles, but several upstream developers recommended that they be enabled together. http://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2010-04/msg00773.html This shows that long doubles are not backwards-compatible. 8-) The root cause is

/usr/bin/mail policy

2010-05-07 Thread Florian Weimer
bts from devscripts invokes mail with an -a flag, which has different meanings in bsd-mailx and heirloom-mailx (the latter being some sort-of-default in squeeze installations, apparently). I'm not sure which package is at fault here. Any suggestions? -- To UNSUBSCRIBE, email to

Re: Bug#580386: ITP: libclean-crypto-java -- Simplified and unrestricted javax.crypto bootstrap library

2010-05-06 Thread Florian Weimer
* Steffen Moeller: Description : Simplified and unrestricted javax.crypto bootstrap library Provides a simple unrestricted version of the javax.crypto package which can be provided when bootstrapping the Java Virtual Machine. This is needed to load, e.g., unsigned crypo SPI

Re: perl: 64-bit integers and long doubles

2010-05-04 Thread Florian Weimer
* Niko Tyni: The benefits are obviously improved numeric range and precision. The downside is presumably increased memory usage. I have no measurement data on this; suggestions on suitable tests would be welcome. I have run into several incompatibilities between i386 and amd64 due to

Re: Proposed changes to the Debian Machine Usage Policy (DMUP)

2010-05-03 Thread Florian Weimer
* Martin Zobel-Helas: Using Debian machines for reading mail is OK, please choose a lightly loaded machine [ie not master]. We do not master is not heavily loaded anymore, isn't it? So this is probably outdated. -- To UNSUBSCRIBE, email to

Re: bindv6only again

2010-04-27 Thread Florian Weimer
* Julien Cristau: +#if defined(ENABLE_IPV6) defined(IPV6_V6ONLY) + if (ai-ai_family == AF_INET6) { + int zero = 0; + if (setsockopt(sock, IPPROTO_IPV6, IPV6_V6ONLY, zero, sizeof(zero)) 0) + g_warning(setsockopt(IPV6_V6ONLY): %s,

Re: How does lintian detect embedded-zlib?

2010-04-14 Thread Florian Weimer
* Matthias Klumpp: Russ Albery writes about this: -- This is generally a false positive in that this is not the problem that Lintian is trying to diagnose (although I don't understand why it only sometimes shows up in builds of easymp3gain). I'm trying to figure out a good way of

Re: libgcrypt brain dead?

2010-03-20 Thread Florian Weimer
* Henrique de Moraes Holschuh: 2. Must be thread-safe, and fully reentrant both at the function and at the _library_ level; This does not include the async-signal-safe property, right? I'm also not sure if the function needs to be reentrant within the same thread (depending on what it

<    1   2   3   4   5   6   7   8   9   >