Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Jeremiah C. Foster]

On 10/9/21 4:04 PM, Holger Levsen wrote:

On Sat, Oct 09, 2021 at 10:33:47AM +0200, Sylvain Beucler wrote:

This would be the ELTS (not LTS) repo at
https://salsa.debian.org/freexian-team/extended-lts/security-tracker/.

See the ELTS README at gitlab.com:freexian-lts/extended-lts

[...]

See
https://wiki.debian.org/LTS/Development#Prepare_an_update_for_the_website


Thanks, Sylvain! :)


Yes, thank you both. The naming is clear to me now and I have the repos 
here on disk.


Cheers,

Jeremiah

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Sat, Oct 09, 2021 at 10:33:47AM +0200, Sylvain Beucler wrote:
> This would be the ELTS (not LTS) repo at
> https://salsa.debian.org/freexian-team/extended-lts/security-tracker/.
> 
> See the ELTS README at gitlab.com:freexian-lts/extended-lts
[...]
> See
> https://wiki.debian.org/LTS/Development#Prepare_an_update_for_the_website

Thanks, Sylvain! :)

(and sorry for having been busy with other stuff. I shall reply timely again
now.)


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Today, over 800 women will have died due to preventable pregnancy and birth
complications, over 130 due to femicide. 
https://www.who.int/news-room/fact-sheets/detail/maternal-mortality
https://en.wikipedia.org/wiki/Femicide#Worldwide


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Jeremiah C. Foster]

On 9/28/21 12:46 PM, Holger Levsen wrote:

Hi Jeremiah,

On Mon, Sep 06, 2021 at 08:57:04PM -0400, Jeremiah C. Foster wrote:

(Jeremiah, shall I explain how to gather this data?)


so there are three very simple scripts involved, which are attached and which
I used to run every Monday and then I massaged them into one email, where I 
basically
just resend the same but edited mail every week.

These scripts expect that you have clones of the security-tracker.git repo as 
well
as the extented-security-tracker.git repo and the webwml.git repo checked out in
these directories:
  ~/Projects/security-tracker
  ~/Projects/extended-security-tracker
  ~/Projects/debian-www/webwml


As I mentioned in another email that I didn't send to the list, I'm not 
sure I have access to all of these git repos. I do have to 
security-tracker but I cannot find extended-security-tracker in Salsa or 
Gitlab. As for webwml, is that this 
https://salsa.debian.org/webmaster-team/webwml/ ?



I didn't sent that mail yesterday as I planned to send these instructions 
instead.
if you have any further questions, please ask.


I'm attaching some output for the run of lts-unclaim-packages for anyone 
to review. It doesn't look like the emails you sent, perhaps you edit 
this info into the email? If so, how?


Cheers,

Jeremiah
commit f2d8e8d18be206d84d34ff69936aa7c1a100b25d
Author: Jeremiah C. Foster 
Date:   Fri Oct 8 19:46:05 2021 -0400

semi-automatic unclaim after 2 weeks of inactivity

Signed-off-by: Jeremiah C. Foster 

diff --git a/data/dla-needed.txt b/data/dla-needed.txt
index 7522a88c8d..3060d4916a 100644
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -18,12 +18,12 @@ amd64-microcode
   NOTE: 20210831: https://lists.debian.org/debian-lts/2021/08/msg00033.html
   NOTE: 20210831: needs to be fixed (Beuc)
 --
-ansible (Lee Garrett)
+ansible
   NOTE: 20210411: As discussed with the maintainer I will update Buster first 
and
   NOTE: 20210411: after that LTS. (apo)
   NOTE: 20210426: https://people.debian.org/~apo/lts/ansible/
 --
-cacti (Roberto C. Sánchez)
+cacti
   NOTE: 20210829: not really sure whether affected, please recheck
   NOTE: 20210914: still assessing whether or not affected (roberto)
 --
@@ -34,11 +34,11 @@ debian-archive-keyring (Utkarsh)
   NOTE: 20211003: seemed to have expired and the build is thus
   NOTE: 20211003: failing. Or at least appears to be. :( (utkarsh)
 --
-exiv2 (Thorsten Alteholz)
+exiv2
 --
-faad2 (Thorsten Alteholz)
+faad2
 --
-ffmpeg (Anton Gladky)
+ffmpeg
   NOTE: probably wait until stuff is fixed in Buster
 --
 firefox-esr (Emilio)
@@ -50,7 +50,7 @@ firmware-nonfree
 hiredis (Chris Lamb)
   NOTE: 20211006: Fixed in sid and experimental. (lamby)
 --
-jsoup (Markus Koschany)
+jsoup
 --
 linux (Ben Hutchings)
 --
@@ -62,9 +62,9 @@ mosquitto
   NOTE: 20210805: coordinating upload to buster before DLA for Stretch 
(codehelp)
   NOTE: 20210806: CVE-2021-34432 ignored in buster and stretch. Vulnerable 
code not accessible. (codehelp)
 --
-nghttp2 (Anton Gladky)
+nghttp2
 --
-ntfs-3g (Abhijith PA)
+ntfs-3g
 --
 nvidia-graphics-drivers
   NOTE: package is in non-free but also in packages-to-support
@@ -114,7 +114,7 @@ smarty3
   NOTE: 20210829: Track regression (abhijith)
   NOTE: 20210906: prepared a build for testing. Waiting for bug submitter's 
reply (abhijith)
 --
-squashfs-tools (Thorsten Alteholz)
+squashfs-tools
   NOTE: 20210926: coordinate with upload to other releases
 --
 thunderbird (Emilio)

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

Hi Jeremiah,

On Mon, Sep 06, 2021 at 08:57:04PM -0400, Jeremiah C. Foster wrote:
> > (Jeremiah, shall I explain how to gather this data?)

so there are three very simple scripts involved, which are attached and which
I used to run every Monday and then I massaged them into one email, where I 
basically
just resend the same but edited mail every week.

These scripts expect that you have clones of the security-tracker.git repo as 
well
as the extented-security-tracker.git repo and the webwml.git repo checked out in
these directories:
 ~/Projects/security-tracker
 ~/Projects/extended-security-tracker
 ~/Projects/debian-www/webwml 

I didn't sent that mail yesterday as I planned to send these instructions 
instead.
if you have any further questions, please ask.


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

„Guten Tag, ich rufe Sie an, um Ihnen mitzuteilen, dass Ihre Tochter seit
geraumer Zeit die schulischen Abläufe erheblich stört.“ - „Entschuldigen Sie,
meine Tochter ist 54 und Ministerin für Schule und Bildung in NRW.“ - „Gut,
dann wissen Sie also, von wem ich rede.“- Germany, early 2021
#!/bin/sh
# WTF licenced, copyright 2019 Holger Levsen

_unclaim(){
TARGET=$1
DIR=$2
figlet $TARGET
cd $DIR
git status
git pull
git status
./bin/review-update-needed --$TARGET --unclaim 1209600 --exclude linux 
linux-4.9 linux-4.19 xen
git commit -a -s -m 'semi-automatic unclaim after 2 weeks of inactivity'
git log -p -1
echo
echo "Don't forget to push..."
echo
git status
bash
}

unclaim_lts(){
_unclaim lts ~/Projects/security-tracker
}

unclaim_elts(){
_unclaim elts ~/Projects/extended-security-tracker
}

if [ -z "$1" ] ; then
xterm -e "$0 unclaim_lts" &
xterm -e "$0 unclaim_elts" &
else
$1
fi


#!/bin/bash

# WTF licenced, copyright 2020-2021 Holger Levsen

TRESHOLD=4

cd ~/Projects/security-tracker
git pull
echo

DLANEEDED=~/Projects/security-tracker/data/dla-needed.txt 
TMPFILE=$(mktemp)
egrep '^[A-Za-z0-9]+\ \(.*\)'  $DLANEEDED | cut -d ' ' -f2-| sort | tr -d 
'('|tr -d ')' | sort -u > $TMPFILE
WARNING=$(mktemp)

echo "Current number of package claims in LTS:"
echo ""
( while IFS= read -r  LINE ; do
HITS=$(grep -v '^ ' $DLANEEDED | grep -c "$LINE")
PACKAGES=$(grep -v '^ ' $DLANEEDED | grep "$LINE" | cut -d ' ' -f1 | 
xargs echo)
echo "$HITS: $LINE"
if [ $HITS -ge $TRESHOLD ] ; then
echo "Warning: $LINE probably claimed too many: $HITS packages: 
$PACKAGES" >> $WARNING
fi 
 done < $TMPFILE ) |sort -nr

echo
if [ -s $WARNING ] ; then
cat $WARNING | sort
else
echo "Nice, noone claimed $TRESHOLD packages or more."
fi
echo

rm $TMPFILE $WARNING
#!/bin/bash

# WTF licenced, copyright 2020 Holger Levsen

cd ~/Projects/security-tracker
git pull
cd ~/Projects/debian-www/webwml 
git pull
./english/security/find-missing-advisories --mode DLA --tracker 
../../security-tracker/ 2>&1



signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today four packages were unclaimed for LTS:

- debian-archive-keyring (Utkarsh)
- krb5 (Adrian Bunk)
- ruby2.3 (Utkarsh)
- smarty3 (Abhijith PA)

and six for ELTS:

- ntfs-3g (Abhijith PA)
- ckeditor (Abhijith PA)
- gst-plugins-bad0.10 (Utkarsh)
- jsoup (Utkarsh)
- krb5 (Adrian Bunk)
- ruby2.1 (Utkarsh)

Utkarsh had probably claimed too many packages but then I unclaimed
some ;)

No DLAs have been reserved and haven't been published yet.

Jeremiah: next Monday I'll have time to explain how to gather this data...
(next Monday or later, please tell me if+when you are available next
Monday, else I'll send this mail once more... :)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:

LTS:
- cacti (Roberto C. Sánchez)
- qtbase-opensource-src (Utkarsh Gupta)

and none for ELTS.

Utkarsh probably claimed too many packages, 4: 
- debian-archive-keyring
- qtbase-opensource-src
- ruby2.3
- tiff

No DLAs have been reserved and haven't been published yet.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Jeremiah C. Foster]

On 9/6/21 5:31 AM, Holger Levsen wrote:

hi,

today one package was unclaimed for LTS:
- mupdf (codehelp)

and none for ELTS. Also noone claimed 4 packages or more.

Two DLAs which already have been reserved have not yet been published:
- DLA 2754-1 (04 Sep 2021) (pywps)
- DLA 2717-2 (27 Aug 2021) (redis)

(Jeremiah, shall I explain how to gather this data?)


Yes please! :-)

Cheers,

Jeremiah

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Chris Lamb]

Holger Levsen wrote:

> Two DLAs which already have been reserved have not yet been published:
[..]
> - DLA 2717-2 (27 Aug 2021) (redis)

Thanks for the reminder. This change has now been committed and will
be available on the website after the next run.


Regards,

--
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org  chris-lamb.co.uk
   `-

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- mupdf (codehelp)

and none for ELTS. Also noone claimed 4 packages or more.

Two DLAs which already have been reserved have not yet been published:
- DLA 2754-1 (04 Sep 2021) (pywps)
- DLA 2717-2 (27 Aug 2021) (redis)

(Jeremiah, shall I explain how to gather this data?)

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
-ruby2.3 (Utkarsh Gupta)
-rustc (Anton Gladky)

and none for ELTS.

Thorsten probably claimed too many packages: 
- btrbk
- grilo
- openssl
- openssl1.0
- squashfs-tools

One DLA which already has been reserved has not yet been published:
- DLA 2717-2 (27 Aug 2021) (redis)

Last: Jeremiah will you take over sending these mails (and unclaiming packages)
in future? Starting next week? :)

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no were unclaimed for LTS and ELTS, noone claimed too many packages
and there's also no DLA which has been reserved but not published, wheehoo,
that's awesome and a first, I think. :)

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: always check and update (d|e)la-needed.txt (Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do))

[Emilio Pozuelo Monfort]

Roberto C. Sánchez wrote:

On this past Friday, Raphaël put me in touch with Thorsten Glaser, who
had already prepared openjdk-8 package for jessie and stretch.  I
reviewed and sponsored the upload, and the packages were literally in
the process of uploading when I saw this message.  I will publish the
advisories in a few hours, after all the binary packages are built.


Oops, this explains the REJECTs I got :)


I know I will be extra careful going forward.  This especially as in the
past I have been quick to become frustrated at others' mistakes.  I
appreciate the patience you and Emilio have shown toward me.  It is very
much appreciated.


Np, we all make mistakes.

Cheers,
Emilio

Re: always check and update (d|e)la-needed.txt (Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do))

[Roberto C . Sánchez]

On Mon, Aug 09, 2021 at 10:52:00AM +, Holger Levsen wrote:
> Hi Roberto,
> 
> On Mon, Aug 09, 2021 at 06:38:15AM -0400, Roberto C. Sánchez wrote:
> > It was completely my fault.  [...]
> 
> Mistakes happen, thank you for owning yours!
> 
> >  The update to dla-needed.txt
> > and ela-needed.txt did not even cross my mind. 
> 
> Mistakes happen. I'm just emphasizing "the wrongdoing" so everybody
> learns and in future updating (d|e)la-ndeed.txt will be forgotten
> less often! :)
> 
I know I will be extra careful going forward.  This especially as in the
past I have been quick to become frustrated at others' mistakes.  I
appreciate the patience you and Emilio have shown toward me.  It is very
much appreciated.

Regards,

-Roberto

-- 
Roberto C. Sánchez

always check and update (d|e)la-needed.txt (Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do))

[Holger Levsen]

Hi Roberto,

On Mon, Aug 09, 2021 at 06:38:15AM -0400, Roberto C. Sánchez wrote:
> It was completely my fault.  [...]

Mistakes happen, thank you for owning yours!

>  The update to dla-needed.txt
> and ela-needed.txt did not even cross my mind. 

Mistakes happen. I'm just emphasizing "the wrongdoing" so everybody
learns and in future updating (d|e)la-ndeed.txt will be forgotten
less often! :)


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

The planet will be fine. We won't.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Markus Koschany]

Am Montag, dem 09.08.2021 um 06:38 -0400 schrieb Roberto C. Sánchez:
[...]
> 
> It was completely my fault.  According to Raphaël and Thorsten, Markus
> was not responding to emails.  I assumed that because Raphaël requested
> someone get in touch with Thorsten, that I should simply contact
> Thorsten, review the packages, and upload.  The update to dla-needed.txt
> and ela-needed.txt did not even cross my mind.  My apologies if I have
> over-stepped or caused problems with my oversight.

Emilio has been taking care of openjdk-8 for several months now. You probably
confused the two of us. Nobody contacted me in regard to openjdk-8.

Regards,

Markus


signature.asc
Description: This is a digitally signed message part

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Roberto C . Sánchez]

On Mon, Aug 09, 2021 at 10:32:54AM +, Holger Levsen wrote:
> On Mon, Aug 09, 2021 at 06:20:43AM -0400, Roberto C. Sánchez wrote:
> > On Mon, Aug 09, 2021 at 08:43:34AM +, Holger Levsen wrote:
> > > today three packages were unclaimed for LTS:
> > > - openjdk-8 (Emilio)
> > > 
> > > and three for ELTS:
> > > - openjdk-8 (Emilio)
> 
> > On this past Friday, Raphaël put me in touch with Thorsten Glaser, who
> > had already prepared openjdk-8 package for jessie and stretch.  I
> > reviewed and sponsored the upload, and the packages were literally in
> > the process of uploading when I saw this message.  I will publish the
> > advisories in a few hours, after all the binary packages are built.
> 
> I'm surprised you (nor anyone else) updated dla-needed.txt in the process.
> any idea why not?
> 
It was completely my fault.  According to Raphaël and Thorsten, Markus
was not responding to emails.  I assumed that because Raphaël requested
someone get in touch with Thorsten, that I should simply contact
Thorsten, review the packages, and upload.  The update to dla-needed.txt
and ela-needed.txt did not even cross my mind.  My apologies if I have
over-stepped or caused problems with my oversight.

Regards,

-Roberto

-- 
Roberto C. Sánchez

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Aug 09, 2021 at 10:32:54AM +, Holger Levsen wrote:
> On Mon, Aug 09, 2021 at 06:20:43AM -0400, Roberto C. Sánchez wrote:
> > On Mon, Aug 09, 2021 at 08:43:34AM +, Holger Levsen wrote:
> > > today three packages were unclaimed for LTS:
> > > - openjdk-8 (Emilio)
> > > 
> > > and three for ELTS:
> > > - openjdk-8 (Emilio)
> 
> > On this past Friday, Raphaël put me in touch with Thorsten Glaser, who
> > had already prepared openjdk-8 package for jessie and stretch.  I
> > reviewed and sponsored the upload, and the packages were literally in
> > the process of uploading when I saw this message.  I will publish the
> > advisories in a few hours, after all the binary packages are built.
> I'm surprised you (nor anyone else) updated dla-needed.txt in the process.

this also lead to more work wasted now: Markus just claimed openjdk-8
for stretch...


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

If you own several guns but no guitars, you are doing life all wrong.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Aug 09, 2021 at 06:20:43AM -0400, Roberto C. Sánchez wrote:
> On Mon, Aug 09, 2021 at 08:43:34AM +, Holger Levsen wrote:
> > today three packages were unclaimed for LTS:
> > - openjdk-8 (Emilio)
> > 
> > and three for ELTS:
> > - openjdk-8 (Emilio)

> On this past Friday, Raphaël put me in touch with Thorsten Glaser, who
> had already prepared openjdk-8 package for jessie and stretch.  I
> reviewed and sponsored the upload, and the packages were literally in
> the process of uploading when I saw this message.  I will publish the
> advisories in a few hours, after all the binary packages are built.

I'm surprised you (nor anyone else) updated dla-needed.txt in the process.
any idea why not?


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Our civilization is being sacrificed for the opportunity of a very small number
of people to continue making enormous amounts of money...  It is the sufferings
of the many  which pay  for the luxuries  of the few...  You say  you love your
children  above all else,  and yet  you are stealing  their future  in front of 
their very eyes... (Greta Thunberg)


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Roberto C . Sánchez]

On Mon, Aug 09, 2021 at 08:43:34AM +, Holger Levsen wrote:
> hi,
> 
> today three packages were unclaimed for LTS:
> - nettle (Emilio)
> - openjdk-8 (Emilio)
> - pillow (codehelp)
> 
> and three for ELTS:
> - nettle (Emilio)
> - openjdk-7 (Emilio)
> - openjdk-8 (Emilio)
> 
> Utkarsh probably claimed too many packages: 
> - amd64-microcode
> - exiv2
> - ruby2.3
> - usermode
> 

On this past Friday, Raphaël put me in touch with Thorsten Glaser, who
had already prepared openjdk-8 package for jessie and stretch.  I
reviewed and sponsored the upload, and the packages were literally in
the process of uploading when I saw this message.  I will publish the
advisories in a few hours, after all the binary packages are built.

Regards,

-Roberto


-- 
Roberto C. Sánchez

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today three packages were unclaimed for LTS:
- nettle (Emilio)
- openjdk-8 (Emilio)
- pillow (codehelp)

and three for ELTS:
- nettle (Emilio)
- openjdk-7 (Emilio)
- openjdk-8 (Emilio)

Utkarsh probably claimed too many packages: 
- amd64-microcode
- exiv2
- ruby2.3
- usermode

One DLA which already has been reserved has not yet been published:
- DLA 2733-1 (05 Aug 2021) (tomcat8)

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no package was unclaimed for LTS nor ELTS and noone claimed too
many packages neither. Yay!

Just a few DLAs need publishing:

- DLA 2723-1 (31 Jul 2021) (linuxptp)
- DLA 2722-1 (30 Jul 2021) (libsndfile)
- DLA 2721-1 (26 Jul 2021) (drupal7)
- DLA 2720-1 (26 Jul 2021) (aspell)


Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no package was unclaimed for LTS and one for ELTS:
- ceph (Markus Koschany)

(looking at data/ela-needed.txt it's unclear to me why ceph is claimed at
 all... -> please update the note to make that clear...)


Noone claimed too many packages and the same as last week and all DLAs which
have been reserved >24h ago have been published, yay.

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

if you reclaim packages which were unclaimed after 2 weeks of inactivity,
please update the notes *properly*. Updating the date of a note entry stating
'WIP' is not helpful for anyone wanting to contribute, especially if it's 
WIP for two months or similar.

Also if it's WIP for weeks it might very well be sensible to spend 15min
updating the notes and bill that work, so please do.

(This is a general comment even though it was triggered by two actual commits.
I have almost zero desire to discuss the specific cases here, I just wanted to
make the general statement "please update the notes properly".)

Also, if you're waiting for weeks for a reply from upstream, state so, and
repeat yourself ("20210719 still waiting for reply from upstream") and better 
yet,
ping them, after two weeks thats fine for security issues I'd say.
"20210719 still waiting for reply from upstream, so pinged them again, <$MSGID>"

Thanks.


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

It's the end of the world as we know it - and I feel fine.


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today several packages were unclaimed for LTS:

-ffmpeg (Anton Gladky)
-nettle (Emilio)
-ruby-actionpack-page-caching (Markus Koschany)
-ruby-kaminari (Markus Koschany)
-runc (Abhijith PA)
-shiro (Roberto C. Sánchez)

and two for ELTS:

-nettle (Emilio)
-openjdk-7 (Emilio)

Then Markus probably claimed too many packages and the same as last week, so
today two were unclaimed (see above):
- ceph
- condor
- ruby-actionpack-page-caching
- ruby-kaminari

All DLAs which have been reserved have been published, yay.
Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- ansible (Lee Garrett)
and none for ELTS.

Markus Koschany probably claimed too many packages:
- ceph
- condor
- ruby-actionpack-page-caching
- ruby-kaminari

All DLAs which have been reserved have been published, yay.
Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today just one package was unclaimed for LTS:
- rabbitmq-server (Abhijith PA)

No packages were unclaimed for ELTS and noone claimed 4 packages or more. 
All reserved DLAs have been published! Yay!

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

moining,

today four packages were unclaimed for LTS:
- apache2 (Emilio)
- htmldoc (Utkarsh Gupta)
- nettle (Emilio)
- runc (Abhijith PA)

and four for ELTS:
- apache2 (Emilio)
- htmldoc (Utkarsh Gupta)
- nettle (Emilio)
- openjdk-7 (Emilio)

Then, noone claimed 4 packages or more. 

Five DLAs have been reserved and haven't been published yet:
- DLA 2694-1 (28 Jun 2021) (tiff)
- DLA 2693-1 (28 Jun 2021) (xmlbeans)
- DLA 2692-1 (27 Jun 2021) (bluez)
- DLA 2691-1 (25 Jun 2021) (libgcrypt20)
- DLA 2684-1 (10 Jun 2021) (lasso)

Nice, noone claimed 4 packages or more.

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Jun 14, 2021 at 09:51:44AM +0100, Chris Lamb wrote:
> Ah. I can see forgot to make sure it actually ended up on the website.
> I've merged the commit from my fork of the webwml.git repository and
> it should appear on the website in due course. Thanks for the
> pointers.

thanks for fixing this, Chris!


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄

Dat gifft in Plattdüütschen keen Woort för „Flüchtlinge”. Dat sünd allens Lüüd, 
Mischen, Kinners, Olle, Froons, Mannslüüd, so as Du un Ick.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Chris Lamb]

Hey,

> > The script checks:
> > https://salsa.debian.org/webmaster-team/webwml/-/tree/master/english/lts/security/2021
> > Maybe you forgot to git-push there?
>
> https://www.debian.org/lts/security/ also does not show it.

Ah. I can see forgot to make sure it actually ended up on the website.
I've merged the commit from my fork of the webwml.git repository and
it should appear on the website in due course. Thanks for the
pointers.


Regards,

--
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org  chris-lamb.co.uk
   `-

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

Hi,

On Mon, Jun 14, 2021 at 09:20:45AM +0200, Sylvain Beucler wrote:
> The script checks:
> https://salsa.debian.org/webmaster-team/webwml/-/tree/master/english/lts/security/2021
> Maybe you forgot to git-push there?

https://www.debian.org/lts/security/ also does not show it.


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁  holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀  OpenPGP: B8BF54137B09D35CF026FE9D 091AB856069AAA1C
 ⠈⠳⣄


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi Chris,

The script checks:
https://salsa.debian.org/webmaster-team/webwml/-/tree/master/english/lts/security/2021

Maybe you forgot to git-push there?

- Sylvain

On 14/06/2021 09:08, Chris Lamb wrote:

Hi Holger,


Just three DLAs have been reserved and haven't been published yet:


Thanks for these. However, I think this is a false positive:


- DLA 2676-1 (05 Jun 2021) (python-django)


This, I believe, has been published:

   https://lists.debian.org/debian-lts-announce/2021/06/msg4.html

   data/DLA/list:
   [05 Jun 2021] DLA-2676-1 python-django - security update
{CVE-2021-33203 CVE-2021-33571}
[stretch] - python-django 1:1.10.7-2+deb9u14

   $ rmadison python-django --url=udd --suite=stretch-security
   python-django | 1:1.10.7-2+deb9u14 | stretch-security | source, all
   $

Am I missing something?


Best wishes,

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Chris Lamb]

Hi Holger,

> Just three DLAs have been reserved and haven't been published yet:

Thanks for these. However, I think this is a false positive:

> - DLA 2676-1 (05 Jun 2021) (python-django)

This, I believe, has been published:

  https://lists.debian.org/debian-lts-announce/2021/06/msg4.html

  data/DLA/list:
  [05 Jun 2021] DLA-2676-1 python-django - security update
{CVE-2021-33203 CVE-2021-33571}
[stretch] - python-django 1:1.10.7-2+deb9u14

  $ rmadison python-django --url=udd --suite=stretch-security
  python-django | 1:1.10.7-2+deb9u14 | stretch-security | source, all
  $ 

Am I missing something?


Best wishes,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org  chris-lamb.co.uk
   `-

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

moining,

today no packages were unclaimed for LTS nor ELTS, and nobody has claimed 4 
packages
or more, yay.

Just three DLAs have been reserved and haven't been published yet:
- DLA 2685-1 (14 Jun 2021) (squid3)
- DLA 2684-1 (10 Jun 2021) (lasso)
- DLA 2676-1 (05 Jun 2021) (python-django)

Have a good week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

moining,

today two packages were unclaimed for LTS:
-ceph (Emilio)
-thunderbird (Emilio)

and two for ELTS:
-ceph (Emilio)
-openjdk-7 (Emilio)

Nobody claimed 4 packages or more.

Two DLAs have been reserved and haven't been published yet:
- DLA 2678-1 (06 Jun 2021) (ruby-nokogiri)
- DLA 2676-1 (05 Jun 2021) (python-django)

Nice, noone claimed 4 packages or more.


Have a good week!

-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hello again,

i'm back :) for the time being...

today one package was unclaimed for LTS:
- shiro (Roberto C. Sánchez)

and one for ELTS:
- ruby-nokogiri (Markus Koschany)

Nobody claimed 4 packages or more.

One DLA has been reserved and haven't been published yet:
- DLA 2668-1 (29 May 2021) (samba)


Have a good week!

-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Utkarsh Gupta]

Hello,

On Tue, May 25, 2021 at 2:23 AM Lynoure Braakman  wrote:
> No one claimed more than 4 packages. Utkarsh claimed 4 packages, but
> having mrxvt, rxvt and uxvt-unicode claimed by different people wouldn't
> make very much sense, so no problem there.

Yep, all 4 packages are affected by the same CVE.


- u

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Lynoure Braakman]

hi,

No one claimed more than 4 packages. Utkarsh claimed 4 packages, but 
having mrxvt, rxvt and uxvt-unicode claimed by different people wouldn't 
make very much sense, so no problem there.



Following packages were unclaimed for LTS:

-php-phpseclib (Abhijith PA)
-phpseclib (Abhijith PA)
-ruby-nokogiri (Markus Koschany)
-xmlbeans (Roberto C. Sánchez)


Nothing was unclaimed for ELTS.


No missing DLAs!


Have a good week,

--
Lynoure

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Lynoure Braakman]

hi,

Nobody claimed 4 packages or more.


Following package was unclaimed for LTS:
-ansible (Markus Koschany)


Here I'm having doubts about needing to unclaim this... Do take it back 
as you see fit, Markus.



Nothing was unclaimed for ELTS.


Only one reserved DLA has not been published yet:
 DLA 2664-1 (17 May 2021) (curl)


Have a good week, everybody!

--
Lynoure

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Lynoure Braakman]

hi,


today one package was unclaimed for LTS:
-imagemagick (Anton Gladky)


and none for ELTS.


Only Abhijith PA has claimed 4 or more packages, but I assume it's 
because php-phpseclib and phpseclib go inherently together, so no 
problem at all.



Have a good week everybody!

--
Lynoure

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Emilio Pozuelo Monfort]

Hi,

On 03/05/2021 16:40, Lynoure Braakman wrote:

Following DLAs have been reserved and haven't been published yet:
DLA 2637-1 (23 Apr 2021) (drupal7)
DLA 2610-1 (29 Mar 2021) (linux-4.19)


As FD, I have added these to the website (the other two were already done).

Cheers,
Emilio

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Lynoure Braakman]

On Monday 26 April 2021 17:39:01 CEST Lynoure Braakman wrote:

> Four DLAs have been reserved and haven't been published yet:
>  DLA 2637-1 (23 Apr 2021)  (drupal7)
>  DLA 2636-1 (23 Apr 2021) (pjproject)
>  DLA 2629-1 (18 Apr 2021) (libebml)
>  DLA 2628-1 (17 Apr 2021) (python2.7)
>  DLA 2618-2 (16 Apr 2021) (smarty3)
>  DLA 2610-1 (29 Mar 2021) (linux-4.19)

All you can count, and I don't always remember to edit the things I copy 
paste, so:

s/Four/Following/


-- 
Lynoure Braakman 

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Lynoure Braakman]

hi, 

As I am gradually taking coordination duties over fro Holger, here's my first 
time doing these mails.

Nobody claimed 4 packages or more.

Nothing was unclaimed for LTS or ELTS.

Four DLAs have been reserved and haven't been published yet:
 DLA 2637-1 (23 Apr 2021)  (drupal7)
 DLA 2636-1 (23 Apr 2021) (pjproject)
 DLA 2629-1 (18 Apr 2021) (libebml)
 DLA 2628-1 (17 Apr 2021) (python2.7)
 DLA 2618-2 (16 Apr 2021) (smarty3)
 DLA 2610-1 (29 Mar 2021) (linux-4.19)


Have a splendid week,

-- 
Lynoure Braakman

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:

LTS:
- cgal (Anton Gladky)
- gsoap (Abhijith PA)

and none for ELTS.

Nobody claimed 4 packages or more.

Four DLAs have been reserved and haven't been published yet:
- DLA 2629-1 (18 Apr 2021) (libebml)
- DLA 2628-1 (17 Apr 2021) (python2.7)
- DLA 2618-2 (16 Apr 2021) (smarty3)
- DLA 2610-1 (29 Mar 2021) (linux-4.19)

Theat linux-4.19 DLA was also missing the last two weeks?!?!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Utkarsh Gupta]

Hello,

On Tue, Apr 13, 2021 at 1:43 AM Holger Levsen  wrote:
> well, yes, but it was caught by the script I'm running each week?!?

I am actually not sure what to reply because all I wanted to convey is
that this was left unpublished and no one's at fault here, really.
Someone had to notice and fix that, which is done :)


- u

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

dropping the elts list..

On Tue, Apr 13, 2021 at 12:41:27AM +0530, Utkarsh Gupta wrote:
> I am not sure. This is a rare example of how a website update could go
> missing since this update was done entirely by another DD without
> anyone's help or coordination and might've missed the publishing to
> the website part.

well, yes, but it was caught by the script I'm running each week?!?
 

-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁   holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀ PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
 ⠈⠳⣄

If you upload your address book to "the cloud", I don't want to be in it.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Utkarsh Gupta]

Hello,

On Tue, Apr 13, 2021 at 12:26 AM Holger Levsen  wrote:
> On Tue, Apr 13, 2021 at 12:04:44AM +0530, Utkarsh Gupta wrote:
> > > Twos DLAs have been reserved and haven't been published yet:
> > > - DLA 2613-1 (31 Mar 2021) (underscore)
> > This was issued by Yadd (the regular maintainer/team member of the JS
> > team) and hence was missing the website update. I've now published
> > that on his behalf via 020b540c.
>
> yay, thanks! & also, I don't really care as long as it's fixed in a timely
> manner, and after my first reminder is definitly still soon enough.
>
> So, IOW, thanks and no need to explain if there is just some little slag.
> :)
>
> (But please do share if you think that's helpful and eg. is something
> which could be improved etc...)

I am not sure. This is a rare example of how a website update could go
missing since this update was done entirely by another DD without
anyone's help or coordination and might've missed the publishing to
the website part.

I happened to remember this package name and re-called that nobody
from the LTS team worked on this and so I just went ahead and pushed
the missing piece.


- u

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

Hi Utkarsh,

On Tue, Apr 13, 2021 at 12:04:44AM +0530, Utkarsh Gupta wrote:
> > Twos DLAs have been reserved and haven't been published yet:
> > - DLA 2613-1 (31 Mar 2021) (underscore)
> This was issued by Yadd (the regular maintainer/team member of the JS
> team) and hence was missing the website update. I've now published
> that on his behalf via 020b540c.

yay, thanks! & also, I don't really care as long as it's fixed in a timely
manner, and after my first reminder is definitly still soon enough.

So, IOW, thanks and no need to explain if there is just some little slag.
:)

(But please do share if you think that's helpful and eg. is something
which could be improved etc...)


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁   holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀ PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
 ⠈⠳⣄

The corona crisis is peanuts compared to the global climate disaster.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Utkarsh Gupta]

Hi Holger,

On Mon, Apr 12, 2021 at 5:29 PM Holger Levsen  wrote:
> Twos DLAs have been reserved and haven't been published yet:
> - DLA 2613-1 (31 Mar 2021) (underscore)

This was issued by Yadd (the regular maintainer/team member of the JS
team) and hence was missing the website update. I've now published
that on his behalf via 020b540c.


- u

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- salt (Utkarsh)
- subversion (Emilio)

and one for ELTS:
- zeromq3 (Thorsten Alteholz)

Nobody claimed 4 packages or more.

Twos DLAs have been reserved and haven't been published yet:
- DLA 2613-1 (31 Mar 2021) (underscore)
- DLA 2610-1 (29 Mar 2021) (linux-4.19)

These two DLAs were also missing last week?!?


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- ansible (Markus Koschany)
- shiro (Roberto C. Sánchez)

and none for ELTS.

Also noone claimed 4 packages or more.

Six DLAs have been reserved and havn't been published yet:
- DLA 2618-1 (05 Apr 2021) (smarty3)
- DLA 2613-1 (31 Mar 2021) (underscore)
- DLA 2612-1 (31 Mar 2021) (leptonlib)
- DLA 2611-1 (31 Mar 2021) (ldb)
- DLA 2610-1 (29 Mar 2021) (linux-4.19)
- DLA 2606-1 (24 Mar 2021) (lxml)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- xmlbeans (Roberto C. Sánchez)

and one for ELTS:
- phpldapadmin (Emilio)

Thorsten Alteholz probably claimed too many packages:
- golang-github-appc-cni
- ldb
- leptonlib
- libebml

One DLA has been reserved and hasn't been published yet:
- DLA 2606-1 (24 Mar 2021) (lxml)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no package was unclaimed for LTS and one for ELTS:
- tomcat7 (Utkarsh)

Noone claimed 4 packages or more.

One DLAs has been reserved today and hasn't been published yet, but I expect
this will happen any moment, so I'll keep quiet here and now.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- php-pear (Ola Lundqvist)

and none for ELTS.

Noone claimed 4 packages or more.

Two DLAs which already had been reserved last week have not yet been published:
- DLA 2592-1 (13 Mar 2021) (golang-1.8)
- DLA 2591-1 (13 Mar 2021) (golang-1.7)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today four packages were unclaimed for LTS:
- glib2.0 (Emilio)
- golang-1.7 (Sylvain Beucler)
- golang-1.8 (Sylvain Beucler)
- xmlbeans (Roberto C. Sánchez)

and two for ELTS:
- glib2.0 (Emilio)
- golang (Sylvain Beucler)

Noone claimed 4 packages or more.

Three DLAs which already had been reserved last week have not yet been 
published:
- DLA 2553-2 (08 Mar 2021) (xcftools)
- DLA 2586-1 (08 Mar 2021) (linux)
- DLA 2557-1 (12 Feb 2021) (linux-4.19)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- ceph (Emilio, like last week)
- dnsmasq (Utkarsh)

and one for ELTS too:
- dnsmasq (Utkarsh)

Utkarsh probably claimed too many packages, so one has been removed (see above):
- adminer
- dnsmasq
- python-aiohttp
- wpa

One DLA which already had been reserved last week has not yet been published:
- DLA 2557-1 (12 Feb 2021) (linux-4.19) 


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- python-pysaml2 (Abhijith PA)
- shiro (Roberto C. Sánchez)

and two for ELTS too:
- ceph (Emilio)
- phpldapadmin (Emilio)

Noone claimed 4 packages or more.

Finally there are two DLAs which have been reserved but not yet been
published:
- DLA 2559-1 (15 Feb 2021) (busybox)
- DLA 2557-1 (12 Feb 2021) (linux-4.19)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today packages were unclaimed for

LTS:
- ansible (Markus Koschany)

ELTS:
- openjpeg2 (Roberto C. Sánchez)

Then, Thorsten Alteholz probably claimed too many packages: 
- golang-github-appc-cni
- libebml
- openvswitch
- subversion
- wpa

And three DLA have been reserved but not yet been published:
- DLA 2557-1 (12 Feb 2021) (linux-4.19)
- DLA 2552-1 (09 Feb 2021) (connman)
- DLA 2551-1 (09 Feb 2021) (slirp)

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today packages were unclaimed for

LTS:
- dnsmasq (Utkarsh)
- slirp (Thorsten)
- xmlbeans (Roberto)

ELTS:
- dnsmasq (Utkarsh)

Noone claimed too many packages.

One DLA has been reserved but not yet been published, but that was today...
- DLA 2549-1 (8 Feb 2021) (gdisk)

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Roberto C . Sánchez]

On Mon, Feb 01, 2021 at 11:32:13AM +, Holger Levsen wrote:
> 
> One DLA has been reserved but not yet been published:
> - DLA 2537-1 (31 Jan 2021) (ffmpeg)
> 
It looks like this was just merged/published.

> Have a great week!
> 
You too!

Regards,

-Roberto

-- 
Roberto C. Sánchez

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:

- ansible (Markus Koschany)
- shiro (Roberto C. Sánchez)

and none ELTS. Also noone claimed too many packages and no DLAs have been
reserved but not yet been published, hooray! Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:

- ceph (Emilio)
- opendmarc (Abhijith PA)

and two for ELTS as well:

- ceph (Emilio)
- phpldapadmin (Emilio)


Noone claimed too many packages and no DLAs have been reserved but not yet
been published, hooray! Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- shiro (Roberto C. Sánchez)

No package was unclaimed for ELTS.

Noone claimed too many packages.

Two DLAs have been reserved but not yet been published:
- DLA 2511-1 (30 Dec 2020) (highlight.js)
- DLA 2512-1 (03 Jan 2021) (libhibernate3-java)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no packages were unclaimed for LTS, no packages were unclaimed for ELTS,
noone claimed too many packages and there is just one DLAs which has been 
reserved
but not yet been published:

- DLA 2505-1 (23 Dec 2020) (spip)


Whooohooo! Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no packages were unclaimed for LTS, no packages were unclaimed for ELTS,
noone claimed too many packages and there are no DLAs which have been reserved
but not yet been published.

Whooohooo! That's a first! Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- slirp (Thorsten Alteholz)
- spice-vdagent (Abhijith PA)
and none for ELTS.

Noone claimed too many packages.

Finally there four two DLAs which have been reserved but not yet been published:
- DLA 2494-1 (14 Dec 2020) (linux)
- DLA 2490-1 (10 Dec 2020) (x11vnc)
- DLA 2489-1 (10 Dec 2020) (minidlna)
- DLA 2483-1 (05 Dec 2020) (linux-4.19)

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:
- snapd (Brian May)

and none for ELTS.

Thorsten Alteholz probably claimed too many, 4, packages: minidlna openjpeg2 
slirp x11vnc

Finally there are two DLAs which have been reserved but not yet been published:
- DLA 2483-1 (05 Dec 2020) (linux-4.19)
- DLA 2482-1 (04 Dec 2020) (debian-security-support)

(plus one missing DLAs from today. And the debian-security-support one is from 
me...)

Have a great week!

(and please publish your reports and give back any remaining ELTS hours from
November if you still have some.)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Nov 23, 2020 at 08:08:55AM +, Holger Levsen wrote:
> There are two DLAs which have been reserved but not yet been published:
> - DLA 2463-1 (22 Nov 2020) (samba)
> - DLA 2379-3 (21 Nov 2020) (mediawiki)

I've just merged those debian-www MRs so these DLAs should be on the website
any minute.


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁   holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀ PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
 ⠈⠳⣄


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today is a nice Monday:
- no packages were unclaimed for LTS.
- no packages were unclaimed for ELTS.

There are two DLAs which have been reserved but not yet been published:
- DLA 2463-1 (22 Nov 2020) (samba)
- DLA 2379-3 (21 Nov 2020) (mediawiki)

Markus probably claimed too many packages: 
- ansible
- libxstream-java
- pacemaker
- webcit
- zsh

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Brian May]

Abhijith PA  writes:

> Also my issue is cleared and jupyter-notebook *accepted* . I hope
> golang-github-ncw-rclone-dev cleared too.

Yes, the two packages of mine that were waiting now got in.
-- 
Brian May 

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Abhijith PA]

Hello Brian,

On 17/11/20 2:14 am, Brian May wrote:
> Abhijith PA  writes:
> 
>> I generated DLA for jupyter-notebook just before upload. But upload was
>> rejected due to `Built-Using refers to non-existing source package`. I have
>> pinged ftp masters couple of times to manually move needed packages to
>> security-master. If any ftp masters here, please help.
> 
> I have a similar issue. I opened up a bug report:
> 
> https://bugs.debian.org/974877
> 
> I suggest you do they same. At least with the bug report there is a
> formal public record of the pending request.

Thanks for the suggestion. I filed bug report(#974954) two days ago.

Also my issue is cleared and jupyter-notebook *accepted* . I hope
golang-github-ncw-rclone-dev cleared too.

--abhijith

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Brian May]

Abhijith PA  writes:

> I generated DLA for jupyter-notebook just before upload. But upload was
> rejected due to `Built-Using refers to non-existing source package`. I have
> pinged ftp masters couple of times to manually move needed packages to
> security-master. If any ftp masters here, please help.

I have a similar issue. I opened up a bug report:

https://bugs.debian.org/974877

I suggest you do they same. At least with the bug report there is a
formal public record of the pending request.
-- 
Brian May 

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Nov 16, 2020 at 12:36:23PM +0100, Emilio Pozuelo Monfort wrote:
> These used to include the DLA number. Maybe those could be back?
 
copy error on my side, sorry.

- DLA 2446-1 (10 Nov 2020) (moin)
- DLA 2432-1 (04 Nov 2020) (jupyter-notebook)


-- 
cheers,
Holger

 ⢀⣴⠾⠻⢶⣦⠀
 ⣾⠁⢠⠒⠀⣿⡁   holger@(debian|reproducible-builds|layer-acht).org
 ⢿⡄⠘⠷⠚⠋⠀ PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
 ⠈⠳⣄

Dance like no one's watching. Encrypt like everyone is.


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Abhijith PA]

Hi,

On 16/11/20 5:06 pm, Emilio Pozuelo Monfort wrote:
> Hi,
...
> fwiw the jupyter-notebook DLA is not in -announce either, so it's not just
> missing in the website.

I generated DLA for jupyter-notebook just before upload. But upload was
rejected due to `Built-Using refers to non-existing source package`. I have
pinged ftp masters couple of times to manually move needed packages to
security-master. If any ftp masters here, please help.

--abhijith

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Emilio Pozuelo Monfort]

Hi,

On 16/11/2020 11:31, Holger Levsen wrote:

There are three DLAs which have been reserved but not yet been published:
- (15 Nov 2020) (libvncserver)
- (10 Nov 2020) (moin)
- (04 Nov 2020) (jupyter-notebook)


These used to include the DLA number. Maybe those could be back?

fwiw the jupyter-notebook DLA is not in -announce either, so it's not just 
missing in the website.


Cheers,
Emilio

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today is a nice Monday:
- no packages were unclaimed for LTS.
- no packages were unclaimed for ELTS.
- noone claimed too many packages.

There are three DLAs which have been reserved but not yet been published:
- (15 Nov 2020) (libvncserver)
- (10 Nov 2020) (moin)
- (04 Nov 2020) (jupyter-notebook)

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- brotli (Roberto C. Sánchez)
- zeromq3 (Adrian Bunk)

and three for ELTS:
- libdatetime-timezone-perl (Adrian Bunk)
- tzdata (Adrian Bunk)
- zeromq3 (Adrian Bunk)

Related, Adrian Bunk probably claimed too many (4) packages: 
- cimg 
- libdatetime-timezone-perl
- wireshark
- zeromq3
(But due to the unclaiming this is down to 3 now.)

Finally, there is one DLA which has been reserved but not yet been published:
- DLA 2432-1 (04 Nov 2020) (jupyter-notebook)

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today, one package was unclaimed for LTS:

- python3.5 (Thorsten Alteholz)

and one for ELTS:

- phpmyadmin (Emilio)

Then, noone claimed 4 packages or more. And also no DLA has been reserved but
not yet published.

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today, again, no packages were unclaimed for LTS and ELTS, whoooray!

Then Adrian Bunk probably claimed too many packages (5):
 libdatetime-timezone-perl qtsvg-opensource-src tzdata wireshark zeromq3

And just one DLA has been reserved but not yet published:
- DLA 2415-1 (25 Oct 2020) (freetype)


Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:
- shiro (Roberto C. Sánchez)
- tinymce (Abhijith PA)

plus I added linux-4.19 to the (short) list of packages to be ignored from 
unclaiming, as Ben is taking care of it.

For ELTS one package was unclaimed:
- samba (Mike Gabriel)

Then, noone claimed 4 packages or more and there were also no DLAs which have
been reserved but not yet been published, yay.

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today is a very special day:

*No* packages were unclaimed for LTS nor ELTS.

*Noone* claimed 4 packages or more.

Finally, there are *no* DLAs which have been reserved but not yet been
published!

That's pretty awesome!

Just unfortunatly I'm having a pretty busy Monday so I'm not sure if I can
sent out the monthly report draft today, or whether that will become tomorrow.
I'm sorry for that.

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:


- cimg (Thorsten Alteholz)
- php-horde-trean (Mike Gabriel)

and none for ELTS.

Also, noone claimed 4 packages or more.

Finally, there are four DLAs which have been reserved but not yet been
published:

- DLA 2394-1 (02 Oct 2020) (squid3)
- DLA 2384-1 (26 Sep 2020) (yaws)
- DLA 2383-1 (26 Sep 2020) (nfdump)
- DLA 2382-1 (26 Sep 2020) (curl)

The last three were already reserved last week.

Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed for LTS:

- ceph (Ola Lundqvist)

and none for ELTS.

Also, noone claimed 4 packages or more.

Finally, there are four DLAs which have been reserved but not yet been
published:

- DLA 2385-1 (26 Sep 2020) (linux-4.19)
- DLA 2384-1 (26 Sep 2020) (yaws)
- DLA 2383-1 (26 Sep 2020) (nfdump)
- DLA 2382-1 (26 Sep 2020) (curl)


Have a great week!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today three packages were unclaimed for LTS:

- ark (Abhijith PA)
- guacamole-client (Mike Gabriel)
- samba (Mike Gabriel)

and two for ELTS:

- clamav (Utkarsh Gupta)
- rails (Mike Gabriel)

Then, noone claimed too many packages, yay!

Also, while there are two DLAs which have been reserved but not yet been
published, this is indeed fine as they have been reserved today:
so yay once more! :)

- DLA 2377-1 (21 Sep 2020) (qt4-x11)
- DLA 2376-1 (21 Sep 2020) (qtbase-opensource-src)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today five packages were unclaimed for LTS:

- freerdp (Mike Gabriel)
- gnome-shell (Mike Gabriel)
- php-horde-trean (Mike Gabriel)
- ruby-json-jwt (Utkarsh Gupta)
- ruby-kaminari (Utkarsh Gupta)
- ruby-rack-cors (Utkarsh Gupta)

and two for ELTS:

- samba (Mike Gabriel)
- squid3 (Markus Koschany)


Then, two people probably claimed too many packages:

- Adrian Bunk with 5 packages: nss osc qt4-x11 qtbase-opensource-src zeromq3
- Mike Gabriel with 5 packages: freerdp gnome-shell guacamole-client 
php-horde-trean samba
(though 3 from Mike I just unclaimed.)

Finally, there were no DLAs which have been reserved but not yet been published
yay!


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today two packages were unclaimed for LTS:

- curl (Thorsten Alteholz)
- squid3 (Markus Koschany)

and one for ELTS:

- curl (Thorsten Alteholz)


Then, one person probably claimed too many packages:

Mike Gabriel: freerdp gnome-shell guacamole-client php-horde-trean samba


There are six DLAs which have been reserved (until yesterday) but not yet been
published on www.debian.org:

- DLA 2366-1 (07 Sep 2020) (imagemagick)
- DLA 2345-1 (26 Aug 2020) (php7)


As usual, being mentioned here is just a sign that you've been working and some
work is unfinished, so nothing bad, nothing to justify, just please continue
your great work on (E)LTS.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Mon, Aug 31, 2020 at 03:41:25PM +0200, Sylvain Beucler wrote:
> I consider each separately and I can write a detailed rationale, but I
> feel out-of-place doing so (I'm not the one designing and justifying the
> procedures), and 10 days with no activity feels a bit long to resume
> this kind of thread.

wow, it's August (=summer & vacation time here) and online DebConf too,
so I would have thought 10 days is not even that late. C'est la vie
moderne, I guess. 


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

"There's no glory in prevention." (Christian Drosten)


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi,

On 31/08/2020 14:44, Holger Levsen wrote:
> On Fri, Aug 21, 2020 at 12:59:54PM +0200, Sylvain Beucler wrote:
>> Still in this particular case, in our process the team coordinator cites
>> contributors by running a heuristic-based script, and forwarding it
>> verbatim to the team (and the whole Internet), so I believe this isn't a
>> case where the contributor would need to learn to cope, but a case where
>> public naming is error-prone and not appropriate. Hence why I replaced
>> the last-committer name with package+date for missing website imports.
>>
>> That being said, I think the current process for reporting stalled and
>> multiples claims is good enough as-is :)
> 
> I don't understand why you think naming people and package names is ok
> for stalled updates and multiple claims but not for stalled announcements.
> could you please explain and make me understand?

I consider each separately and I can write a detailed rationale, but I
feel out-of-place doing so (I'm not the one designing and justifying the
procedures), and 10 days with no activity feels a bit long to resume
this kind of thread.

Cheers!
Sylvain

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

On Fri, Aug 21, 2020 at 12:59:54PM +0200, Sylvain Beucler wrote:
> In this particular case of missing web imports, one real issue is a
> fragile workflow involving duplicate mail/web announcements due to lack
> of automation/integration.

sure, and my remarks are just to help with this sub-optimal workflow.

> Still in this particular case, in our process the team coordinator cites
> contributors by running a heuristic-based script, and forwarding it
> verbatim to the team (and the whole Internet), so I believe this isn't a
> case where the contributor would need to learn to cope, but a case where
> public naming is error-prone and not appropriate. Hence why I replaced
> the last-committer name with package+date for missing website imports.
> 
> That being said, I think the current process for reporting stalled and
> multiples claims is good enough as-is :)

I don't understand why you think naming people and package names is ok
for stalled updates and multiple claims but not for stalled announcements.
could you please explain and make me understand?


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

Dance like no one's watching. Encrypt like everyone is.


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today four packages were unclaimed for LTS:

- asyncpg (Utkarsh Gupta)
- firefox-esr (Emilio)
- guacamole-client (Mike Gabriel)
- jupyter-notebook (Mike Gabriel)

and one for ELTS:

- clamav (Utkarsh Gupta)

Then, it seems the end of the month is near and 3 people probably claimed too
many packages:

Mike Gabriel: fossil freerdp gnome-shell guacamole-client jupyter-notebook 
php-horde-trean
Utkarsh Gupta: asyncpg ruby-json-jwt ruby-kaminari ruby-rack-cors uwsgi
Markus Koschany: imagemagick jetty9 lucene-solr squid3

There are six DLAs which have been reserved (until yesterday) but not yet been
published on www.debian.org:

- DLA 2359-1 (30 Aug 2020) (xorg)
- DLA 2355-1 (29 Aug 2020) (bind9)
- DLA 2354-1 (29 Aug 2020) (ndpi)
- DLA 2353-1 (29 Aug 2020) (bacula)
- DLA 2345-1 (26 Aug 2020) (php7)
- DLA 2333-1 (18 Aug 2020) (imagemagick)

As usual, being mentioned here is just a sign that you've been working and some
work is unfinished, so nothing bad, nothing to justify, just please continue
your great work on (E)LTS.

Last but not least: please give back any unused ELTS hours until the end of the
month, which is in a few hours.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today one package was unclaimed each for
LTS:
- nss (Adrian Bunk)
and ELTS:
- apache2 (Utkarsh Gupta)


Then, it seems the end of the month is near and 4 people probably claimed too
many packages:

Adrian Bunk:   nss openexr qt4-x11 qtbase-opensource-src
Mike Gabriel:  freerdp gnome-shell guacamole-client jupyter-notebook 
libvncserver
Thorsten Alteholz: bind9 curl ndpi yubico-piv-tool
Utkarsh Gupta: asyncpg ruby-json-jwt ruby-kaminari ruby-rack-cors


There are three DLAs which have been reserved but not yet been published on
www.debian.org:

- DLA 2342-1 (24 Aug 2020) (libjackson)
- DLA 2341-1 (24 Aug 2020) (inetutils)
- DLA 2333-1 (18 Aug 2020) (imagemagick)


As usual, being mentioned here is just a sign that you've been working and some
work is unfinished, so nothing bad, nothing to justify, just please continue
your great work on (E)LTS.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi,

On 20/08/2020 19:37, Holger Levsen wrote:
>>> p.s.: as an after thought re: "don't harass me" (though I get it was a
>>> joke, but I think the joke conveyed a useful notion): maybe my semiautomatic
>>> mails should have a permanent disclaimer that being 'called out' by them is
>>> nothing bad and doesn't deserve any explaination, just fixing? I've just 
>>> took 
>>> a note to do so next monday, please help me to word this disclaimer nicely.
>> Whether the e-mail is from a human or from a machine, whether it has a
>> disclaimer or not, it's never pleasing to be called out.
>> We better do it only when there's a valid reason.
>> Which I think is the case for the prior parts of the weekly e-mail.
> well, reserving an DLA and not sending it is also a valid reason.
>
> and I still disagree with being called out here is a bad thing, because it's
> worse to claim a package and not do the work. So being called out^w^wreminded
> of this is still a good thing in my book.
>
> we work in public here and this means our good and bad work is public.
> if one cannot work like this, one should learn to cope or switch.
>
> that said, I'll edit the results to not include missing DLAs on webwml if the
> DLA was requested on day I'll be sending the mail.

As a general guideline, I try to steer away from public shaming, which
is detrimental to team spirit and tends to hide real issues, and steer
towards problem identification and correction.

In this particular case of missing web imports, one real issue is a
fragile workflow involving duplicate mail/web announcements due to lack
of automation/integration.

Still in this particular case, in our process the team coordinator cites
contributors by running a heuristic-based script, and forwarding it
verbatim to the team (and the whole Internet), so I believe this isn't a
case where the contributor would need to learn to cope, but a case where
public naming is error-prone and not appropriate. Hence why I replaced
the last-committer name with package+date for missing website imports.

That being said, I think the current process for reporting stalled and
multiples claims is good enough as-is :)

Cheers!
Sylvain

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

Hi Sylvain,

On Tue, Aug 18, 2020 at 04:31:28PM +0200, Sylvain Beucler wrote:
> I was thinking of 24h, in which case it's perfectly justified to be
> notified.
> Anyway I settled for printing the DLA date.

thanks, I like that the date and package name is printed now. I slightly dislike
not naming the requestor, but won't change it myself for now.

> Spurious notifications waste time, we better fix them.

agreed.

> (I also dislike when debwatch mails me about a new upstream release
> while I'm upstream and I already uploaded a Debian package ;))

well, yes, but there will always be race conditions...

> > p.s.: as an after thought re: "don't harass me" (though I get it was a
> > joke, but I think the joke conveyed a useful notion): maybe my semiautomatic
> > mails should have a permanent disclaimer that being 'called out' by them is
> > nothing bad and doesn't deserve any explaination, just fixing? I've just 
> > took 
> > a note to do so next monday, please help me to word this disclaimer nicely.
> Whether the e-mail is from a human or from a machine, whether it has a
> disclaimer or not, it's never pleasing to be called out.
> We better do it only when there's a valid reason.
> Which I think is the case for the prior parts of the weekly e-mail.

well, reserving an DLA and not sending it is also a valid reason.

and I still disagree with being called out here is a bad thing, because it's
worse to claim a package and not do the work. So being called out^w^wreminded
of this is still a good thing in my book.

we work in public here and this means our good and bad work is public.
if one cannot work like this, one should learn to cope or switch.

that said, I'll edit the results to not include missing DLAs on webwml if the
DLA was requested on day I'll be sending the mail.


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

Our civilization is being sacrificed for the opportunity of a very small number
of people to continue making enormous amounts of money...  It is the sufferings
of the many  which pay  for the luxuries  of the few...  You say  you love your
children  above all else,  and yet  you are stealing  their future  in front of 
their very eyes... (Greta Thunberg)


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi

On 18/08/2020 00:08, Holger Levsen wrote:
> I believe that wouldn't change anything. If the script would only
> complain about DLA reservations X hours old, of course $you would send
> the DLA right after my mail / after X hours + 2 minutes.

I was thinking of 24h, in which case it's perfectly justified to be
notified.
Anyway I settled for printing the DLA date.

Spurious notifications waste time, we better fix them.
(I also dislike when debwatch mails me about a new upstream release
while I'm upstream and I already uploaded a Debian package ;))

> p.s.: as an after thought re: "don't harass me" (though I get it was a
> joke, but I think the joke conveyed a useful notion): maybe my semiautomatic
> mails should have a permanent disclaimer that being 'called out' by them is
> nothing bad and doesn't deserve any explaination, just fixing? I've just took 
> a note to do so next monday, please help me to word this disclaimer nicely.

Whether the e-mail is from a human or from a machine, whether it has a
disclaimer or not, it's never pleasing to be called out.
We better do it only when there's a valid reason.
Which I think is the case for the prior parts of the weekly e-mail.

Cheers!
Sylvain

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi,

According to
https://wiki.debian.org/LTS/Development#Claim_a_DLA_ID_in_DLA.2Flist
one reserves the DLA number right /after/ the upload, with a dated entry
in data/DLA/list, so it's meant to be used quickly.

That being said, I modified the script to not only s/committer/package/,
but also print the DLA date.
(I scrapped a version where I filtered out the current date's DLAs,
because I'm not sure who else uses the script and what they expect).

Cheers!
Sylvain

On 18/08/2020 13:46, Ola Lundqvist wrote:
> Hi
>
> One thing to consider when implementing a delay. You typically reserve
> the DLA some time before making the update so the time you select will
> most likely be wrong.
> Based on this I tend to agree with Holger that any time you select
> will not be suitable. :-)
>
> But sure some delay may be ok.
>
> // Ola
>
> On Tue, 18 Aug 2020 at 00:08, Holger Levsen  > wrote:
>
> hi Sylvain,
>
> On Mon, Aug 17, 2020 at 11:45:03PM +0200, Sylvain Beucler wrote:
> > > - DLA 2332-1 (reserved by Sylvain Beucler)
> > I just uploaded it, I am waiting for the ftp confirmation mail,
> I didn't
> > even send it by e-mail yet - don't harass me!! ;)
> >
> > More seriously, we could add a delay.
>
> I believe that wouldn't change anything. If the script would only
> complain about DLA reservations X hours old, of course $you would send
> the DLA right after my mail / after X hours + 2 minutes.
>
> p.s.: as an after thought re: "don't harass me" (though I get it was a
> joke, but I think the joke conveyed a useful notion): maybe my
> semiautomatic
> mails should have a permanent disclaimer that being 'called out'
> by them is
> nothing bad and doesn't deserve any explaination, just fixing?
> I've just took
> a note to do so next monday, please help me to word this
> disclaimer nicely.
>
> > Also, I remember we added the uploader name to make it easier for
> > everybody to notice what needs to be fixed, but for roughly the same
> > informational value it may be nicer to mention the package name
> instead.
>
> that seriously would be a good improvement! patches welcome! ;-D
>
> > What script is responsible for this?
>
> find-missing-advisories in debian-webwml.git, to be used like this:
>
> cd ~/Projects/security-tracker
> git pull
> cd ~/Projects/debian-www/webwml
> git pull
> ./english/security/find-missing-advisories --mode DLA --tracker
> ../../security-tracker/ 2>&1
>
> (while having these git repos cloned into those paths...)
>

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Ola Lundqvist]

Hi

One thing to consider when implementing a delay. You typically reserve the
DLA some time before making the update so the time you select will most
likely be wrong.
Based on this I tend to agree with Holger that any time you select will not
be suitable. :-)

But sure some delay may be ok.

// Ola

On Tue, 18 Aug 2020 at 00:08, Holger Levsen  wrote:

> hi Sylvain,
>
> On Mon, Aug 17, 2020 at 11:45:03PM +0200, Sylvain Beucler wrote:
> > > - DLA 2332-1 (reserved by Sylvain Beucler)
> > I just uploaded it, I am waiting for the ftp confirmation mail, I didn't
> > even send it by e-mail yet - don't harass me!! ;)
> >
> > More seriously, we could add a delay.
>
> I believe that wouldn't change anything. If the script would only
> complain about DLA reservations X hours old, of course $you would send
> the DLA right after my mail / after X hours + 2 minutes.
>
> p.s.: as an after thought re: "don't harass me" (though I get it was a
> joke, but I think the joke conveyed a useful notion): maybe my
> semiautomatic
> mails should have a permanent disclaimer that being 'called out' by them is
> nothing bad and doesn't deserve any explaination, just fixing? I've just
> took
> a note to do so next monday, please help me to word this disclaimer nicely.
>
> > Also, I remember we added the uploader name to make it easier for
> > everybody to notice what needs to be fixed, but for roughly the same
> > informational value it may be nicer to mention the package name instead.
>
> that seriously would be a good improvement! patches welcome! ;-D
>
> > What script is responsible for this?
>
> find-missing-advisories in debian-webwml.git, to be used like this:
>
> cd ~/Projects/security-tracker
> git pull
> cd ~/Projects/debian-www/webwml
> git pull
> ./english/security/find-missing-advisories --mode DLA --tracker
> ../../security-tracker/ 2>&1
>
> (while having these git repos cloned into those paths...)
>
>
> --
> cheers,
> Holger
>
>
> ---
>holger@(debian|reproducible-builds|layer-acht).org
>PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C
>
> "There's no glory in prevention." (Christian Drosten)
>


-- 
 --- Inguza Technology AB --- MSc in Information Technology 
|  o...@inguza.como...@debian.org|
|  http://inguza.com/Mobile: +46 (0)70-332 1551 |
 ---

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi Sylvain,

On Mon, Aug 17, 2020 at 11:45:03PM +0200, Sylvain Beucler wrote:
> > - DLA 2332-1 (reserved by Sylvain Beucler)
> I just uploaded it, I am waiting for the ftp confirmation mail, I didn't
> even send it by e-mail yet - don't harass me!! ;)
> 
> More seriously, we could add a delay.

I believe that wouldn't change anything. If the script would only
complain about DLA reservations X hours old, of course $you would send
the DLA right after my mail / after X hours + 2 minutes.
 
p.s.: as an after thought re: "don't harass me" (though I get it was a
joke, but I think the joke conveyed a useful notion): maybe my semiautomatic
mails should have a permanent disclaimer that being 'called out' by them is
nothing bad and doesn't deserve any explaination, just fixing? I've just took 
a note to do so next monday, please help me to word this disclaimer nicely.

> Also, I remember we added the uploader name to make it easier for
> everybody to notice what needs to be fixed, but for roughly the same
> informational value it may be nicer to mention the package name instead.

that seriously would be a good improvement! patches welcome! ;-D

> What script is responsible for this?

find-missing-advisories in debian-webwml.git, to be used like this:

cd ~/Projects/security-tracker
git pull
cd ~/Projects/debian-www/webwml 
git pull
./english/security/find-missing-advisories --mode DLA --tracker 
../../security-tracker/ 2>&1

(while having these git repos cloned into those paths...)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C

"There's no glory in prevention." (Christian Drosten)


signature.asc
Description: PGP signature

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Sylvain Beucler]

Hi,

On 17/08/2020 23:31, Holger Levsen wrote:
> There are three DLAs which have been reserved but not yet been published on
> www.debian.org:
> 
> - DLA 2332-1 (reserved by Sylvain Beucler)

I just uploaded it, I am waiting for the ftp confirmation mail, I didn't
even send it by e-mail yet - don't harass me!! ;)

More seriously, we could add a delay.

Also, I remember we added the uploader name to make it easier for
everybody to notice what needs to be fixed, but for roughly the same
informational value it may be nicer to mention the package name instead.

What script is responsible for this?

- Sylvain

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today no package was unclaimed for LTS, while I did unclaim two packages for 
ELTS:

- openjdk-7 (Emilio)
- openjdk-8 (Roberto C. Sánchez)


Then, Mike Gabriel probably claimed too many packages for LTS: 

- freerdp 
- gnome-shell
- guacamole-client
- jupyter-notebook
- libvncserver


There are three DLAs which have been reserved but not yet been published on
www.debian.org:

- DLA 2332-1 (reserved by Sylvain Beucler)
- DLA 2328-1 (reserved by Roberto C. Sánchez)
- DLA 2298-1 (reserved by Thorsten Alteholz, as last week)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today there was one package unclaimed for LTS:
- condor (Roberto C. Sánchez)

and for ELTS:

- clamav (Utkarsh Gupta)
- python2.7 (Thorsten Alteholz)
- squid3 (Markus Koschany)

Noone claimed 4 packages or more.

There are three DLAs which have been reserved but not yet been published on
www.debian.org:

- DLA 2298-1 (reserved by Thorsten Alteholz)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

[Holger Levsen]

hi,

today there was one package unclaimed for LTS:
- imagemagick (Markus Koschany)
and none for ELTS.


Emilio probably claimed too many packages, 4:
- clamav
- firefox-esr
- libx11
- openjdk-8


There are three DLAs which have been reserved but not yet been published on
www.debian.org:
- DLA 2306-1 (reserved by Abhijith PA)
- DLA 2303-1 (reserved by Markus Koschany)
- DLA 2298-1 (reserved by Thorsten Alteholz)


-- 
cheers,
Holger

---
   holger@(debian|reproducible-builds|layer-acht).org
   PGP fingerprint: B8BF 5413 7B09 D35C F026 FE9D 091A B856 069A AA1C


signature.asc
Description: PGP signature