Re: Gnutls and secure renegotiation / CVE-2009-3555 / RFC 5746

2010-12-08 Thread Stefan Fritsch
On Tuesday 07 December 2010, Simon Josefsson wrote: But Suse has released updates for 2.4.1 and 2.8.6 [2]. I have put the extracted source rpms at [3]. The patches are huge but 80% seem to be the test suite. [3] contains two versions of each, the older one is the released package and the

Re: Bug#596899: Please unblock ia32-libs/20101012

2010-12-08 Thread Alexander Reichle-Schmehl
Hi! Am 07.12.2010 18:01, schrieb Goswin von Brederlow: Uploading ia32-libs-core_20101207_source to mentors. Sponsors welcome. That one FTBFS for me with: dh_builddeb -s dh_builddeb: You asked that all arch in(dep) packages be built, but there are none of that type. dpkg-genchanges

Re: Bug#596899: Please unblock ia32-libs/20101012

2010-12-08 Thread Alexander Reichle-Schmehl
Hi! Am 08.12.2010 09:31, schrieb Alexander Reichle-Schmehl: That one FTBFS for me with: Sorry for the noise. I was just pointed at the fact, that this is the expected behaviour when building an ia64 package on amd64 :( Best regards, Alexander -- To UNSUBSCRIBE, email to

Re: Is 603450 realy release critical?

2010-12-08 Thread Bastian Blank
On Wed, Dec 08, 2010 at 08:45:30AM +0100, Alexander Reichle-Schmehl wrote: #603450 is a bug (currently with severity grave, Justification: user security hole), as offlineimap does no ssl certificate checking. Could you explain why it should be acceptable to announce secure operation but ignore

Re: Your last phamm upload in Debian unstable

2010-12-08 Thread Alessandro De Zorzi
Il 05/12/2010 22:01, Mehdi Dogguy ha scritto: Could you please fix this? I see two solutions 1) Upload the fix for the RC-bug to testing-proposed-updates 2) Revert the source format change in unstable and remove /usr/share/phamm/.pc. Thus, making it possible to migrate phamm from Unstable to

Re: Is 603450 realy release critical?

2010-12-08 Thread Alexander Reichle-Schmehl
Hi! Am 08.12.2010 10:37, schrieb Bastian Blank: #564690 is an old example of the same problem. So is #547092 (which has severity important). And I'm sure if we dig deep enough, we can find others as well. There's patch floating arround, which has a major regression: It doesn't work for

Bug#606312: unblock: opendnssec/1.1.3-3

2010-12-08 Thread Ondřej Surý
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package opendnssec Same reasons as for opendnssec/1.1.3-2 (#605601), but this time I have removed rebuilding *.rng files because there is an error in trang package which

Re: Is 603450 realy release critical?

2010-12-08 Thread Carsten Hey
* Bastian Blank [2010-12-08 10:37 +0100]: On Wed, Dec 08, 2010 at 08:45:30AM +0100, Alexander Reichle-Schmehl wrote: #603450 is a bug (currently with severity grave, Justification: user security hole), as offlineimap does no ssl certificate checking. Could you explain why it should be

Re: Bug#511582: Plan of action ?

2010-12-08 Thread Julien Cristau
tag 511582 squeeze-ignore kthxbye On Sun, Dec 5, 2010 at 22:23:04 +0100, Moritz Muehlenhoff wrote: IMO we should ignore this for Squeeze and proceed with removing opie after the Squeeze release. Sounds like a good plan. Cheers, Julien signature.asc Description: Digital signature

Re: Security bugfix #595248: please unblock libnusoap-php

2010-12-08 Thread Olivier Berger
Hi. Le mercredi 08 décembre 2010 à 19:57 +0800, Thomas Goirand (GPLHost) a écrit : On 09/08/2010 12:02 PM, Thomas Goirand wrote: Hi, That leads me to say that I would suggest any DD to *not* sponsor any package from Olivier Berger in the future, as he really had a bad attitude on this

Re: Security bugfix #595248: please unblock libnusoap-php

2010-12-08 Thread Olivier Berger
Oh, and btw, please use a proper 'from' or reply-to address if you post and eventually expect a response... Here's the message I've sent to you earlier, but which bounced on Thomas Goirand (GPLHost) tho...@goirand.nospam.fr :-/ Le mercredi 08 décembre 2010 à 13:50 +0100, Olivier Berger a écrit :

Re: freeze exception -- bugzilla3 3.6.3.0-1

2010-12-08 Thread Raphael Bossek
Dear Christian, Debian uses a different directory structure then upstream since years. The CVE-2010-3764 patch can not be applied as drop in because it's affect the directory structure of Debian. You have to change Debian's patches to achieve this too. Instead of loosing time changing something

Please, is it possible to give back qgis on ppc?

2010-12-08 Thread Francesco P. Lovergine
On the basis of final comments about #603986 a rebuild could fix the problem. -- Francesco P. Lovergine -- To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive:

Re: Please, is it possible to give back qgis on ppc?

2010-12-08 Thread Adam D. Barratt
On Wed, 2010-12-08 at 16:35 +0100, Francesco P. Lovergine wrote: On the basis of final comments about #603986 a rebuild could fix the problem. I was about to suggest that you should have e-mailed powe...@buildd.d.o and/or debian-wb-t...@l.d.o for this, but looking at the bug and the package

Bug#606258: unblock: distcc/3.1-3.2

2010-12-08 Thread Moritz Muehlenhoff
On Tue, Dec 07, 2010 at 10:35:06PM +, Adam D. Barratt wrote: On Tue, 2010-12-07 at 22:25 +0100, Moritz Muehlenhoff wrote: Please unblock package distcc. It fixes another of the yet CVE-less PYTHONPATH issues. Looking at the diff, either the original code is more broken than the

Re: Bug#605748: Intent to NMU or help for an l10n upload of grub2 to fix pending po-debconf l10n bugs

2010-12-08 Thread Helge Kreutzmann
Hello, On Tue, Dec 07, 2010 at 11:17:14PM +0100, Julien Cristau wrote: On Sat, Dec 4, 2010 at 18:23:39 +, Colin Watson wrote: grub2 (1.98+20100804-10) unstable; urgency=low I've just unblocked this one, should go in in a couple of days, barring new RC bugs. So are those

Re: Bug#606327: vmmemctl missing in squeeze

2010-12-08 Thread Martin Zobel-Helas
Hi, On Wed Dec 08, 2010 at 19:21:50 +0100, Daniel Baumann wrote: reassign 606327 open-vm-tools severity 606327 important thanks On 12/08/2010 01:54 PM, Martin Zobel-Helas wrote: This makes the package partly unsuable right, partially, correcting severity. Please provide vmmemctl on

Re: Bug#606311: Acknowledgement (movabletype-opensource: Unspecified XSS and SQL injection vulnerabilities fixed in 4.35)

2010-12-08 Thread Dominic Hargreaves
Ignoring files that have only changed SVN ID, removed files which were already ignored by debian/rules (mt-static/support/dashboard/stats) and changes which only bump the version number, we have the following changes between MTOS 4.34 and 4.35: lib/MT/App/Search.pm| 22

Re: freeze exception -- bugzilla3 3.6.3.0-1

2010-12-08 Thread Christian PERRIER
Quoting Raphael Bossek (boss...@debian.org): Dear Christian, Debian uses a different directory structure then upstream since years. The CVE-2010-3764 patch can not be applied as drop in because it's affect the directory structure of Debian. You have to change Debian's patches to achieve

Bug#606384: unblock: collectd/4.10.1-2.1

2010-12-08 Thread Moritz Muehlenhoff
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package collectd. Judging by the changelog 4.10.1-1+squeeze1 and 4.10.1-2 look alike, but for some reason Steffen NMUd the unstable version. RMs, can 4.10.1-2.1 be

Re: Please unblock schroot 1.4.16-1

2010-12-08 Thread Adam D. Barratt
On Tue, 2010-12-07 at 17:31 +, Roger Leigh wrote: I've made a new upload of schroot to unstable which fixes a few security- and upgrade-related bugs. The bulk of the changes are documentation (manual pages, release notes and changelogs). The code changes are tiny, but are important to

Re: Bug#605748: Intent to NMU or help for an l10n upload of grub2 to fix pending po-debconf l10n bugs

2010-12-08 Thread Colin Watson
On Wed, Dec 08, 2010 at 08:19:02PM +0100, Helge Kreutzmann wrote: On Tue, Dec 07, 2010 at 11:17:14PM +0100, Julien Cristau wrote: On Sat, Dec 4, 2010 at 18:23:39 +, Colin Watson wrote: grub2 (1.98+20100804-10) unstable; urgency=low I've just unblocked this one, should go in in a

Bug#606384: unblock: collectd/4.10.1-2.1

2010-12-08 Thread Adam D. Barratt
On Wed, 2010-12-08 at 21:10 +0100, Moritz Muehlenhoff wrote: Please unblock package collectd. Judging by the changelog 4.10.1-1+squeeze1 and 4.10.1-2 look alike, but for some reason Steffen NMUd the unstable version. RMs, can 4.10.1-2.1 be unblocked or should this be fixed as

Bug#606390: unblock: libio-socket-ssl-perl/1.35-1

2010-12-08 Thread Moritz Muehlenhoff
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package libio-socket-ssl-perl. It fixes CVE-2010-4334. If the diff between 1.33 and 1.35 is to large to unblock, we'll need a tpu upload with the security fix only, adding

Re: Bug#606327: vmmemctl missing in squeeze

2010-12-08 Thread Mehdi Dogguy
severity 606327 grave thanks On 08/12/2010 20:24, Martin Zobel-Helas wrote: Hi, On Wed Dec 08, 2010 at 19:21:50 +0100, Daniel Baumann wrote: reassign 606327 open-vm-tools severity 606327 important thanks On 12/08/2010 01:54 PM, Martin Zobel-Helas wrote: This makes the package partly

Re: Alive

2010-12-08 Thread Moritz Muehlenhoff
On Fri, Nov 12, 2010 at 05:10:11PM +0100, Pietro Battiston wrote: Il giorno ven, 12/11/2010 alle 13.46 +0100, Moritz Muehlenhoff ha scritto: On Mon, Nov 08, 2010 at 11:08:38AM +0100, Pietro Battiston wrote: I didn't forget this, it's just harder than I thought, in particular considering

Re: Alive

2010-12-08 Thread Mehdi Dogguy
On 08/12/2010 21:57, Moritz Muehlenhoff wrote: [ Adding debian-release to CC, please remove libcloud from testing for now ] Removal hint added. Cheers, -- Mehdi Dogguy مهدي الدڤي http://dogguy.org/ -- To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org with a subject of

Bug#606390: unblock: libio-socket-ssl-perl/1.35-1

2010-12-08 Thread Salvatore Bonaccorso
Hi On Wed, Dec 08, 2010 at 09:52:13PM +0100, Moritz Muehlenhoff wrote: Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package libio-socket-ssl-perl. It fixes CVE-2010-4334. If the diff between 1.33 and 1.35 is

Re: Possible upload for libio-socket-ssl-perl to t-p-u?

2010-12-08 Thread Adam D. Barratt
On Mon, 2010-12-06 at 13:38 +0100, Salvatore Bonaccorso wrote: I just uploaded libio-socket-ssl-perl 1.35-1 to unstable fixing Bug #606058 (http://bugs.debian.org/606058) (Severity normal, tagged security). The change done by upstream is, that if the verify_mode is not VERIFY_NONE and the

Bug#606390: unblock: libio-socket-ssl-perl/1.35-1

2010-12-08 Thread Adam D. Barratt
On Wed, 2010-12-08 at 21:52 +0100, Moritz Muehlenhoff wrote: Please unblock package libio-socket-ssl-perl. It fixes CVE-2010-4334. If the diff between 1.33 and 1.35 is to large to unblock, we'll need a tpu upload with the security fix only, adding Salvatore to CC. Salvatore already suggested

Bug#606384: unblock: collectd/4.10.1-2.1

2010-12-08 Thread Moritz Muehlenhoff
On Wed, Dec 08, 2010 at 09:03:17PM +, Adam D. Barratt wrote: On Wed, 2010-12-08 at 21:10 +0100, Moritz Muehlenhoff wrote: Please unblock package collectd. Judging by the changelog 4.10.1-1+squeeze1 and 4.10.1-2 look alike, but for some reason Steffen NMUd the unstable version.

Bug#603982: unblock: unscd/0.47-1 (New Package)

2010-12-08 Thread Don Armstrong
On Thu, 25 Nov 2010, Don Armstrong wrote: On Thu, 25 Nov 2010, Mehdi Dogguy wrote: Moreover, it doesn't seem to fix any RC bug. unscd was made to resolve the problems seen in nscd where nscd is near useless in a system with any amount of load (see #574990 et al.) So, I'd rather keep it

Re: Bug#598463: Alive

2010-12-08 Thread Soren Hansen
Hi. I'm the maintainer. I'll readily admit I've failed miserably to track this issue appropriately. Part of it is due to some rather unfortunate e-mail filtering, but that's certainly not all. (Debian bug mail ended in a folder I didn't subscribe to, but I noticed the issue when it was first

Re: Please, is it possible to give back qgis on ppc?

2010-12-08 Thread Francesco P. Lovergine
On Wed, Dec 08, 2010 at 06:53:44PM +, Adam D. Barratt wrote: On Wed, 2010-12-08 at 16:35 +0100, Francesco P. Lovergine wrote: On the basis of final comments about #603986 a rebuild could fix the problem. I was about to suggest that you should have e-mailed powe...@buildd.d.o and/or

Bug#606399: unblock: grub 0.97-64

2010-12-08 Thread Colin Watson
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock I only just uploaded this, but before I forget, this fixes a critical bug and I think it should go into squeeze. grub (0.97-64) unstable; urgency=low * Exit silently from zz-update-grub

Re: Please unblock schroot 1.4.16-1

2010-12-08 Thread Roger Leigh
On Wed, Dec 08, 2010 at 08:44:48PM +, Adam D. Barratt wrote: On Tue, 2010-12-07 at 17:31 +, Roger Leigh wrote: I've made a new upload of schroot to unstable which fixes a few security- and upgrade-related bugs. The bulk of the changes are documentation (manual pages, release notes

Bug#606399: marked as done (unblock: grub 0.97-64)

2010-12-08 Thread Debian Bug Tracking System
Your message dated Wed, 08 Dec 2010 22:12:29 + with message-id 1291846349.3331.10.ca...@hathi.jungle.funky-badger.org and subject line Re: Bug#606399: unblock: grub 0.97-64 has caused the Debian Bug report #606399, regarding unblock: grub 0.97-64 to be marked as done. This means that you

Re: release team advice: chocolate-doom lock-up / OOD libsdl-mixer

2010-12-08 Thread Jon Dowland
On Tue, Nov 30, 2010 at 10:17:48PM +, Jon Dowland wrote: Chocolate doom (contrib) upstream has alerted me to an RC bug http://bugs.debian.org/605504. The problem is actually in libsdl-mixer1.2 and is fixed upstream. There are three possible ways to resolve this for squeeze (asides from

Re: Bug#606327: vmmemctl missing in squeeze

2010-12-08 Thread Daniel Baumann
On 12/08/2010 10:14 PM, Mehdi Dogguy wrote: Could you please provide a reasonable fix for this bug? the correct fix is to upload open-vm-tools 8.4.2-261024. will you accept this new-old upstream release for squeeze? -- Address:Daniel Baumann, Burgunderstrasse 3, CH-4562 Biberist

Bug#606404: RM: lgrind/3.67-2

2010-12-08 Thread Moritz Muehlenhoff
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: rm Please remove lgrind from Squeeze. It's more or less unmaintained (the maintainer didn't notice the lack of autobuild/testing migration since april and didn't followup on my pointer (which

Bug#606406: unblock: movabletype-opensource/4.3.5+dfsg-1

2010-12-08 Thread Dominic Hargreaves
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package movabletype-opensource This fixes security vulnerabilities, see #606311. unblock movabletype-opensource/4.3.5+dfsg-1 Many thanks, Dominic. -- To UNSUBSCRIBE,

Re: Bug#404760: closed: fixed in inetutils 2:1.8-1

2010-12-08 Thread Simon McVittie
On Mon, 06 Dec 2010 at 05:05:54 +0100, Guillem Jover wrote: I guess the inetd se_v4mapped logical inversion fix and the “ping -w” support, both from upstream 1.8, would be important to have. My backport of making tcp/udp be v4-only already included the inversion fix as part of the conflict

Bug#606406: marked as done (unblock: movabletype-opensource/4.3.5+dfsg-1)

2010-12-08 Thread Debian Bug Tracking System
Your message dated Wed, 08 Dec 2010 23:52:50 + with message-id 1291852370.3331.318.ca...@hathi.jungle.funky-badger.org and subject line Re: Bug#606406: unblock: movabletype-opensource/4.3.5+dfsg-1 has caused the Debian Bug report #606406, regarding unblock: movabletype-opensource/4.3.5+dfsg-1

Re: Bug#404760: closed: fixed in inetutils 2:1.8-1

2010-12-08 Thread Axel Beckert
Hi Simon, Simon McVittie wrote: [ping on kfreebsd] (I also don't have a kFreeBSD machine around to test that aspect of it.) If you want, you can prepare a test-case on io.d.n or asdfasdf.d.n, and me (or KiBi or aurel32) can test the stuff which needs root permissions or setuid. Another option

Bug#606404: marked as done (RM: lgrind/3.67-2)

2010-12-08 Thread Debian Bug Tracking System
Your message dated Wed, 08 Dec 2010 23:56:58 + with message-id 1291852618.3331.332.ca...@hathi.jungle.funky-badger.org and subject line Re: Bug#606404: RM: lgrind/3.67-2 has caused the Debian Bug report #606404, regarding RM: lgrind/3.67-2 to be marked as done. This means that you claim that

Bug#606427: unblock: debian-reference/2.45

2010-12-08 Thread Osamu Aoki
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package debian-reference Basic document corrections and translation updates: debian-reference (2.45) unstable; urgency=low * Fixed typo per Mathieu Parent. Closes:

Bug#606428: unblock: debian-history/2.14

2010-12-08 Thread Osamu Aoki
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: unblock Please unblock package debian-history Document corrections and translation updates. debian-history (2.14) unstable; urgency=low [ David Prévot ] * Updated French translation from

Bug#606258: unblock: distcc/3.1-3.2

2010-12-08 Thread Steve M. Robbins
Hi, On Wed, Dec 08, 2010 at 07:32:01PM +0100, Moritz Muehlenhoff wrote: On Tue, Dec 07, 2010 at 10:35:06PM +, Adam D. Barratt wrote: Looking at the diff, either the original code is more broken than the general case, or it's intentionally adding an empty entry to PYTHONPATH. It seems

Bug#606430: unblock: puppet/2.6.2-3

2010-12-08 Thread Micah Anderson
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: freeze-exception Hello! There have been a number of issues that have come up in the puppet package that really should be included in Squeeze. The puppet packaging team have fixed them, and so I am

Re: Bug#598463: Alive

2010-12-08 Thread dave b
Um, well I could see if they would accept a patch I could make up soon... The problem is / was they closed the bug saying it was a python issue, where they didnt' even attempt to ensure that a https connection would be secured, through wrapping it in ssl, iirc. -- To UNSUBSCRIBE, email to

Bug#606427: unblock: debian-reference/2.45

2010-12-08 Thread Adam D. Barratt
On Thu, 2010-12-09 at 11:04 +0900, Osamu Aoki wrote: Please unblock package debian-reference Basic document corrections and translation updates: debian-reference (2.45) unstable; urgency=low * Fixed typo per Mathieu Parent. Closes: #597816 * Added clearsigned gpg mail example. *

Bug#606384: unblock: collectd/4.10.1-2.1

2010-12-08 Thread Steffen Joeris
Hi, On Wed, Dec 08, 2010 at 09:03:17PM +, Adam D. Barratt wrote: On Wed, 2010-12-08 at 21:10 +0100, Moritz Muehlenhoff wrote: Please unblock package collectd. Judging by the changelog 4.10.1-1+squeeze1 and 4.10.1-2 look alike, but for some reason Steffen NMUd the unstable version.

Bug#603982: unblock unscd

2010-12-08 Thread Nico Schottelius
Good morning, we (Sysadmins at ETH Zurich) would be very happy to see unscd unblocked. nscd is broken for YEARS and nobody cared (*) about it. Don is probably the only person in the Debian area, who took responsibilty and created a VERY GOOD replacement (**). IF you haven't run a large scale

Bug#606430: marked as done (unblock: puppet/2.6.2-3)

2010-12-08 Thread Debian Bug Tracking System
Your message dated Thu, 09 Dec 2010 08:27:47 +0100 with message-id 4d0084f3.6000...@dogguy.org and subject line Re: Bug#606430: unblock: puppet/2.6.2-3 has caused the Debian Bug report #606430, regarding unblock: puppet/2.6.2-3 to be marked as done. This means that you claim that the problem has