Your message dated Sat, 12 Jan 2019 19:34:15 +0000 with message-id <[email protected]> and subject line Bug#916073: fixed in devscripts 2.19.1 has caused the Debian Bug report #916073, regarding devscripts: Reportbug includes sensitive ~/.devscripts to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 916073: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=916073 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: devscripts Version: 2.18.11 Severity: important Justification: potential sensitive information leak Dear Maintainer, by default reportbug(1) includes content of ~/.devscripts when reporting bugs in devscripts. Problem is that it can contain sensitive information (at least SALSA_TOKEN, maybe something more). Since salsa(1) is only in experimental, and such changes would not introduce major breakage, I suggest: * discourage/prohibit storing sensitive information in ~/.devscripts * read SALSA_TOKEN from environment * remove/discourage --token option, since this way token is exposed to anybody, who can invoke ps(1). -- Package-specific info: --- /etc/devscripts.conf --- --- ~/.devscripts --- SALSA_TOKEN=$(pass access/git/salsa.debian.org/kaction | awk 'NR == 2 { print $2 }') -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.18.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to C.UTF-8) Shell: /bin/sh linked to /bin/dash Init: runit (via /run/runit.stopit) LSM: AppArmor: enabled Versions of packages devscripts depends on: ii dpkg-dev 1.19.2 ii fakeroot 1.23-1 ii file 1:5.34-2 ii gnupg 2.2.11-1 ii gnupg2 2.2.11-1 ii gpgv 2.2.11-1 ii libc6 2.28-2 ii libfile-homedir-perl 1.004-1 ii libfile-which-perl 1.22-1 ii libipc-run-perl 20180523.0-1 ii libmoo-perl 2.003004-2 ii libwww-perl 6.36-1 ii patchutils 0.3.4-2 ii perl 5.28.1-3 ii python3 3.7.1-2 ii sensible-utils 0.0.12 ii wdiff 1.2.2-2+b1 Versions of packages devscripts recommends: ii apt 1.8.0~alpha2 pn at <none> ii curl 7.62.0-1 ii dctrl-tools 2.24-3 pn debian-keyring <none> ii dput 1.0.2 ii equivs 2.2.0 ii libdistro-info-perl 0.20 ii libdpkg-perl 1.19.2 ii libencode-locale-perl 1.05-1 ii libgit-wrapper-perl 0.048-1 ii libgitlab-api-v4-perl 0.13-1 ii liblist-compare-perl 0.53-1 ii liblwp-protocol-https-perl 6.07-2 pn libsoap-lite-perl <none> ii libstring-shellquote-perl 1.04-1 ii libtry-tiny-perl 0.30-1 ii liburi-perl 1.74-1 pn licensecheck <none> ii lintian 2.5.116 ii man-db 2.8.4-3 ii patch 2.7.6-3 ii python3-apt 1.7.0 ii python3-debian 0.1.33 ii python3-magic 2:0.4.15-2 ii python3-requests 2.20.0-2 ii python3-unidiff 0.5.4-1 ii python3-xdg 0.25-4 ii strace 4.21-1 ii unzip 6.0-21 ii wget 1.19.5-2 ii xz-utils 5.2.2-1.3 Versions of packages devscripts suggests: pn adequate <none> pn autopkgtest <none> pn bls-standalone <none> ii bsd-mailx [mailx] 8.1.2-0.20180807cvs-1 ii build-essential 12.5 pn check-all-the-things <none> pn cvs-buildpackage <none> pn devscripts-el <none> ii diffoscope 107 pn disorderfs <none> pn dose-extra <none> pn duck <none> ii faketime 0.9.7-3 pn gnuplot <none> pn how-can-i-help <none> pn libauthen-sasl-perl <none> pn libdbd-pg-perl <none> ii libfile-desktopentry-perl 0.22-1 pn libnet-smtps-perl <none> pn libterm-size-perl <none> pn libtimedate-perl <none> pn libyaml-syck-perl <none> ii mozilla-devscripts 0.53 ii mutt 1.10.1-2 ii openssh-client [ssh-client] 1:7.9p1-4 pn piuparts <none> pn postgresql-client <none> ii quilt 0.65-3 pn ratt <none> pn reprotest <none> pn svn-buildpackage <none> ii w3m 0.5.3-36+b1 -- no debconf information
--- End Message ---
--- Begin Message ---Source: devscripts Source-Version: 2.19.1 We believe that the bug you reported is fixed in the latest version of devscripts, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Mattia Rizzolo <[email protected]> (supplier of updated devscripts package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 12 Jan 2019 20:18:58 +0100 Source: devscripts Binary: devscripts Architecture: source Version: 2.19.1 Distribution: unstable Urgency: medium Maintainer: Devscripts Maintainers <[email protected]> Changed-By: Mattia Rizzolo <[email protected]> Description: devscripts - scripts to make the life of a Debian Package maintainer easier Closes: 915393 915978 916073 918994 Changes: devscripts (2.19.1) unstable; urgency=medium . [ Mattia Rizzolo ] * Upload to unstable. * d/control: + Add debhelper to Suggests. Thanks Simon Quigley for the suggestion. + Restrict the Build-Depends on git to >= 1:2.7.0 (to use `git log --date=format-local:`), that is not available on kbsd yet. + Bump debhelper compat level to 12, using the new debhelper-compat format. + Bump Standards-Version to 4.3.0, no changes needed. * d/lintian-overrides: + Add some lintian overrides for uses-dpkg-database-directly. MR: !95 + Add a lintian override for binary-package-depends-on-toolchain-package. * Move manual calls to dpkg-maintscript-helper to d/maintscripts. * Remove the whole postinst script, dealing with updates to the configuration file from very ancient versions. Thank you lintian for opening my eyes. * debchange: + Add patch from Stuart Prescott to fix the autodetection of NMU in case the person running dch is listed in the first line under a wrapped Uploaders field. Closes: #915393 * tests/test_debrepro: + Skip testing filesystem-ordering, as that may fail if disorderfs is installed but the fuse kernel module is not loaded. . [ Xavier Guimard ] * salsa: + Fix typo in salsa fork command. Closes: #915978 + Fix typo in pod documentation. + Hide salsa token in bug report. Closes: #916073; MR: !91 + Fix mr bug when colors are activated. MR: !92 + Fix bad warning on unexistent project and downgrade messages to debug level. + Add libgitlab-api-v4-perl and libtest-output-perl in build dependencies and d/tests/control to enable the salsa unit tests. MR: !94 + Add a --ci-config-path option. MR: !96 + push_repo: allow pushing even if the project already exists. MR: !97 + Skip project in update_repo if hooks are not available. * uscan: + Fix warning when grouped package is up to date. + Fix dehs output when using --report with pgpmode next/previous. Closes: #918994; MR: !99 + Fix dehs output for grouped packages. MR: !99 * French translation update. . [ Benjamin Drung ] * wrap-and-sort: + Also sort debian/tests/control. Checksums-Sha1: 4499e13076fc282e22bb9e705fa2d2aa98f2e0b0 3080 devscripts_2.19.1.dsc c80b0709101d02355dc54ab6fb38304b740af38c 797208 devscripts_2.19.1.tar.xz 14c3bbf323a62bd736f8fdbd2a3123942a1e7fd2 12001 devscripts_2.19.1_amd64.buildinfo Checksums-Sha256: 75b1b8656fa4ea9a1682ebb45d5cecd0c1b7a2f192e145c4862a111c46c7da54 3080 devscripts_2.19.1.dsc ee82449e7ce43b58220a8e6ea39743ef212c621f1dd382f8d5c1d3747dca5d11 797208 devscripts_2.19.1.tar.xz 688280644896c70cd592cd129251c4fd87781ce3865a3c212db8d2aa966b0251 12001 devscripts_2.19.1_amd64.buildinfo Files: 439215d621425beee588bee51b199f10 3080 devel optional devscripts_2.19.1.dsc 2145b2a2c3f716e4bb5df95618ca080d 797208 devel optional devscripts_2.19.1.tar.xz eec4020e751e8a568d28a3d4a7513fe5 12001 devel optional devscripts_2.19.1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAlw6PrYACgkQCBa54Yx2 K60GXg//eS4Fl7YRWuMcYmSNAsV8g3ndvI8uJUpBWu9fk2F7vmbZ/A4wga2CtOBE PIJJ2uP4JV5HREHm5xPrvKXYXX7JNhjykjW9wbb2QUwIWBtk6FB6r100I6txv5mQ yLh/kURg5ba5Nx28vfi7yXNVv9oZlTZnLSsuIbO/0JytHPJMgJppo8mdhjO+TbDR 13GiK8sR2TnLovIQeyOIGD/IMsvhodDDSGUGVtofLlMBrVFJqgrC/CDyPaamTWAH CKJh9z3gJbGZImbAtayL0xchBtzcng+xd5Ek4Vx0vIxcsZWEhcmCmgtK99TtFLtz 1HaDrqF6v7UxeCAMm5EyignUwJRoFoTidiEIbzX3HmykDl7M2TfD+jSgXz/4O2NU 0V3BxdgcxRDrv6f5dFMvtsbP0EPZOGlo2lKSy58pA4aWavVRYUMn+aKh0X2amEff x7jqmqEeGVUYhbZ9b72ZRkUg7jdNwWQyrz6UhxI2NzciPKGd1XD03oVOp9mFfScR awKStj8gXXPgRtyYVUIvyZ6I2cM7HA9wIaOXNRTfeY/WF2YCKpM+NfU2l2fdcYCZ J15x0FhQC/H/vTHgivdiPL+lg9lzzKPMJJb52FrRhDCEVWdwV5XlOHYHYTFPi+Q9 BGan5Xdl6u+v080pMgBeBAaqXlw2YMZIYwnEgZNj2A4Btg497LM= =37+s -----END PGP SIGNATURE-----
--- End Message ---
