Hi all,
cyrus-imapd 3.12.3-2 is flagged for autoremoval from testing on
2026-09-21, for two independent reasons:
- #1143973, a cyrus-imapd RC bug (autopkgtest fails with gcc-defaults
from unstable), and
- #1143939, a clamav CVE bug, which cyrus-imapd build-depends on via
libclamav-dev.
I have prepared 3.12.3-3, which fixes the first of these (it was already in
Salsa as MR25). I cannot upload, so I am looking for someone to review and
upload it.
MR: https://salsa.debian.org/debian/cyrus-imapd/-/merge_requests/25
Package: https://mentors.debian.net/package/cyrus-imapd/
A debdiff vs. 3.12.3-2 is attached.
I have reproduced and verified the fix locally with autopkgtest in an
unstable chroot (g++ 4:16.1.0-3, gcc-16 16.2.0-1),
using -B/--no-built-binaries so that the binaries come from the archive,
as it is done on ci.debian.net (it took me a while to figure this one out!).
Beyond fixing the RC bug, this removes the last place where an upstream's
pre-generated `configure` is executed, instead of regenerating it. I think
this is important with reference to the xz-utils backdoor from a while ago.
The upload also includes a Lintian fix that was merged into master on Salsa
("Fix lintian: mismatched-override"). There are a few more Lintian fix
MR's on
Salsa that have not (yet) been merged.
Full changelog:
cyrus-imapd (3.12.3-3) unstable; urgency=medium
* d/tests/unit-test: run dh_autoreconf so the autopkgtest configures
with the same autoconf as the build, fixing the C++ standard
mismatch under gcc-16 (Closes: #1143973)
* Fix lintian: mismatched-override
I hope this helps, and will see if I can assist the clamav team so that
cyrus-imapd will not be removed.
Kind regards,
Edmund
--
Edmund Lodewijks <[email protected]>
TZ: UTC+2 / GMT+2
diff -Nru cyrus-imapd-3.12.3/debian/changelog
cyrus-imapd-3.12.3/debian/changelog
--- cyrus-imapd-3.12.3/debian/changelog 2026-08-01 00:32:20.000000000 +0200
+++ cyrus-imapd-3.12.3/debian/changelog 2026-08-17 11:43:09.000000000 +0200
@@ -1,3 +1,12 @@
+cyrus-imapd (3.12.3-3) unstable; urgency=medium
+
+ * d/tests/unit-test: run dh_autoreconf so the autopkgtest configures
+ with the same autoconf as the build, fixing the C++ standard
+ mismatch under gcc-16 (Closes: #1143973)
+ * Fix lintian: mismatched-override
+
+ -- Edmund Lodewijks <[email protected]> Mon, 17 Aug 2026 11:43:09 +0200
+
cyrus-imapd (3.12.3-2) unstable; urgency=medium
* Team upload
diff -Nru cyrus-imapd-3.12.3/debian/source/lintian-overrides
cyrus-imapd-3.12.3/debian/source/lintian-overrides
--- cyrus-imapd-3.12.3/debian/source/lintian-overrides 2026-08-01
00:32:20.000000000 +0200
+++ cyrus-imapd-3.12.3/debian/source/lintian-overrides 2026-08-17
10:52:28.000000000 +0200
@@ -1,6 +1,5 @@
# Uninstalled files
source-is-missing [*doc/html/*]
-source-is-missing [*docsrc/*]
very-long-line-length-in-source-file *doc/**
very-long-line-length-in-source-file *docsrc/**
very-long-line-length-in-source-file *cassandane/.travis.yml*
diff -Nru cyrus-imapd-3.12.3/debian/tests/unit-test
cyrus-imapd-3.12.3/debian/tests/unit-test
--- cyrus-imapd-3.12.3/debian/tests/unit-test 2026-08-01 00:32:20.000000000
+0200
+++ cyrus-imapd-3.12.3/debian/tests/unit-test 2026-08-17 11:42:58.000000000
+0200
@@ -1,4 +1,7 @@
#!/bin/sh
+set -e
+dh_update_autotools_config
+dh_autoreconf
debian/rules override_dh_auto_configure
dh_auto_test
