date:20161030

Processing control commands:

> severity -1 important
Bug #840170 [npm2deb] some modules has package.yaml instead of package.json
Severity set to 'important' from 'grave'

-- 
840170: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840170
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#828076: marked as done (ruby-saml: CVE-2016-5697)

Your message dated Mon, 31 Oct 2016 10:04:03 +0530
with message-id <28f198b5-8b70-2959-fc66-4f3ac0700...@debian.org>
and subject line it was fixed some time back
has caused the Debian Bug report #828076,
regarding ruby-saml: CVE-2016-5697
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828076: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828076
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: ruby-saml
Version: 1.1.2-1
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for ruby-saml.

CVE-2016-5697[0]:
signature wrapping attack vulnerability

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-5697

Regards,
Salvatore
--- End Message ---
--- Begin Message ---



signature.asc
Description: OpenPGP digital signature
--- End Message ---

Processed: Re: Bug#842586: git: FTBFS on mips64el (fatal: Out of memory, getdelim failed)

Processing control commands:

> tags -1 + help
Bug #842586 [src:git] git: FTBFS on mips64el (fatal: Out of memory, getdelim 
failed)
Added tag(s) help.

-- 
842586: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842586
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842586: git: FTBFS on mips64el (fatal: Out of memory, getdelim failed)

2016-10-30 Thread Anders Kaseorg

Control: tags -1 + help

On Sun, 30 Oct 2016, Bas Couwenberg wrote:
> The recent git upload FTBFS on mips64el due to OOM, the missing build on
> mips64el is preventing the qgis rebuild as part of the ongoing gdal
> transition (#842288).
> 
> The build was performed on mipsel-manda-02 which is known to have issues
> like these (although git built successfully on this buildd before).
> Perhaps a rebuild on another buildd will be sufficient.

Eep.

Looking at 
https://buildd.debian.org/status/logs.php?pkg=git=mips64el, the build 
has been attempted three times now, including once on mipsel-aql-02, 
failing all three times with out of memory errors.  None of the failing 
tests (t0023-crlf-am.sh, t0064-sha1-array.sh, t0302-credential-store.sh) 
have changed between 2.10.1 and 2.10.2, and 2.10.1 built with no trouble.  
These tests should be using basically no memory (about 4 MB each).

Maybe another test running in parallel is using memory and causing these 
tests to fail?  Could these build machines be so underpowered that they 
shouldn’t be setting DEB_BUILD_OPTIONS=parallel=4?

Unless someone familiar with the mips64el buildd situation has a better 
plan, I’m unsure how to proceed except by disabling individual failing 
tests, or the entire test suite, for mips64el.

Any ideas?

Anders

Bug#828611: [Xymon] [PATCH] Re: Fwd: Bug#828611: xymon: Fails to build from source with OpenSSL 1.1.0

2016-10-30 Thread J.C. Cleaver

On Sun, October 30, 2016 6:07 am, Axel Beckert wrote:
> Hi,
>
> Axel Beckert wrote:
>> this has been reported in Debian at https://bugs.debian.org/828611
> [...]
>> OpenSSL 1.1.0 is about to released.  During a rebuild of all packages
>> using
>> OpenSSL this package fail to build.  A log of that build can be found
>> at:
>> https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/xymon_4.3.27-1_amd64-20160529-1558
>>
>> On https://wiki.openssl.org/index.php/1.1_API_Changes you can see
>> various of the
>> reasons why it might fail.  There are also updated man pages at
>> https://www.openssl.org/docs/manmaster/ that should contain useful
>> information.
>
> While it took quite a while to figure it out, the patch to make it
> compile again against OpenSSL 1.1.0 is surprisingly tiny:
>
> --- a/xymonnet/contest.c
> +++ b/xymonnet/contest.c
> @@ -648,7 +648,7 @@
>
>   certcn = X509_NAME_oneline(X509_get_subject_name(peercert), NULL, 0);
>   certissuer = X509_NAME_oneline(X509_get_issuer_name(peercert), NULL, 0);
> - certsigalg = OBJ_nid2ln(OBJ_obj2nid(peercert->sig_alg->algorithm));
> + certsigalg = OBJ_nid2ln(X509_get_signature_nid(peercert));
>   certstart = strdup(xymon_ASN1_UTCTIME(X509_get_notBefore(peercert)));
>   certend = strdup(xymon_ASN1_UTCTIME(X509_get_notAfter(peercert)));
>   {
>
> See also
> https://anonscm.debian.org/cgit/collab-maint/xymon.git/tree/debian/patches/81_fix_compilation_with_OpenSSL_1.1+.patch
> https://anonscm.debian.org/cgit/collab-maint/xymon.git/plain/debian/patches/81_fix_compilation_with_OpenSSL_1.1+.patch
>
> I've got one (currently non-productive) Xymon server on a Raspberry Pi
> running(*) Debian Unstable with that patch and xymonnet properly
> reported SSL certificate and https:// URL states so far. So I believe,
> that patch is sufficient and working, despite I have not much of an
> idea what it actually does. I took the idea for the patch from here:
> https://github.com/bukka/php-src/commit/0598a8da2bc005b3a0be2801033b5347020f8316#diff-69bad938d17f4283faa5f7fea17fa627L2174
>
> I would be happy if you could integrate the patch into the (probably
> upcoming) 4.3.28 release to allow others to compile Xymon against
> OpenSSL 1.1.0+. (And to spread it further to get more testing. :-)
>
> (*) It's currently running with OpenSSL 1.0.2j though, but that proves
> that it's at least also backward compatible to 1.0.2. As soon as
> Debian Unstable switches to OpenSSL 1.1.0b or later, I'll continue
> to test it with that version.
>
>   Regards, Axel


Thanks! It seems I missed that back in July.

This looks good. I wrapped it in a version check to hopefully DTRT when
it's not present. This does lead to doing the new call between 1.0.2 and
<1.1.0, but AFAICT the call itself is nothing more than that anyway... I
think.

Committed at https://sourceforge.net/p/xymon/code/7975/


Regards,
-jc

Bug#839474: marked as done (golang-github-gorilla-handlers: FTBFS: Tests failures)

Your message dated Mon, 31 Oct 2016 01:18:35 +
with message-id 
and subject line Bug#839474: fixed in golang-github-gorilla-handlers 1.1-2
has caused the Debian Bug report #839474,
regarding golang-github-gorilla-handlers: FTBFS: Tests failures
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
839474: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839474
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: golang-github-gorilla-handlers
Version: 1.1-1
Severity: serious
Tags: stretch sid
User: debian...@lists.debian.org
Usertags: qa-ftbfs-20161001 qa-ftbfs
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part (hopefully):
> panic(0x68d920, 0xc4205a00a0)
>   /usr/lib/go-1.7/src/runtime/panic.go:500 +0x1a1
> testing.tRunner.func1(0xc42001cfc0)
>   /usr/lib/go-1.7/src/testing/testing.go:579 +0x25d
> panic(0x68d920, 0xc4205a00a0)
>   /usr/lib/go-1.7/src/runtime/panic.go:458 +0x243
> github.com/gorilla/handlers.TestWriteLog(0xc42001cfc0)
>   
> /<>/obj-x86_64-linux-gnu/src/github.com/gorilla/handlers/handlers_test.go:79
>  +0xe79
> testing.tRunner(0xc42001cfc0, 0x709310)
>   /usr/lib/go-1.7/src/testing/testing.go:610 +0x81
> created by testing.(*T).Run
>   /usr/lib/go-1.7/src/testing/testing.go:646 +0x2ec
> exit status 2
> FAIL  github.com/gorilla/handlers 0.011s
> dh_auto_test: go test -v -p 1 -short github.com/gorilla/handlers returned 
> exit code 1
> debian/rules:4: recipe for target 'override_dh_auto_test' failed

If the failure looks somehow time/timezone related:
Note that this rebuild was performed without the 'tzdata' package
installed in the chroot. tzdata used be (transitively) part of
build-essential, but it no longer is. If this package requires it to
build, it should be added to build-depends. For the release team's
opinion on this, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836940#185

If the failure looks LSB-related:
similarly to tzdata, lsb-base is not installed in the build chroot.

The full build log is available from:
   
http://aws-logs.debian.net/2016/10/01/golang-github-gorilla-handlers_1.1-1_unstable.log

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on EC2 VM instances from
Amazon Web Services, using a clean, minimal and up-to-date chroot. Every
failed build was retried once to eliminate random failures.
--- End Message ---
--- Begin Message ---
Source: golang-github-gorilla-handlers
Source-Version: 1.1-2

We believe that the bug you reported is fixed in the latest version of
golang-github-gorilla-handlers, which is due to be installed in the Debian FTP 
archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 839...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tim Potter  (supplier of updated golang-github-gorilla-handlers 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Mon, 31 Oct 2016 11:38:29 +1100
Source: golang-github-gorilla-handlers
Binary: golang-github-gorilla-handlers-dev
Architecture: source all
Version: 1.1-2
Distribution: unstable
Urgency: medium
Maintainer: pkg-go 
Changed-By: Tim Potter 
Description:
 golang-github-gorilla-handlers-dev - collection of useful handlers for Go's 
net/http package
Closes: 839474
Changes:
 golang-github-gorilla-handlers (1.1-2) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Paul Tagliamonte ]
   * Use a secure transport for the Vcs-Git and Vcs-Browser URL
 .
   [ Tim Potter ]
   * Add tzdata to build dependencies to fix FTBFS on stretch (Closes: #839474).
Checksums-Sha1:
 18217a3379805095c4d059edfbb839490058a7c4 2235 
golang-github-gorilla-handlers_1.1-2.dsc
 2383f5ed3915234019e605ffe0a9a0af6ae28ad8 16916 
golang-github-gorilla-handlers_1.1.orig.tar.gz
 b8ea465ef7b83f497872bb9711aedf999138873f 3076 
golang-github-gorilla-handlers_1.1-2.debian.tar.xz
 e4df76e6b13dc79ef8420fed6d23cce25dc2facf 17014

Bug#839307: marked as done (golang-github-google-gofuzz: FTBFS: dh_auto_test: go test -v -p 1 github.com/google/gofuzz returned exit code 1)

Your message dated Mon, 31 Oct 2016 01:18:29 +
with message-id 
and subject line Bug#839307: fixed in golang-github-google-gofuzz 
0.0~git20150903.0.e4af62d-2
has caused the Debian Bug report #839307,
regarding golang-github-google-gofuzz: FTBFS: dh_auto_test: go test -v -p 1 
github.com/google/gofuzz returned exit code 1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
839307: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839307
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: golang-github-google-gofuzz
Version: 0.0~git20150903.0.e4af62d-1
Severity: serious
Tags: stretch sid
User: debian...@lists.debian.org
Usertags: qa-ftbfs-20160930 qa-ftbfs
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part (hopefully):
>  debian/rules build
> dh build --buildsystem=golang --with=golang
>dh_testdir -O--buildsystem=golang
>dh_update_autotools_config -O--buildsystem=golang
>dh_auto_configure -O--buildsystem=golang
>dh_auto_build -O--buildsystem=golang
>   go install -v -p 1 github.com/google/gofuzz
> github.com/google/gofuzz
>dh_auto_test -O--buildsystem=golang
>   go test -v -p 1 github.com/google/gofuzz
> === RUN   TestFuzz_basic
> --- PASS: TestFuzz_basic (0.00s)
> === RUN   TestFuzz_structptr
> --- FAIL: TestFuzz_structptr (0.00s)
>   fuzz_test.go:96: a not nil seems to not be getting set, was zero value 
> 9 times
>   fuzz_test.go:96: as seems to not be getting set, was zero value 9 times
> === RUN   TestFuzz_structmap
> --- PASS: TestFuzz_structmap (0.00s)
> === RUN   TestFuzz_structslice
> --- PASS: TestFuzz_structslice (0.00s)
> === RUN   TestFuzz_custom
> --- PASS: TestFuzz_custom (0.00s)
> === RUN   TestFuzz_interface
> --- PASS: TestFuzz_interface (0.00s)
> === RUN   TestFuzz_interfaceAndFunc
> --- PASS: TestFuzz_interfaceAndFunc (0.00s)
> === RUN   TestFuzz_noCustom
> --- PASS: TestFuzz_noCustom (0.00s)
> === RUN   ExampleSimple
> --- PASS: ExampleSimple (0.01s)
> === RUN   ExampleCustom
> --- PASS: ExampleCustom (0.00s)
> === RUN   ExampleComplex
> --- PASS: ExampleComplex (0.00s)
> === RUN   ExampleMap
> --- PASS: ExampleMap (0.00s)
> === RUN   ExampleSingle
> --- PASS: ExampleSingle (0.00s)
> === RUN   ExampleEnum
> --- PASS: ExampleEnum (0.00s)
> FAIL
> exit status 1
> FAIL  github.com/google/gofuzz0.009s
> dh_auto_test: go test -v -p 1 github.com/google/gofuzz returned exit code 1

If the failure looks somehow time/timezone related:
Note that this rebuild was performed without the 'tzdata' package
installed in the chroot. tzdata used be (transitively) part of
build-essential, but it no longer is. If this package requires it to
build, it should be added to build-depends. For the release team's
opinion on this, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836940#185

The full build log is available from:
   
http://aws-logs.debian.net/2016/09/30/golang-github-google-gofuzz_0.0~git20150903.0.e4af62d-1_unstable.log

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on EC2 VM instances from
Amazon Web Services, using a clean, minimal and up-to-date chroot. Every
failed build was retried once to eliminate random failures.
--- End Message ---
--- Begin Message ---
Source: golang-github-google-gofuzz
Source-Version: 0.0~git20150903.0.e4af62d-2

We believe that the bug you reported is fixed in the latest version of
golang-github-google-gofuzz, which is due to be installed in the Debian FTP 
archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 839...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Tim Potter  (supplier of updated golang-github-google-gofuzz 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Mon, 31 Oct 2016 11:57:43 +1100
Source: golang-github-google-gofuzz
Binary: golang-github-google-gofuzz-dev
Architecture: source all
Version: 0.0~git20150903.0.e4af62d-2
Distribution: unstable
Urgency: medium

Bug#841567: marked as done (ruby-moneta: FTBFS: ERROR: Test "ruby2.3" failed.)

Your message dated Mon, 31 Oct 2016 00:35:30 +
with message-id 
and subject line Bug#841567: fixed in ruby-moneta 0.7.20-3
has caused the Debian Bug report #841567,
regarding ruby-moneta: FTBFS: ERROR: Test "ruby2.3" failed.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
841567: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841567
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: ruby-moneta
Version: 0.7.20-2.2
Severity: serious
Tags: stretch sid
User: debian...@lists.debian.org
Usertags: qa-ftbfs-20161021 qa-ftbfs
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.

Relevant part (hopefully):
> /usr/bin/ruby2.3 /usr/bin/gem2deb-test-runner
> 
> ┌──┐
> │ Run tests for ruby2.3 from debian/ruby-tests.rb 
>  │
> └──┘
> 
> RUBYLIB=/<>/debian/ruby-moneta/usr/lib/ruby/vendor_ruby:. 
> GEM_PATH=debian/ruby-moneta/usr/share/rubygems-integration/all:/var/lib/gems/2.3.0:/usr/lib/x86_64-linux-gnu/rubygems-integration/2.3.0:/usr/share/rubygems-integration/2.3.0:/usr/share/rubygems-integration/all
>  ruby2.3 debian/ruby-tests.rb
> mysql_install_db: [ERROR] unknown option '--rpm'
> 2016-10-21 01:22:53 [ERROR]   Unrecognized options
> Unable to start the test MySQL server.
> ERROR: Test "ruby2.3" failed.

If the failure looks somehow time/timezone related:
Note that this rebuild was performed without the 'tzdata' package
installed in the chroot. tzdata used be (transitively) part of
build-essential, but it no longer is. If this package requires it to
build, it should be added to build-depends. For the release team's
opinion on this, see
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=836940#185

If the failure looks LSB-related:
similarly to tzdata, lsb-base is not installed in the build chroot.

The full build log is available from:
   http://aws-logs.debian.net/2016/10/21/ruby-moneta_0.7.20-2.2_unstable.log

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on EC2 VM instances from
Amazon Web Services, using a clean, minimal and up-to-date chroot. Every
failed build was retried once to eliminate random failures.
--- End Message ---
--- Begin Message ---
Source: ruby-moneta
Source-Version: 0.7.20-3

We believe that the bug you reported is fixed in the latest version of
ruby-moneta, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 841...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
HIGUCHI Daisuke (VDR dai)  (supplier of updated ruby-moneta 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Mon, 31 Oct 2016 01:34:58 +0900
Source: ruby-moneta
Binary: ruby-moneta
Architecture: source all
Version: 0.7.20-3
Distribution: unstable
Urgency: medium
Maintainer: Joshua Timberman 
Changed-By: HIGUCHI Daisuke (VDR dai) 
Description:
 ruby-moneta - Ruby interface to multiple key/value stores
Closes: 841567
Changes:
 ruby-moneta (0.7.20-3) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Christian Hofstaedtler ]
   * Wrap-and-sort everything
   * Bump Standards-Version, fix URLs
 .
   [ Cédric Boutillier ]
   * Bump debhelper compatibility level to 9
   * Remove version in the gem2deb build-dependency
   * Use https:// in Vcs-* fields
   * Bump Standards-Version to 3.9.7 (no changes needed)
 .
   [ HIGUCHI Daisuke (VDR dai) ]
   * use mysqld --initialize-insecure (Closes: #841567)
   * Transition to RSpec 3
   * B-D-I on mysql-server-5.7 instead of mysql-server
   * Use https:// in Homepage field
   * add override_dh_auto_clean to clean test data
   * Bump Standards-Version to 3.9.8 (no changes needed)
Checksums-Sha1:
 474ce171eebdbb5d63ecf188307a1b68d9ab4cae 2286 ruby-moneta_0.7.20-3.dsc

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Anders Kaseorg

On Sun, 30 Oct 2016, Ævar Arnfjörð Bjarmason wrote:
> This did break in v2.10.0, and it's taken a couple of months to notice
> this, so clearly it's not very widely used, which says something about
> the cost-benefit of maintaining this for external users.

For the record, in case this affects the calculation, it was noticed that 
guilt was broken a just couple of days after the first git 2.10.x upload 
to Debian, which was last weekend.

https://bugs.debian.org/842477
http://repo.or.cz/guilt.git/blob/v0.36:/guilt#l28

(I have no further opinion; I trust that Junio has all the information 
needed to decide one way or the other.)

Anders

Bug#831938: marked as done (pyrex: FTBFS with dpkg-buildpackage -A: dpkg-genchanges: error: binary build with no binary artifacts found; cannot distribute)

Your message dated Mon, 31 Oct 2016 00:20:40 +
with message-id 
and subject line Bug#831938: fixed in pyrex 0.9.9-1
has caused the Debian Bug report #831938,
regarding pyrex: FTBFS with dpkg-buildpackage -A: dpkg-genchanges: error: 
binary build with no binary artifacts found; cannot distribute
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
831938: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831938
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: pyrex
Version: 0.9.8.5-2.1
Severity: important
Tags: stretch sid
User: debian...@lists.debian.org
Usertags: qa-ftbfs-20160720 qa-ftbfs qa-indep
Justification: FTBFS on amd64

Hi,

During a rebuild of all packages in sid, your package failed to build on
amd64.  This rebuild was done by building only the architecture-independent
packages.  At the same time, a normal build succeeded, which points the
problem specifically to build-indep/binary-indep targets.


The specific error below usually happens there is a binary-indep target in
debian/rules which is either empty or does not do anything useful.

If all the arch-independent packages are dummy transitional packages released
with jessie, the easy fix is to drop them now. If not, debian/rules should be
modified so that the binary-indep target generates the architecture independent
packages (and only those).

After checking that both "dpkg-buildpackage -A" and "dpkg-buildpackage -B" work
properly, this package will be suitable to be uploaded in source-only form if
you wish.

I file this bug as severity: important, but Santiago Vila, who led this
effort (kudos to him), got approval from the release team to consider those
bugs RC for stretch. The severity will be increased to 'serious' shortly.
See #830997 for details.

Relevant part (hopefully):
>  fakeroot debian/rules binary-indep
> pyversions: missing X(S)-Python-Version in control file, fall back to 
> debian/pyversions
> pyversions: missing debian/pyversions file, fall back to supported versions
> make: Nothing to be done for 'binary-indep'.
>  dpkg-genchanges --build=all >../pyrex_0.9.8.5-2.1_all.changes
> dpkg-genchanges: error: binary build with no binary artifacts found; cannot 
> distribute

The full build log is available from:
   
http://people.debian.org/~lucas/logs/2016/07/20/pyrex_0.9.8.5-2.1_unstable_archallonly.log

A list of current common problems and possible solutions is available at
http://wiki.debian.org/qa.debian.org/FTBFS . You're welcome to contribute!

About the archive rebuild: The rebuild was done on EC2 VM instances from
Amazon Web Services, using a clean, minimal and up-to-date chroot. Every
failed build was retried once to eliminate random failures.
--- End Message ---
--- Begin Message ---
Source: pyrex
Source-Version: 0.9.9-1

We believe that the bug you reported is fixed in the latest version of
pyrex, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 831...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Brossier  (supplier of updated pyrex package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Thu, 01 Sep 2016 12:04:51 +0200
Source: pyrex
Binary: python-pyrex pyrex-mode
Architecture: source all
Version: 0.9.9-1
Distribution: unstable
Urgency: medium
Maintainer: Paul Brossier 
Changed-By: Paul Brossier 
Description:
 pyrex-mode - emacs-lisp pyrex-mode for pyrex
 python-pyrex - compile native-code modules for Python from Python-like syntax
Closes: 582561 604965 610386 616980 648800 668804 831938
Changes:
 pyrex (0.9.9-1) unstable; urgency=medium
 .
   * New upstream release (closes: #582561, #610386)
   * Bump debian/compat to 7
   * Acknowledge NMU (Closes: #616980)
   * debian/compat: bump from 5 to 9
   * debian/patches: removed, integrated upstream
   * debian/control: add X-Python-Version, remove dpatch, add dh-python
   * debian/control: bump Standards-Version to 3.9.8, strip trailing space
   * debian/rules: update (closes: #668804, #831938), strip trailing spaces
   * debian/control: add python-dev to depends

Bug#821526: marked as done (libphp-jpgraph: PHP 7.0 Transition)

Your message dated Sun, 30 Oct 2016 23:50:11 +
with message-id 
and subject line Bug#821526: fixed in libphp-jpgraph 1.5.2-13
has caused the Debian Bug report #821526,
regarding libphp-jpgraph: PHP 7.0 Transition
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
821526: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=821526
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: libphp-jpgraph
Version: 1.5.2-12.1
Severity: important
User: pkg-php-ma...@lists.alioth.debian.org
Usertags: php7.0-transition

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Dear maintainer(s),

this bug is a part of ongoing php7.0 transition.  It is filled as
important, but the severity will be bumped to serious within quite short
(~month) timeframe as the transition was announced almost 3 months ago.

The libphp-jpgraph package currently depends on libapache2-mod-php5 php5
php5-cgi php5-gd .

PHP 7.0 has landed in unstable with substantial changes to the packaging:

  1. Every package built from src:phpMAJOR.MINOR now include
 phpMAJOR.MINOR in the name, so f.e. php5-fpm is now php7.0-fpm.

  2. Accompanying src:php-defaults builds 1:1 mapping to a default
 MAJOR.MINOR version, e.g. php-fpm depends on php7.0-fpm.  When you
 specify a dependency, please use the generic name, unless you
 absolutely know that won't work for you.

  3. Every path in the system has been changed to a versioned, e.g.
 /etc/php5/cli is now /etc/php/7.0/cli

  4. dh_php5 is now dh_php

  5. php-pear is not built from independent source package.

  6. master-7.0 branches of several extensions (php-apcu, xdebug,
 php-apcu-bc) can be used as a template how to change the PHP
 extension packaging.  It's mostly cut since the d/rules tries
 to figure-out most of the variables from debian/ directory.

  7. pkg-php-tools package now supports PHP 7.0 packaging and if your
 package uses pkg-php-tools a simple binNMU is all it might need

  8. PHP 7.0 has changed extension API, so most-if-not-all extensions
 need work from upstream to be compatible with PHP 7.0.

  9. We expect to ship next Debian release (stretch) only with PHP
 7.0, that means that all packages needs to be made compatible with
 PHP 7.0.  Fortunately the PHP 7.0 is mostly compatible with properly
 maintained software.  However some extensions has been deprecated
 (f.e. mysql) and thus old unmaintained software will stop working
 and it will have to be either patched or removed from stable Debian.

So what you need to do:

Replace every occurence of php5 with just php, e.g. if you depend on
'php5' then you just need to depend on 'php'.  Also if you package a web
application and depend on specific SAPI, I would recommend depending just
on 'php' package and let the user decide whether he will install php-fpm,
libapache2-mod-php or php-cgi.

The script that was used to get the list of packages for MBF was not a
particular smart one (so it doesn't detect alternatives, etc.), so if
there's a false positive, please excuse me and just close the bug with
short explanation.

The other options that might be used with packages that don't and won't
support PHP 7.0 is to remove the software from Debian by changing the
title of this bugreport to:

RM: libphp-jpgraph -- ROM; doesn't support PHP 7.0

reassigning it to ftp.debian.org pseudo-package and changing severity to
'normal'.

Also feel free to contact the maintainers at one of the lists:

pkg-php-p...@lists.alioth.debian.org -- for PEAR related packages
pkg-php-p...@lists.alioth.debian.org -- for PHP extensions
pkg-php-ma...@lists.alioth.debian.org -- main PHP packaging and catch-all

Cheers, Ondrej

- -- System Information:
Debian Release: 8.4
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'proposed-updates'), (500, 
'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.2.0-35-generic (SMP w/24 CPU cores)
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQJ8BAEBCgBmBQJXFUp+XxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQzMEI5MzNEODBGQ0UzRDk4MUEyRDM4RkIw
Qzk5QjcwRUY0RkNCQjA3AAoJEAyZtw70/LsHa5wQAMUAObVlOfqzRdP/GMZ5Cicy
ICIW4d9eozs267ee9j/SpF2Wtb9luh3EO5HrhLusY/rHnxPVUSQvroMOlPNyEEWR
JjX3IsAXtFJ81t56bbfQQ1eDI+Rb/j0qAwI5ok9PiUZsL+TdX76I/Pk5HItBl4PC
ouEbd5WCspr4sGX7eiZyohxt7oN4dKz/TgfBHMEPGmAbGj4jdcjBcBmR+LqYbPFL

Processed: Re: Bug#842443: abiword under XFCE4 displays all documents as black on black

Processing control commands:

> retitle -1 abiword displays documents as black on black with GTK 3.22
Bug #842443 [abiword] abiword under XFCE4 displays all documents as black on 
black
Changed Bug title to 'abiword displays documents as black on black with GTK 
3.22' from 'abiword under XFCE4 displays all documents as black on black'.
> severity -1 serious
Bug #842443 [abiword] abiword displays documents as black on black with GTK 3.22
Severity set to 'serious' from 'important'
> tags -1 confirmed
Bug #842443 [abiword] abiword displays documents as black on black with GTK 3.22
Added tag(s) confirmed.
> forwarded -1 http://bugzilla.abisource.com/show_bug.cgi?id=13815
Bug #842443 [abiword] abiword displays documents as black on black with GTK 3.22
Set Bug forwarded-to-address to 
'http://bugzilla.abisource.com/show_bug.cgi?id=13815'.

-- 
842443: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842443
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842591: marked as done (debootstrap-udeb: fails to validate InRelease (BADSIG))

Your message dated Sun, 30 Oct 2016 23:03:30 +
with message-id 
and subject line Bug#842591: fixed in debootstrap 1.0.86
has caused the Debian Bug report #842591,
regarding debootstrap-udeb: fails to validate InRelease (BADSIG)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
842591: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842591
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: debootstrap-udeb
Version: 1.0.85
Severity: grave
Justification: renders package unusable

The (re)addition of InRelease support broke debootstrap(-udeb) in a d-i
context. The sed|tr|sed dance doesn't kill the final newline, which
leads to a BAD signature.

My original proposal was to use head -c -1, which while not specified by
posix actually just works. Reasons include:
 1. Tests agree.
 2. busybox's coreutils/head.c has:
case 'c':
count_bytes = 1;
…
if (negative_N) {
if (count_bytes) {
print_except_N_last_bytes(fp, count);
} else {
print_except_N_last_lines(fp, count);
}
} else {
print_first_N(fp, count, count_bytes);
}

It might be suboptimal to use this for the time being, as it /might/
limit portability. On the other hand, the idea was to get a d-i release
out of the door.

I'll give it some thoughts in the upcoming hours, and decide how to fix.


KiBi.
--- End Message ---
--- Begin Message ---
Source: debootstrap
Source-Version: 1.0.86

We believe that the bug you reported is fixed in the latest version of
debootstrap, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 842...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Cyril Brulebois  (supplier of updated debootstrap package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Format: 1.8
Date: Sun, 30 Oct 2016 23:35:45 +0100
Source: debootstrap
Binary: debootstrap debootstrap-udeb
Architecture: source
Version: 1.0.86
Distribution: unstable
Urgency: high
Maintainer: Debian Install System Team 
Changed-By: Cyril Brulebois 
Description:
 debootstrap - Bootstrap a basic Debian system
 debootstrap-udeb - Bootstrap the Debian system (udeb)
Closes: 842591
Changes:
 debootstrap (1.0.86) unstable; urgency=high
 .
   * Rework split_inline_sig by using shell built-ins instead of trying to
 mix sed and tr together, which might work on regular systems but not
 from inside the Debian Installer (Closes: #842591). Thanks to Ansgar
 Burchardt for the proof of concept!
Checksums-Sha1:
 f987909e91e06f211c1e44a5d25ba97b96549286 1775 debootstrap_1.0.86.dsc
 3261092408a4f0a8d0939e07d1d5fea6e69369ed 65352 debootstrap_1.0.86.tar.gz
Checksums-Sha256:
 099ed437938b8be828757352bc6f75da0a7fcf2866e77523b9785442acb44b45 1775 
debootstrap_1.0.86.dsc
 ce7eb450f7d5dd55d9b49f8a68f2b33c5f4edeba93c2d63ef3dd01e009f4fb5c 65352 
debootstrap_1.0.86.tar.gz
Files:
 31c168345de7c0ba38abd8f1be769a5a 1775 admin extra debootstrap_1.0.86.dsc
 4b6b9c35e867e4b37aa4be2dd4078fee 65352 admin extra debootstrap_1.0.86.tar.gz

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQIcBAEBAgAGBQJYFnjiAAoJEP+RSvDCs1UgGtEP/1OLFirGQBTiw0QgSZbEsuN9
J0V5iqgmJ0mHxTYjOuCfgt9u432dESjeERncLm32Ya7uZgk+pGpvAGSMa2Tu4Hrv
gYBPWHA/rfQRYrzbs327UbesKbjohrg8NBGT0YFJq/DL9EYNXDID53poL/o7xIvW
WfX+nKFRM1/8rOeJu/EzAthBmY9JX17/ygaNjWlgAMfAYUczp8gm893sNydhkfgH
s72RkBqreuVlY88s5oHFTg9i/BiaO1APE769ORXxhoXP7FbaR3EkywbnFIIsUE8j
9dsZEpoluwxnqPEo/F1Gr6Z3rcbk23tBaQiIJXr8XrcP4KJklaJkpnRRct7sZ+0N
AN2NTOHkw8gF2+oTNqhrn7DLZCMINpmr5leks58X+v7Cvi5Wo0UgzDj+GWhk3A8r
ruMFKjfG9oxga1mOi9yAxt5oiypWiMYEQ5CxjjXmpWXgMniqkoaRudQoB3lsZKHA
bV5RYemePXnA2KdIJJojD+a/SedqEJx4jPpYzVa8FfWGzf1blrjBcSmdlFpDO4B7
/8sotJxRRpB4juNY3kYAQD2urDlvl53TZdrUtvwqo4bEvHIcqgwlJXBh9QeKx/a4
uhISa2l3W7V7gzu1NzffQtyOvUkPSs2Gfjgt1w+EuHFeBAefyk9q0yn18U3Duwss

Bug#842639: libhmsbeagle1v5: unsatisfiable Depends: beignet-opencl-icd | mesa-opencl-icd | opencl-icd

2016-10-30 Thread Emilio Pozuelo Monfort

Package: libhmsbeagle1v5
Version: 2.1.2+20160831-4
Severity: serious

emilio@tatooine:~$ grep-excuses libhmsbeagle
libhmsbeagle (2.1.2+20150609-1.1 to 2.1.2+20160831-4)
Maintainer: Debian Med Packaging Team
14 days old (needed 5 days)
libhmsbeagle1v5/armel unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/mips unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/mips64el unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/mipsel unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/powerpc unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/ppc64el unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
libhmsbeagle1v5/s390x unsatisfiable Depends: beignet-opencl-icd | 
mesa-opencl-icd | opencl-icd
Valid candidate

beignet-opencl-icd is only available on any-{amd64,i386}, so that dependency
should be restricted to those architectures, or your package should be
removed from !any-{amd64,i386}.

Cheers,
Emilio

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (800, 'unstable'), (700, 'experimental'), (650, 'testing'), (500, 
'unstable-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386, armhf

Kernel: Linux 4.7.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Junio C Hamano

Ævar Arnfjörð Bjarmason  writes:

(commenting out of order)

> It's probably worthwhile to split off git-sh-setup into git-sh-setup &
> git-sh-setup-internal along with a documentation fix. A lot of what
> it's doing (e.g. git_broken_path_fix(), and adding a die() function)
> is probably only needed internally by git itself. The
> git-sh-setup-internal should be the thing sourcing "git-sh-i18n", I
> don't see how anyone out-of-tree could make use of that. Surely nobody
> needs to re-emit the exact message we shipped with our *.po files.

My reading of d323c6b641 ("i18n: git-sh-setup.sh: mark strings for
translation", 2016-06-17) is abit different.  It needs to dot-source
the i18n stuff because the shell library functions it contains need
the localization support in the messages they emit.  IOW, I do not
think i18n belongs to -internal at all.

> I don't see why we shouldn't have some stable shellscript function API
> if that's needed either.
>
> I just wanted to point out that currently git-sh-setup isn't
> documented as such. So at least a follow-up patch to the documentation
> seems in order.
>
> This did break in v2.10.0, and it's taken a couple of months to notice
> this, so clearly it's not very widely used, which says something about
> the cost-benefit of maintaining this for external users.

I am not sure if "stable API" in sh-setup is a good thing for the
ecosystem in the longer term.

As more and more in-tree scripted Porcelain commands migrate to C,
many helper functions in sh-setup will lose their in-tree users.
For example, get_author_ident_from_commit used to have three in-tree
customers (git-commit.sh, git-am.sh and git-rebase--interactive.sh),
but the first two is long gone and the third one may soon lose its
need to call it.  Once a helper function in setup-sh loses all
in-tree users, we may no longer _break_ that helper, but that is
simply because we feel no need to touch it.  The in-tree Porcelain
commands that migrated to C however will enhance the counterpart
they use in C to be more featureful or fix longstanding bugs in the
C version they use, while sh-setup version bitrot and making old
practice obsolete for "modern" use of Git of the day.  

Keeping such a stale version that we do not use, or even we attempt
to update it without having a good vehicle to test the change
ourselves (because we no longer have any in-tree users) will be
disservice to third-party scripts---the only thing they are getting
by using the stale one, instead of reinventing their own that they
may be responsible to keep up to date, is that they share the same
staleness as everybody else that use the sh-setup version as a
third-party.

I am not arguing that we should remove what loses all in-tree users
immediately.  At least not yet.  But I wanted to point out that it
may not be a good use of our brain cycles to keep the API "stable"
by keeping what in-tree users do not use anymore, especially if it
does not help third-party users in the long run.

Bug#817345: marked as done (aconnectgui: Removal of debhelper compat 4)

Your message dated Sun, 30 Oct 2016 22:48:31 +
with message-id 
and subject line Bug#817345: fixed in aconnectgui 0.9.0rc2-1-10
has caused the Debian Bug report #817345,
regarding aconnectgui: Removal of debhelper compat 4
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
817345: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=817345
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: aconnectgui
Severity: important
Usertags: compat-4-removal

Hi,

The package aconnectgui uses debhelper with a compat level of 4,
which is deprecated and scheduled for removal.

 * Please bump the debhelper compat at your earliest convenience.
   on the 15th of June.
   - Compat 9 is recommended
   - Compat 5 is the bare minimum
   - If the package has been relying on dh_install being lenient about
 missing files, please see "MIGRATING TO COMPAT 5 OR LATER" in [1].

 * Compat level 4 will be removed on the first debhelper upload after
   the 15th of June.

Thanks,
~Niels

[1] https://lists.debian.org/debian-devel/2015/09/msg00257.html
--- End Message ---
--- Begin Message ---
Source: aconnectgui
Source-Version: 0.9.0rc2-1-10

We believe that the bug you reported is fixed in the latest version of
aconnectgui, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 817...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Brossier  (supplier of updated aconnectgui package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 23:16:57 +0100
Source: aconnectgui
Binary: aconnectgui
Architecture: source amd64
Version: 0.9.0rc2-1-10
Distribution: unstable
Urgency: medium
Maintainer: Paul Brossier 
Changed-By: Paul Brossier 
Description:
 aconnectgui - graphical ALSA sequencer connection manager
Closes: 615179 638253 817345
Changes:
 aconnectgui (0.9.0rc2-1-10) unstable; urgency=medium
 .
   * debian/compat: bump to 5 (closes: #817345)
   * debian/control:
 + change Architecture to linux-any (closes: #638253)
 + move homepage out of description (closes: #615179)
 + add ${misc:Depends}
 + bump standards-version to 3.9.8
   * Improve debian/copyright
   * Remove debian/menu
   * Remove 'Applications' from .desktop Categories
Checksums-Sha1:
 f11e4cb729a413ac4555d5a2a741fb15e37241dc 1969 aconnectgui_0.9.0rc2-1-10.dsc
 77b5ff968e69fad0c3436a26198efa54ecf9d99e 47125 
aconnectgui_0.9.0rc2-1-10.diff.gz
 062f19c3ad1ca3f5d4c0129cc0eb16920660bb34 67724 
aconnectgui-dbgsym_0.9.0rc2-1-10_amd64.deb
 44c52d61394ba4570c5723583619dce5771de37c 23472 
aconnectgui_0.9.0rc2-1-10_amd64.deb
Checksums-Sha256:
 c35280184bac02ad0570b37f449933c68368cc35dc65ab2554b2a3b70a330327 1969 
aconnectgui_0.9.0rc2-1-10.dsc
 b6108d6514e8aca6fd9a2428bc555dd50d7d36b059e6e4ea7a4a46db39668b51 47125 
aconnectgui_0.9.0rc2-1-10.diff.gz
 5f730236f260c6ce44583a9cc709cfc51e42fa9d584922b1264118fd05829133 67724 
aconnectgui-dbgsym_0.9.0rc2-1-10_amd64.deb
 c4ccb88520695f77b781622589e5271994171b4955866bca25dba142d957865c 23472 
aconnectgui_0.9.0rc2-1-10_amd64.deb
Files:
 342cfba0c6c2f3dfee9ea1efd517b813 1969 sound optional 
aconnectgui_0.9.0rc2-1-10.dsc
 b2ca17846ad80cd774fe68db7ac008b7 47125 sound optional 
aconnectgui_0.9.0rc2-1-10.diff.gz
 4c2ae0bf82a6d8ac73ef40cc822fec54 67724 debug extra 
aconnectgui-dbgsym_0.9.0rc2-1-10_amd64.deb
 82187d6dc511af18db37cbbce7ac2306 23472 sound optional 
aconnectgui_0.9.0rc2-1-10_amd64.deb

-BEGIN PGP SIGNATURE-

iQJ8BAEBCgBmBQJYFnRQXxSAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCODhBNTA3MkQ0OTE1QUVDRjgxQTI0MzQ2
QTQ5QjE5NzI4QUJERDkyAAoJEGpJsZcoq92S1DEQAJj4+FUbPyCT/553LbJCsI0B
vPg44fdFhddVo3VuxetQFruVD2BKhHacnK6uP7gocO2gTO/BSs6kRJBPgddo324D
rdylesCC5vM4cCIXjilZ4pPrJArkWyybiAnm9oxgbkjFHGD5amvAa8DFxBTPucrl
0mUzo0a3gg+IEE8rOfkCwwUom1+RiVQKmdkedCmsuUFLB7WEM/r5oHeUWB41TDfa
bkBxuqgQ6n5pRQBuhLEPjUSzD7Z4wZ/eAYSWG1+uRvhRtGGD87k3G/hh0IBnB79l
bQistcs7sXT2MQV2KaZzRKxvCXl3xVsTStch34YgM6MUiJbjCUnuecP7cIWipcwW
/UffUlniZxGP26LP1MHvOy/OBQe2u/Y/Q2u/zNXTKefXB+0QjTKSGi3Lcgy8GSwY

Processed: Re: Bug#841733: Transition Opencv 3.1

Processing commands for cont...@bugs.debian.org:

> block 841733 with 841245 841245 841412 841407 841246 841413 841406 812032 
> 841370 841246 841408 841246 841409 841405 841416 841410 841287 841411
Bug #841733 [release.debian.org] Transition Opencv 3.1
841733 was not blocked by any bugs.
841733 was not blocking any bugs.
Added blocking bug(s) of 841733: 841408, 841245, 841246, 841370, 841405, 
841416, 841410, 841406, 812032, 841287, 841407, 841412, 841411, 841409, and 
841413
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
841733: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841733
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Junio C Hamano

Anders Kaseorg  writes:

> v2.10.0-rc0~45^2~2 “i18n: git-sh-setup.sh: mark strings for
> translation” broke outside scripts such as guilt that source
> git-sh-setup as described in the documentation:
>
> $ . "$(git --exec-path)/git-sh-setup"
> sh: 6: .: git-sh-i18n: not found
>
> This also affects contrib/convert-grafts-to-replace-refs.sh and
> contrib/rerere-train.sh in tree.  Fix this by using git --exec-path to
> find git-sh-i18n.
>
> While we’re here, move the sourcing of git-sh-i18n below the shell
> portability fixes.
>
> Signed-off-by: Anders Kaseorg 
> ---

Looks good.

Our in-tree scripts rely on the fact that $PATH is adjusted to have
$GIT_EXEC_PATH early (either by getting invoked indirectly by "git"
potty, or the requirement to do so for people and scripts that still
run our in-tree scripts with dashed e.g. "git-rebase" form) by the
time they run.  But when sh-setup dot-sources git-sh-i18n for its
own use, it should be explicit to name which one of the many copies
that may appear in directories on user's $PATH (one among which is
the one in $GIT_EXEC_PATH) it wants to use.  And this patch does the
right thing by not relying on the $PATH, but instead naming the
exact path using $(git --exec-path)/ prefix, to the included file.

In other words, I think this patch is a pure bugfix, even if there
is no third-party script that includes it.  We may want to have the
above as the rationale to apply this patch in the proposed log
message, though.

> Is this a supported use of git-sh-setup?  Although the documentation is
> clear that the end user should not invoke it directly, it seems to imply
> that scripts may do this, and in practice it has worked until v2.10.0.

It is correct for the documentation to say that this is not a
"command" end users would want to run; they cannot invoke it as a
standalone command as it is written as a dot-sourced shell library.

Even though it is intended solely for internal use, so far we have
not removed things from there, which would have signalled people
that third-party scripts can also dot-source it.  We may want to
reserve the right to break them in the future, but because this is a
pure bugfix, "can third-party rely on the interface not changing?"
is not a question we need to answer in this thread---there is no
reason to leave this broken.

Thanks.

>  git-sh-setup.sh | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/git-sh-setup.sh b/git-sh-setup.sh
> index a8a4576..240c7eb 100644
> --- a/git-sh-setup.sh
> +++ b/git-sh-setup.sh
> @@ -2,9 +2,6 @@
>  # to set up some variables pointing at the normal git directories and
>  # a few helper shell functions.
>  
> -# Source git-sh-i18n for gettext support.
> -. git-sh-i18n
> -
>  # Having this variable in your environment would break scripts because
>  # you would cause "cd" to be taken to unexpected places.  If you
>  # like CDPATH, define it for your interactive shell sessions without
> @@ -46,6 +43,9 @@ git_broken_path_fix () {
>  
>  # @@BROKEN_PATH_FIX@@
>  
> +# Source git-sh-i18n for gettext support.
> +. "$(git --exec-path)/git-sh-i18n"
> +
>  die () {
>   die_with_status 1 "$@"
>  }

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Ævar Arnfjörð Bjarmason

,On Sun, Oct 30, 2016 at 10:12 PM, Jeff King  wrote:
> On Sun, Oct 30, 2016 at 08:09:21PM -, Philip Oakley wrote:
>
>> > It is documented (Documentation/git-sh-setup.txt), and this is not the
>> > internal Documentation/technical section of the documentation, so my
>> > default assumption would be that everything shown there is intended as
>> > public.  I only bring this up as a question because it was apparently
>> > allowed to break.  If I’m wrong and it isn’t public, other patches are
>> > needed (to the documentation and to its users in contrib).
>> >
>> But the Documenation does say ::
>>
>> - This is not a command the end user would want to run. Ever.
>>
>> - This documentation is meant for people who are studying the Porcelain-ish
>> scripts and/or are writing new ones.
>> --
>
> Historically speaking, porcelain-ish scripts were carried both in and
> out of git.git. These days what we consider porcelain is usually carried
> in-tree, but I don't think it's unreasonable for people building their
> own scripts to want to make use of git-sh-setup. And we've generally
> tried to retain backwards compatibility in the functions it provides,
> even to out-of-tree scripts.
>
> So I think it is worth applying the fix at the start of this thread to
> keep that working.
>
> As for a documentation change for "do not use this for out-of-tree
> scripts", I am mildly negative, as I don't think that matches historical
> practice.

I don't see why we shouldn't have some stable shellscript function API
if that's needed either.

I just wanted to point out that currently git-sh-setup isn't
documented as such. So at least a follow-up patch to the documentation
seems in order.

This did break in v2.10.0, and it's taken a couple of months to notice
this, so clearly it's not very widely used, which says something about
the cost-benefit of maintaining this for external users.

It's probably worthwhile to split off git-sh-setup into git-sh-setup &
git-sh-setup-internal along with a documentation fix. A lot of what
it's doing (e.g. git_broken_path_fix(), and adding a die() function)
is probably only needed internally by git itself. The
git-sh-setup-internal should be the thing sourcing "git-sh-i18n", I
don't see how anyone out-of-tree could make use of that. Surely nobody
needs to re-emit the exact message we shipped with our *.po files.

Processed: your mail

Processing commands for cont...@bugs.debian.org:

> severity 828600 wishlist
Bug #828600 [src:witty] witty: FTBFS with openssl 1.1.0
Severity set to 'wishlist' from 'serious'
>
End of message, stopping processing here.

Please contact me if you need assistance.
-- 
828600: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828600
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: Re: pycuda: FTBFS with CUDA 8.0

Processing control commands:

> severity -1 serious
Bug #842035 [src:pycuda] pycuda: FTBFS with CUDA 8.0
Severity set to 'serious' from 'normal'

-- 
842035: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842035
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842619: game-data-packager: FTBFS (improper image header `data/soltys.xpm')

2016-10-30 Thread Simon McVittie

Control: clone 842619 -1
Control: reassign -1 imagemagick
Control: retitle -1 no longer supports XPM with > 8464 colours
Control: found -1 8:6.9.6.2+dfsg-2
Control: severity -1 important
Control: fixed 842619 46

ImageMagick maintainers, for context: game-data-package used to
contain this:

which it converted to PNG with convert(1) at build time, and that no
longer works.

On Sun, 30 Oct 2016 at 20:46:15 +, Santiago Vila wrote:
> convert-im6.q16: improper image header `data/soltys.xpm' @
> error/xpm.c/ReadXPMImage/348.
...
> This could be a problem with imagemagick, which entered testing today,
> but I'm not 100% sure that imagemagick is to blame.

I think this is a feature regression in ImageMagick: XPM images that
encode a single pixel as three or more characters are no longer supported:

http://git.imagemagick.org/repos/ImageMagick/commit/76edbbafe01574ee2d6539f9b87e30a3f33ccd51

I previously thought this was something that needed to be fixed in
game-data-packager, and I fixed it in experimental by shipping a PNG
instead of an oversized XPM (the version in experimental isn't fully
ready for unstable for unrelated reasons, but the change would be trivial
to backport if g-d-p is in danger of being autoremoved). However,
looking at ImageMagick again, I'm less sure that this regression was
actually intended - it's intentionally more strict than it used to be,
but I don't think it was meant to be quite as strict as this.

The commit message was "The number of colors is limited to 65535", and the
size of the palette is indeed now limited to MaxColormapSize = 65536.
However, the number of characters used to represent a pixel ("width")
is now limited to 2, which is not enough. XPM effectively encodes each
pixel as a number in base 92, so 2 characters per pixel is only enough for
8464 colours. A palette of 65536 distinct colours would need 3 characters
per pixel (although the most significant character would only take a subset
of its possible values).

I don't think this is necessarily RC for imagemagick, so I'm using a
cloned bug at important severity, and keeping the original RC FTBFS
bug open; I'll avoid the FTBFS in game-data-packager soon anyway,
either by doing a 45.1 release or by uploading a new version 47
to unstable. However, it's a regression which deserves looking at.
Feel free to increase or decrease severity according to what you think
its likely impact is.

Bug#828600:

2016-10-30 Thread Pau Garcia i Quiles

Upstream does not support OpenSSL 1.1.0 yet and I will not patch Wt myself.
It is just too risky and dangerous. I will not cause another OpenSSL PRNG
debacle.

Processed: Re: Bug#842619: game-data-packager: FTBFS (improper image header `data/soltys.xpm')

Processing control commands:

> clone 842619 -1
Bug #842619 [src:game-data-packager] game-data-packager: FTBFS (improper image 
header `data/soltys.xpm')
Bug 842619 cloned as bug 842632
> reassign -1 imagemagick
Bug #842632 [src:game-data-packager] game-data-packager: FTBFS (improper image 
header `data/soltys.xpm')
Bug reassigned from package 'src:game-data-packager' to 'imagemagick'.
No longer marked as found in versions game-data-packager/45.
Ignoring request to alter fixed versions of bug #842632 to the same values 
previously set
> retitle -1 no longer supports XPM with > 8464 colours
Bug #842632 [imagemagick] game-data-packager: FTBFS (improper image header 
`data/soltys.xpm')
Changed Bug title to 'no longer supports XPM with > 8464 colours' from 
'game-data-packager: FTBFS (improper image header `data/soltys.xpm')'.
> found -1 8:6.9.6.2+dfsg-2
Bug #842632 [imagemagick] no longer supports XPM with > 8464 colours
Marked as found in versions imagemagick/8:6.9.6.2+dfsg-2.
> severity -1 important
Bug #842632 [imagemagick] no longer supports XPM with > 8464 colours
Severity set to 'important' from 'serious'
> fixed 842619 46
Bug #842619 [src:game-data-packager] game-data-packager: FTBFS (improper image 
header `data/soltys.xpm')
Marked as fixed in versions game-data-packager/46.

-- 
842619: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842619
842632: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842632
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#736687: [Pkg-openssl-devel] Bug#736687: libssl1.0.0: default cipher list contains insecure ciphers

2016-10-30 Thread Kurt Roeckx

On Sun, Oct 30, 2016 at 11:35:23PM +0200, Adrian Bunk wrote:
> I am raising this to RC severity since 1.0.2 will likely still be 
> shipped in stretch, and removing ciphers from the 1.0.2 defaults
> that were already removed from the 1.1.0 defaults should clearly
> be done for stretch.

I did plan on disabling 3DES and RC4 in 1.0.2 for stretch.


Kurt

Processed: Re: [Pkg-openssl-devel] Bug#736687: libssl1.0.0: default cipher list contains insecure ciphers

Processing control commands:

> severity -1 serious
Bug #736687 [openssl] libssl1.0.0: default cipher list contains insecure ciphers
Severity set to 'serious' from 'important'

-- 
736687: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=736687
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#828378: marked as done (libapache2-mod-auth-cas: FTBFS with openssl 1.1.0)

Your message dated Sun, 30 Oct 2016 21:25:05 +
with message-id 
and subject line Bug#828378: fixed in libapache2-mod-auth-cas 1.1-1
has caused the Debian Bug report #828378,
regarding libapache2-mod-auth-cas: FTBFS with openssl 1.1.0
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828378: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828378
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libapache2-mod-auth-cas
Version: 1.0.9.1-4
Severity: important
Control: block 827061 by -1

Hi,

OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
OpenSSL this package fail to build.  A log of that build can be found at:
https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/libapache2-mod-auth-cas_1.0.9.1-4_amd64-20160529-1438

On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of the
reasons why it might fail.  There are also updated man pages at
https://www.openssl.org/docs/manmaster/ that should contain useful information.

There is a libssl-dev package available in experimental that contains a recent
snapshot, I suggest you try building against that to see if everything works.

If you have problems making things work, feel free to contact us.


Kurt
--- End Message ---
--- Begin Message ---
Source: libapache2-mod-auth-cas
Source-Version: 1.1-1

We believe that the bug you reported is fixed in the latest version of
libapache2-mod-auth-cas, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 828...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Thijs Kinkhorst  (supplier of updated libapache2-mod-auth-cas 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 19:59:32 +
Source: libapache2-mod-auth-cas
Binary: libapache2-mod-auth-cas
Architecture: source amd64
Version: 1.1-1
Distribution: unstable
Urgency: medium
Maintainer: CAS packaging team 
Changed-By: Thijs Kinkhorst 
Description:
 libapache2-mod-auth-cas - CAS authentication module for Apache2
Closes: 828378
Changes:
 libapache2-mod-auth-cas (1.1-1) unstable; urgency=medium
 .
   * New upstream release (closes: #828378).
 - Obsoletes all Debian patches.
Checksums-Sha1:
 380c4752e07ced65276aa5b90c4a54c3f28b0f86 1879 libapache2-mod-auth-cas_1.1-1.dsc
 fd71f452a607b22ab7b3abad7b30eeb1dbf031ee 409316 
libapache2-mod-auth-cas_1.1.orig.tar.gz
 4a06013cddc1e2b5fd8d37e0155c74ee4a4b03e1 4488 
libapache2-mod-auth-cas_1.1-1.debian.tar.xz
 bbde9933021ed049a0f346571376ee6e805e8730 66700 
libapache2-mod-auth-cas-dbgsym_1.1-1_amd64.deb
 69773d485978e1974bdf8af8f3ebeee4feaa6d06 35564 
libapache2-mod-auth-cas_1.1-1_amd64.deb
Checksums-Sha256:
 e4fe43737cdb5ebc406956061db074185d0d058eb124289b74d85b687edeefaa 1879 
libapache2-mod-auth-cas_1.1-1.dsc
 e70decc7a887c63df46a848497acdbd8fa4776d0c8a8c1de2c0d71b1b07e3dd0 409316 
libapache2-mod-auth-cas_1.1.orig.tar.gz
 532529835ee1d4e810030eacca7a54deaf08a38fcdc00378d3d49aa8f12d68f3 4488 
libapache2-mod-auth-cas_1.1-1.debian.tar.xz
 b1308e24bbfe106574dd62d786e186e2bc0a6455f920023a100657f780e2f98a 66700 
libapache2-mod-auth-cas-dbgsym_1.1-1_amd64.deb
 c4bd47a6d73fbbafec89b90e084ef6b3aa0814cb0986951de2fd5b19c405fa20 35564 
libapache2-mod-auth-cas_1.1-1_amd64.deb
Files:
 fb780aea75e9c1709be71d93ba58616a 1879 httpd extra 
libapache2-mod-auth-cas_1.1-1.dsc
 ee2e96b71d77fb7bd206d818f0c8a0bc 409316 httpd extra 
libapache2-mod-auth-cas_1.1.orig.tar.gz
 eb6cfb4314d00503bb2518d1dd5a85fc 4488 httpd extra 
libapache2-mod-auth-cas_1.1-1.debian.tar.xz
 97ac0c95f80e7970b1a0509c6821f21a 66700 debug extra 
libapache2-mod-auth-cas-dbgsym_1.1-1_amd64.deb
 9a2568e61a28e1cc87d40baee4ae6094 35564 httpd extra 
libapache2-mod-auth-cas_1.1-1_amd64.deb

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQEcBAEBCAAGBQJYFlP6AAoJEFb2GnlAHawE0awH/ibtfikSDwoPiWztxPpqBDKi
A+rW6XcDnm4lmFr8qT4GpmVH22fUbvhmz4XCPxGsxTkgtE4J6dw8+MajGx57ZAWI
5z64vW0eaLsMtMufF0oqm1TZKu/SsGIftt/Ov29YRS7s+bJl+xy2cXPloZBg+0+z

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Jeff King

On Sun, Oct 30, 2016 at 08:09:21PM -, Philip Oakley wrote:

> > It is documented (Documentation/git-sh-setup.txt), and this is not the
> > internal Documentation/technical section of the documentation, so my
> > default assumption would be that everything shown there is intended as
> > public.  I only bring this up as a question because it was apparently
> > allowed to break.  If I’m wrong and it isn’t public, other patches are
> > needed (to the documentation and to its users in contrib).
> > 
> But the Documenation does say ::
> 
> - This is not a command the end user would want to run. Ever.
> 
> - This documentation is meant for people who are studying the Porcelain-ish
> scripts and/or are writing new ones.
> --

Historically speaking, porcelain-ish scripts were carried both in and
out of git.git. These days what we consider porcelain is usually carried
in-tree, but I don't think it's unreasonable for people building their
own scripts to want to make use of git-sh-setup. And we've generally
tried to retain backwards compatibility in the functions it provides,
even to out-of-tree scripts.

So I think it is worth applying the fix at the start of this thread to
keep that working.

As for a documentation change for "do not use this for out-of-tree
scripts", I am mildly negative, as I don't think that matches historical
practice.

-Peff

Bug#842619: game-data-packager: FTBFS (improper image header `data/soltys.xpm')

Package: src:game-data-packager
Version: 45
Severity: serious

Dear maintainer:

I tried to build this package in stretch with "dpkg-buildpackage -A"
(which is what the "Arch: all" autobuilder would do to build it)
but it failed:


[...]
 debian/rules build-indep
dh build-indep --parallel --with python3,bash-completion
   dh_testdir -i -O--parallel
   dh_update_autotools_config -i -O--parallel
   dh_auto_configure -i -O--parallel
   debian/rules override_dh_auto_build
make[1]: Entering directory '/<>'
BUILD_DATE="$(dpkg-parsechangelog --show-field=Date)" \
dh_auto_build --parallel
make -j1
make[2]: Entering directory '/<>'
convert data/draci.xpm out/draci.png
convert data/sfinx.xpm out/sfinx.png
convert data/soltys.xpm out/soltys.png
convert-im6.q16: improper image header `data/soltys.xpm' @ 
error/xpm.c/ReadXPMImage/348.
convert-im6.q16: no images defined `out/soltys.png' @ 
error/convert.c/ConvertImageCommand/3257.
Makefile:81: recipe for target 'out/soltys.png' failed
make[2]: *** [out/soltys.png] Error 1
make[2]: Leaving directory '/<>'
dh_auto_build: make -j1 returned exit code 2
debian/rules:13: recipe for target 'override_dh_auto_build' failed
make[1]: *** [override_dh_auto_build] Error 2
make[1]: Leaving directory '/<>'
debian/rules:10: recipe for target 'build-indep' failed
make: *** [build-indep] Error 2
dpkg-buildpackage: error: debian/rules build-indep gave error exit status 2


This could be a problem with imagemagick, which entered testing today,
but I'm not 100% sure that imagemagick is to blame. If that's the
case, please use reassign and affects, so that this is still visible
in the page for this package.

Thanks.

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Philip Oakley


From: "Anders Kaseorg" 

On Sun, 30 Oct 2016, Ævar Arnfjörð Bjarmason wrote:

This seems like a reasonable fix for this issue. However as far as I
can tell git-sh-setup was never meant to be used by outside scripts
that didn't ship as part of git itself.

If that's the case any change in the API which AFAICT is now
considered internal might break them, so should some part of that be
made public & documented as such?


It is documented (Documentation/git-sh-setup.txt), and this is not the
internal Documentation/technical section of the documentation, so my
default assumption would be that everything shown there is intended as
public.  I only bring this up as a question because it was apparently
allowed to break.  If I’m wrong and it isn’t public, other patches are
needed (to the documentation and to its users in contrib).


But the Documenation does say ::

- This is not a command the end user would want to run. Ever.

- This documentation is meant for people who are studying the Porcelain-ish 
scripts and/or are writing new ones.

--

So there is a cautionary word or two there...

The question would then become: what (if anything) was missing in the 
documentation?...
maybe the inclusion of Ævar's "[Not] to be used by outside scripts that 
didn't ship as part of git itself."?

Or a comment that it may change in newer versions.
Though the code fix may still be reasonable..


Philip

Bug#841420: --enable-default-pie breaks kernel builds

2016-10-30 Thread Al Viro

One more point: suggestions along the lines of "patch the kernel"
are no good in this case.  Ever heard of git bisect?  Once the proposed
Makefile changes are far enough in the past (5 years or so) - fine, but
until then you've just made life considerably more unpleasant for those
of us who do kernel development on debian boxen.
Sure, it can be worked around, by remembering to pass the damn
thing in kbuild flags.  Delightful, that...

The bug is in gcc-6.  Reassigning it elsewhere doesn't change the
fact that it breaks one of the normal uses of gcc and no amount of changes
in debian packaging of kernel source is going to affect that.

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Anders Kaseorg

On Sun, 30 Oct 2016, Ævar Arnfjörð Bjarmason wrote:
> This seems like a reasonable fix for this issue. However as far as I
> can tell git-sh-setup was never meant to be used by outside scripts
> that didn't ship as part of git itself.
> 
> If that's the case any change in the API which AFAICT is now
> considered internal might break them, so should some part of that be
> made public & documented as such?

It is documented (Documentation/git-sh-setup.txt), and this is not the 
internal Documentation/technical section of the documentation, so my 
default assumption would be that everything shown there is intended as 
public.  I only bring this up as a question because it was apparently 
allowed to break.  If I’m wrong and it isn’t public, other patches are 
needed (to the documentation and to its users in contrib).

Anders

Bug#842607: ruby-fog-rackspace: FTBFS (undefined method `flavors')

Package: src:ruby-fog-rackspace
Version: 0.1.1-2
Severity: serious

Dear maintainer:

I tried to build this package in stretch with "dpkg-buildpackage -A"
(which is what the "Arch: all" autobuilder would do to build it)
but it failed:


[...]
 debian/rules build-indep
dh build-indep --buildsystem=ruby --with ruby
   dh_testdir -i -O--buildsystem=ruby
   dh_update_autotools_config -i -O--buildsystem=ruby
   dh_auto_configure -i -O--buildsystem=ruby
dh_ruby --configure
   dh_auto_build -i -O--buildsystem=ruby
dh_ruby --build
   dh_ruby --build
   dh_auto_test -i -O--buildsystem=ruby
dh_ruby --test
 fakeroot debian/rules binary-indep
dh binary-indep --buildsystem=ruby --with ruby

[... snipped ...]

# Fog::Rackspace::Monitoring | metrics (rackspace, rackspace_monitoring)
  
  Fog::Rackspace::Monitoring | checks (rackspace, rackspace_monitoring)
# Fog::Rackspace::Monitoring | checks (rackspace, rackspace_monitoring)
  
  Fog::Rackspace::Monitoring | check_types (rackspace, rackspace_monitoring)
# Fog::Rackspace::Monitoring | check_types (rackspace, rackspace_monitoring)
  
  Fog::Rackspace::Monitoring | alarm_examples (rackspace, rackspace_monitoring)
# Fog::Rackspace::Monitoring | alarm_examples (rackspace, 
rackspace_monitoring)
  
  Fog::Rackspace::DNS | zones (rackspace)
zones.find(fog-test-56e3) => finds domain_name
  # zones.find(fog-test-56e3) => finds domain_name
zones.find(fog-test-1944) => finds nothing
  # zones.find(fog-test-1944) => finds nothing
next_params
  + no body
  + no links
  + links are empty
  + links does not contain next hash
  + contains a link without parameters
  + contains a link without parameters
  
  Fog::Rackspace::DNS | zone (rackspace)
# Fog::Rackspace::DNS | zone (rackspace)
  
  Fog::Rackspace::Networking | virtual_interface (rackspace)
undefined method `flavors' for 
# (NoMethodError)
  /<>/tests/rackspace/helper.rb:83:in 
`rackspace_test_flavor_id'
  
/<>/tests/rackspace/models/networking/virtual_interface_tests.rb:11:in
 `block in '
  /usr/lib/ruby/vendor_ruby/shindo.rb:79:in `instance_eval'
  /usr/lib/ruby/vendor_ruby/shindo.rb:79:in `tests'
  /usr/lib/ruby/vendor_ruby/shindo.rb:38:in `initialize'
  /usr/lib/ruby/vendor_ruby/shindo.rb:13:in `new'
  /usr/lib/ruby/vendor_ruby/shindo.rb:13:in `tests'
  
/<>/tests/rackspace/models/networking/virtual_interface_tests.rb:1:in
 `'
  /usr/lib/ruby/vendor_ruby/shindo/bin.rb:61:in `load'
  /usr/lib/ruby/vendor_ruby/shindo/bin.rb:61:in `block (2 levels) in 
run_in_thread'
  /usr/lib/ruby/vendor_ruby/shindo/bin.rb:58:in `each'
  /usr/lib/ruby/vendor_ruby/shindo/bin.rb:58:in `block in run_in_thread'
An error occurred outside of a test
ERROR: Test "ruby2.3" failed. Exiting.
dh_auto_install: dh_ruby --install /<>/debian/ruby-fog-rackspace 
returned exit code 1
debian/rules:6: recipe for target 'binary-indep' failed
make: *** [binary-indep] Error 1
dpkg-buildpackage: error: fakeroot debian/rules binary-indep gave error exit 
status 2


The relevant part of the build log is included above.

I'm attaching a full build log.

The failure happens randomly, but it always happens on some machines
and never on some others. I think that the build system is
non-deterministic and success or failure depends on some unknown
variable like filesystem ordering.

Please tell me if you would like me to perform any tests on any of the
machines where it always fail.

Thanks.

ruby-fog-rackspace_0.1.1-2_amd64-20161030T175340Z.gz
Description: application/gzip

Bug#842564: marked as done (tzdata-java install fails - depend is tzdata=2016f-0+deb8u1 but should be tzdata>=2016f-0+deb8u1)

Your message dated Sun, 30 Oct 2016 20:44:09 +0200
with message-id <20161030184409.yb7qf32sosbxi...@bunk.spdns.de>
and subject line Re: tzdata-java install fails - depend is 
tzdata=2016f-0+deb8u1 but should be tzdata>=2016f-0+deb8u1
has caused the Debian Bug report #842564,
regarding tzdata-java install fails - depend is tzdata=2016f-0+deb8u1 but 
should be tzdata>=2016f-0+deb8u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)

-- 
842564: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842564
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: tzdata-java
Version: 2016f-0+deb8u1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

when I try to install `tzdata-java` (or any package that depends on it) on my 
"out of the box" Jessie 8.6 stable system, it fails because of an "impossible" 
dependeny. This is because `tzdata` depends on tzdata (= 2016f-0+deb8u1), which 
is outdated. I would assume that this is a bug and that it should actually be 
depending on tzdata (>= 2016f-0+deb8u1) ?

How to reproduce:
`apt-get install tzdata-java`

Workaround:
- `apt-get download tzdata-java`
- `dpkg -i --ignore-depends=tzdata-java,tzdata 
tzdata-java_2016f-0+deb8u1_all.deb`
- edit `/var/lib/dpkg/status` and change `Depends` line for package 
`tzdata-java` to: `tzdata (>= 2016f-0+deb8u1)` (instead of: `tzdata (= 
2016f-0+deb8u1)`.
- afterwards packages that the depend on `tzdata-java` install fine

Thanks for your time and effort.

-- System Information:
Debian Release: 8.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/24 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages tzdata-java depends on:
ii  tzdata  2016h-0+deb8u1

tzdata-java recommends no packages.

tzdata-java suggests no packages.

-- no debconf information
--- End Message ---
--- Begin Message ---
On Sun, Oct 30, 2016 at 01:01:14PM +0100, Chris wrote:
> Package: tzdata-java
> Version: 2016f-0+deb8u1
> Severity: grave
> Justification: renders package unusable
> 
> Dear Maintainer,
> 
> when I try to install `tzdata-java` (or any package that depends on it) on my 
> "out of the box" Jessie 8.6 stable system, it fails because of an 
> "impossible" dependeny. This is because `tzdata` depends on tzdata (= 
> 2016f-0+deb8u1), which is outdated. I would assume that this is a bug and 
> that it should actually be depending on tzdata (>= 2016f-0+deb8u1) ?
> 
> How to reproduce:
> `apt-get install tzdata-java`
>...
> Versions of packages tzdata-java depends on:
> ii  tzdata  2016h-0+deb8u1

You have the tzdata package from jessie-updates installed, but 
jessie-updates seems to be missing from your apt sources.list

With jessie-updates in the sources.list, apt will download the 
tzdata-java package from jessie-updates that matches with a
version matching the tzdata package you already have installed.

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed--- End Message ---

Bug#842604: tcpdump 4.8.1 is not for testing

2016-10-30 Thread Romain Francoise

Package: tcpdump
Version: 4.8.1-2
Severity: serious

Upstream realized after I pointed out some inconsistencies that tcpdump
4.8.1 was released from the wrong Git branch, and it has some known bugs
that make it unfit for release. So I'm opening this bug to prevent its
automatic migration to testing.

tcpdump 4.8.2 is expected later this week with the right code this time.

-- 
Romain Francoise 
https://people.debian.org/~rfrancoise/

Bug#841662: libserver-starter-perl: test suite sometimes times out

2016-10-30 Thread Niko Tyni

On Sat, Oct 22, 2016 at 08:15:46PM +0200, gregor herrmann wrote:
> On Fri, 21 Oct 2016 23:13:53 +0300, Niko Tyni wrote:
> 
> > This package occasionally fails its autopkgtest checks on ci.debian.net.
> > 
> >   https://ci.debian.net/packages/libs/libserver-starter-perl/unstable/amd64/

I've been looking at this for half a day, and it's annoyingly hard to
reproduce. Running t/01-starter.t in a loop, I've seen it deadlock a
dozen times or so altogether. When it happens, strace shows the child
is calling accept() and its parent is waiting for it to exit.

Adding instrumentation mostly makes it go away. It does seem like the
parent killing the child with TERM succeeds, but the child never executes
its $SIG{TERM} handler. I haven't been able to figure out why. Perhaps
the handler gets interrupted by another signal - my first thought was
SIGPIPE but adding a handler for that didn't show anything.

Given it fails somewhat regularly on both ci.debian.net and
tests.reproducible-builds.org, possibly a faster machine would improve
the chances of reproducing it.  Just getting the log of 'strace -f
-olog prove -l t/01-starter.t' when it locks up would help tremendously,
but I ran it for two hours or so like that without a single lockup.

OTOH, reading https://rt.cpan.org/Public/Bug/Display.html?id=73711
I get the impression that the test suite is riddled with races that
are worked around by sprinkling sleep() calls in the test code.

Even though it feels like giving up, I suggest either disabling the test
suite or somehow guarding it with a timeout and making failures non-fatal.

Perhaps we should devise something very simple instead for a single
basic test?
-- 
Niko Tyni   nt...@debian.org

Bug#842477: [PATCH] git-sh-setup: Restore sourcability from outside scripts

2016-10-30 Thread Ævar Arnfjörð Bjarmason

On Sun, Oct 30, 2016 at 3:10 AM, Anders Kaseorg  wrote:
> v2.10.0-rc0~45^2~2 “i18n: git-sh-setup.sh: mark strings for
> translation” broke outside scripts such as guilt that source
> git-sh-setup as described in the documentation:
>
> $ . "$(git --exec-path)/git-sh-setup"
> sh: 6: .: git-sh-i18n: not found

This seems like a reasonable fix for this issue. However as far as I
can tell git-sh-setup was never meant to be used by outside scripts
that didn't ship as part of git itself.

If that's the case any change in the API which AFAICT is now
considered internal might break them, so should some part of that be
made public & documented as such?

Bug#839603: marked as done (amanda: The /usr/lib/amanda/amcheck-device command SIGSEGV when called by amcheck)

Your message dated Sun, 30 Oct 2016 17:48:47 +
with message-id 
and subject line Bug#839603: fixed in amanda 1:3.3.9-2
has caused the Debian Bug report #839603,
regarding amanda: The /usr/lib/amanda/amcheck-device command SIGSEGV when 
called by amcheck
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
839603: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=839603
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: amanda-server
Version: 1:3.3.9-1
Severity: normal
File: amanda

Dear Maintainer,

After I upgraded my host this week (I do not know the exact date) I started
to receive an alert message from amanda with the following subject:
"Daily AMANDA PROBLEM: FIX BEFORE RUN, IF POSSIBLE"
Which told me, that:
"amcheck-device terminated with signal 11"

Also, I was able to reproduce the issue with running the amcheck by hand
with the following command line:
"su -s /bin/bash -l -c "ulimit -c unlimited; /usr/sbin/amcheck -m Daily" backup"

Seemingly the daily backup job is running without success (this is while it
is just normal), but not checked throroughly.

The strace show the following:
29840 stat("/backup/amanda/daily/vtapes/drive0/data//0.MyData08", 
{st_mode=S_IFREG|0600, st_size=32768, ...}) = 0
29840 getdents(5, /* 0 entries */, 32768) = 0
29840 close(5)  = 0
29840 lseek(4, 0, SEEK_SET) = 0
29840 write(4, "$STATE = {\n   'drives' => {\n 
'/backup/amanda/daily/vtapes/drive0' => {\n 
  'pid' => 29840\n  
   }\n   },\n   'meta' 
=> undef\n };\n", 317) = 317
29840 close(4)  = 0
29840 write(2, "found in slot 8:", 16)  = 16
29840 write(2, " volume 'MyData08'\n", 19) = 19
29840 write(10, "Sun Oct  2 20:33:32 2016: thd-0x1a4f200: amcheck-device: 
Amanda::Taper::Scan::traditional result: 'MyData08' on 
file:/backup/amanda/daily/vtapes/drive0 slot 8, mode 2\n", 167) = 167
29840 lstat("/backup/amanda/daily/vtapes/drive0/data", {st_mode=S_IFLNK|0777, 
st_size=8, ...}) = 0
29840 unlink("/backup/amanda/daily/vtapes/drive0/data") = 0
29840 rmdir("/backup/amanda/daily/vtapes/drive0") = 0
29840 open("/etc/amanda/Daily/changer", O_RDWR|O_CREAT, 0666) = 4
29840 fcntl(4, F_SETLK, {l_type=F_WRLCK, l_whence=SEEK_SET, l_start=0, 
l_len=0}) = 0
29840 fstat(4, {st_mode=S_IFREG|0600, st_size=317, ...}) = 0
29840 read(4, "$STATE = {\n   'drives' => {\n 
'/backup/amanda/daily/vtapes/drive0' => {\n 
  'pid' => 29840\n  
   }\n   },\n   'meta' 
=> undef\n };\n", 317) = 317
29840 lseek(4, 0, SEEK_SET) = 0
29840 write(4, "$STATE = {\n   'drives' => {\n 
'/backup/amanda/daily/vtapes/drive0' => {}\n   },\n 
  'meta' => undef\n };\n", 169) = 169
29840 ftruncate(4, 169) = 0
29840 close(4)  = 0
29840 write(3, "\1\0\0\0\0\0\0\0", 8)   = 8
29840 futex(0x25370c0, FUTEX_WAKE_PRIVATE, 2147483647) = 0
29840 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x10} ---

And the dbg output is (I cannot find debug symbols neither for perl nor
amanda):
Reading symbols from /usr/bin/perl...(no debugging symbols found)...done.

warning: core file may not match specified executable file.
[New LWP 29840]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/bin/perl /usr/lib/amanda/amcheck-device Daily'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x7f24ced6e1fb in ?? () from 
/usr/lib/x86_64-linux-gnu/amanda/perl/auto/Amanda/MainLoop/libMainLoop.so
(gdb) bt full
#0  0x7f24ced6e1fb in  () at 
/usr/lib/x86_64-linux-gnu/amanda/perl/auto/Amanda/MainLoop/libMainLoop.so
#1  0x7f24d4975103 in g_timeout_dispatch (source=0x2311c10, 
callback=, user_data=) at ././glib/gmain.c:4672
timeout_source = 0x2311c10
again = 
#2  0x7f24d497468a in g_main_context_dispatch (context=0x25370b0) at 
././glib/gmain.c:3201
dispatch = 0x7f24d49750f0 
prev_source = 0x0
was_in_call = 0
user_data = 0x25d3af0
callback = 0x7f24ced6e090
cb_funcs =

Bug#828552: marked as done (spamassassin: FTBFS with openssl 1.1.0)

Your message dated Sun, 30 Oct 2016 17:06:58 +
with message-id 
and subject line Bug#828552: fixed in spamassassin 3.4.1-6
has caused the Debian Bug report #828552,
regarding spamassassin: FTBFS with openssl 1.1.0
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828552: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828552
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: spamassassin
Version: 3.4.1-4
Severity: important
Control: block 827061 by -1

Hi,

OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
OpenSSL this package fail to build.  A log of that build can be found at:
https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/spamassassin_3.4.1-4_amd64-20160529-1538

On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of the
reasons why it might fail.  There are also updated man pages at
https://www.openssl.org/docs/manmaster/ that should contain useful information.

There is a libssl-dev package available in experimental that contains a recent
snapshot, I suggest you try building against that to see if everything works.

If you have problems making things work, feel free to contact us.


Kurt
--- End Message ---
--- Begin Message ---
Source: spamassassin
Source-Version: 3.4.1-6

We believe that the bug you reported is fixed in the latest version of
spamassassin, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 828...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noah Meyerhans  (supplier of updated spamassassin package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 09:39:27 -0700
Source: spamassassin
Binary: spamassassin spamc sa-compile
Architecture: source all amd64
Version: 3.4.1-6
Distribution: unstable
Urgency: medium
Maintainer: Noah Meyerhans 
Changed-By: Noah Meyerhans 
Description:
 sa-compile - Tools for compiling SpamAssassin rules into C
 spamassassin - Perl-based spam filter using text analysis
 spamc  - Client for SpamAssassin spam filtering daemon
Closes: 675540 784023 805009 828552 839704 841960
Changes:
 spamassassin (3.4.1-6) unstable; urgency=medium
 .
   * Import upstream fix for spamassassin bug 7226: Enhance whitelist_from_dkim
 to let it accept signing subdomains
   * Import upstream fix for spamassassin bug 7212: Warning of uninitialized
 value in
 Mail::SpamAssassin::PerMsgStatus::get_names_of_tests_hit_with_scores()
   * Add libgeo-ip-perl to Suggests for
 Mail::SpamAssassin::Plugin::URILocalBL (Closes: #841960)
   * Add libnet-patricia-perl to Suggests
   * Documentation updates
   * Promote libmail-dkim-perl to Depends (Closes: #675540)
   * Add missing dependency on lsb-base (>= 3.0-6)
   * Correct an error in debian/watch
   * Fix an error in -stamp file management in debian/rules.
   * Pass CPPFLAGS to gcc when building spamc
   * Allow building against OpenSSL 1.1.0 (Closes: #828552)
   * Acknowledge 3.4.1-5.1 NMU (Closes: #839704)
   * Support passing http_proxy to sa-update if set (Closes: #805009).
   * Run test suite during build (Closes: #784023).
   * Update to debhelper compatibility version 9
Checksums-Sha1:
 915f2c3e22e96c521e0c675e9fa2d540ba78285b 2430 spamassassin_3.4.1-6.dsc
 9655f5c563b6f40025c1743e4829ad00821e5214 44336 
spamassassin_3.4.1-6.debian.tar.xz
 dee7a25d15409a0a1c2b9114d2e7fc4fdffadd1b 53902 sa-compile_3.4.1-6_all.deb
 a16c0241a1529a79c83c3e6f23e2234ca9202405 1100980 spamassassin_3.4.1-6_all.deb
 9c5601937f6e62de48460ed12c530caabf3941ba 69804 spamc-dbgsym_3.4.1-6_amd64.deb
 ce6af0328f478a34fefb4101c8c9ef8177138f1d 89538 spamc_3.4.1-6_amd64.deb
Checksums-Sha256:
 871915effeaf4c333af9339b1240acd69e451537bf5a7f08b6e1733587966c8c 2430 
spamassassin_3.4.1-6.dsc
 b95bef23b079d2ef8cefc9867621b4990e237ada4ddab7ddeb0aa8d5d9cb522e 44336 
spamassassin_3.4.1-6.debian.tar.xz
 324fdf9c6a6fd24de10b9e45c8701dbe910d30af52d07dee3fe91bf4e5e2d3d5 53902 
sa-compile_3.4.1-6_all.deb
 5604f226595318441b9bbb53d22a68778b98c418fd37062e0407903d33469adb 1100980

Processed: [/master] debian/rules: Set INSTALL_ROOT for dh_auto_install (Closes: #840176).

Processing commands for cont...@bugs.debian.org:

> tag 840176 pending
Bug #840176 {Done: Andrew Starr-Bochicchio } [src:qbittorrent] 
qbittorrent: FTBFS: mkdir: cannot create directory 
'/usr/share/icons/hicolor/32x32': Permission denied
Added tag(s) pending.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
840176: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840176
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#840176: [/master] debian/rules: Set INSTALL_ROOT for dh_auto_install (Closes: #840176).

2016-10-30 Thread Andrew Starr-Bochicchio

tag 840176 pending
thanks

Date: Sat Oct 29 15:35:27 2016 -0400
Author: Andrew Starr-Bochicchio 
Commit ID: 0f2fff526f885470d0ca23b2ea5a4e0e2fef90e8
Commit URL: 
http://anonscm.debian.org/gitweb/?p=collab-maint/qbittorrent.git;a=commitdiff;h=0f2fff526f885470d0ca23b2ea5a4e0e2fef90e8
Patch URL: 
http://anonscm.debian.org/gitweb/?p=collab-maint/qbittorrent.git;a=commitdiff_plain;h=0f2fff526f885470d0ca23b2ea5a4e0e2fef90e8

debian/rules: Set INSTALL_ROOT for dh_auto_install (Closes: #840176).

Bug#840554: marked as done (libxml2: CVE-2016-5131)

Your message dated Sun, 30 Oct 2016 16:35:36 +
with message-id 
and subject line Bug#840554: fixed in libxml2 2.9.4+dfsg1-2.1
has caused the Debian Bug report #840554,
regarding libxml2: CVE-2016-5131
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
840554: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840554
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libxml2
Version: 2.9.4+dfsg1-2
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for libxml2.

CVE-2016-5131[0]:
| Use-after-free vulnerability in libxml2 through 2.9.4, as used in
| Google Chrome before 52.0.2743.82, allows remote attackers to cause a
| denial of service or possibly have unspecified other impact via
| vectors related to the XPointer range-to function.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-5131
[1] 
https://git.gnome.org/browse/libxml2/commit/?id=9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1358641#c3
[3] https://bugzilla.gnome.org/show_bug.cgi?id=768428 (not public)

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libxml2
Source-Version: 2.9.4+dfsg1-2.1

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 840...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso  (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 16:30:55 +0100
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg 
libxml2-doc python-libxml2 python-libxml2-dbg python3-libxml2 
python3-libxml2-dbg
Architecture: all source
Version: 2.9.4+dfsg1-2.1
Distribution: unstable
Urgency: medium
Maintainer: Debian XML/SGML Group 
Changed-By: Salvatore Bonaccorso 
Closes: 840553 840554
Description: 
 libxml2- GNOME XML library
 libxml2-dbg - Debugging symbols for the GNOME XML library
 libxml2-dev - Development files for the GNOME XML library
 libxml2-doc - Documentation for the GNOME XML library
 libxml2-utils - XML utilities
 libxml2-utils-dbg - XML utilities (debug extension)
 python-libxml2 - Python bindings for the GNOME XML library
 python-libxml2-dbg - Python bindings for the GNOME XML library (debug 
extension)
 python3-libxml2 - Python3 bindings for the GNOME XML library
 python3-libxml2-dbg - Python3 bindings for the GNOME XML library (debug 
extension)
Changes:
 libxml2 (2.9.4+dfsg1-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix comparison with root node in xmlXPathCmpNodes
   * Fix XPointer paths beginning with range-to (CVE-2016-5131)
 (Closes: #840554)
   * Disallow namespace nodes in XPointer ranges (CVE-2016-4658)
 (Closes: #840553)
   * Fix more NULL pointer derefs in xpointer.c
Checksums-Sha1: 
 267a7d892b9be45ab462d18e2a3aafe2ff45303b 2992 libxml2_2.9.4+dfsg1-2.1.dsc
 a87cdd246581b9c16e76d85f370ce940261570c8 28036 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 e28016a9d650ec40e7e53a0c17dbc5ad0c7af18f 828180 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Checksums-Sha256: 
 be01780a7b7bf2531e065c8b783ab425d4fb03ab4d1b61386be7be636be913b3 2992 
libxml2_2.9.4+dfsg1-2.1.dsc
 e71790a415e5d6b4a6490040d946d584fa79465571da3b186cc67b8f064cd104 28036 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 a42c045e2edc5007b4b5bb0608ef59f6dd59faa7766de891ae780f9f2a2559ea 828180 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Files: 
 adafe65e8fe3d1f22f4b4f81b35bfecb 2992 libs optional libxml2_2.9.4+dfsg1-2.1.dsc
 08fd0b330d3b53b6d5eac185fb2c9973 28036 libs optional 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 bc9ea1f1b544d7fadea851721c174282 828180 doc optional 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb

-BEGIN PGP

Bug#840553: marked as done (libxml2: CVE-2016-4658)

Your message dated Sun, 30 Oct 2016 16:35:36 +
with message-id 
and subject line Bug#840553: fixed in libxml2 2.9.4+dfsg1-2.1
has caused the Debian Bug report #840553,
regarding libxml2: CVE-2016-4658
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
840553: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libxml2
Version: 2.9.4+dfsg1-2
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for libxml2.

CVE-2016-4658[0]:
| libxml2 in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
| watchOS before 3 allows remote attackers to execute arbitrary code or
| cause a denial of service (memory corruption) via a crafted XML
| document.

Although the MITRE description at the moment explicitly mention that
as Apple related, the upstream commit is now know as [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4658
[1] 
https://git.gnome.org/browse/libxml2/commit/?id=c1d1f7121194036608bf555f08d3062a36fd344b

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libxml2
Source-Version: 2.9.4+dfsg1-2.1

We believe that the bug you reported is fixed in the latest version of
libxml2, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 840...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Salvatore Bonaccorso  (supplier of updated libxml2 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 16:30:55 +0100
Source: libxml2
Binary: libxml2 libxml2-utils libxml2-utils-dbg libxml2-dev libxml2-dbg 
libxml2-doc python-libxml2 python-libxml2-dbg python3-libxml2 
python3-libxml2-dbg
Architecture: all source
Version: 2.9.4+dfsg1-2.1
Distribution: unstable
Urgency: medium
Maintainer: Debian XML/SGML Group 
Changed-By: Salvatore Bonaccorso 
Closes: 840553 840554
Description: 
 libxml2- GNOME XML library
 libxml2-dbg - Debugging symbols for the GNOME XML library
 libxml2-dev - Development files for the GNOME XML library
 libxml2-doc - Documentation for the GNOME XML library
 libxml2-utils - XML utilities
 libxml2-utils-dbg - XML utilities (debug extension)
 python-libxml2 - Python bindings for the GNOME XML library
 python-libxml2-dbg - Python bindings for the GNOME XML library (debug 
extension)
 python3-libxml2 - Python3 bindings for the GNOME XML library
 python3-libxml2-dbg - Python3 bindings for the GNOME XML library (debug 
extension)
Changes:
 libxml2 (2.9.4+dfsg1-2.1) unstable; urgency=medium
 .
   * Non-maintainer upload.
   * Fix comparison with root node in xmlXPathCmpNodes
   * Fix XPointer paths beginning with range-to (CVE-2016-5131)
 (Closes: #840554)
   * Disallow namespace nodes in XPointer ranges (CVE-2016-4658)
 (Closes: #840553)
   * Fix more NULL pointer derefs in xpointer.c
Checksums-Sha1: 
 267a7d892b9be45ab462d18e2a3aafe2ff45303b 2992 libxml2_2.9.4+dfsg1-2.1.dsc
 a87cdd246581b9c16e76d85f370ce940261570c8 28036 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 e28016a9d650ec40e7e53a0c17dbc5ad0c7af18f 828180 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Checksums-Sha256: 
 be01780a7b7bf2531e065c8b783ab425d4fb03ab4d1b61386be7be636be913b3 2992 
libxml2_2.9.4+dfsg1-2.1.dsc
 e71790a415e5d6b4a6490040d946d584fa79465571da3b186cc67b8f064cd104 28036 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 a42c045e2edc5007b4b5bb0608ef59f6dd59faa7766de891ae780f9f2a2559ea 828180 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb
Files: 
 adafe65e8fe3d1f22f4b4f81b35bfecb 2992 libs optional libxml2_2.9.4+dfsg1-2.1.dsc
 08fd0b330d3b53b6d5eac185fb2c9973 28036 libs optional 
libxml2_2.9.4+dfsg1-2.1.debian.tar.xz
 bc9ea1f1b544d7fadea851721c174282 828180 doc optional 
libxml2-doc_2.9.4+dfsg1-2.1_all.deb

-BEGIN PGP SIGNATURE-

Bug#842591: debootstrap-udeb: fails to validate InRelease (BADSIG)

2016-10-30 Thread Cyril Brulebois

Package: debootstrap-udeb
Version: 1.0.85
Severity: grave
Justification: renders package unusable

The (re)addition of InRelease support broke debootstrap(-udeb) in a d-i
context. The sed|tr|sed dance doesn't kill the final newline, which
leads to a BAD signature.

My original proposal was to use head -c -1, which while not specified by
posix actually just works. Reasons include:
 1. Tests agree.
 2. busybox's coreutils/head.c has:
case 'c':
count_bytes = 1;
…
if (negative_N) {
if (count_bytes) {
print_except_N_last_bytes(fp, count);
} else {
print_except_N_last_lines(fp, count);
}
} else {
print_first_N(fp, count, count_bytes);
}

It might be suboptimal to use this for the time being, as it /might/
limit portability. On the other hand, the idea was to get a d-i release
out of the door.

I'll give it some thoughts in the upcoming hours, and decide how to fix.


KiBi.

Bug#840553: [xml/sgml-pkgs] Bug#840553: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Hi Mattia,

On Sun, Oct 30, 2016 at 04:17:18PM +, Mattia Rizzolo wrote:
> On Sun, Oct 30, 2016 at 05:00:01PM +0100, Salvatore Bonaccorso wrote:
> > Control: tags 840553 + pending
> > Control: tags 840554 + pending
> > 
> > Dear maintainer,
> > 
> > I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
> > uploaded it to DELAYED/5. Please feel free to tell me if I
> > should delay it longer.
> 
> Thanks, I'm rescheduling it to 0-day.

Thanks for confirming and doing so.

(and thanks as well for importing the diff into the packaging git
repository).

Regards,
Salvatore

Bug#840553: [xml/sgml-pkgs] Bug#840553: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

2016-10-30 Thread Mattia Rizzolo

On Sun, Oct 30, 2016 at 05:00:01PM +0100, Salvatore Bonaccorso wrote:
> Control: tags 840553 + pending
> Control: tags 840554 + pending
> 
> Dear maintainer,
> 
> I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
> uploaded it to DELAYED/5. Please feel free to tell me if I
> should delay it longer.

Thanks, I'm rescheduling it to 0-day.

-- 
regards,
Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540  .''`.
more about me:  https://mapreri.org : :'  :
Launchpad user: https://launchpad.net/~mapreri  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-


signature.asc
Description: PGP signature

Bug#840176: marked as done (qbittorrent: FTBFS: mkdir: cannot create directory '/usr/share/icons/hicolor/32x32': Permission denied)

Your message dated Sun, 30 Oct 2016 16:20:27 +
with message-id 
and subject line Bug#840176: fixed in qbittorrent 3.3.7-1
has caused the Debian Bug report #840176,
regarding qbittorrent: FTBFS: mkdir: cannot create directory 
'/usr/share/icons/hicolor/32x32': Permission denied
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
840176: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840176
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: qbittorrent
Version: 3.3.6-1
Severity: serious
Justification: fails to build from source
User: reproducible-bui...@lists.alioth.debian.org
Usertags: ftbfs
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Dear Maintainer,

qbittorrent fails to build from source in unstable/amd64:

  [..]

  compiling ../../src/gui/previewselect.cpp
  compiling ../../src/gui/guiiconprovider.cpp
  compiling ../../src/gui/updownratiodlg.cpp
  compiling ../../src/gui/loglistwidget.cpp
  compiling ../../src/gui/addnewtorrentdialog.cpp
  compiling ../../src/gui/autoexpandabledialog.cpp
  compiling ../../src/gui/statsdialog.cpp
  compiling ../../src/gui/messageboxraised.cpp
  compiling ../../src/gui/statusbar.cpp
  compiling ../../src/gui/advancedsettings.cpp
  compiling ../../src/gui/trackerlogin.cpp
  compiling ../../src/gui/optionsdlg.cpp
  compiling ../../src/gui/shutdownconfirmdlg.cpp
  compiling ../../src/gui/torrentmodel.cpp
  compiling ../../src/gui/torrentcreatordlg.cpp
  compiling ../../src/gui/scanfoldersdelegate.cpp
  compiling ../../src/gui/search/searchwidget.cpp
  compiling ../../src/gui/search/searchtab.cpp
  compiling ../../src/gui/search/pluginselectdlg.cpp
  compiling ../../src/gui/search/pluginsourcedlg.cpp
  compiling ../../src/gui/search/searchlistdelegate.cpp
  compiling ../../src/gui/search/searchsortmodel.cpp
  compiling ../../src/gui/cookiesmodel.cpp
  compiling ../../src/gui/cookiesdialog.cpp
  rcc ../../src/webui/webui.qrc
  rcc ../../src/gui/lineedit/resources/lineeditimages.qrc
  rcc ../../src/gui/about.qrc
  rcc ../../src/icons.qrc
  rcc ../../src/lang.qrc
  rcc ../../src/searchengine.qrc
  moc ../../src/app/qtsingleapplication/qtsingleapplication.h
  moc ../../src/app/qtsingleapplication/qtlocalpeer.h
  moc ../../src/app/application.h
  moc ../../src/app/filelogger.h
  moc ../../src/base/filesystemwatcher.h
  moc ../../src/base/qinisettings.h
  moc ../../src/base/logger.h
  moc ../../src/base/settingsstorage.h
  moc ../../src/base/preferences.h
  moc ../../src/base/http/connection.h
  moc ../../src/base/http/server.h
  moc ../../src/base/net/dnsupdater.h
  moc ../../src/base/net/downloadmanager.h
  moc ../../src/base/net/downloadhandler.h
  moc ../../src/base/net/geoipmanager.h
  moc ../../src/base/net/portforwarder.h
  moc ../../src/base/net/reverseresolution.h
  moc ../../src/base/net/smtp.h
  moc ../../src/base/bittorrent/session.h
  moc ../../src/base/bittorrent/torrentcreatorthread.h
  moc ../../src/base/bittorrent/tracker.h
  moc ../../src/base/bittorrent/private/bandwidthscheduler.h
  moc ../../src/base/bittorrent/private/filterparserthread.h
  moc ../../src/base/bittorrent/private/statistics.h
  moc ../../src/base/bittorrent/private/resumedatasavingmanager.h
  moc ../../src/base/rss/rssmanager.h
  moc ../../src/base/rss/rssfeed.h
  moc ../../src/base/rss/rssarticle.h
  moc ../../src/base/rss/private/rssparser.h
  moc ../../src/base/torrentfileguard.h
  moc ../../src/base/scanfoldersmodel.h
  moc ../../src/webui/webui.h
  moc ../../src/base/searchengine.h
  moc ../../src/webui/abstractwebapplication.h
  moc ../../src/gui/lineedit/src/lineedit.h
  moc ../../src/gui/properties/propertieswidget.h
  moc ../../src/gui/properties/peerlistwidget.h
  moc ../../src/gui/properties/proplistdelegate.h
  moc ../../src/gui/properties/trackerlist.h
  moc ../../src/gui/properties/downloadedpiecesbar.h
  moc ../../src/gui/properties/peerlistdelegate.h
  moc ../../src/gui/properties/peerlistsortmodel.h
  moc ../../src/gui/properties/peersadditiondlg.h
  moc ../../src/gui/properties/trackersadditiondlg.h
  moc ../../src/gui/properties/pieceavailabilitybar.h
  moc ../../src/gui/properties/proptabbar.h
  moc ../../src/gui/properties/speedwidget.h
  moc ../../src/gui/properties/speedplotview.h
  moc ../../src/gui/properties/piecesbar.h
  moc ../../src/gui/rss/rss_imp.h
  moc ../../src/gui/rss/rsssettingsdlg.h
  moc ../../src/gui/rss/feedlistwidget.h
  moc ../../src/gui/rss/automatedrssdownloader.h
  moc ../../src/gui/rss/htmlbrowser.h
  moc ../../src/gui/powermanagement/powermanagement.h
  moc

Processed: found 840554 in 2.8.0+dfsg1-7, found 840553 in 2.8.0+dfsg1-7

Processing commands for cont...@bugs.debian.org:

> # according to LTS triage
> found 840554 2.8.0+dfsg1-7
Bug #840554 [src:libxml2] libxml2: CVE-2016-5131
Marked as found in versions libxml2/2.8.0+dfsg1-7.
> found 840553 2.8.0+dfsg1-7
Bug #840553 [src:libxml2] libxml2: CVE-2016-4658
Marked as found in versions libxml2/2.8.0+dfsg1-7.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
840553: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553
840554: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840554
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Processing control commands:

> tags 840553 + pending
Bug #840553 [src:libxml2] libxml2: CVE-2016-4658
Ignoring request to alter tags of bug #840553 to the same tags previously set
> tags 840554 + pending
Bug #840554 [src:libxml2] libxml2: CVE-2016-5131
Ignoring request to alter tags of bug #840554 to the same tags previously set

-- 
840553: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553
840554: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840554
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Processing control commands:

> tags 840553 + pending
Bug #840553 [src:libxml2] libxml2: CVE-2016-4658
Added tag(s) pending.
> tags 840554 + pending
Bug #840554 [src:libxml2] libxml2: CVE-2016-5131
Added tag(s) pending.

-- 
840553: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840553
840554: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=840554
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#840553: libxml2: diff for NMU version 2.9.4+dfsg1-2.1

Control: tags 840553 + pending
Control: tags 840554 + pending

Dear maintainer,

I've prepared an NMU for libxml2 (versioned as 2.9.4+dfsg1-2.1) and
uploaded it to DELAYED/5. Please feel free to tell me if I
should delay it longer.

Regards,
Salvatore
diff -Nru libxml2-2.9.4+dfsg1/debian/changelog libxml2-2.9.4+dfsg1/debian/changelog
--- libxml2-2.9.4+dfsg1/debian/changelog	2016-09-11 20:57:02.0 +0200
+++ libxml2-2.9.4+dfsg1/debian/changelog	2016-10-30 16:30:55.0 +0100
@@ -1,3 +1,15 @@
+libxml2 (2.9.4+dfsg1-2.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * Fix comparison with root node in xmlXPathCmpNodes
+  * Fix XPointer paths beginning with range-to (CVE-2016-5131)
+(Closes: #840554)
+  * Disallow namespace nodes in XPointer ranges (CVE-2016-4658)
+(Closes: #840553)
+  * Fix more NULL pointer derefs in xpointer.c
+
+ -- Salvatore Bonaccorso   Sun, 30 Oct 2016 16:30:55 +0100
+
 libxml2 (2.9.4+dfsg1-2) unstable; urgency=medium
 
   [ YunQiang Su ]
diff -Nru libxml2-2.9.4+dfsg1/debian/patches/0004-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch libxml2-2.9.4+dfsg1/debian/patches/0004-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch
--- libxml2-2.9.4+dfsg1/debian/patches/0004-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch	1970-01-01 01:00:00.0 +0100
+++ libxml2-2.9.4+dfsg1/debian/patches/0004-Fix-comparison-with-root-node-in-xmlXPathCmpNodes.patch	2016-10-30 16:30:55.0 +0100
@@ -0,0 +1,34 @@
+From a005199330b86dada19d162cae15ef9bdcb6baa8 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer 
+Date: Tue, 28 Jun 2016 14:19:58 +0200
+Subject: [PATCH] Fix comparison with root node in xmlXPathCmpNodes
+
+This change has already been made in xmlXPathCmpNodesExt but not in
+xmlXPathCmpNodes.
+---
+ xpath.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/xpath.c b/xpath.c
+index 751665b..d992841 100644
+--- a/xpath.c
 b/xpath.c
+@@ -3342,13 +3342,13 @@ xmlXPathCmpNodes(xmlNodePtr node1, xmlNodePtr node2) {
+  * compute depth to root
+  */
+ for (depth2 = 0, cur = node2;cur->parent != NULL;cur = cur->parent) {
+-	if (cur == node1)
++	if (cur->parent == node1)
+ 	return(1);
+ 	depth2++;
+ }
+ root = cur;
+ for (depth1 = 0, cur = node1;cur->parent != NULL;cur = cur->parent) {
+-	if (cur == node2)
++	if (cur->parent == node2)
+ 	return(-1);
+ 	depth1++;
+ }
+-- 
+2.10.1
+
diff -Nru libxml2-2.9.4+dfsg1/debian/patches/0005-Fix-XPointer-paths-beginning-with-range-to.patch libxml2-2.9.4+dfsg1/debian/patches/0005-Fix-XPointer-paths-beginning-with-range-to.patch
--- libxml2-2.9.4+dfsg1/debian/patches/0005-Fix-XPointer-paths-beginning-with-range-to.patch	1970-01-01 01:00:00.0 +0100
+++ libxml2-2.9.4+dfsg1/debian/patches/0005-Fix-XPointer-paths-beginning-with-range-to.patch	2016-10-30 16:30:55.0 +0100
@@ -0,0 +1,138 @@
+From 9ab01a277d71f54d3143c2cf333c5c2e9aaedd9e Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer 
+Date: Tue, 28 Jun 2016 14:22:23 +0200
+Subject: [PATCH] Fix XPointer paths beginning with range-to
+
+The old code would invoke the broken xmlXPtrRangeToFunction. range-to
+isn't really a function but a special kind of location step. Remove
+this function and always handle range-to in the XPath code.
+
+The old xmlXPtrRangeToFunction could also be abused to trigger a
+use-after-free error with the potential for remote code execution.
+
+Found with afl-fuzz.
+
+Fixes CVE-2016-5131.
+---
+ result/XPath/xptr/vidbase | 13 
+ test/XPath/xptr/vidbase   |  1 +
+ xpath.c   |  7 -
+ xpointer.c| 76 ---
+ 4 files changed, 26 insertions(+), 71 deletions(-)
+
+--- a/xpath.c
 b/xpath.c
+@@ -10691,13 +10691,18 @@ xmlXPathCompPathExpr(xmlXPathParserConte
+ 		lc = 1;
+ 		break;
+ 		} else if ((NXT(len) == '(')) {
+-		/* Note Type or Function */
++		/* Node Type or Function */
+ 		if (xmlXPathIsNodeType(name)) {
+ #ifdef DEBUG_STEP
+ 		xmlGenericError(xmlGenericErrorContext,
+ "PathExpr: Type search\n");
+ #endif
+ 			lc = 1;
++#ifdef LIBXML_XPTR_ENABLED
++} else if (ctxt->xptr &&
++   xmlStrEqual(name, BAD_CAST "range-to")) {
++lc = 1;
++#endif
+ 		} else {
+ #ifdef DEBUG_STEP
+ 		xmlGenericError(xmlGenericErrorContext,
+--- a/xpointer.c
 b/xpointer.c
+@@ -1332,8 +1332,6 @@ xmlXPtrNewContext(xmlDocPtr doc, xmlNode
+ ret->here = here;
+ ret->origin = origin;
+ 
+-xmlXPathRegisterFunc(ret, (xmlChar *)"range-to",
+-	 xmlXPtrRangeToFunction);
+ xmlXPathRegisterFunc(ret, (xmlChar *)"range",
+ 	 xmlXPtrRangeFunction);
+ xmlXPathRegisterFunc(ret, (xmlChar *)"range-inside",
+@@ -2243,76 +2241,14 @@ xmlXPtrRangeInsideFunction(xmlXPathParse
+  * @nargs:  the number of

Bug#842570: marked as done (libxslt: CVE-2016-4738: possible heap overread)

Your message dated Sun, 30 Oct 2016 15:47:56 +
with message-id 
and subject line Bug#842570: fixed in libxslt 1.1.29-2
has caused the Debian Bug report #842570,
regarding libxslt: CVE-2016-4738: possible heap overread
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
842570: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842570
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libxslt
Version: 1.1.28-2
Severity: grave
Tags: security upstream patch

Hi,

the following vulnerability was published for libxslt.

CVE-2016-4738[0]:
| libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
| watchOS before 3 allows remote attackers to execute arbitrary code or
| cause a denial of service (memory corruption) via a crafted web site.

Unfortunately as for many libxml2 issues, the above is not very
specific and there is upstream bug referenced. But the fix is
mentioned as [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4738
[1] 
https://git.gnome.org/browse/libxslt/commit/?id=eb1030de31165b68487f288308f9d1810fed6880

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libxslt
Source-Version: 1.1.29-2

We believe that the bug you reported is fixed in the latest version of
libxslt, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 842...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattia Rizzolo  (supplier of updated libxslt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 14:01:00 +
Source: libxslt
Binary: libxslt1.1 libxslt1-dev libxslt1-dbg xsltproc python-libxslt1 
python-libxslt1-dbg
Architecture: source
Version: 1.1.29-2
Distribution: unstable
Urgency: high
Maintainer: Debian XML/SGML Group 
Changed-By: Mattia Rizzolo 
Description:
 libxslt1-dbg - XSLT 1.0 processing library - debugging symbols
 libxslt1-dev - XSLT 1.0 processing library - development kit
 libxslt1.1 - XSLT 1.0 processing library - runtime library
 python-libxslt1 - Python bindings for libxslt1
 python-libxslt1-dbg - Python bindings for libxslt1 (debug extension)
 xsltproc   - XSLT 1.0 command line processor
Closes: 842570
Changes:
 libxslt (1.1.29-2) unstable; urgency=high
 .
   * Team upload.
   * Bump debhelper compat level to 10.
 + --parallel is now default
 + --with autoreconf is now default
   * Add patch from upstream to fix a heap overread which could cause remote
 arbitrary code execution or denial of service.
 Closes: #842570 — CVE-2016-4738
Checksums-Sha1:
 5d433d7ee06ef9805b0b588be91296c3cbcc43b2 2368 libxslt_1.1.29-2.dsc
 0c9a27255fbff85efa011b577810e59889978c3b 27884 libxslt_1.1.29-2.debian.tar.xz
Checksums-Sha256:
 dcedd2cbe791c0053253181fc71cfae5a7e9babe081c80eb65e05b64efe5287e 2368 
libxslt_1.1.29-2.dsc
 c206efbcc3bd857316e9f01059b1095e42552b3321b398168ff4bfcc0b01910c 27884 
libxslt_1.1.29-2.debian.tar.xz
Files:
 ae68aff650760e797559f99686a69b76 2368 text optional libxslt_1.1.29-2.dsc
 94cf8bdb259f8248564061786b31be6e 27884 text optional 
libxslt_1.1.29-2.debian.tar.xz

-BEGIN PGP SIGNATURE-

iQIvBAEBCgAZBQJYFgCUEhxtYXR0aWFAZGViaWFuLm9yZwAKCRAIFrnhjHYrraUl
D/sHhUDwRpr1PvD20yYcOSOk7Xjf6lj1rkqG+OPfna6sijPv3xFXvSyHQlrWyF7Q
kcevAN/2K4MM6UhNDkWClXanrAon1qCSaEQTXY8oCkZNUFO/pE5oXiWqbhO57J1Q
2NCCcDVxllFWcAHphy41wQlYFXKLziYm2kZNJaqF7THo0lfXEsHW3XIGb5MYCf7t
w0sDrT9obrNgzf9j2v+1qhrRCh6kwGm29mteXZvd84cOmWgpcM/6sLAbjyOlglTu
Qj540vx8xcakp3IcQbIx8xGMsTc7zoB6dEEOvQl4yOfcjKIxD0EVKIr23EYZCRab
5fijbVJkYQ7ZNa4BoAtPYbRzN74ca4o/LdmnWuHujZM0ibRua/GLMlhk8LV3Sivk
AMHCckmij0sjShpYhpIR5q+DUa0Se5zm6w4SNZp6CWMu4mqpErVRNq8fogF5l1JF
Sp/HhuHxANJaZrag8OCMF4wEaIYDxtDLFrPqGFncRwBrvFCAqH7ylYQ5aMks7udg
FeEsdEAIOWWOaz0U+I5rz/oPPkK32/PK5rMvjP+87hTNW9pEgZmAxz6YhVS5NIVo

Bug#769395: marked as done (ceph-dkms: module FTBFS for kernel 3.16.0-4)

Your message dated Sun, 30 Oct 2016 17:47:38 +0200
with message-id <20161030154738.5jc22s46hyrk2...@bunk.spdns.de>
and subject line ceph-dkms has been removed from experimental
has caused the Debian Bug report #769395,
regarding ceph-dkms: module FTBFS for kernel 3.16.0-4
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
769395: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=769395
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: ceph-dkms
Version: 3.14+git20140429-1
Severity: serious

The module fails to build for a recent kernel:

/var/lib/dkms/ceph/3.14+git20140429/build/ceph/file.c:740:4: error: implicit 
declaration of function 'iov_iter_copy_from_user' 
[-Werror=implicit-function-declaration]
/var/lib/dkms/ceph/3.14+git20140429/build/ceph/file.c:833:4: error: implicit 
declaration of function 'generic_segment_checks' 
[-Werror=implicit-function-declaration]
/var/lib/dkms/ceph/3.14+git20140429/build/ceph/file.c:857:3: error: implicit 
declaration of function 'generic_file_aio_read' 
[-Werror=implicit-function-declaration]
/var/lib/dkms/ceph/3.14+git20140429/build/ceph/file.c:982:3: error: implicit 
declaration of function 'generic_file_buffered_write' 
[-Werror=implicit-function-declaration]
/var/lib/dkms/ceph/3.14+git20140429/build/ceph/file.c:1289:18: error: 
'generic_file_splice_write' undeclared here (not in a function)

Andreas


make.log.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---
ceph-dkms has been removed from experimental.

cu
Adrian

-- 

   "Is there not promise of rain?" Ling Tan asked suddenly out
of the darkness. There had been need of rain for many days.
   "Only a promise," Lao Er said.
   Pearl S. Buck - Dragon Seed--- End Message ---

Bug#842586: git: FTBFS on mips64el (fatal: Out of memory, getdelim failed)

2016-10-30 Thread Bas Couwenberg

Source: git
Version: 1:2.10.2-1
Severity: serious
Justification: makes the package in question unusable or mostly so

Dear Maintainer,

The recent git upload FTBFS on mips64el due to OOM, the missing build on
mips64el is preventing the qgis rebuild as part of the ongoing gdal
transition (#842288).

The build was performed on mipsel-manda-02 which is known to have issues
like these (although git built successfully on this buildd before).
Perhaps a rebuild on another buildd will be sufficient.

Kind Regards,

Bas

Processed: Mark as forwarded

Processing commands for cont...@bugs.debian.org:

> forwarded 837638 https://github.com/mhfs/devise-async/issues/94
Bug #837638 [ruby-devise-async] ruby-devise-async: Incompatible with 
ruby-devise 4
Bug #837644 [ruby-devise-async] ruby-devise-async is not compatible with devise 
>= 4.0
Set Bug forwarded-to-address to 
'https://github.com/mhfs/devise-async/issues/94'.
Set Bug forwarded-to-address to 
'https://github.com/mhfs/devise-async/issues/94'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
837638: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837638
837644: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837644
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#841420: --enable-default-pie breaks kernel builds

2016-10-30 Thread Sven C. Dack


On Sun, 30 Oct 2016 14:41:18 + "Sven C. Dack"  wrote:
> On Fri, 21 Oct 2016 08:07:03 -0500 "S. R. Wright"  wrote:
> > I agree with Eric; while the workaround is to back rev the gcc and its
> > associated packages, I also build kernels straight from kernel.org,
> > usually within hours of their availability and this has been working for
> > me for many years, and it is not sufficient to justify this change by
> > saying doing so "isn't a good idea." A change of functionality of this
> > scope warrants a minor version number increase, this change was not
> > merely a bug fix.
> >
> > As the kernel is the most important code gcc is ever likely to compile
> > on debian or any other distro for that matter, this change should be
> > backed out, and not reintroduced UNTIL the *official* kernel source is
> > ready for it.
> >
> > -- sRw
>
> I'm seeing the same failure and agree with the above statements.
>
> Please note that a vanilla gcc-6 can compile a vanilla kernel, and so should
> Debian's gcc-6.
>
> Sven C.
>

To add to this, enabling -fpie and -fPIE per default for *ALL* compilations can 
only be a mistake.


Position independent code when generated with -fpic, -fPIC, -fpie or -fPIE, is 
commonly slower (by 3%-5%) than normal code. Enabling it as the default for 
everything will certainly lead to a performance regression for the entire Debian 
distribution and beyond.


Sven C.

Bug#841420: --enable-default-pie breaks kernel builds

2016-10-30 Thread Sven C. Dack


On Fri, 21 Oct 2016 08:07:03 -0500 "S. R. Wright"  wrote:
> I agree with Eric; while the workaround is to back rev the gcc and its
> associated packages, I also build kernels straight from kernel.org,
> usually within hours of their availability and this has been working for
> me for many years, and it is not sufficient to justify this change by
> saying doing so "isn't a good idea." A change of functionality of this
> scope warrants a minor version number increase, this change was not
> merely a bug fix.
>
> As the kernel is the most important code gcc is ever likely to compile
> on debian or any other distro for that matter, this change should be
> backed out, and not reintroduced UNTIL the *official* kernel source is
> ready for it.
>
> -- sRw

I'm seeing the same failure and agree with the above statements.

Please note that a vanilla gcc-6 can compile a vanilla kernel, and so should 
Debian's gcc-6.


Sven C.

Bug#841763: unattended-upgrades: Breaks hard when apt is upgraded

2016-10-30 Thread Michael Vogt

On Sun, Oct 23, 2016 at 01:55:37PM +0200, Alexandre Detiste wrote:
> Le dimanche 23 octobre 2016, 13 h 43 min 59 s CEST Santiago Vila a écrit :
> > Aha! I can reproduce this too. On the machines where this happens,
> > I believe I answered "yes" to a debconf question about restarting
> > services automatically (one of the times I upgraded by hand and not
> > using unattended-upgrades).
> > 
> > Maybe something like this would work as a workaround?
> > 
> > echo "libc6 libraries/restart-without-asking boolean false" | 
> > debconf-set-selections
> > 
> > Thanks a lot.
> 
> Hi,
> 
> I think that adding this snippet to apt's debian/rules would fix this problem,
> not tested tough.
> 
> 
> 
> override_dh_systemd_start:
> dh_systemd_start apt-daily.timer
> 

Yes, I think you are right. This appears to be what is happening. I
have commited this fix to git and it will be part of the next upload.

Thanks,
 Michael

> 
> Without this override, we get this: apt got -daily.service got "try-restart"ed
> bit this statement in atp.postinst:
> -
> 
> 
> # Automatically added by dh_systemd_start
> if [ -d /run/systemd/system ]; then
> systemctl --system daemon-reload >/dev/null || true
> if [ -n "$2" ]; then
> _dh_action=try-restart
> else
> _dh_action=start
> fi
> deb-systemd-invoke $_dh_action apt-daily.service apt-daily.timer 
> >/dev/null || true
> fi
> # End automatically added section
> 
> 
> 
> 
> Greets,
> 
> Alexandre Detiste

Bug#798080: mysql-server-5.6: service stop hangs forever on systemd -- fixed upstream

2016-10-30 Thread Jonas Meurer

Control: notfixed -1 5.6.30-1

Hello,

On Sun, 2 Oct 2016 15:07:31 -0400 "William L. DeRieux IV" wrote:
> I had an older version installed and could confirm the issue existed;
> but as of v5.6.30-1 this is no longer an issue.

unfortunately, this bug seems to be not fixed in the MySQL 5.6 packages
in Sid/Stretch. The systemd unit still uses mysqld_safe there and as a
result, systemd seems to fail to stop the MySQL daemon in certain
circumstances.

Giving mysqld directly to systemd (as done in the new mysql-5.7
packages) fixes this bug:

ExecStart=/usr/sbin/mysqld

Cheers,
 jonas

signature.asc
Description: OpenPGP digital signature

Processed: Re: mysql-server-5.6: service stop hangs forever on systemd -- fixed upstream

Processing control commands:

> notfixed -1 5.6.30-1
Bug #798080 [mysql-server-5.6] mysql-server-5.6: service stop hangs forever on 
systemd
No longer marked as fixed in versions mysql-5.6/5.6.30-1.

-- 
798080: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798080
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842576: (caja:1599): Gtk-ERROR

2016-10-30 Thread Vangelis Mouhtsis

Package: caja
Version: 1.16.1-1
Severity: serious
Justification: must

(caja:1599): Gtk-ERROR **: GTK+ 2.x symbols detected. Using GTK+ 2.x and GTK+ 3
in the same process is not supported
Trap Trace/breakpoint



-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.7.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=el_GR.UTF-8, LC_CTYPE=el_GR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages caja depends on:
ii  caja-common   1.16.1-1
ii  desktop-file-utils0.23-1
ii  gvfs  1.30.1.1-1
ii  libatk1.0-0   2.22.0-1
ii  libc6 2.24-5
ii  libcairo-gobject2 1.14.6-1+b1
ii  libcairo2 1.14.6-1+b1
ii  libcaja-extension11.16.1-1
ii  libexempi32.3.0-2
ii  libexif12 0.6.21-2
ii  libgail-3-0   3.22.2-1
ii  libgdk-pixbuf2.0-02.36.0-1
ii  libglib2.0-0  2.50.1-1
ii  libglib2.0-data   2.50.1-1
ii  libgtk-3-03.22.2-1
ii  libice6   2:1.0.9-1+b1
ii  libmate-desktop-2-17  1.16.1-1
ii  libpango-1.0-01.40.3-2
ii  libpangocairo-1.0-0   1.40.3-2
ii  libselinux1   2.5-3
ii  libsm62:1.2.2-1+b1
ii  libstartup-notification0  0.12-4
ii  libunique-3.0-0   3.0.2-2
ii  libx11-6  2:1.6.3-1
ii  libxext6  2:1.3.3-1
ii  libxml2   2.9.4+dfsg1-2
ii  libxrender1   1:0.9.9-2
ii  mate-desktop  1.16.1-1
ii  shared-mime-info  1.7-1

Versions of packages caja recommends:
ii  gvfs-backends  1.30.1.1-1

Versions of packages caja suggests:
ii  engrampa1.16.0-1
ii  gstreamer1.0-tools  1.8.3-1
pn  meld

-- no debconf information

-- debsums errors found:
debsums: changed file /usr/bin/caja (from caja package)

Bug#842452: FTBFS depdnding on docs/apibuild.py timestamp (api docs not buildable)

2016-10-30 Thread Ian Jackson

Santiago Vila writes ("Re: Bug#842452: FTBFS depdnding on docs/apibuild.py 
timestamp (api docs not buildable)"):
> On Sat, Oct 29, 2016 at 09:24:35PM +0100, Ian Jackson wrote:
> > The reason I think it's RC is that it demonstrates that the
> > documentation files shipped in the package are not buildable from
> > source (at least, using tools in the current version of Debian
> > unstable main).
> 
> IMO, it does not demonstrate that the files are unbuildable.
> 
> It is completely possible that they are indeed buildable from source,
> but using additional build-depeds.

You're right, of course.  It only demonstrates that the docs are
_probably_ unbuildable.  To me, the error message doesn't seem to
indicate a missing build-dependency.  I'd be happy to be shown to be
wrong.

> In this case: are the existence of "apibuild.py.stamp" and the
> references to apibuild.py in the Makefile not a good indication that
> maybe you can't just modify apibuild.py and expect everything to work?

I thought those were probably accidental.  It doesn't seem likely to
me that the maintainers intend this situation.

So, anyway: if the maintainers want to downgrade this bug then frankly
I won't take it any further.  I do think that recent discussions about
non-buildable js files etc. have shown that, on the whole, the project
thinks that stuff in .debs should be built from source; and that when
the provided source does not produce the stuff in the .debs, that's an
RC bug.

But as I say I don't have any interest in making a fight out of this.
I filed the bug because I thought the Debian libvirt maintainers
probably didn't intend this situation and would like to know about
it.  I gave it the severity I thought was appropriate not in order to
be aggressive but just because that's what one does with bug reports.

Thanks,
Ian.

-- 
Ian Jackson    These opinions are my own.

If I emailed you from an address @fyvzl.net or @evade.org.uk, that is
a private address which bypasses my fierce spamfilter.

Bug#839603: Problem was already deal with a binNMU

2016-10-30 Thread jose

The problem in this defect was already fixed by a binNMU.  But anyway I 
have a new amanda_3.3.9-2 that closes this defect.

Bug#842572: FTBFS: newer persistent

2016-10-30 Thread Clint Adams

Package: git-annex
Version: 6.20161012-1
Severity: serious

git-annex no longer build in sid because we have moved to ghc 8 and with
it persistent 2.6.

The reason git-annex conflicts with newer persistent is because esqueleto's
upstream is MIA.  However, we have patched our version of esqueleto to
work with persistent 2.6, so git-annex.cabal could have a Debian patch
along the lines of

-   persistent (< 2.5),
+   persistent >= 2.5 && < 2.7,

HTH

Bug#828232: Package ready, waiting for sponsor

2016-10-30 Thread jose

I have a new amanda_3.3.9-2 that fix this bug.  I am waiting for my 
sponsor to review and upload it.


Kind regards

Bug#842570: libxslt: CVE-2016-4738: possible heap overread

Source: libxslt
Version: 1.1.28-2
Severity: grave
Tags: security upstream patch

Hi,

the following vulnerability was published for libxslt.

CVE-2016-4738[0]:
| libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and
| watchOS before 3 allows remote attackers to execute arbitrary code or
| cause a denial of service (memory corruption) via a crafted web site.

Unfortunately as for many libxml2 issues, the above is not very
specific and there is upstream bug referenced. But the fix is
mentioned as [1].

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2016-4738
[1] 
https://git.gnome.org/browse/libxslt/commit/?id=eb1030de31165b68487f288308f9d1810fed6880

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Bug#828611: [PATCH] Re: Fwd: Bug#828611: xymon: Fails to build from source with OpenSSL 1.1.0

2016-10-30 Thread Axel Beckert

Hi,

Axel Beckert wrote:
> this has been reported in Debian at https://bugs.debian.org/828611
[...]
> OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
> OpenSSL this package fail to build.  A log of that build can be found at:
> https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/xymon_4.3.27-1_amd64-20160529-1558
> 
> On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of 
> the
> reasons why it might fail.  There are also updated man pages at
> https://www.openssl.org/docs/manmaster/ that should contain useful 
> information.

While it took quite a while to figure it out, the patch to make it
compile again against OpenSSL 1.1.0 is surprisingly tiny:

--- a/xymonnet/contest.c
+++ b/xymonnet/contest.c
@@ -648,7 +648,7 @@

certcn = X509_NAME_oneline(X509_get_subject_name(peercert), NULL, 0);
certissuer = X509_NAME_oneline(X509_get_issuer_name(peercert), NULL, 0);
-   certsigalg = OBJ_nid2ln(OBJ_obj2nid(peercert->sig_alg->algorithm));
+   certsigalg = OBJ_nid2ln(X509_get_signature_nid(peercert));
certstart = strdup(xymon_ASN1_UTCTIME(X509_get_notBefore(peercert)));
certend = strdup(xymon_ASN1_UTCTIME(X509_get_notAfter(peercert)));
{

See also
https://anonscm.debian.org/cgit/collab-maint/xymon.git/tree/debian/patches/81_fix_compilation_with_OpenSSL_1.1+.patch
https://anonscm.debian.org/cgit/collab-maint/xymon.git/plain/debian/patches/81_fix_compilation_with_OpenSSL_1.1+.patch

I've got one (currently non-productive) Xymon server on a Raspberry Pi
running(*) Debian Unstable with that patch and xymonnet properly
reported SSL certificate and https:// URL states so far. So I believe,
that patch is sufficient and working, despite I have not much of an
idea what it actually does. I took the idea for the patch from here:
https://github.com/bukka/php-src/commit/0598a8da2bc005b3a0be2801033b5347020f8316#diff-69bad938d17f4283faa5f7fea17fa627L2174

I would be happy if you could integrate the patch into the (probably
upcoming) 4.3.28 release to allow others to compile Xymon against
OpenSSL 1.1.0+. (And to spread it further to get more testing. :-)

(*) It's currently running with OpenSSL 1.0.2j though, but that proves
that it's at least also backward compatible to 1.0.2. As soon as
Debian Unstable switches to OpenSSL 1.1.0b or later, I'll continue
to test it with that version.

Regards, Axel
-- 
 ,''`.  |  Axel Beckert , http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5
  `-|  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE

signature.asc
Description: Digital signature

Bug#842568: iisemulator: FTBFS when built with dpkg-buildpackage -A (swapped binary-* targets)

Package: src:iisemulator
Version: 0.95-3.1
Severity: serious
Tags: patch

Dear maintainer:

I tried to build this package in stretch with "dpkg-buildpackage -A"
(which is what the "Arch: all" autobuilder would do to build it)
but it failed:


[...]
 fakeroot debian/rules binary-indep
dh_testdir
dh_testroot
dh_clean -k
dh_clean: dh_clean -k is deprecated; use dh_prep instead
dh_installdirs
cp -a iisemul* iis_data wwwroot 
/<>/debian/iisemulator/usr/share/iisemulator
find /<>/debian/iisemulator/usr/share/iisemulator/iis_data -type f 
-exec chmod a-x {} \;
find /<>/debian/iisemulator/usr/share/iisemulator/wwwroot -type f 
-exec chmod a-x {} \;
 dpkg-genchanges --build=all >../iisemulator_0.95-3.1_all.changes
dpkg-genchanges: error: binary build with no binary artifacts found; cannot 
distribute
dpkg-buildpackage: error: dpkg-genchanges gave error exit status 2


This happens because the binary-* targets are swapped.

Trivial patch below.

Thanks.

--- a/debian/rules
+++ b/debian/rules
@@ -49,13 +49,9 @@ install: build
find $(CURDIR)/debian/iisemulator/usr/share/iisemulator/iis_data -type 
f -exec chmod a-x {} \;
find $(CURDIR)/debian/iisemulator/usr/share/iisemulator/wwwroot -type f 
-exec chmod a-x {} \;
 
+binary-arch: build install
 
-# Build architecture-independent files here.
 binary-indep: build install
-# We have nothing to do by default.
-
-# Build architecture-dependent files here.
-binary-arch: build install
dh_testdir
dh_testroot
dh_installdocs

Processed: Re: Bug#842551: gdb fails to build from source in binary NMU

Processing commands for cont...@bugs.debian.org:

> reassign 842551 cdbs
Bug #842551 [src:gdb] gdb fails to build from source in binary NMU
Bug reassigned from package 'src:gdb' to 'cdbs'.
No longer marked as found in versions gdb/7.11.1-2.
Ignoring request to alter fixed versions of bug #842551 to the same values 
previously set
> affects 842551 src:gdb
Bug #842551 [cdbs] gdb fails to build from source in binary NMU
Added indication that 842551 affects src:gdb
> forcemerge 837006 842551
Bug #837006 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837018 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837024 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837220 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837239 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837243 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837244 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837248 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837256 [cdbs] pygtksourceview: FTBFS: 
/usr/share/cdbs/1/class/autotools.mk:44: *** no python implementation resolved 
from binary package "stamp-autotools".  Stop.
Bug #837260 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837266 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837270 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837274 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #837278 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #838359 [cdbs] cdbs: some packages FTBFS with 'no python implementation 
resolved from binary package "stamp-autotools"'
Bug #838592 [cdbs] gnome-python-desktop: FTBFS: autotools.mk:44: *** no python 
implementation resolved from binary package "stamp-autotools".
Bug #839296 [cdbs] gdb: FTBFS: /usr/share/cdbs/1/class/autotools.mk:44: *** no 
python implementation resolved from binary package "stamp-autotools".  Stop.
Bug #841595 [cdbs] gdb: FTBFS: /usr/share/cdbs/1/class/autotools.mk:44: *** no 
python implementation resolved from binary package "stamp-autotools".  Stop.
Bug #842065 [cdbs] sugar: FTBFS: autotools.mk:44: *** no python implementation 
resolved from binary package "stamp-autotools". Stop.
Bug #838592 [cdbs] gnome-python-desktop: FTBFS: autotools.mk:44: *** no python 
implementation resolved from binary package "stamp-autotools".
Removed indication that 838592 affects src:pygtksourceview, src:sugar, src:gdb, 
gdb, and pygtksourceview
Added indication that 838592 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837006 affects src:gdb, src:sugar, src:pygtksourceview, 
pygtksourceview, and gdb
Added indication that 837006 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837018 affects gdb, pygtksourceview, 
src:pygtksourceview, src:gdb, and src:sugar
Added indication that 837018 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837024 affects gdb, pygtksourceview, 
src:pygtksourceview, src:gdb, and src:sugar
Added indication that 837024 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837220 affects gdb, pygtksourceview, 
src:pygtksourceview, src:sugar, and src:gdb
Added indication that 837220 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837239 affects gdb, pygtksourceview, 
src:pygtksourceview, src:sugar, and src:gdb
Added indication that 837239 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837243 affects src:pygtksourceview, src:sugar, src:gdb, 
gdb, and pygtksourceview
Added indication that 837243 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837244 affects src:pygtksourceview, src:sugar, src:gdb, 
gdb, and pygtksourceview
Added indication that 837244 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837248 affects src:pygtksourceview, src:gdb, src:sugar, 
gdb, and pygtksourceview
Added indication that 837248 affects 
src:gdb,src:pygtksourceview,src:sugar,pygtksourceview,gdb
Removed indication that 837256

Bug#819857: marked as done (libmlx4: FTBFS: rc/mlx4.c:206:2: error: 'struct verbs_context' has no member named 'drv_ibv_create_flow' verbs_set_ctx_op(verbs_ctx, drv_ibv_create_flow, ibv_cmd_create

Your message dated Sun, 30 Oct 2016 12:21:42 +
with message-id 
and subject line Bug#819857: fixed in libmlx4 1.2.1-1
has caused the Debian Bug report #819857,
regarding libmlx4: FTBFS: rc/mlx4.c:206:2: error: 'struct verbs_context' has no 
member named 'drv_ibv_create_flow' verbs_set_ctx_op(verbs_ctx, 
drv_ibv_create_flow, ibv_cmd_create_flow);
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
819857: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=819857
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libmlx4
Version: 1.0.6-1
Severity: serious
Justification: fails to build from source
User: reproducible-bui...@lists.alioth.debian.org
Usertags: ftbfs
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Dear Maintainer,

libmlx4 fails to build from source in unstable/amd64:

  [..]

  /bin/bash ./libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I.-g 
-Wall -D_GNU_SOURCE -g -O2 -c -o src/dbrec.lo src/dbrec.c
  libtool: compile:  gcc -DHAVE_CONFIG_H -I. -g -Wall -D_GNU_SOURCE -g -O2 -c 
src/dbrec.c  -fPIC -DPIC -o src/.libs/dbrec.o
  libtool: compile:  gcc -DHAVE_CONFIG_H -I. -g -Wall -D_GNU_SOURCE -g -O2 -c 
src/dbrec.c -o src/dbrec.o >/dev/null 2>&1
  /bin/bash ./libtool  --tag=CC   --mode=compile gcc -DHAVE_CONFIG_H -I.-g 
-Wall -D_GNU_SOURCE -g -O2 -c -o src/mlx4.lo src/mlx4.c
  libtool: compile:  gcc -DHAVE_CONFIG_H -I. -g -Wall -D_GNU_SOURCE -g -O2 -c 
src/mlx4.c  -fPIC -DPIC -o src/.libs/mlx4.o
  In file included from src/mlx4.h:37:0,
   from src/mlx4.c:45:
  src/mlx4.c: In function 'mlx4_init_context':
  src/mlx4.c:206:2: error: 'struct verbs_context' has no member named 
'drv_ibv_create_flow'
verbs_set_ctx_op(verbs_ctx, drv_ibv_create_flow, ibv_cmd_create_flow);
^
  In file included from /usr/include/infiniband/driver.h:38:0,
   from src/mlx4.h:39,
   from src/mlx4.c:45:
  src/mlx4.c:206:2: error: 'struct verbs_context' has no member named 
'drv_ibv_create_flow'
verbs_set_ctx_op(verbs_ctx, drv_ibv_create_flow, ibv_cmd_create_flow);
^
  In file included from src/mlx4.h:37:0,
   from src/mlx4.c:45:
  src/mlx4.c:207:2: error: 'struct verbs_context' has no member named 
'drv_ibv_destroy_flow'
verbs_set_ctx_op(verbs_ctx, drv_ibv_destroy_flow, ibv_cmd_destroy_flow);
^
  In file included from /usr/include/infiniband/driver.h:38:0,
   from src/mlx4.h:39,
   from src/mlx4.c:45:
  src/mlx4.c:207:2: error: 'struct verbs_context' has no member named 
'drv_ibv_destroy_flow'
verbs_set_ctx_op(verbs_ctx, drv_ibv_destroy_flow, ibv_cmd_destroy_flow);
^
  Makefile:516: recipe for target 'src/mlx4.lo' failed
  make[2]: *** [src/mlx4.lo] Error 1
  make[2]: Leaving directory 
'/home/lamby/temp/cdt.20160403080959.UdWjm2HKVI/libmlx4-1.0.6'
  Makefile:372: recipe for target 'all' failed
  make[1]: *** [all] Error 2
  make[1]: Leaving directory 
'/home/lamby/temp/cdt.20160403080959.UdWjm2HKVI/libmlx4-1.0.6'
  dh_auto_build: make -j1 returned exit code 2
  debian/rules:5: recipe for target 'build' failed
  make: *** [build] Error 2

  [..]

The full build log is attached.


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-


libmlx4.1.0.6-1.unstable.amd64.log.txt.gz
Description: Binary data
--- End Message ---
--- Begin Message ---
Source: libmlx4
Source-Version: 1.2.1-1

We believe that the bug you reported is fixed in the latest version of
libmlx4, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 819...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Ana Beatriz Guerrero Lopez  (supplier of updated libmlx4 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 12:59:48 +0100
Source: libmlx4
Binary: libmlx4-1 libmlx4-dev
Architecture: source amd64
Version: 1.2.1-1
Distribution: unstable
Urgency: medium
Maintainer: OFED and Debian Development and Discussion 

Changed-By: Ana Beatriz

Bug#842551: gdb fails to build from source in binary NMU

reassign 842551 cdbs
affects 842551 src:gdb
forcemerge 837006 842551
thanks

On Sun, Oct 30, 2016 at 11:47:16AM +0100, Matthias Klose wrote:
> Package: src:gdb
> Version: 7.11.1-2
> Severity: serious
> Tags: sid stretch
> 
> According to
> https://buildd.debian.org/status/fetch.php?pkg=gdb=amd64=7.11.1-2%2Bb1=1476144043
> 
> gdb fails to build from source on all architectures:
> [...]
> /usr/share/cdbs/1/class/autotools.mk:44: *** no python implementation resolved

This is a bug in cdbs and it was already visible in the BTS web page for gdb:

https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=gdb

Thanks.

Bug#828607: The Shibboleth stack can't switch to OpenSSL 1.1 yet

2016-10-30 Thread Ferenc Wágner

Hi Kurt,

Unfortunately it doesn't look like we could switch to OpenSSL 1.1 in the
full Shibboleth stack for stretch.  For upstream's take on the matter see
https://lists.alioth.debian.org/pipermail/pkg-shibboleth-devel/2016-October/004315.html.
I hope you can keep 1.0 in some form for now.
-- 
Thanks,
Feri

Bug#842564: tzdata-java install fails - depend is tzdata=2016f-0+deb8u1 but should be tzdata>=2016f-0+deb8u1

2016-10-30 Thread Chris

Package: tzdata-java
Version: 2016f-0+deb8u1
Severity: grave
Justification: renders package unusable

Dear Maintainer,

when I try to install `tzdata-java` (or any package that depends on it) on my 
"out of the box" Jessie 8.6 stable system, it fails because of an "impossible" 
dependeny. This is because `tzdata` depends on tzdata (= 2016f-0+deb8u1), which 
is outdated. I would assume that this is a bug and that it should actually be 
depending on tzdata (>= 2016f-0+deb8u1) ?

How to reproduce:
`apt-get install tzdata-java`

Workaround:
- `apt-get download tzdata-java`
- `dpkg -i --ignore-depends=tzdata-java,tzdata 
tzdata-java_2016f-0+deb8u1_all.deb`
- edit `/var/lib/dpkg/status` and change `Depends` line for package 
`tzdata-java` to: `tzdata (>= 2016f-0+deb8u1)` (instead of: `tzdata (= 
2016f-0+deb8u1)`.
- afterwards packages that the depend on `tzdata-java` install fine

Thanks for your time and effort.

-- System Information:
Debian Release: 8.6
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/24 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages tzdata-java depends on:
ii  tzdata  2016h-0+deb8u1

tzdata-java recommends no packages.

tzdata-java suggests no packages.

-- no debconf information

Bug#835125: marked as done (jqueryui: Wrong licensing information: Licensed under MIT, not GPL-2)

Your message dated Sun, 30 Oct 2016 12:19:21 +
with message-id 
and subject line Bug#835125: fixed in jqueryui 1.12.1+dfsg-1
has caused the Debian Bug report #835125,
regarding jqueryui: Wrong licensing information: Licensed under MIT, *not* GPL-2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
835125: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=835125
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: jqueryui
Version: 1.10.1+dfsg
Severity: serious
Justification: Policy 2.3

The package's debian/copyright mentions all of the contents as being
licensed udner "GPL-2 or MIT", but they are exclusively licensed under
the MIT:

$ grep -ri 'gnu' . --exclude-dir=debian
Binary file ./development-bundle/demos/position/images/rocket.jpg matches
./development-bundle/demos/autocomplete/search.php:"Mute Swan"=>"Cygnus 
olor",
./development-bundle/demos/autocomplete/search.php:"Bewick`s Swan"=>"Cygnus 
bewickii",
./development-bundle/demos/autocomplete/search.php:"Whooper Swan"=>"Cygnus 
cygnus",
./development-bundle/demos/autocomplete/search.php:"Whistling 
Swan"=>"Cygnus columbianus",
$ grep -ri gpl . --exclude-dir=debian
./development-bundle/AUTHORS.txt:Garrison Locke 
$ grep -ri 'public license' . --exclude-dir=debian
$

Please fix this information. Thanks!

-- System Information:
Debian Release: stretch/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
--- End Message ---
--- Begin Message ---
Source: jqueryui
Source-Version: 1.12.1+dfsg-1

We believe that the bug you reported is fixed in the latest version of
jqueryui, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 835...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers  (supplier of updated jqueryui package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 11:08:03 +0100
Source: jqueryui
Binary: libjs-jquery-ui libjs-jquery-ui-docs
Architecture: source
Version: 1.12.1+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers 

Changed-By: Paul Gevers 
Description:
 libjs-jquery-ui - JavaScript UI library for dynamic web applications
 libjs-jquery-ui-docs - Documentation for JQuery-UI
Closes: 720556 730015 829073 835125
Changes:
 jqueryui (1.12.1+dfsg-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #730015, #829073)
 - Fixes CVE-2016-7103 cross site scripting (XSS) vulnerability in the
   closeText parameter of the dialog function
   * Added myself to uploaders
   * Update d/watch and use Files-excluded in d/copyright instead of
 get-orig-source target
   * Build jquery-ui.js and jquery-ui.css from source with manual created
 build system (until Debian has grunt)
 - total rework of how the package is built
   * Add add_missing_semicolon.patch to prevent mismatch (apparently grunt
 fixes this automatically)
   * Add match_css_source_to_release.patch to let Debian's jquery-ui.css
 match the one released upstream
   * Add use_system_files_in_examples.patch to let the examples use system
 files as the relative locations don't exist
   * Bump jQuery dependency to 1.7
   * Bump Standards (no changes)
   * Add symlinks from the old default theme location to the new to avoid
 breakage
   * Update copyright file (Closes: #835125)
   * Provide minified versions of i18n datepicker files (Closes: #720556)
Checksums-Sha1:
 a6bd4536c557f9b3ea6623b02ad558b2f3eb8230 1779 jqueryui_1.12.1+dfsg-1.dsc
 548e338a77a9ccc2594a154c5b02508bbe2420c0 696380 
jqueryui_1.12.1+dfsg.orig.tar.gz
 77b2739fb136cccfa95c5b77e7552a2ee60e9e9c 117800 
jqueryui_1.12.1+dfsg-1.debian.tar.xz
Checksums-Sha256:
 4baaa911302e535d2f0e0e3be2daedb761d8addd9ad54d768e7e814d8a536942 1779

Bug#828382: marked as done (libapache2-mod-qos: FTBFS with openssl 1.1.0)

Your message dated Sun, 30 Oct 2016 12:04:37 +
with message-id 
and subject line Bug#828382: fixed in libapache2-mod-qos 11.32-1
has caused the Debian Bug report #828382,
regarding libapache2-mod-qos: FTBFS with openssl 1.1.0
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828382: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828382
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: libapache2-mod-qos
Version: 11.28-1
Severity: important
Control: block 827061 by -1

Hi,

OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
OpenSSL this package fail to build.  A log of that build can be found at:
https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/libapache2-mod-qos_11.28-1_amd64-20160529-1439

On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of the
reasons why it might fail.  There are also updated man pages at
https://www.openssl.org/docs/manmaster/ that should contain useful information.

There is a libssl-dev package available in experimental that contains a recent
snapshot, I suggest you try building against that to see if everything works.

If you have problems making things work, feel free to contact us.


Kurt
--- End Message ---
--- Begin Message ---
Source: libapache2-mod-qos
Source-Version: 11.32-1

We believe that the bug you reported is fixed in the latest version of
libapache2-mod-qos, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 828...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sergey B Kirpichev  (supplier of updated 
libapache2-mod-qos package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 13:55:33 +0300
Source: libapache2-mod-qos
Binary: libapache2-mod-qos
Architecture: source amd64
Version: 11.32-1
Distribution: unstable
Urgency: medium
Maintainer: Sergey B Kirpichev 
Changed-By: Sergey B Kirpichev 
Description:
 libapache2-mod-qos - quality of service module for the apache2
Closes: 828382
Changes:
 libapache2-mod-qos (11.32-1) unstable; urgency=medium
 .
   * Imported Upstream version 11.32 (Closes: #828382)
   * Fix spelling (from lintian)
Checksums-Sha1:
 93355cc1222db9c95cba0f47091a47e57c98337a 2084 libapache2-mod-qos_11.32-1.dsc
 0ff171b99158fe15325a9ef769af9d5b4bcb3e3d 532548 
libapache2-mod-qos_11.32.orig.tar.gz
 41740de70cb41630755b0122e772c699f65109da 8488 
libapache2-mod-qos_11.32-1.debian.tar.xz
 75c65d27d66cbdd0fffd64abaebfa3d2e81c63b0 355600 
libapache2-mod-qos-dbgsym_11.32-1_amd64.deb
 52cb9cabb5c0a599ae264441b00044ad192340d3 208378 
libapache2-mod-qos_11.32-1_amd64.deb
Checksums-Sha256:
 054762b13d06b44b9f41bcda286dc436e01cc386d2c35a21d2809e48d930 2084 
libapache2-mod-qos_11.32-1.dsc
 61bbeae145ee886c646bddf467663aa085e69b0517a58a3fdabc6e58ab9c2a2b 532548 
libapache2-mod-qos_11.32.orig.tar.gz
 75e91e26be093b62e6613c9f8b56dfe29250ad10846baba7c0965862def2dd62 8488 
libapache2-mod-qos_11.32-1.debian.tar.xz
 81c9d3e76af23db71c6b910a7fbb4843fa179d4225fdd2923ed3e9965d75a373 355600 
libapache2-mod-qos-dbgsym_11.32-1_amd64.deb
 c1d410493d6c8c2784aacb7c0c11b70e1717168b549d2abbdfbec946cb1353c0 208378 
libapache2-mod-qos_11.32-1_amd64.deb
Files:
 11fb5e32ff3c209316ccf7776bc4807f 2084 httpd extra 
libapache2-mod-qos_11.32-1.dsc
 08fbd291309a3fd39ce61bc67e7802df 532548 httpd extra 
libapache2-mod-qos_11.32.orig.tar.gz
 24882386c35ab486290afa6ef5cd3018 8488 httpd extra 
libapache2-mod-qos_11.32-1.debian.tar.xz
 58d9c53f35e7a0f1c1b8272d54e5b607 355600 debug extra 
libapache2-mod-qos-dbgsym_11.32-1_amd64.deb
 dbfc73e5e6bff1b2574b27b776962970 208378 httpd extra 
libapache2-mod-qos_11.32-1_amd64.deb

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQIcBAEBCAAGBQJYFdrmAAoJEDnJoLZAJirwDkMQAJ+HzXYX939NzrAA22qFkOg2
ckUjas8Qz8jzkY4kVcJBQ8GPJkiI1jxt5ynzPRYKHP6365Hyl1+5F00ihKM6Uk11
S6xVO/duJBtievrObvHJk9jReSl7aPBbjeASK11+TGjrUjUqCmAfnFFPp7xFNr4C
9VCu2w4uikZTJe9NVjymUMeusTgAp8CS2pnSR8HWrlcvBFP05X9R/1jTnGM+42Br
u1RFEGtu0ycjGcClYOerHOjtaE58epebXGrFBenJZ50k2Uxhf0sV7U6bubE5icYv

Bug#842513: vlc: immediate crash on launch on powerpc

2016-10-30 Thread James Cowgill

Control: tags -1 - help
Control: severity -1 important
Control: retitle -1 vlc: should prevent installation on powerpc G3

Hi,

On 30/10/16 00:16, Robert Ou wrote:
> On Sat, Oct 29, 2016 at 3:43 PM, James Cowgill  wrote:
>> Control: tags -1 help
>> Control: severity -1 grave
>>
>> Hi,
>>
>> On 29/10/16 23:00, Robert Ou wrote:
>>> Package: src:vlc
>>> Version: 2.2.4-7
>>> Severity: normal
>>>
>>> Dear Maintainer,
>>>
>>> I decided I wanted to test the performance of Debian PowerPC on my
>>> ancient iMac, and I discovered that vlc will immediately crash with an
>>> illegal instruction right after showing the "Privacy and Network Access
>>> Policy" window and before showing the main window. The crashes look like
>>> the following:
>>>
>>> [ 1560.952016] vlc[997]: unhandled signal 4 at 0ea48f58 nip 0ea48f58 lr 
>>> 0ea48f4c code 30001
>>
>> As powerpc is a release architecture, this bug is RC.
>>
>> I tried running vlc on partch. It managed to get further, but then
>> segfaulted inside QT so it's probably a separate issue. I also had to
>> run it in xvfb so it probably gets different results.
>>
>> Specifically what powerpc hardware do you have? Could you run vlc within
>> gdb to determine which instruction it SIGILLs on (try 'layout asm')?
> 
> I was testing on a first-generation iMac with a 333 MHz PowerPC 750
> (G3). Running vlc under gdb shows that the crash occurs in
> libqt4_plugin.so in QRect::adjusted. The crash occurs on a "lvx
> v0,r10,r5" opcode, which is an Altivec opcode. The G3 however does not
> support Altivec. Here is a backtrace and some more debug information:

This explains it. From the PowerPC FAQ:
https://wiki.debian.org/PowerPC/FAQ#VLC_crashes_on_startup._What.27s_up_with_that.3F

"
If VLC immediately crashes, it's probably because you're on a G3 and
VLC was compiled with Altivec instructions. To use VLC on a G3, you
must compile it with the configure option --disable-altivec.
"

Having said that, I think adding something to vlc's preinst to prevent
installation on systems without altivec would be a good idea here.

I'm not sure going through all the trouble of compiling vlc twice so it
works on the G3 is worth it here - especially since powerpc may not be
a release architecture in 24 hours...

Thanks,
James



signature.asc
Description: OpenPGP digital signature

Processed: Re: Bug#842513: vlc: immediate crash on launch on powerpc

Processing control commands:

> tags -1 - help
Bug #842513 [src:vlc] vlc: immediate crash on launch on powerpc
Removed tag(s) help.
> severity -1 important
Bug #842513 [src:vlc] vlc: immediate crash on launch on powerpc
Severity set to 'important' from 'grave'
> retitle -1 vlc: should prevent installation on powerpc G3
Bug #842513 [src:vlc] vlc: immediate crash on launch on powerpc
Changed Bug title to 'vlc: should prevent installation on powerpc G3' from 
'vlc: immediate crash on launch on powerpc'.

-- 
842513: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842513
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: Re: gitlab-workhorse: FTBFS: src/gitlab.com/gitlab-org/gitlab-workhorse/internal/api/api.go:136: undefined: jwt.NewWithClaims

Processing control commands:

> tags -1 pending
Bug #841617 [src:gitlab-workhorse] gitlab-workhorse: FTBFS: 
src/gitlab.com/gitlab-org/gitlab-workhorse/internal/api/api.go:136: undefined: 
jwt.NewWithClaims
Added tag(s) pending.

-- 
841617: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=841617
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#841617: gitlab-workhorse: FTBFS: src/gitlab.com/gitlab-org/gitlab-workhorse/internal/api/api.go:136: undefined: jwt.NewWithClaims

2016-10-30 Thread Pirate Praveen

Control: tags -1 pending

On Fri, 21 Oct 2016 15:46:23 +0200 Lucas Nussbaum  wrote:
> > src/gitlab.com/gitlab-org/gitlab-workhorse/internal/api/api.go:136: 
> > undefined: jwt.NewWithClaims
> > src/gitlab.com/gitlab-org/gitlab-workhorse/internal/api/api.go:136: 
> > undefined: jwt.StandardClaims

Waiting for golang-github-dgrijalva-jwt-go-v3 to clear NEW.



signature.asc
Description: OpenPGP digital signature

Bug#804442: marked as done (python-memory-profiler: FTBFS: NameError: name 'profile' is not defined)

Your message dated Sun, 30 Oct 2016 11:19:19 +
with message-id 
and subject line Bug#804442: fixed in python-memory-profiler 0.41+git20161018-1
has caused the Debian Bug report #804442,
regarding python-memory-profiler: FTBFS: NameError: name 'profile' is not 
defined
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
804442: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=804442
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: python-memory-profiler
Version: 0.31+git20141019-1
Severity: serious
Justification: fails to build from source
User: reproducible-bui...@lists.alioth.debian.org
Usertags: ftbfs
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Dear Maintainer,

python-memory-profiler fails to build from source in unstable/amd64:

  [..]

  
  ==
  ERROR: test.test_precision_command_line
  (unittest.loader.ModuleImportFailure)
  --
  ImportError: Failed to import test module:
  test.test_precision_command_line
  Traceback (most recent call last):
File "/usr/lib/python2.7/unittest/loader.py", line 254, in
_find_tests
  module = self._get_module_from_name(name)
File "/usr/lib/python2.7/unittest/loader.py", line 232, in
_get_module_from_name
  __import__(name)
File "test/test_precision_command_line.py", line 11, in 
  @profile(precision=4)
  NameError: name 'profile' is not defined
  
  
  --
  Ran 7 tests in 0.001s
  
  FAILED (errors=7)
  E: pybuild pybuild:274: test: plugin distutils failed with: exit
  code=1: cd
  /build/python-memory-profiler-0.31+git20141019/.pybuild/pythonX.Y_2.7/build;
  python2.7 -m unittest discover -v 
  dh_auto_test: pybuild --test -i python{version} -p 2.7 --dir .
  returned exit code 13
  debian/rules:8: recipe for target 'build' failed
  make: *** [build] Error 25
  dpkg-buildpackage: error: debian/rules build gave error exit status 2

  [..]

The full build log is attached or can be viewed here:


https://reproducible.debian.net/logs/unstable/amd64/python-memory-profiler_0.31+git20141019-1.build1.log.gz


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-


python-memory-profiler.0.31+git20141019-1.unstable.amd64.log.txt.gz
Description: application/gzip
--- End Message ---
--- Begin Message ---
Source: python-memory-profiler
Source-Version: 0.41+git20161018-1

We believe that the bug you reported is fixed in the latest version of
python-memory-profiler, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 804...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Changwoo Ryu  (supplier of updated python-memory-profiler 
package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

Format: 1.8
Date: Sun, 30 Oct 2016 01:32:46 +0900
Source: python-memory-profiler
Binary: python-memory-profiler python3-memory-profiler
Architecture: source
Version: 0.41+git20161018-1
Distribution: unstable
Urgency: medium
Maintainer: Changwoo Ryu 
Changed-By: Changwoo Ryu 
Description:
 python-memory-profiler - memory consumption analysis for Python programs 
(Python 2 build)
 python3-memory-profiler - memory consumption analysis for Python programs 
(Python 3 build)
Closes: 804442
Changes:
 python-memory-profiler (0.41+git20161018-1) unstable; urgency=medium
 .
   * New upstream release
   * debian/*: Clean up the pybuild build (Closes: #804442)
   * debian/*: lintian fixes
 - Standard-Version: 3.9.8
 - Add missing source format
 - Use new https addresses for Vcs-* fields
 - Rename /usr/bin/mprof to /usr/bin/{python,python3}-mprof
   * debian/patches/testsuite-disabled.patch: Disabled some tests
Checksums-Sha1:
 25155add82b546f6ef91f126212a9feecbc5 2275 
python-memory-profiler_0.41+git20161018-1.dsc
 4596a7a413113a64463371ce9b62842bd1241a0c 25857

Processed: mark #811862 as not fixed in unstable

Processing commands for cont...@bugs.debian.org:

> reopen 811862
Bug #811862 {Done: Vincent Legout } [libqalculate] 
libqalculate: FTBFS with GCC 6: no matching function for call to
'reopen' may be inappropriate when a bug has been closed with a version;
all fixed versions will be cleared, and you may need to re-add them.
Bug reopened
No longer marked as fixed in versions libqalculate/0.9.10-1.
> found 811862 0.9.7-9.1
Bug #811862 [libqalculate] libqalculate: FTBFS with GCC 6: no matching function 
for call to
There is no source info for the package 'libqalculate' at version '0.9.7-9.1' 
with architecture ''
Unable to make a source version for version '0.9.7-9.1'
Ignoring request to alter found versions of bug #811862 to the same values 
previously set
> notfound 811862 0.9.10-1
Bug #811862 [libqalculate] libqalculate: FTBFS with GCC 6: no matching function 
for call to
There is no source info for the package 'libqalculate' at version '0.9.10-1' 
with architecture ''
Unable to make a source version for version '0.9.10-1'
Ignoring request to alter found versions of bug #811862 to the same values 
previously set
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
811862: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=811862
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842551: gdb fails to build from source in binary NMU

2016-10-30 Thread Matthias Klose

Package: src:gdb
Version: 7.11.1-2
Severity: serious
Tags: sid stretch

According to
https://buildd.debian.org/status/fetch.php?pkg=gdb=amd64=7.11.1-2%2Bb1=1476144043

gdb fails to build from source on all architectures:

 debian/rules build-arch
test -x debian/rules
mkdir -p "/«PKGBUILDDIR»/build/objdir"
CDBS WARNING:DEB_DH_STRIP_ARGS is deprecated since 0.4.85
set -e;   mv ./config.guess ./config.guess.cdbs-orig; cp --remove-destination
/usr/share/misc/config.guess ./config.guess;   mv
./readline/support/config.guess ./readline/support/config.guess.cdbs-orig; cp
--remove-destination /usr/share/misc/config.guess 
./readline/support/config.guess;
set -e;   mv ./readline/support/config.sub
./readline/support/config.sub.cdbs-orig; cp --remove-destination
/usr/share/misc/config.sub ./readline/support/config.sub;   mv ./config.sub
./config.sub.cdbs-orig; cp --remove-destination /usr/share/misc/config.sub
./config.sub;
touch debian/stamp-autotools-files
/usr/share/cdbs/1/class/autotools.mk:44: *** no python implementation resolved
from binary package "stamp-autotools".  Stop.
dpkg-buildpackage: error: debian/rules build-arch gave error exit status 2

Bug#828598: marked as done (webcit: FTBFS with openssl 1.1.0)

Your message dated Sun, 30 Oct 2016 10:20:47 +
with message-id 
and subject line Bug#828598: fixed in webcit 902-dfsg-2
has caused the Debian Bug report #828598,
regarding webcit: FTBFS with openssl 1.1.0
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828598: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828598
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: webcit
Version: 902-dfsg-1
Severity: important
Control: block 827061 by -1

Hi,

OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
OpenSSL this package fail to build.  A log of that build can be found at:
https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/webcit_902-dfsg-1_amd64-20160529-1551

On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of the
reasons why it might fail.  There are also updated man pages at
https://www.openssl.org/docs/manmaster/ that should contain useful information.

There is a libssl-dev package available in experimental that contains a recent
snapshot, I suggest you try building against that to see if everything works.

If you have problems making things work, feel free to contact us.


Kurt
--- End Message ---
--- Begin Message ---
Source: webcit
Source-Version: 902-dfsg-2

We believe that the bug you reported is fixed in the latest version of
webcit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 828...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Meskes  (supplier of updated webcit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 09:55:18 +0100
Source: webcit
Binary: citadel-webcit webcit-dbg citadel-suite
Architecture: source all amd64
Version: 902-dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Citadel Team 
Changed-By: Michael Meskes 
Description:
 citadel-suite - complete and feature-rich groupware server; metapackage for 
full
 citadel-webcit - web-based frontend to Citadel groupware server
 webcit-dbg - web-based frontend to Citadel - debugging symbols
Closes: 828598
Changes:
 webcit (902-dfsg-2) unstable; urgency=medium
 .
   * Use SSL compatibility API. (Closes: #828598)
   * Added dependency on lsb-base.
Checksums-Sha1:
 8d186be602e960f03f7aac82224113fcfcdae922 2235 webcit_902-dfsg-2.dsc
 5edbe06db461889cb3e5ae76510ae90237062e19 25558 webcit_902-dfsg-2.diff.gz
 a79ab1ae45e2bde2a9ef5d97e826736686230f46 8096 citadel-suite_902-dfsg-2_all.deb
 8351d9ee90eb0b5eaaed7048fb6ea837b1e6aeab 754972 
citadel-webcit_902-dfsg-2_amd64.deb
 81be174982aaad5130496c97fef90c567d21bf4d 1435696 
webcit-dbg_902-dfsg-2_amd64.deb
Checksums-Sha256:
 4c551360d301baf2768ffb848367797037461492c21ea3180fcfefdf6cfe629a 2235 
webcit_902-dfsg-2.dsc
 42138cbd4a4cd463a76ce05c37ec28cc1bc97ea80c4177de74cf257793bfab08 25558 
webcit_902-dfsg-2.diff.gz
 2784c864195eeaf336fe99d816874a165ba80814dd96f6880724eecc5f5f1f5e 8096 
citadel-suite_902-dfsg-2_all.deb
 c12a7202462c1bc6a70760c5a083aa79ca267c8e2628e20dcc0f56105af6bb30 754972 
citadel-webcit_902-dfsg-2_amd64.deb
 211d5fb24a7b645852b961d7bd240dd06da3a467357c98ff7c2989a3203bc883 1435696 
webcit-dbg_902-dfsg-2_amd64.deb
Files:
 2bdbae2adc213adcb689fe49c8be76fb 2235 web extra webcit_902-dfsg-2.dsc
 4d429d5940e7c0db9ef688371100fff7 25558 web extra webcit_902-dfsg-2.diff.gz
 87efe71bcde70bb1b79cdc49bd6cd9a6 8096 mail extra 
citadel-suite_902-dfsg-2_all.deb
 b7d003421c7e37b05cd08446f6702351 754972 web extra 
citadel-webcit_902-dfsg-2_amd64.deb
 b7fc093ba727236406b69e91d6b7239e 1435696 debug extra 
webcit-dbg_902-dfsg-2_amd64.deb

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdBQJYFcSAFhxtZXNrZXNAcG9zdGdyZXNxbC5vcmcACgkQNdhXwLvL
OyXLDxAAiTDCBnn1SsXVKuMyDSgpLiBAPcDyffBe0lZ5q+QyZb1ALUuMt4c+WOrF
ETCOtks5mTOgqjrWfMBYgG4lL+n0AYqHNOlErcFb9gy2Bx8dsEAIyJ17r6j+Bzlo
xAsHTERXenLFuLxShOnHjI5dyDU0B6iSGo62VdpK8IzDISDc/xmuUP6bEhmM9l/z
iwRWauLmcx+15aag5xqvjzRyY32kdQSwMaWgzookluhdlCJ7AN1joK2oyPiWNclU
T/cKfWAC5OtnNeLbFvS47XvqqfFm/yWbqR6wZG2jUsn6CvQSpcOtQn0IKJC4ZUWB

Bug#828267: marked as done (citadel: FTBFS with openssl 1.1.0)

Your message dated Sun, 30 Oct 2016 10:19:12 +
with message-id 
and subject line Bug#828267: fixed in citadel 902-2
has caused the Debian Bug report #828267,
regarding citadel: FTBFS with openssl 1.1.0
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
828267: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828267
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: citadel
Version: 902-1
Severity: important
Control: block 827061 by -1

Hi,

OpenSSL 1.1.0 is about to released.  During a rebuild of all packages using
OpenSSL this package fail to build.  A log of that build can be found at:
https://breakpoint.cc/openssl-1.1-rebuild-2016-05-29/Attempted/citadel_902-1_amd64-20160529-1410

On https://wiki.openssl.org/index.php/1.1_API_Changes you can see various of the
reasons why it might fail.  There are also updated man pages at
https://www.openssl.org/docs/manmaster/ that should contain useful information.

There is a libssl-dev package available in experimental that contains a recent
snapshot, I suggest you try building against that to see if everything works.

If you have problems making things work, feel free to contact us.


Kurt
--- End Message ---
--- Begin Message ---
Source: citadel
Source-Version: 902-2

We believe that the bug you reported is fixed in the latest version of
citadel, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 828...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Meskes  (supplier of updated citadel package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Format: 1.8
Date: Sun, 30 Oct 2016 09:46:13 +0100
Source: citadel
Binary: citadel-server citadel-mta citadel-doc citadel-dbg
Architecture: source amd64 all
Version: 902-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Citadel Team 
Changed-By: Michael Meskes 
Description:
 citadel-dbg - complete and feature-rich groupware server - debugging symbols
 citadel-doc - complete and feature-rich groupware server (documentation)
 citadel-mta - complete and feature-rich groupware server (mail transport agent)
 citadel-server - complete and feature-rich groupware server
Closes: 828267
Changes:
 citadel (902-2) unstable; urgency=medium
 .
   * Use SSL compatibility API. (Closes: #828267)
   * Fir citadel-server added dependency to lsb-base.
Checksums-Sha1:
 0a904766b0c8f4cd83f3c1424f2b16ef27e614f5 2386 citadel_902-2.dsc
 95f4d2d9c451105c86e7e1de648fabb0f31563de 50493 citadel_902-2.diff.gz
 95ed44a2e9fee012938e3e3b5e65c7d0d021b768 3763700 citadel-dbg_902-2_amd64.deb
 9cc30c7d17a3231623164c5e28ed0241b4030e05 46342 citadel-doc_902-2_all.deb
 e4a2a920b9a571dfe1ad4c3e9a3968093cf7378f 11926 citadel-mta_902-2_amd64.deb
 68a1431d442c40ab85d6b2d65115594dd623a76d 393610 citadel-server_902-2_amd64.deb
Checksums-Sha256:
 cf9a89836944568426297693e751f7b2bbe4fd52f2cd51e0f477aaa435ece968 2386 
citadel_902-2.dsc
 13efbd98faa35dec885da020a2d3bdc6a069036bd6d39abfdfe96e842e96288d 50493 
citadel_902-2.diff.gz
 c782421b21fea8d7f931ef91fc1cefee45cef770692b2ed06be9ffe948b8228b 3763700 
citadel-dbg_902-2_amd64.deb
 e49a578d7b09d0f54bd12424a713451efbde470a82bce07b515b329fc10618bc 46342 
citadel-doc_902-2_all.deb
 c2f217cefa1a94f12fd34ae6f4813f39a504b4f33798e19511d6e35591c1cd99 11926 
citadel-mta_902-2_amd64.deb
 738b016254e71ab06f853f2dd3c14300e95fb66d8c6526418603b42c57ecf9b5 393610 
citadel-server_902-2_amd64.deb
Files:
 f7622ed4cc347f11b4a73f345f952dca 2386 mail extra citadel_902-2.dsc
 cde432bcc80b935529cb2d886d0a302d 50493 mail extra citadel_902-2.diff.gz
 7a46bf1f73e524b4fef6a6a34834b45c 3763700 debug extra 
citadel-dbg_902-2_amd64.deb
 830499b28007a3f09be3d56aceb7f76c 46342 doc extra citadel-doc_902-2_all.deb
 4854edd8504676f40be888dc85a7be31 11926 mail extra citadel-mta_902-2_amd64.deb
 4b546b0140aef7a10fb4e46373dbad32 393610 mail extra 
citadel-server_902-2_amd64.deb

-BEGIN PGP SIGNATURE-

iQIzBAEBCAAdBQJYFcR/FhxtZXNrZXNAcG9zdGdyZXNxbC5vcmcACgkQNdhXwLvL
OyVE0w/+KzpLP3TJQO7IDy3xDcOrS2AouTWUgeRPjgvwqMGNcQ/7a0FkpyEFOTBs

Bug#842477: marked as done (git-sh-setup is broken)

Your message dated Sun, 30 Oct 2016 09:21:04 +
with message-id 
and subject line Bug#842477: fixed in git 1:2.10.2-1
has caused the Debian Bug report #842477,
regarding git-sh-setup is broken
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
842477: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842477
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Source: guilt
Version: 0.36-1
Severity: serious
Justification: fails to build from source
User: reproducible-bui...@lists.alioth.debian.org
Usertags: ftbfs
X-Debbugs-Cc: reproducible-bui...@lists.alioth.debian.org

Dear Maintainer,

guilt fails to build from source in unstable/amd64:

  […]

  
  
**
  ** Starting build 
  **
  
**
  
   Package:  guilt
   Version:  0.36-1
   Build architecture:   amd64
   Date: Sat, 29 Oct 2016 15:58:55 +0100
   Hostname: 34cc4054a89a
   Uname:Linux 34cc4054a89a 4.7.0-1-amd64 #1 SMP Debian 4.7.8-1 
(2016-10-19) x86_64 GNU/Linux
   /etc/timezone:Europe/London
  
  
**
  ** Installing build dependencies  
  **
  
**
  
  dh_testdir
  dh_testroot
  dh_prep
  dh_testdir
  dh_testroot
  dh_install
  dh_installdocs
  dh_installchangelogs
  dh_compress
  dh_fixperms
  dh_installdeb
  dh_gencontrol
  dh_md5sums
  dh_builddeb
  dpkg-deb: building package 'guilt-build-deps' in 
'../guilt-build-deps_0.36-1_all.deb'.
  
  The package has been created.
  Attention, the package has been created in the current directory,
  not in ".." as indicated by the message above!
  Selecting previously unselected package guilt-build-deps.
  (Reading database ... 23465 files and directories currently installed.)
  Preparing to unpack guilt-build-deps_0.36-1_all.deb ...
  Unpacking guilt-build-deps (0.36-1) ...
  Reading package lists...
  Building dependency tree...
  Reading state information...
  Correcting dependencies... Done
  The following additional packages will be installed:
asciidoc docbook-xml docbook-xsl libexpat1-dev libxml2-utils libxslt1.1
sgml-base sgml-data xml-core xmlto xsltproc
  Suggested packages:
source-highlight vim-addon-manager docbook docbook-dsssl docbook-defguide
dbtoepub docbook-xsl-doc-html | docbook-xsl-doc-pdf | docbook-xsl-doc-text
| docbook-xsl-doc docbook-xsl-saxon fop libsaxon-java libxalan2-java
libxslthl-java xalan sgml-base-doc perlsgml w3-recs opensp w3m | lynx-cur
| links xmltex
  Recommended packages:
dblatex docbook-utils dblatex | fop libpaper-utils zip
  The following NEW packages will be installed:
asciidoc docbook-xml docbook-xsl libexpat1-dev libxml2-utils libxslt1.1
sgml-base sgml-data xml-core xmlto xsltproc
  0 upgraded, 11 newly installed, 0 to remove and 0 not upgraded.
  1 not fully installed or removed.
  Need to get 2999 kB of archives.
  After this operation, 23.5 MB of additional disk space will be used.
  Get:1 http://httpredir.debian.org/debian sid/main amd64 asciidoc all 8.6.9-3 
[830 kB]
  Get:2 http://httpredir.debian.org/debian sid/main amd64 libexpat1-dev amd64 
2.2.0-1 [128 kB]
  Get:3 http://httpredir.debian.org/debian sid/main amd64 sgml-base all 1.28 
[14.7 kB]
  Get:4 http://httpredir.debian.org/debian sid/main amd64 xml-core all 0.16 
[23.0 kB]
  Get:5 http://httpredir.debian.org/debian sid/main amd64 sgml-data all 2.0.10 
[181 kB]
  Get:6 http://httpredir.debian.org/debian sid/main amd64 docbook-xml all 4.5-8 
[84.7 kB]
  Get:7 http://httpredir.debian.org/debian sid/main amd64 docbook-xsl all 
1.79.1+dfsg-2 [1249 kB]
  Get:8 http://httpredir.debian.org/debian sid/main amd64 libxml2-utils amd64 
2.9.4+dfsg1-2 [102 kB]
  Get:9 http://httpredir.debian.org/debian sid/main amd64 libxslt1.1 amd64 
1.1.29-1 [233 kB]
  Get:10 http://httpredir.debian.org/debian sid/main amd64 xsltproc amd64 
1.1.29-1 [120 kB]
  Get:11 http://httpredir.debian.org/debian sid/main amd64 xmlto amd64 
0.0.28-0.1 [32.9 kB]
  Fetched 2999 kB in 0s (85.3 MB/s)
  Selecting previously unselected package asciidoc.
  (Reading database ... 
(Reading database ... 5%
(Reading database ... 10%
(Reading

Bug#840845: python-pygraphviz: FTBFS with /bin/sh as bash

2016-10-30 Thread Chris Lamb

Cyril Brulebois wrote:

> Control: tag -1 pending

> I've decided to go ahead with just the set -e line dropped for the time
> being, as inaction on this serious bug report was going to get both
> python-{networkx,pygraphviz} removed from testing.

Good call. I've filed another, separate bug as promised re. test failures
not causing an FTBFS.


Regards,

-- 
  ,''`.
 : :'  : Chris Lamb
 `. `'`  la...@debian.org / chris-lamb.co.uk
   `-

Processed: Bug fixed upstream for fqterm

Processing commands for cont...@bugs.debian.org:

> tags 828302 + fixed-upstream
Bug #828302 [src:fqterm] fqterm: FTBFS with openssl 1.1.0
Added tag(s) fixed-upstream.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
828302: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=828302
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#842339: [Bug-tar] possible fixes for CVE-2016-6321

Control: tags -1 + patch

(dropping the bug-tar list, since this reply only relevant within
Debian).

Hi Paul,

On Sat, Oct 29, 2016 at 09:19:09PM -0700, Paul Eggert wrote:
> Thanks for the heads-up. Yes, it appears the 2003 change was not
> sufficiently paranoid about ".." in member names. Luckily, the tar manual
> still documents the pre-2003 behavior, so we can restore that behavior as a
> simple bug fix. I installed the attached patch into Savannah as one way to
> do that. This patch causes 'tar' to issue two diagnostics when given a
> member name containing "..", and I suppose tar should be cleaned up at some
> point to issue just one diagnostic. The main thing, though, is that the
> patch is simple and fixes the security gotcha in question.
> 
> I don't view this as a serious bug, as the tar manual has long said that you
> should extract untrusted tarballs only into empty directories, and doing
> that forestalls the attack even without this patch. (There are other reasons
> for this longstanding recommendation.)

Thanks for the patch!

For reference, attached would be the debdiff for a possible unstable
and jessie-security upload.

Regards,
Salvatore
diff -Nru tar-1.27.1/debian/changelog tar-1.27.1/debian/changelog
--- tar-1.27.1/debian/changelog 2014-03-22 22:55:23.0 +0100
+++ tar-1.27.1/debian/changelog 2016-10-30 07:48:55.0 +0100
@@ -1,3 +1,12 @@
+tar (1.27.1-2+deb8u1) jessie-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * CVE-2016-6321: Bypassing the extract path name.
+When extracting, member names containing '..' components are skipped.
+(Closes: #842339)
+
+ -- Salvatore Bonaccorso   Sun, 30 Oct 2016 07:48:55 +0100
+
 tar (1.27.1-2) unstable; urgency=low
 
   * patch from David Gilman adds watch file with signature verification, 
diff -Nru tar-1.27.1/debian/patches/When-extracting-skip-.-members.patch 
tar-1.27.1/debian/patches/When-extracting-skip-.-members.patch
--- tar-1.27.1/debian/patches/When-extracting-skip-.-members.patch  
1970-01-01 01:00:00.0 +0100
+++ tar-1.27.1/debian/patches/When-extracting-skip-.-members.patch  
2016-10-30 07:48:55.0 +0100
@@ -0,0 +1,33 @@
+Description: When extracting, skip ".." members (CVE-2016-6321)
+Origin: upstream,  
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
+Bug-Debian: https://bugs.debian.org/842339
+Forwarded: not-needed.
+Author: Paul Eggert 
+Last-Update: 2016-10-30
+---
+ src/extract.c | 8 
+ 2 files changed, 15 insertions(+), 1 deletion(-)
+
+--- a/src/extract.c
 b/src/extract.c
+@@ -1584,12 +1584,20 @@ extract_archive (void)
+ {
+   char typeflag;
+   tar_extractor_t fun;
++  bool skip_dotdot_name;
+ 
+   fatal_exit_hook = extract_finish;
+ 
+   set_next_block_after (current_header);
+ 
++  skip_dotdot_name = (!absolute_names_option
++&& contains_dot_dot (current_stat_info.orig_file_name));
++  if (skip_dotdot_name)
++ERROR ((0, 0, _("%s: Member name contains '..'"),
++  quotearg_colon (current_stat_info.orig_file_name)));
++
+   if (!current_stat_info.file_name[0]
++  || skip_dotdot_name
+   || (interactive_option
+ && !confirm ("extract", current_stat_info.file_name)))
+ {
diff -Nru tar-1.27.1/debian/patches/series tar-1.27.1/debian/patches/series
--- tar-1.27.1/debian/patches/series2014-03-22 22:55:23.0 +0100
+++ tar-1.27.1/debian/patches/series2016-10-30 07:48:55.0 +0100
@@ -1,2 +1,3 @@
 pristine-tar.diff
 listed03-linux-only
+When-extracting-skip-.-members.patch
diff -Nru tar-1.29b/debian/changelog tar-1.29b/debian/changelog
--- tar-1.29b/debian/changelog  2016-07-22 22:07:14.0 +0200
+++ tar-1.29b/debian/changelog  2016-10-30 07:35:31.0 +0100
@@ -1,3 +1,12 @@
+tar (1.29b-1.1) unstable; urgency=medium
+
+  * Non-maintainer upload.
+  * CVE-2016-6321: Bypassing the extract path name.
+When extracting, member names containing '..' components are skipped.
+(Closes: #842339)
+
+ -- Salvatore Bonaccorso   Sun, 30 Oct 2016 07:35:31 +0100
+
 tar (1.29b-1) unstable; urgency=medium
 
   * re-constitute the 1.29 orig.tar with man pages as version 1.29b
diff -Nru tar-1.29b/debian/patches/When-extracting-skip-.-members.patch 
tar-1.29b/debian/patches/When-extracting-skip-.-members.patch
--- tar-1.29b/debian/patches/When-extracting-skip-.-members.patch   
1970-01-01 01:00:00.0 +0100
+++ tar-1.29b/debian/patches/When-extracting-skip-.-members.patch   
2016-10-30 07:35:31.0 +0100
@@ -0,0 +1,33 @@
+Description: When extracting, skip ".." members (CVE-2016-6321)
+Origin: upstream,  
http://git.savannah.gnu.org/cgit/tar.git/commit/?id=7340f67b9860ea0531c1450e5aa261c50f67165d
+Bug-Debian: https://bugs.debian.org/842339
+Forwarded: not-needed.
+Author: Paul Eggert 
+Last-Update: 2016-10-30
+---
+

Processed: Re: Bug#842339: [Bug-tar] possible fixes for CVE-2016-6321

Processing control commands:

> tags -1 + patch
Bug #842339 [tar] tar: CVE-2016-6321: Bypassing the extract path name
Added tag(s) patch.

-- 
842339: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842339
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Processed: found 842339 in 1.26+dfsg-0.1, retitle 842339 to tar: CVE-2016-6321: Bypassing the extract path name ...

Processing commands for cont...@bugs.debian.org:

> # as triaged by the LTS team
> found 842339 1.26+dfsg-0.1
Bug #842339 [tar] CVE-2016-6321
Marked as found in versions tar/1.26+dfsg-0.1.
> retitle 842339 tar: CVE-2016-6321: Bypassing the extract path name
Bug #842339 [tar] CVE-2016-6321
Changed Bug title to 'tar: CVE-2016-6321: Bypassing the extract path name' from 
'CVE-2016-6321'.
> tags 842339 + upstream fixed-upstream
Bug #842339 [tar] tar: CVE-2016-6321: Bypassing the extract path name
Added tag(s) fixed-upstream and upstream.
> forwarded 842339 
> https://lists.gnu.org/archive/html/bug-tar/2016-10/msg00012.html
Bug #842339 [tar] tar: CVE-2016-6321: Bypassing the extract path name
Set Bug forwarded-to-address to 
'https://lists.gnu.org/archive/html/bug-tar/2016-10/msg00012.html'.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
842339: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=842339
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

Bug#841604: marked as done (datalad: FTBFS: Tests failures)