Re: Bug#293926: dictionaries-common needs a "don't muck with my config files" option

[Steve Langasek]

Hi Agustin,

On Fri, Mar 04, 2005 at 12:47:59PM +0100, Agustin Martin wrote:
> On Thu, Mar 03, 2005 at 06:00:57PM -0800, Steve Langasek wrote:
> > On Thu, Mar 03, 2005 at 09:24:14AM +0100, Agustin Martin wrote:

> > > A fix for that is in unstable, for two weeks now, and I think this should 
> > > go
> > > into sarge. I have prepared a sarge package with this problem fixed, and
> > > would like to know the release team opinion about the convenience of its
> > > upload to testing-proposed-updates, since it involves changes that are
> > > neither very small nor absolutely straightforward.

> > Is there a reason not to push the version from unstable through to testing?
> > That would give us the benefit of having a known tested package before it
> > hits testing, at least.

> I prefer that too, 

> So, please consider pushing unstable version to testing. Thanks for that.

Ok, approved.

Thanks,
-- 
Steve Langasek
postmodern programmer


signature.asc
Description: Digital signature

Re: gcc-3.3 3.3.5-9 C++ ABI problem.

[Aurelien Jarno]

On Tue, Mar 08, 2005 at 10:22:00PM +0100, Kurt Roeckx wrote:
> Hi,
> 
> gcc-3.3 3.3.5-9 was build with the configure option
> --disable-__cxa_atexit instead of --enable-__cxa_atexit.  This
> causes it to have a different C++ ABI.
> 
> This was fixed in the 3.3.5-10 which should be available soon.
> 
> I've made a list of source packages that might have been build
> with the 3.3.5-9 version so far.  This is based on all packages
> uploaded after the gcc-3.3 3.3.5-9 package.  This is a list of
> source package who have a binary package with a dependency on the
> libstdc++5 package.
Is there anyway to detect the breakage? Is running the program enough?

What about the buildds, has gcc-3.3 3.3.5-9 been installed on one of
them?



-- 
  .''`.  Aurelien Jarno | GPG: 1024D/F1BCDB73
 : :' :  Debian GNU/Linux developer | Electrical Engineer
 `. `'   [EMAIL PROTECTED] | [EMAIL PROTECTED]
   `-people.debian.org/~aurel32 | www.aurel32.net


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

gcc-3.3 3.3.5-9 C++ ABI problem.

[Kurt Roeckx]

Hi,

gcc-3.3 3.3.5-9 was build with the configure option
--disable-__cxa_atexit instead of --enable-__cxa_atexit.  This
causes it to have a different C++ ABI.

This was fixed in the 3.3.5-10 which should be available soon.

I've made a list of source packages that might have been build
with the 3.3.5-9 version so far.  This is based on all packages
uploaded after the gcc-3.3 3.3.5-9 package.  This is a list of
source package who have a binary package with a dependency on the
libstdc++5 package.

This list is probably not complete since people can still be
uploading packages with this broken ABI.  Please make sure you
either have the 3.3.5-8 or 3.3.5-10 version installed if you are
uploading a new package.

This is the list of source packages:
acovea
akregator
bidentd
bincimap
capi4hylafax
capisuite
cloop
cmt
d4x
flwm
glibmm2.4
gtkmm2.4
gtkwave
k3b
kcdlabel
kino
kismet
knetfilter
kwave
latd
lcdf-typetools
mozilla-firefox
mysql-query-browser
nmap
octave2.1
openam
openh323
oprofile
poedit
sdcc
sms-pl
synaptic
t38modem
tagtool
tora
trackballs
wine
wipl



Kurt


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: (forw) Bug#298060: Please don't install login as setuid root

[Michael Banck]

On Tue, Mar 08, 2005 at 05:03:11PM +0100, Wouter Verhelst wrote:
> Op za, 05-03-2005 te 22:56 -0800, schreef Matt Zimmerman:
> > On Sat, Mar 05, 2005 at 03:34:58PM +0100, Christian Perrier wrote:
> > 
> > > Security and release teams, may I have your advice about this suggestion?
> > > 
> > > As you may know, I currently act as maintainer for the shadow package,
> > > but I'm also aware of my own weaknesses when it comes at security (and
> > > security-related) issues so I prefer getting the advice of more
> > > competent people.
> > > 
> > > Given that installing login non setuid has been blessed for Ubuntu,
> > > I'm inclined to follow the suggestion, but doing so close to a release
> > > is maybe not wise.so I'm seeking for advices..:-)
> > 
> > FWIW, We've been doing this for some time in Ubuntu, and no one has missed
> > it.  In this age of pseudoterminals and single-user systems...
> 
> On Linux.
> 
> I'm not exactly sure about this, but I think it might break the way the
> Hurd does a login. 

The hurd package currently ships its own /bin/login and
Provides/Replaces/Conflicts with the login package.

As to why that is suid as well, Roland McGrath once said[0]:

login   -- Falls back to unix-style if password server is not there.
   If we can presume the password server works, then we can
   clear the setuid bit here.  (We could also remove the old
   code, or leave it there for only root to be able to use w/o
   server.)


I guess this is a good opportunity to review our suid login as well.


cheers,

Michael

-- 
[0] http://lists.gnu.org/archive/html/bug-hurd/2002-06/msg00130.html


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: (forw) Bug#298060: Please don't install login as setuid root

[Samuel Thibault]

Wouter Verhelst, le mar 08 mar 2005 17:03:11 +0100, a dit :
> Op za, 05-03-2005 te 22:56 -0800, schreef Matt Zimmerman:
> > On Sat, Mar 05, 2005 at 03:34:58PM +0100, Christian Perrier wrote:
> > 
> > > Security and release teams, may I have your advice about this suggestion?
> > > 
> > > As you may know, I currently act as maintainer for the shadow package,
> > > but I'm also aware of my own weaknesses when it comes at security (and
> > > security-related) issues so I prefer getting the advice of more
> > > competent people.
> > > 
> > > Given that installing login non setuid has been blessed for Ubuntu,
> > > I'm inclined to follow the suggestion, but doing so close to a release
> > > is maybe not wise.so I'm seeking for advices..:-)
> > 
> > FWIW, We've been doing this for some time in Ubuntu, and no one has missed
> > it.  In this age of pseudoterminals and single-user systems...
> 
> On Linux.
> 
> I'm not exactly sure about this, but I think it might break the way the
> Hurd does a login. On The Hurd, you don't get a login prompt; rather,
> you get a login /shell/ which allows you to do some things without
> having been logged on; loggin in then requires you to do 'login '.
> It /might/ be the case that this requires /bin/login to be setuid root,
> but I'm not sure. Hurd developers (Cc'ed), care to shed some light here?

It does even *less* need to be setuid root: login way be run without
*any* identity: it gets uid from the passwd server in exchange of the
correct password for the uid. No need to be root for that.

Regards,
Samuel Thibault


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Re: arm buildd holdup?

[Wouter Verhelst]

Op zo, 06-03-2005 te 22:52 +1100, schreef Hamish Moffatt:
> Goswin wrote:
>  > Need-build is a good sign. http://buildd.net/ shows you are on place
>  > 37 out of 120. I suggest just waiting unless the buildd has stoped
>  > altogether.
> 
> What is the ordering criteria on the buildds?

See , under the
"needs-build" header.

> 
> I notice that speex (for example) was uploaded on Feb 26 with priority 
> low and it's 7th on the arm list, but geda-gschem was uploaded on Feb 23 
> with priority low and it's 35th. quodlibet was uploaded on March 4 (also 
> priority low) and it's 6th.
> 
> Is it FIFO within the priority levels? I would've expected so.

No. Instead, it is assumed that the buildd queue length regularly
reaches 0; when this assumption breaks, we conclude that the buildd pool
is unable to keep up, and that more machines need to be added.

-- 
 EARTH
 smog  |   bricks
 AIR  --  mud  -- FIRE
soda water |   tequila
 WATER
 -- with thanks to fortune


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: (forw) Bug#298060: Please don't install login as setuid root

[Wouter Verhelst]

Op za, 05-03-2005 te 22:56 -0800, schreef Matt Zimmerman:
> On Sat, Mar 05, 2005 at 03:34:58PM +0100, Christian Perrier wrote:
> 
> > Security and release teams, may I have your advice about this suggestion?
> > 
> > As you may know, I currently act as maintainer for the shadow package,
> > but I'm also aware of my own weaknesses when it comes at security (and
> > security-related) issues so I prefer getting the advice of more
> > competent people.
> > 
> > Given that installing login non setuid has been blessed for Ubuntu,
> > I'm inclined to follow the suggestion, but doing so close to a release
> > is maybe not wise.so I'm seeking for advices..:-)
> 
> FWIW, We've been doing this for some time in Ubuntu, and no one has missed
> it.  In this age of pseudoterminals and single-user systems...

On Linux.

I'm not exactly sure about this, but I think it might break the way the
Hurd does a login. On The Hurd, you don't get a login prompt; rather,
you get a login /shell/ which allows you to do some things without
having been logged on; loggin in then requires you to do 'login '.
It /might/ be the case that this requires /bin/login to be setuid root,
but I'm not sure. Hurd developers (Cc'ed), care to shed some light here?

-- 
 EARTH
 smog  |   bricks
 AIR  --  mud  -- FIRE
soda water |   tequila
 WATER
 -- with thanks to fortune


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]

Re: Directory structure for upgrade kernels?

[Andreas Barth]

* Frank Lichtenheld ([EMAIL PROTECTED]) [050307 11:20]:
> I've begun to create the backports needed for the upgrade kernel and
> write a README for them. The current state can be seen at
> http://higgs.djpig.de/upgrade/. Before uploading this to ftp.debian.org
> we obviously need to find a suitable directory structure.
> 
> At my server I currently have
>   README.html -- common README
>   upgrade-sun4m -- debs for sun4m-nomult
>   upgrade-hppa64 -- debs for hppa64
>   upgrade-source -- source code for all debs

why not all in one? One Packages file could hold binaries of different
architectures.


Cheers,
Andi
-- 
   http://home.arcor.de/andreas-barth/
   PGP 1024/89FB5CE5  DC F1 85 6D A6 45 9C 0F  3B BE F1 D0 C5 D1 D9 0C


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]