Re: Stable update of dajaxice

2011-02-26 Thread Thijs Kinkhorst
Hi Angel,

On Thursday 24 February 2011 12:27:21 Angel Abad wrote:
 2011/2/24 Adam D. Barratt a...@adam-barratt.org.uk:
  Hi,
  
  On Thu, February 24, 2011 10:16, Angel Abad wrote:
  I've prepared an upload to stable for package dajaxice, since
  python-django was patched for problems related with crsf cookies,
  dajaxice is unusable in squeeze.
  
  Was this issue introduced as a side-effect of the changes in DSA-2163-1,
  specifically those marked as backwardly-incompatible?  If so then it
  would be good if this could also be fixed via the security archive, as
  the regression was introduced in a security update (albeit in a
  different package); I've CCed the security team for comment.
 
 Yes, you are right is a side-effect of DSA-2163-1 - CVE-2011-0696

Please upload the package to security-master then. Note that you need to 
change the target in the changelog and build the package with full source (-sa 
flag). Full checklist of packages for security-master is here:
http://www.debian.org/doc/developers-reference/pkgs.html#bug-security-building

The security team will then take care of releasing it through security-master.


Cheers,
Thijs


signature.asc
Description: This is a digitally signed message part.


Re: perl 5.12/5.14 transition plans

2011-02-26 Thread Dominic Hargreaves
On Wed, Feb 23, 2011 at 07:40:26PM +, Dominic Hargreaves wrote:
 You can see the transition tracking bugs at [1].

Additionally, bugs which are not perl 5.12 specific but which may
affect binNMUs are

http://bugs.debian.org/cgi-bin/pkgreport.cgi?tag=perl-5.12-transition-ftbfs-sid;users=debian-p...@lists.debian.org

Dominic.

-- 
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110226160830.gy4...@urchin.earth.li



Re: Bug#615157: gcc-4.6: -Wunused-but-set-variable -Werror does not imply -Werror=unused-but-set-variable

2011-02-26 Thread Matthias Klose

On 26.02.2011 07:43, Jonathan Nieder wrote:

Package: gcc-4.6
Version: 4.6-20110216-1



I would have expected all three to error out.

Known problem?


yes, explicitly disabled in the package, for a limited time.  If you keep this 
warning enabled, it will result in too many build failures.  Somebody needs to 
scan the successful build logs of a test rebuild for these warnings, file bug 
reports, user-tag them with debian-...@lists.debian.org, and after we know what 
needs to be fixed, we can turn this warning on again.


Could you work on filing these reports?

These reports will end up as release critical bug reports for wheezy, so maybe 
start filing these with severity important.


  Matthias


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4d692d1d.3040...@debian.org



Re: GMP transition: 4.3.2 to 5.0.1?

2011-02-26 Thread Matthias Klose

On 26.02.2011 04:42, Steve M. Robbins wrote:

On Fri, Feb 25, 2011 at 03:57:28PM +0100, Matthias Klose wrote:

On 25.02.2011 08:46, Steve M. Robbins wrote:



Clearly one should be mindful of the effect on GCC -- that's why I
asked the question on debian-gcc.  Do you have any specific concerns?


Have any concerns been raised on the GCC mailing list?  I've googled
and found only anecdotal positive reports:

   http://www.listware.net/201003/gcc-gcc/99756-gmp-501-and-gcc-45.html




Is there a GCC autobuilder suite that can do all these rebuilds?  I
will upload there.


I don't have such a setup.


OK, but someone must have a similar setup.  People are occasionally
rebuilding the archive to test new GCC versions.  Anyone on the
debian-gcc list got an idea?


does gcc still work when gmp5 is in the archive, and mpfr is not yet rebuilt 
against the new gmp5?



--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4d692f2d.1050...@debian.org



Re: GMP transition: 4.3.2 to 5.0.1?

2011-02-26 Thread Steve M. Robbins
On Sat, Feb 26, 2011 at 05:49:49PM +0100, Matthias Klose wrote:
 On 26.02.2011 04:42, Steve M. Robbins wrote:
 On Fri, Feb 25, 2011 at 03:57:28PM +0100, Matthias Klose wrote:
 On 25.02.2011 08:46, Steve M. Robbins wrote:
 
 Clearly one should be mindful of the effect on GCC -- that's why I
 asked the question on debian-gcc.  Do you have any specific concerns?
 
 Have any concerns been raised on the GCC mailing list?  I've googled
 and found only anecdotal positive reports:
 
http://www.listware.net/201003/gcc-gcc/99756-gmp-501-and-gcc-45.html
 
 
 
 Is there a GCC autobuilder suite that can do all these rebuilds?  I
 will upload there.
 
 I don't have such a setup.
 
 OK, but someone must have a similar setup.  People are occasionally
 rebuilding the archive to test new GCC versions.  Anyone on the
 debian-gcc list got an idea?
 
 does gcc still work when gmp5 is in the archive, and mpfr is not yet
 rebuilt against the new gmp5?

Sure: I've been running that way at home for a year.  Why wouldn't it
work?

Instead of asking cryptic questions, could you please spell out your
concerns in detail so that we could address them.

Thanks,
-Steve





signature.asc
Description: Digital signature


Re: GMP transition: 4.3.2 to 5.0.1?

2011-02-26 Thread Matthias Klose

On 26.02.2011 18:08, Steve M. Robbins wrote:

On Sat, Feb 26, 2011 at 05:49:49PM +0100, Matthias Klose wrote:

On 26.02.2011 04:42, Steve M. Robbins wrote:

On Fri, Feb 25, 2011 at 03:57:28PM +0100, Matthias Klose wrote:

On 25.02.2011 08:46, Steve M. Robbins wrote:



Clearly one should be mindful of the effect on GCC -- that's why I
asked the question on debian-gcc.  Do you have any specific concerns?


Have any concerns been raised on the GCC mailing list?  I've googled
and found only anecdotal positive reports:

   http://www.listware.net/201003/gcc-gcc/99756-gmp-501-and-gcc-45.html




Is there a GCC autobuilder suite that can do all these rebuilds?  I
will upload there.


I don't have such a setup.


OK, but someone must have a similar setup.  People are occasionally
rebuilding the archive to test new GCC versions.  Anyone on the
debian-gcc list got an idea?


does gcc still work when gmp5 is in the archive, and mpfr is not yet
rebuilt against the new gmp5?


Sure: I've been running that way at home for a year.  Why wouldn't it
work?


I didn't ask about your *home*, but the *archive* (and the buildds).


Instead of asking cryptic questions, could you please spell out your
concerns in detail so that we could address them.


what is cryptic about the question?


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4d69341e.4060...@debian.org



Re: [SRM] upload of debian-reference/2.46 to stable

2011-02-26 Thread Adam D. Barratt
On Fri, 2011-02-25 at 22:20 +0900, Osamu Aoki wrote:
 | debian-reference (2.46) stable; urgency=low
 | 
 |   * Updated Portguese translation by Américo Monteiro.
 |   * Fixed s/--get-selection/--get-selections/ etc. Closes: #612435
 |   * Reflected introduction of squeeze-updates suite which replaced
 | Debian Volatile Service. Closes: #614224
 |   * Fixed URL for Debian Mirror Checker site. Closes: #614253

Thanks for working on this.  The above sounds okay; is a debdiff of the
proposed upload available somewhere?

Is an upload to sid planned soon?  If the package has the same version
in stable and testing at the time of the point release then dak will
automatically propagate the new stable package upwards in to testing
(and unstable as well if required) in order to ensure that the version
constraints between the suites are met; that may or may not be what you
want.

Regards,

Adam


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298742321.535.5759.ca...@hathi.jungle.funky-badger.org



Re: [squeeze] permission to upload desktop-base

2011-02-26 Thread Adam D. Barratt
Hi,

On Fri, 2011-02-18 at 23:16 +0100, Yves-Alexis Perez wrote:
 it seems that plymouth spacefun script doesn't work fine with dual
 monitor setup (#613249). I've checked the patch on a dual monitor setup
 and it seems to do the job just fine so I'd like to push it for 6.0.1 or
 6.0.2.

The patch looks okay; thanks.  Please feel free to go ahead with the
upload for 6.0.1.

Regards,

Adam


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298742706.535.5788.ca...@hathi.jungle.funky-badger.org



Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Adam D. Barratt
Hi,

On Fri, 2011-02-18 at 22:13 +0100, Yves-Alexis Perez wrote:
 would it be possible to make a stable upload, targeted at 6.0.1 or
 6.0.2, to disable default automount/autobrowse in thunar-volman?
 
 It's only a matter of shipping a config file, so the following diff
 should do the trick:

Apologies if I'm missing something obvious, but what's the motivation
for making this change in stable?  The changelog for the proposed upload
and the corresponding upload to unstable don't provide any further
information afaics (hence the suspicion that I'm missing something).

Regards,

Adam


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298743239.535.5830.ca...@hathi.jungle.funky-badger.org



Re: [SRM] (PRSC) Possible removal of tsclient from stable

2011-02-26 Thread Adam D. Barratt
On Wed, 2011-02-16 at 22:57 +, Jonathan Wiltshire wrote:
 tsclient was removed from unstable recently: it has two CVE reports pending
 and no upstream. The rationale was that a suitable replacement, remmina, is
 in the archive.
 
 Since remmina is also in stable, I propose to remove tsclient from stable
 too, which gets these security problems out of the way. Before filing a
 removal bug, I'd like opinions from SRM and the package maintainers.

The timing of the removal is a little unfortunate, given that it was
originally suggested 18 months ago and the bug report (#547314)
indicates that it was planned to be processed last August.  Although
it's a leaf package, it does have non-neglible popcon (recent count
over 800).

GNOME maintainers - any thoughts?

Regards,

Adam


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298743613.535.5859.ca...@hathi.jungle.funky-badger.org



Bug#613723: pu: package sun-java6/6.22-1

2011-02-26 Thread Adam D. Barratt
On Wed, 2011-02-16 at 21:27 +0100, Torsten Werner wrote:
 the version 6.24-1 of the package contains important security related 
 bugfixes.
 I would take 6.24-1 from unstable and build a version 6.24-1~squeeze1 for
 stable. All the changes in the unstable package are safe for stable. I am
 attaching a source package diff between 6.22-1 ... 6.24-1.

Given that we have no realistic means of extracting the security fixes
from the other changes, please go ahead.  Reports of real-world tests on
stable systems (successful or otherwise) would be appreciated.

Regards,

Adam




-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298743876.535.5882.ca...@hathi.jungle.funky-badger.org



Bug#613741: opu: package sun-java6/6-24-0lenny1

2011-02-26 Thread Adam D. Barratt
On Wed, 2011-02-16 at 23:41 +0100, Torsten Werner wrote:
 please have a look at http://people.debian.org/~twerner/ for an (security)
 update of sun-java6 in oldstable.

Please go ahead.

As with the stable update, reports of real-world tests of the packages
in an oldstable environment would be appreciated.

Regards,

Adam




-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1298744636.535.5931.ca...@hathi.jungle.funky-badger.org



Bug#615129: Renaming bug

2011-02-26 Thread Lisandro Damián Nicanor Pérez Meyer
tag 615129 - moreinfo
retitle 615129 RM: kdelibs/4:3.5.10.dfsg.1-5
thanks

Hi! I am retitling this bug correctly.

Qt 3 is a special case and should be treated separately.

Kinds regards, Lisandro.

-- 
Without us [Free Software developers], people would study computer science
and programming without ever having seen a real program in its entirety.
That's like becoming writers without ever having read a complete book.
  Matthias Ettrich, founder of the KDE project.
  http://www.efytimes.com/efytimes/25412/news.htm

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/


signature.asc
Description: This is a digitally signed message part.


Processed: Renaming bug

2011-02-26 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 tag 615129 - moreinfo
Bug #615129 {Done: Jonathan Nieder jrnie...@gmail.com} [release.debian.org] 
RM: kdelibs/4:3.5.10.dfsg.1-5
Removed tag(s) moreinfo.
 retitle 615129 RM: kdelibs/4:3.5.10.dfsg.1-5
Bug #615129 {Done: Jonathan Nieder jrnie...@gmail.com} [release.debian.org] 
RM: kdelibs/4:3.5.10.dfsg.1-5
Ignoring request to change the title of bug#615129 to the same title
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
615129: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615129
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.c.129874582210675.transcr...@bugs.debian.org



NEW changes in proposedupdates

2011-02-26 Thread Debian FTP Masters
Processing changes file: avahi_0.6.27-2+squeeze1_i386.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_amd64.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_armel.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_ia64.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_kfreebsd-amd64.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_kfreebsd-i386.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_mips.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_mipsel.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_powerpc.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_s390.changes
  ACCEPT
Processing changes file: avahi_0.6.27-2+squeeze1_sparc.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_amd64.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_armel.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_i386.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_ia64.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_kfreebsd-amd64.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_kfreebsd-i386.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_mips.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_mipsel.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_powerpc.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_s390.changes
  ACCEPT
Processing changes file: pam-pgsql_0.7.1-4+squeeze1_sparc.changes
  ACCEPT


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/e1ptqem-0004wt...@franck.debian.org



Re: GMP transition: 4.3.2 to 5.0.1?

2011-02-26 Thread Steve M. Robbins
Hi Adam,

On Thu, Feb 24, 2011 at 08:15:44PM +, Adam D. Barratt wrote:
 On Sat, 2011-02-19 at 04:48 -0600, Steve M. Robbins wrote:
  On Sat, Feb 12, 2011 at 01:39:39PM +, Adam D. Barratt wrote:
   Have any of the reverse-dependencies been test-built against the new
   version?  Does the move to 5.0.1 imply any source changes being required
   for reverse-dependencies, or just rebuilds?  (I say just as there
   appear to be around 350 r-dependencies, including at least five from the
   GCC suite).
  
  I haven't done any test-builds.  Since the -dev package changed name,
  I presume that just rebuild won't work; rather, the sources have
  to edit their build-deps.
 
 Out of interest, why is the -dev package versioned?

Thinking about this more, I can't think of any reason for it to be
versioned.  Especially since two GMP versions cannot coexist in the
archive.  

So I think I'll upload with simply libgmp-dev.

Are you ready for the new upload?

Thanks,
-Steve


signature.asc
Description: Digital signature


Re: GMP transition: 4.3.2 to 5.0.1?

2011-02-26 Thread Steve M. Robbins
Dear Matthias,

On Sat, Feb 26, 2011 at 06:10:54PM +0100, Matthias Klose wrote:
 On 26.02.2011 18:08, Steve M. Robbins wrote:

 Instead of asking cryptic questions, could you please spell out your
 concerns in detail so that we could address them.
 
 what is cryptic about the question?

Thanks for your input.  However, I don't find this conversation
productive any longer.

Thanks,
-Steve


signature.asc
Description: Digital signature


Re: [SRM] (PRSC) Possible removal of tsclient from stable

2011-02-26 Thread Josselin Mouette
Le samedi 26 février 2011 à 18:06 +, Adam D. Barratt a écrit : 
 On Wed, 2011-02-16 at 22:57 +, Jonathan Wiltshire wrote:
  tsclient was removed from unstable recently: it has two CVE reports pending
  and no upstream. The rationale was that a suitable replacement, remmina, is
  in the archive.
  
  Since remmina is also in stable, I propose to remove tsclient from stable
  too, which gets these security problems out of the way. Before filing a
  removal bug, I'd like opinions from SRM and the package maintainers.
 
 The timing of the removal is a little unfortunate, given that it was
 originally suggested 18 months ago and the bug report (#547314)
 indicates that it was planned to be processed last August.  Although
 it's a leaf package, it does have non-neglible popcon (recent count
 over 800).
 
 GNOME maintainers - any thoughts?

TTBOMK, no other remote desktop client has the amount of functionality
tsclient provides, so that explains the high popcon.

If it’s possible security-wise, I think it would be better to keep it in
stable.

-- 
 .''`.  Josselin Mouette
: :' :
`. `'  “If you behave this way because you are blackmailed by someone,
  `-[…] I will see what I can do for you.”  -- Jörg Schilling



signature.asc
Description: This is a digitally signed message part


Re: gcc-4.6: -Wunused-but-set-variable -Werror does not imply -Werror=unused-but-set-variable

2011-02-26 Thread Jonathan Nieder
Matthias Klose wrote:

 yes, explicitly disabled in the package, for a limited time.  If you
 keep this warning enabled, it will result in too many build
 failures.  Somebody needs to scan the successful build logs of a
 test rebuild for these warnings, file bug reports, user-tag them
 with debian-...@lists.debian.org, and after we know what needs to be
 fixed, we can turn this warning on again.

Sure, given access to some build logs, I'd be happy to start working
through them and filing reports.

 These reports will end up as release critical bug reports for
 wheezy, so maybe start filing these with severity important.

Isn't it already an almost-RC bug (as in, an FTBFS waiting to happen)
for packages to use -Werror rather than more targetted options on
autobuilders?

Thanks.
Jonathan


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110226220616.GB19176@elie



Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Yves-Alexis Perez
On Sat, 2011-02-26 at 18:00 +, Adam D. Barratt wrote:
 Hi,
 
 On Fri, 2011-02-18 at 22:13 +0100, Yves-Alexis Perez wrote:
  would it be possible to make a stable upload, targeted at 6.0.1 or
  6.0.2, to disable default automount/autobrowse in thunar-volman?
  
  It's only a matter of shipping a config file, so the following diff
  should do the trick:
 
 Apologies if I'm missing something obvious, but what's the motivation
 for making this change in stable?  The changelog for the proposed upload
 and the corresponding upload to unstable don't provide any further
 information afaics (hence the suspicion that I'm missing something).

There have been recent news about security issues with automount stuff
(linked with vulnerabilities in pdf parsers and thumbnailers). It
doesn't warrant a DSA, but I think it's safer to ship thunar-volman with
automount/autobrowse/autorun disabled by default.

Regards,
-- 
Yves-Alexis


signature.asc
Description: This is a digitally signed message part


Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Ron Johnson

On 02/26/2011 05:32 PM, Yves-Alexis Perez wrote:

On Sat, 2011-02-26 at 18:00 +, Adam D. Barratt wrote:

[snip]


Apologies if I'm missing something obvious, but what's the motivation
for making this change in stable?  The changelog for the proposed upload
and the corresponding upload to unstable don't provide any further
information afaics (hence the suspicion that I'm missing something).


There have been recent news about security issues with automount stuff
(linked with vulnerabilities in pdf parsers and thumbnailers). It
doesn't warrant a DSA, but I think it's safer to ship thunar-volman with
automount/autobrowse/autorun disabled by default.



Isn't it auto*run* which opens a vulnerability, and thus should be 
disabled by default?


Disabling automount  autobrowse seem to be security overkill.

--
I prefer banana-flavored energy bars made from tofu.


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4d699401.8070...@cox.net



Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Yves-Alexis Perez
On Sat, 2011-02-26 at 18:00 -0600, Ron Johnson wrote:
 Isn't it auto*run* which opens a vulnerability, and thus should be 
 disabled by default?

Autorun can leads to somehow direct exploitation.
 
 Disabling automount  autobrowse seem to be security overkill. 

Autobrowse means a file manager is opened, which, by default, tries to
make thumbnails of files, which, in turn, can lead to code execution by
exploiting bugs in pdf parsers.

Regards,
-- 
Yves-Alexis


signature.asc
Description: This is a digitally signed message part


Re: [squeeze] permission to upload desktop-base

2011-02-26 Thread Yves-Alexis Perez
On Sat, 2011-02-26 at 17:51 +, Adam D. Barratt wrote:
 Hi,
 
 On Fri, 2011-02-18 at 23:16 +0100, Yves-Alexis Perez wrote:
  it seems that plymouth spacefun script doesn't work fine with dual
  monitor setup (#613249). I've checked the patch on a dual monitor setup
  and it seems to do the job just fine so I'd like to push it for 6.0.1 or
  6.0.2.
 
 The patch looks okay; thanks.  Please feel free to go ahead with the
 upload for 6.0.1.
Uploaded, thanks!
-- 
Yves-Alexis


signature.asc
Description: This is a digitally signed message part


Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Ron Johnson

On 02/26/2011 06:01 PM, Yves-Alexis Perez wrote:

On Sat, 2011-02-26 at 18:00 -0600, Ron Johnson wrote:

Isn't it auto*run* which opens a vulnerability, and thus should be
disabled by default?


Autorun can leads to somehow direct exploitation.


Right.



Disabling automount  autobrowse seem to be security overkill.


Autobrowse means a file manager is opened, which, by default, tries to
make thumbnails of files, which, in turn, can lead to code execution by
exploiting bugs in pdf parsers.



Ah.

Turn off thumbnailing of removable media?

--
I prefer banana-flavored energy bars made from tofu.


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/4d699b13.6060...@cox.net



Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Yves-Alexis Perez
On Sat, 2011-02-26 at 18:30 -0600, Ron Johnson wrote:
 Ah.
 
 Turn off thumbnailing of removable media? 

Why? I do like having thumbnails of my pictures when I plug an sdcard
from my camera.

Anyway this is not really a topic for debian-release imho.

Regards,
-- 
Yves-Alexis


signature.asc
Description: This is a digitally signed message part


Re: [squeeze] permission to upload thunar-volman

2011-02-26 Thread Julien Cristau
On Sun, Feb 27, 2011 at 00:32:04 +0100, Yves-Alexis Perez wrote:

 There have been recent news about security issues with automount stuff
 (linked with vulnerabilities in pdf parsers and thumbnailers). It
 doesn't warrant a DSA, but I think it's safer to ship thunar-volman with
 automount/autobrowse/autorun disabled by default.
 
I'm not sure it warrants a stable update either, or that it makes sense
to have thunar behave differently from nautilus or whatever the kde
equivalent is called this week.

Cheers,
Julien


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110227003644.gm12...@radis.liafa.jussieu.fr



Re: [SRM] upload of debian-reference/2.46 to stable

2011-02-26 Thread Osamu Aoki
Hi,

On Sat, Feb 26, 2011 at 05:45:21PM +, Adam D. Barratt wrote:
 On Fri, 2011-02-25 at 22:20 +0900, Osamu Aoki wrote:
  | debian-reference (2.46) stable; urgency=low
  | 
  |   * Updated Portguese translation by Américo Monteiro.
  |   * Fixed s/--get-selection/--get-selections/ etc. Closes: #612435
  |   * Reflected introduction of squeeze-updates suite which replaced
  | Debian Volatile Service. Closes: #614224
  |   * Fixed URL for Debian Mirror Checker site. Closes: #614253
 
 Thanks for working on this.  The above sounds okay; is a debdiff of the
 proposed upload available somewhere?

Here it is.  (I excluded *.po and *.pot files for debdiff of dsc files
since they contain line numbers which is different due to rebuild and
causes debdiff to be 16892KB instead of 33KB).
 
 Is an upload to sid planned soon?  

Not so soon.  If I do, it will be 2.47

 If the package has the same version in stable and testing at the time
 of the point release then dak will automatically propagate the new
 stable package upwards in to testing (and unstable as well if
 required) in order to ensure that the version constraints between the
 suites are met; that may or may not be what you want.

Thanks.
 
File lists identical (after any substitutions)

Control files of package debian-reference: lines which differ (wdiff format)

Version: [-2.45-] {+2.46+}

Control files of package debian-reference-common: lines which differ (wdiff 
format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-de: lines which differ (wdiff format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-en: lines which differ (wdiff format)
---
Installed-Size: [-4012-] {+4008+}
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-es: lines which differ (wdiff format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-fr: lines which differ (wdiff format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-it: lines which differ (wdiff format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-ja: lines which differ (wdiff format)
---
Installed-Size: [-4408-] {+4404+}
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-pl: lines which differ (wdiff format)
---
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-pt: lines which differ (wdiff format)
---
Installed-Size: [-4052-] {+4068+}
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-pt-br: lines which differ (wdiff 
format)
--
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-zh-cn: lines which differ (wdiff 
format)
--
Version: [-2.45-] {+2.46+}

Control files of package debian-reference-zh-tw: lines which differ (wdiff 
format)
--
Version: [-2.45-] {+2.46+}
diff -Nru --exclude '*.po' --exclude '*.pot' 
debian-reference-2.45/asciidoc/02_package.txt 
debian-reference-2.46/asciidoc/02_package.txt
--- debian-reference-2.45/asciidoc/02_package.txt   2010-09-08 
21:50:36.0 +0900
+++ debian-reference-2.46/asciidoc/02_package.txt   2011-02-26 
09:01:01.0 +0900
@@ -119,7 +119,7 @@
 deb-src http://security.debian.org/ @-@codename-stable@-@/updates main contrib
 
 
-Please note `ftp.XX.debian.org` must be replaced with appropriate mirror 
site URL for your location, for USA `ftp.us.debian.org`, which can be found 
in http://www.debian.org/mirror/list[the list of Debian worldwide mirror 
sites].  The status of these servers can be checked at 
http://www.de.debian.org/dmc/[Debian Mirror Checker site].
+Please note `ftp.XX.debian.org` must be replaced with appropriate mirror 
site URL for your location, for USA `ftp.us.debian.org`, which can be found 
in http://www.debian.org/mirror/list[the list of Debian worldwide mirror 
sites].  The status of these servers can be checked at 
http://ftp.de.debian.org/dmc/[Debian Mirror Checker site].
 
 Here, I tend to use codename 

Re: Processed (with 1 errors): Raise severity for KDE3 / Qt3 removal reminder bugs (squeeze has been released)

2011-02-26 Thread Julien Cristau
On Fri, Feb 25, 2011 at 19:45:11 -0600, Jonathan Nieder wrote:

 Hi,
 
 Julien Cristau wrote:
  On Thu, Feb 24, 2011 at 03:11:52 -0600, Jonathan Nieder wrote:
 
   1. lower the severity of these bugs to important or lower
 
  Yes please.
 
 Based on response from #debian-qt-kde that was a bad idea on
 my part.  Not wanting to spam people further, I'm leaving things
 as they are (half of the bugs important, half serious).
 
Care to elaborate?

Cheers,
Julien


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110227012234.go12...@radis.liafa.jussieu.fr



Severity for KDE3 / Qt3 removal reminder bugs

2011-02-26 Thread Jonathan Nieder
Julien Cristau wrote:

 Care to elaborate?

As I understand it:

The Qt 3 part is a red herring.  Bugs blocking removal of Qt 3 really
should _not_ be release critical as long as there is someone willing
to maintain Qt 3 itself.  I'm not aware of an RFA, so...

As for the KDE 3 part: to avoid user confusion and maintenance hassle,
including KDE 3 in wheezy (at least unless someone else comes in and
shows interest and competence at maintaining the beast) is not
something the KDE maintainers consider an option.  So packages which
only work with KDE 3 need to be removed or ported to KDE 4.

Those packages are mostly being removed already.  As long as it gets
taken care of quickly, I don't personally mind.  And some people at
#debian-qt-kde seemed to mind my meddling a lot.

The status of KDE 3 removal is being tracked at

 http://wiki.debian.org/kdelibs4c2aRemoval

and

 
http://bugs.debian.org/cgi-bin/pkgreport.cgi?users=debian-qt-...@lists.debian.org;tag=kde3libs-removal

I didn't get a clear answer about what the preferred severity is for
these bugs on IRC, so my reaction is to step away quietly...  But
given clear answers, I'd be glad to clean up my mess.

Hope that helps,
Jonathan


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110227013919.GA21197@elie



Bug#615513: release.debian.org: armhf inclusion into the archive

2011-02-26 Thread Hector Oron
Package: release.debian.org
Severity: wishlist

Hello,

  I would like to propose inclusion of Debian ARM for hard float port ('armhf') 
into Debian main archive as a release goal.
  ARM for hard float porters will add bug blockers to this bug to ease release 
team work.

Best regards

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (650, 'testing'), (600, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.37-1-686 (SMP w/2 CPU cores)
Locale: LANG=ca_ES.UTF-8, LC_CTYPE=ca_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash



-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/20110227021107.1045.24894.report...@flaco.tsc-farm.upc.es



Bug#615513: release.debian.org: armhf inclusion into the archive

2011-02-26 Thread Julien Cristau
reassign 615513 ftp.debian.org
kthxbye

On Sun, Feb 27, 2011 at 02:11:07 +, Hector Oron wrote:

 Package: release.debian.org
 Severity: wishlist
 
 Hello,
 
   I would like to propose inclusion of Debian ARM for hard float port 
 ('armhf') into Debian main archive as a release goal.

What does this have to do with the release team?  We don't run the
archive...

Cheers,
Julien



-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20110227023208.ga3...@radis.liafa.jussieu.fr



Processed: Re: Bug#615513: release.debian.org: armhf inclusion into the archive

2011-02-26 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 reassign 615513 ftp.debian.org
Bug #615513 [release.debian.org] release.debian.org: armhf inclusion into the 
archive
Bug reassigned from package 'release.debian.org' to 'ftp.debian.org'.
 kthxbye
Stopping processing here.

Please contact me if you need assistance.
-- 
615513: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615513
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.c.129877393624148.transcr...@bugs.debian.org



Processed (with 1 errors): block 615513 with 604688 605013 521918 533934 589809 552881 552873 501414 577029 596936 593049 367831 590952 599725 598937 577364 571389 495889 596986 598933 602668 598923 5

2011-02-26 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 block 615513 with 604688 605013 521918 533934 589809 552881 552873 501414 
 577029 596936 593049 367831 590952 599725 598937 577364 571389 495889 596986 
 598933 602668 598923 574299 563050 598885 588631 580678 573759 602169 577899 
 605033 543029 544831 552872 596997 597920 604107 565001 565101 565101 598936 
 536544 527419 604792 596952 597000 596996 596989 596960 605841 604523 596968 
 604692 604537 604535 604527 604693 604533 604669 604691 604664 604666 604656 
 604662 604654 604665 604674 604651 604650 604649 604679 604670 604673 604681 
 604660 604658 604653 605842
Bug #615513 [release.debian.org] release.debian.org: armhf inclusion into the 
archive
Was not blocked by any bugs.
Added blocking bug(s) of 615513: 593049, 539028, 596986, 597000, 595743, 
552873, 501414, 596968, 563050, 598933, 590952, 605841, 596952, 527419, 552872, 
544831, 604688, 604673, 536544, 580678, 521918, 604792, 604681, 495889, 604662, 
533934, 604674, 577364, 604654, 604537, 569118, 591560, 604692, 604651, 589809, 
598885, 577899, 543029, 565101, 604693, 604666, 596989, 552881, 602169, 598936, 
605013, 604527, 604653, 604656, 577029, 598923, 602668, 565001, 604691, 578733, 
597920, 604650, 367831, 598937, 604523, 573759, 596996, 588631, 599725, 604649, 
604679, 596936, 581277, 604535, 574299, 604665, 604660, 604669, 571389, 604670, 
604658, 604107, 596997, 595828, 594179, 604533, 596960, 605842, 605033, and 
604664
Failed to set blocking bugs of 615513: failed to get lock on 
/org/bugs.debian.org/spool/lock/merge -- Unable to lock 
/org/bugs.debian.org/spool/lock/merge Resource temporarily unavailable.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532.
Unable to lock /org/bugs.debian.org/spool/lock/merge Resource temporarily 
unavailable at /usr/local/lib/site_perl/Debbugs/Common.pm line 532. at 
/usr/local/lib/site_perl/Debbugs/Common.pm line 545.

 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
615513: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615513
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.c.129877344621747.transcr...@bugs.debian.org