Bug#693290: unblock: horizon/2012.1.1-7 (CVE-2012-5474 fix)

2012-11-15 Thread Thomas Goirand
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Horizon had its /etc/openstack-dashboard/local_settings.py
world readable. This file contains passwords, so that isn't
good. My latest upload to SID fixes this.

Please unblock package horizon 2012.1.1-7.

Note that Debian isn't affected by CVE-2012-5476, or by
CVE-2012-5483. I've checked, and the corresponding
configuration files are *not* world readable in Debian.
The security tracker has been updated for this.

Our Folsom packaging, currently in our Git on Alioth only,
isn't affected by any of the above (we rewrote all the
management on a unified library which uses BSD install,
with -m 0640, so we don't have such problems).

Cheers,

Thomas
diff -Nru horizon-2012.1.1/debian/changelog horizon-2012.1.1/debian/changelog
--- horizon-2012.1.1/debian/changelog	2012-09-21 13:20:55.0 +
+++ horizon-2012.1.1/debian/changelog	2012-11-15 08:50:33.0 +
@@ -1,3 +1,10 @@
+horizon (2012.1.1-7) unstable; urgency=high
+
+  * CVE-2012-5474: The file /etc/openstack-dashboard/local_settings is not
+  world readable anymore (Closes: #693287).
+
+ -- Thomas Goirand z...@debian.org  Thu, 15 Nov 2012 08:47:18 +
+
 horizon (2012.1.1-6) unstable; urgency=low
 
   * Keyerror when displaying Instances  Volumes:
diff -Nru horizon-2012.1.1/debian/openstack-dashboard.postinst horizon-2012.1.1/debian/openstack-dashboard.postinst
--- horizon-2012.1.1/debian/openstack-dashboard.postinst	2012-09-21 13:20:55.0 +
+++ horizon-2012.1.1/debian/openstack-dashboard.postinst	2012-11-15 08:50:33.0 +
@@ -4,10 +4,15 @@
 if [ $1 = configure ]
 then
 adduser --system \
-	--home /var/lib/horizon \
+--home /var/lib/horizon \
 --quiet \
 --disabled-password \
 --group horizon
+
+	if[ -r /etc/openstack-dashboard/local_settings.py ] ; then
+		chmod 0640 /etc/openstack-dashboard/local_settings.py
+		chown horizon:horizon /etc/openstack-dashboard/local_settings.py
+	fi
 fi
 
-#DEBHELPER#
\ No newline at end of file
+#DEBHELPER#


Re: [Pkg-mediawiki-devel] Candidates for removal from testing (2012-11-14)

2012-11-15 Thread Thorsten Glaser
On Wed, 14 Nov 2012, Niels Thykier wrote:

  * The package had at least one RC bug without activity for the past
14 days.

 Jonathan Wiltshire j...@debian.org
mediawiki-math (U)
 
 Mediawiki Maintenance Team pkg-mediawiki-de...@lists.alioth.debian.org
mediawiki-math

Hey Jonathan,

will you take care of this? Otherwise I’ll have to
see that I take some time for it…

bye,
//mirabilos
-- 
tarent solutions GmbH
Rochusstraße 2-4, D-53123 Bonn • http://www.tarent.de/
Tel: +49 228 54881-393 • Fax: +49 228 54881-314
HRB 5168 (AG Bonn) • USt-ID (VAT): DE122264941
Geschäftsführer: Boris Esser, Sebastian Mancke


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/alpine.deb.2.02.1211150925530.5...@tglase.lan.tarent.de



Re: Accepted minidjvu 0.8.svn.2010.05.06+dfsg-1 (source amd64)

2012-11-15 Thread Adam D. Barratt

Hi,

 minidjvu (0.8.svn.2010.05.06+dfsg-1) unstable; urgency=low
 .
   * support multiarch
   * ack silly NMU (silly because the waf file was unused, and because
 there is a difference between sourceless and source in odd 
format)

   * revamp autotools and engage automake for robustness

Unfortunately, the first and last of those changes make the package 
unsuitable for an unblock. Opinions on which of the various options we 
take from here welcome.


Regards,

Adam


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/baa53bdf249e4997b3fcfe69e6d0f...@mail.adsl.funky-badger.org



Re: Bug#692946: cdd-dev: copyright file missing after upgrade (policy 12.5)

2012-11-15 Thread Andreas Beckmann
On 2012-11-15 09:20, Andreas Tille wrote:
 Andreas,
 
 could you please
 
   [ ] agree
   [ ] disagree
 
 to the suggestion to lower the priority of this bug.  I would like to
 deal with this as quick as possible but I would like to hear your opinion
 about the action that should be done.

I'm not sure how to deal with this bug properly: missing copyright file
in empty transitional package, already caused by a lenny-squeeze
update. Therefore Cc:ing -release@ for their opinion on this (currently
RC) bug.

From the piuparts point of view I'd rather like to see this fixed in the
package than working around this in piuparts (IIRC this is blocking
about 50 rdepends from being checked).

The transitional package should have been dropped for wheezy (but there
wasn't any new upload after squeeze).

For fixing this in jessie I'd propose to drop cdd-dev and add
  Package: blends-dev
  Conflicts: cdd-dev
  Replaces: cdd-dev
to get rid of installations of the old faulty package.

Andreas

 
 Kind regards
 
  Andreas.
 
 On Mon, Nov 12, 2012 at 08:35:22AM +0900, Charles Plessy wrote:
 Le Sun, Nov 11, 2012 at 02:57:45PM +0100, Andreas Tille a écrit :

 it is true that /usr/share/doc/cdd-dev does not contain a copyright file
 because it is simply a symlink to /usr/share/doc/blends-dev and the
 transitional (=empty) package cdd-dev depends from blends-dev.  So while
 the report is correct I would consider an upload at current time simply
 causing work for several people just to follow some rules with no profit
 for anybody.  I'd suggest to lower the priority of the bug and leave the
 package as is.

 What do you think?

 Hi Andreas,

 if /usr/share/doc/cdd-dev were a symlink to /usr/share/doc/blends-dev,
 then piuparts would have found the copyright file.

 I think that what piuparts seems to have found, is that when upgrading
 from lenny to squeeze to wheezy, /usr/share/doc/cdd-dev does
 not become a symlink :

   MISSING COPYRIGHT FILE: /usr/share/doc/cdd-dev/copyright
   drwxr-xr-x 2 root root 40 Nov 10 07:33 /usr/share/doc/cdd-dev
   total 0
   drwxr-xr-x   2 root root   40 Nov 10 07:33 .
   drwxr-xr-x 126 root root 2660 Nov 10 07:35 ..

 This really looks like an empty directory.

 I would agree to downgrade the bug (cdd-dev is transitional and native,
 there is anyway not copyrighted work to look for in this package),
 but is the breakage limited to /usr/share/doc/cdd-dev/ ?

 Cheers,

 -- 
 Charles Plessy
 Debian Med packaging team,
 http://www.debian.org/devel/debian-med
 Tsurumi, Kanagawa, Japan


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/50a4b314.6070...@abeckmann.de



Re: Candidates for removal from testing (2012-11-14)

2012-11-15 Thread Niels Thykier
On 2012-11-15 00:15, Emmanuel Bouthenot wrote:
 Hi,
 
 On Wed, Nov 14, 2012 at 10:02:10PM +0100, Niels Thykier wrote:
 [...]
 
 Should you need a bit more time than given, please do not hesitate to
 contact us.  It is also easier for us if we can avoid having to
 reintroduce a removed package.
 [...]
 
 Debian Sympa team pkg-sympa-de...@lists.alioth.debian.org
sympa

 Emmanuel Bouthenot kol...@debian.org
sympa (U)
 
 As said in the bug report[1], I'm currently working on fixing this bug
 but I might need more time to finish writing some tests to be sure that
 the fix is correct.
 
 Is it possible to relax the deadline?
 
 
 [1] http://bugs.debian.org/686846
 
 Regards,
 

Certainly, do you have a rough idea of how long you will need?

~Niels


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/50a4b91e.6030...@thykier.net



Re: Bug#692946: cdd-dev: copyright file missing after upgrade (policy 12.5)

2012-11-15 Thread Andreas Tille
Hi,

On Thu, Nov 15, 2012 at 10:17:08AM +0100, Andreas Beckmann wrote:
 On 2012-11-15 09:20, Andreas Tille wrote:
  Andreas,
  
  could you please
  
[ ] agree
[ ] disagree
  
  to the suggestion to lower the priority of this bug.  I would like to
  deal with this as quick as possible but I would like to hear your opinion
  about the action that should be done.
 
 I'm not sure how to deal with this bug properly: missing copyright file
 in empty transitional package, already caused by a lenny-squeeze
 update. Therefore Cc:ing -release@ for their opinion on this (currently
 RC) bug.
 
 From the piuparts point of view I'd rather like to see this fixed in the
 package than working around this in piuparts (IIRC this is blocking
 about 50 rdepends from being checked).

Hmmm, I wonder what metapackage might remain to depend from cdd-dev ...
 
 The transitional package should have been dropped for wheezy (but there
 wasn't any new upload after squeeze).

That's correct.  I intended to leave the transition package for two
Debian releases in case users might skip Squeeze.  I admit that I will
definitely not stick to this intention - so the most simple fix I would
go for is to do this ...

 For fixing this in jessie I'd propose to drop cdd-dev and add
   Package: blends-dev
   Conflicts: cdd-dev
   Replaces: cdd-dev
 to get rid of installations of the old faulty package.

... right now for Wheezy.

Kind regards

   Andreas.

-- 
http://fam-tille.de


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115101857.ge5...@an3as.eu



Re: Accepted minidjvu 0.8.svn.2010.05.06+dfsg-1 (source amd64)

2012-11-15 Thread Barak A. Pearlmutter
Adam, I do not see any reason to unblock the freeze on minidjvu for
this issue.

But if you want to, and don't want the revamped autotools stuff, feel
free to just take 0.8.svn.2010.05.06+dfsg-0.1 and push it to
proposed-updates or whatever the procedure is.

 Justification for the above

As discussed earlier, despite the overheated rhetoric and +dfsg NMU
version, this is *not* actually a DFSG issue.

There is a file in the upstream source tarball which is in an
unpleasant format (waf).  That file is however (a) easily converted to
a nicer format, and (b) completely unused in the build process.  We
have a policy of not wanting source files in such unpleasant formats
for a reason.  The reason is *not* that they violate the DFSG per-se,
but rather that they're a pain in the ass: we want sources to be easy
to examine and audit both manually and automatically, and files in
weird formats complicate this.  But those are not issues *in this
particular case* because the waf file in question is not used during
the build at all.  The build uses autoconf instead.

   Justification of updated autotools files

The old autotools files were stepping on user variables in a way that
interacted poorly with fortified compilation.  The only substantive
difference in version 0.8.svn.2010.05.06+dfsg-2 is that warning and
strictness flags are not accidentally turned off when doing a
fortified (or optimized for that matter) build.  This potentially
slightly improves security, and certainly makes the package more
auditable.  But, they do not really change the generated binaries
(except for moving library files to multiarch dirs.)

--Barak.
--
Barak A. Pearlmutter
 http://www.bcl.hamilton.ie/~barak/


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/E1TYwNI-0005P8-5o@port-kdr.hamilton.local



Bug#690075: unblock: dnsmasq/2.63-4

2012-11-15 Thread intrigeri
Hi,

Simon Kelley wrote (12 Nov 2012 21:05:35 GMT) :
 I'd strongly suggest moving to 2.63-4, rather than backporting.
 The changes for the security fix are not trivial, and probablity of
 introducing a bug backporting is much larger that the probablity
 that there's an un-found bug in 2.63 which is not in 2.62. There are
 no intended backwards incompatibilities between 2.63 and 2.62, and
 no un-intended ones have been found in the three months since 2.63
 was released.

Then, this matter goes way out of the scope of my humble help the
release team with a few easy reviews effort.

Cheers,
-- 
  intrigeri
  | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
  | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/85y5i3u47f@boum.org



Bug#692911: unblock: ca-certificates/20121105

2012-11-15 Thread intrigeri
Hi,

Michael Shuler wrote (11 Nov 2012 20:59:10 GMT) :
 In parsing certdata.txt for the ca-certificates package, neither of
 these flags are used when the CA trust database is created, so both
 CKT_NSS_MUST_VERIFY_TRUST and CKT_NSS_TRUST_UNKNOWN flags are
 ignored. This is why I indicated these lines are innocuous -

Thanks a lot for the detailed explanation!

 Should I re-upload with a changelog entry of something like:

 diff --git a/debian/changelog b/debian/changelog
 index 861abed..3fe8329 100644
 --- a/debian/changelog
 +++ b/debian/changelog
 @@ -1,6 +1,9 @@
  ca-certificates (20121105) unstable; urgency=low

* Update mozilla/certdata.txt to version 1.86  Closes: #683728
 +Clean up of no explicit trust flag CKT_NSS_TRUST_UNKNOWN to
 +CKT_NSS_MUST_VERIFY_TRUST
 +- https://bugzilla.mozilla.org/show_bug.cgi?id=757189

I think it would be even better to replace clean up with some
version of parsing certdata.txt for the ca-certificates package,
neither of these flags are used when the CA trust database is created,
so both CKT_NSS_MUST_VERIFY_TRUST and CKT_NSS_TRUST_UNKNOWN flags are
ignored: IMHO, Clean up still describes the change itself, rather
than the reason why it is reasonable, which is, I think, as important.

 Or should I patch out these changes from mozilla/certdata.txt and
 re-upload?

Personally, I think these changes should be fine, once it's properly
documented why they have no practical effect, but the final call is
not mine.

In any case, this is starting to look like a pre-approval request more
than a unblock one, since the actual package to unblock has not been
uploaded yet. So, I guess it might be dealt with slightly faster if
the bug against release.d.o was formally put into the right category.

Cheers!
-- 
  intrigeri
  | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
  | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/85d2zfsozj@boum.org



unblock request for dracut 020-2

2012-11-15 Thread Thomas Lange
dracut 020-2 fixes the important bug #685004. Please unblock it.

It also includes the security fix for CVE-2012-4453 (Closes:
#688956). This was already fixed in 020-1.1, but his version did not
went into testing because 020-2 was upload before.

-- 
regards Thomas


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/20644.53307.158639.361...@malzmuehle.informatik.uni-koeln.de



Bug#692911: unblock: ca-certificates/20121105

2012-11-15 Thread Adam D. Barratt

On 15.11.2012 00:12, intrigeri wrote:
In any case, this is starting to look like a pre-approval request 
more

than a unblock one, since the actual package to unblock has not been
uploaded yet. So, I guess it might be dealt with slightly faster if
the bug against release.d.o was formally put into the right category.


It's already usertagged unblock, which is the right category. If 
you're thinking of freeze-exception, that's been deprecated, hence 
wheezy / sid's reportbug not offering it any more.


Regards,

Adam


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/4966a958bd88f716e00c740ab4cb4...@mail.adsl.funky-badger.org



Bug#691552: unblock: yate/4.1.0-1~dfsg-3

2012-11-15 Thread Jeroen Dekkers
At Sun, 11 Nov 2012 18:36:14 +0100,
Julien Cristau wrote:
 
 On Wed, Nov  7, 2012 at 09:28:28 +1100, Mark Purcell wrote:
 
  On Wed, 7 Nov 2012 00:32:36 Paul Chitescu wrote:
unblock yate/4.1.0-1~dfsg-3

[...]
  
   Does this require any more action?
  
  Hi Paul,
  
  Yes we are awaiting a decision from debian-release.
  
 debian-release don't like the debian/rules changes much.

I think we can all agree on that. Such changes shouldn't happen during
the freeze, but the problem is that the debian/rules file is buggy:

http://anonscm.debian.org/viewvc/pkg-voip/yate/tags/4.1.0-1~dfsg-2/debian/rules?revision=9806view=markup

On line 21-22 and 96-97 you see the use of dh, but in lines 24-94 old
style debhelper is used. This is just wrong and causes bugs. The
proper fix would be to use only one style and this is what Mark did in
the last version.

It might be possible to spend a lot of time to see whether the known
bugs can be fixed with minimal changes and just hope there aren't more
bugs caused by the mix of debhelper styles, but I think that's a waste
of time and keeping the mix of debhelper isn't going to make reviewing
what's going on easier.

Yate is also just a leaf package. If Yate gets new RC bugs because of
these changes and those aren't quickly fixed it can simply be removed
from testing.

Kind regards,

Jeroen Dekkers


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/87d2zfnjyc.wl%jer...@dekkers.ch



Re: Candidates for removal from testing (2012-11-14)

2012-11-15 Thread Emmanuel Bouthenot
On Thu, Nov 15, 2012 at 10:42:54AM +0100, Niels Thykier wrote:
[...]

 Certainly, do you have a rough idea of how long you will need?
Before the end of the month, probably earlier but I will be glad to not
have to work under time pressure.


Regards,

M.

-- 
Emmanuel Bouthenot
  mail: kolter@{openics,debian}.orggpg: 4096R/0x929D42C3
  xmpp: kol...@im.openics.org  irc: kolter@{freenode,oftc}


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115124330.gd6...@openics.org



Bug#692911: unblock: ca-certificates/20121105

2012-11-15 Thread Michael Shuler
On 11/14/2012 06:12 PM, intrigeri wrote:
 Michael Shuler wrote (11 Nov 2012 20:59:10 GMT) :
 In parsing certdata.txt for the ca-certificates package, neither of
 these flags are used when the CA trust database is created, so both
 CKT_NSS_MUST_VERIFY_TRUST and CKT_NSS_TRUST_UNKNOWN flags are
 ignored. This is why I indicated these lines are innocuous -
 
 Thanks a lot for the detailed explanation!

No problem!

 Should I re-upload with a changelog entry of something like:
 
* Update mozilla/certdata.txt to version 1.86  Closes: #683728
 +Clean up of no explicit trust flag CKT_NSS_TRUST_UNKNOWN to
 +CKT_NSS_MUST_VERIFY_TRUST
 +- https://bugzilla.mozilla.org/show_bug.cgi?id=757189
 
 I think it would be even better to replace clean up with some
 version of parsing certdata.txt for the ca-certificates package,
 neither of these flags are used when the CA trust database is created,
 so both CKT_NSS_MUST_VERIFY_TRUST and CKT_NSS_TRUST_UNKNOWN flags are
 ignored: IMHO, Clean up still describes the change itself, rather
 than the reason why it is reasonable, which is, I think, as important.

Bummer. I was going to update this bug after 20121114 hit unstable.

I built ca-certificates_20121114 before getting this note, and it is
waiting for upload by my sponsors, as of writing. This upload is being
coordinated with an upload of ca-certificates-java with version breaks
and depends (see full debdiff).

Here is what I did include for this change in 20121114:

+  * Update mozilla/certdata.txt to version 1.86  Closes: #683728
+- Replace legacy no explicit trust flag of CKT_NSS_TRUST_UNKNOWN for
+  CKT_NSS_MUST_VERIFY_TRUST, instead of a mix of both flags:
+  https://bugzilla.mozilla.org/show_bug.cgi?id=757189
+Certificates added (+) (none removed):
++ Actalis Authentication Root CA
...

Full debdiff:
http://www.pbandjelly.org/debian/ca-certificates_20120623-20121114.debdiff

So, while I did include a note about the change for context for the
reader of the diff (upstream change X: reference), I not go into detail
about why this upstream change is not very meaningful to functionality
or packaging (upstream change X: reference - this particular change
doesn't really modify anything with ca-certificates because Y). That
additional info seems a bit overkill to me, but we can add that, if it
would be helpful.

Again, I was going to reply after upload, but since there's another
question on this, I thought I would take a moment to let you know what's
coming.

-- 
Kind regards,
Michael


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/50a50040.9060...@pbandjelly.org



Re: Bug#683323: unblock: python-apt/0.8.7

2012-11-15 Thread Michael Vogt
On Wed, Nov 14, 2012 at 10:04:08PM +0100, Julian Andres Klode wrote:
 On Wed, Nov 14, 2012 at 11:36:28AM +, Michael Vogt wrote:
  On Mon, Nov 12, 2012 at 09:28:00PM +, Adam D. Barratt wrote:
   On Sun, 2012-10-28 at 16:36 +, Adam D. Barratt wrote:
A quick note first, as I noticed the subject was updated to reference
0.8.8... That version isn't a valid candidate right now in any case, as
it FTBFS on approximately half the architectures - see
https://buildd.debian.org/status/package.php?p=python-apt
   
   Any news on that?
  
  Sorry for the delay and thanks for your mail.
  
  This is fallout from a recent change in apt (to handle packages that
  have no architectures) in our testsuite. I fixed it in bzr and its
  ready to upload but I'm traveling right now and my network is pretty
  bad, so building is a bit difficult for me right now. If someone from
  the team could upload it that would be great, otherwise I will do it
  once I found a reasonable network connection.
 
 I can upload it tomorrow or the day after, if you're still travelling
 then.

Thanks, I managed to find some bandwidth today and uploaded, looks
good now on the buildds.

Cheers,
 Michael


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115155656.GB5283@localhost



Bug#692298: unblock: git/1:1.7.10.4-2

2012-11-15 Thread Jonathan Nieder
Julien Cristau wrote:
 On Sun, Nov  4, 2012 at 11:30:04 -0800, Jonathan Nieder wrote:

 Please unblock git/1:1.7.10.4-2 to get fixes to

   #678137 -- incompatibility with SVN 1.7

 and

   #587650 -- Byte order is not compatible at ../../lib/Storable.pm
  errors when accessing git-svn repositories created with
  perl/squeeze
[...]
 The first of those is big, and svn 1.7 is not in wheezy...

Thanks for looking it over.  I can prepare an upload for tpu with the
fix to the second of those and

  b8c78e2a git svn: work around SVN 1.7 mishandling of svn:special
   changes

if you like (which is needed to avoid svn update failing with svn
1.7 and newer

$ svn up
Updating '.':
svn: E235000: In file 'subversion/libsvn_wc/update_editor.c' \
line 1583: assertion failed (action == svn_wc_conflict_action_edit \
|| action == svn_wc_conflict_action_delete || action == \
svn_wc_conflict_action_replace)

on changes pushed by git that flip the is a symlink bit).  As for
the rest of the svn 1.7 compatibility changes, would you be okay with
them after some more aging in unstable?  They would make it easier for
users to upgrade to svn 1.7 privately.

Hope that helps,
Jonathan


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115160756.GA13061@elie.Belkin



Bug#687220: proposed upload: xz-utils/5.1.1alpha+20120614-2

2012-11-15 Thread Jonathan Nieder
Julien Cristau wrote:
 On Thu, Oct 11, 2012 at 18:00:36 -0700, Jonathan Nieder wrote:

 Hi Mohammed, Thorsten, et al,

 I am looking to upload version 5.1.1alpha+20120614-2 of xz-utils
 to unstable.  The package can be found on alioth.debian.org:

 - 
 http://alioth.debian.org/~jrnieder-guest/temp/xz-utils/xz-utils_5.1.1alpha+20120614-2.dsc
 - git://git.debian.org/collab-maint/xz.git master

 What's up here?

Thanks for the ping.  I'm guessing Thorsten was hoping that I would
upload it on my own[1], but I can't do that until keyring-maint
processes the last batch of account requests (a thanksless job).

Regards,
Jonathan

[1] https://lists.debian.org/debian-newmaint/2012/10/msg2.html


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115161557.GB13061@elie.Belkin



Bug#693343: unblock: lyskom-server/2.1.2-13

2012-11-15 Thread Magnus Holmgren
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package lyskom-server

I've taken over this package and fixed the RC bug #689898 that caused it to be 
removed
from testing, as well as cleaned up a few other relatively important issues. 
With this, 
I hope that it can be let back in testing.

unblock lyskom-server/2.1.2-13

Debdiff follows (excluding some changes to config.{guess,sub} files.

diff -Nru --exclude 'config.*' lyskom-server-2.1.2/debian/changelog 
lyskom-server-2.1.2/debian/changelog
--- lyskom-server-2.1.2/debian/changelog2012-11-15 16:40:46.0 
+0100
+++ lyskom-server-2.1.2/debian/changelog2012-11-15 16:40:46.0 
+0100
@@ -1,3 +1,37 @@
+lyskom-server (2.1.2-13) unstable; urgency=low
+
+  * New maintainer.
+  * Rename debian/lyskom-server.copyright debian/copyright as a source
+package should have a debian/copyright file.
+  * Create /var/run/lyskom-server in the init script instead of shipping
+it with the package (Closes: #689898). Thanks Thomas Goirand.
+  * Drop the $startonboot variable, which is rather pointless since
+lyskomd is actually started via cron, is disabled there by default,
+and will start regardless of $startonboot because the status file
+won't exist.
+  * Fix LSB header in the init script: add $remote_fs and move $local_fs
+to Required-Start/Required-Stop; delete commas.
+  * Add dependency on rsyslog | system-log-daemon, since the LSB header
+indicates that lyskomd requires a syslog facility.
+  * Rework and simplify lyskom-server.postinst:
+* Use dpkg-statoverride to set ownership of data and log directories.
+* Don't nullify errors; the package should be left in an unconfigured
+  state in such cases. Remove sanity checks.
+* Simply call adduser with --quiet instead of checking whether the
+  lyskom user already exists.
+* Set stricter modes on the directories.
+  * Don't delete /var/run/lyskom-server/status in the init script. It is
+created by komrunning when shutting down lyskomd to keep updateLysKOM
+from starting lyskomd again.
+  * lyskom-server.postrm: As recommended by policy, don't delete log files
+until on purge. Also, simply rm -rf /var/lib/lyskom-server
+/var/log/lyskom-server.
+  * Add dependendy on cron | cron-daemon, since that's how lyskomd is
+started.
+  * debian/rules: Add build-indep and build-arch targets.
+
+ -- Magnus Holmgren holmg...@debian.org  Thu, 15 Nov 2012 09:26:58 +0100
+
 lyskom-server (2.1.2-12) unstable; urgency=low
 
   * Added Danish translation of Debconf templates.
diff -Nru --exclude 'config.*' lyskom-server-2.1.2/debian/control 
lyskom-server-2.1.2/debian/control
--- lyskom-server-2.1.2/debian/control  2012-11-15 16:40:46.0 +0100
+++ lyskom-server-2.1.2/debian/control  2012-11-15 16:40:46.0 +0100
@@ -1,7 +1,7 @@
 Source: lyskom-server
 Section: net
 Priority: extra
-Maintainer: Peter Krefting pet...@debian.org
+Maintainer: Magnus Holmgren holmg...@debian.org
 Build-Depends: debhelper (= 5.0), bison, flex, po-debconf, autotools-dev
 Standards-Version: 3.8.2
 Homepage: http://www.lysator.liu.se/lyskom/lyskom-server/
@@ -10,7 +10,8 @@
 
 Package: lyskom-server
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, debconf | debconf-2.0, adduser
+Depends: ${shlibs:Depends}, ${misc:Depends}, debconf | debconf-2.0, adduser,
+ rsyslog | system-log-daemon, cron | cron-daemon
 Suggests: lyskom-elisp-client | lyskom-tty-client
 Homepage: http://www.lysator.liu.se/lyskom/lyskom-server/
 Description: Server for the LysKOM conference system
diff -Nru --exclude 'config.*' lyskom-server-2.1.2/debian/copyright 
lyskom-server-2.1.2/debian/copyright
--- lyskom-server-2.1.2/debian/copyright1970-01-01 01:00:00.0 
+0100
+++ lyskom-server-2.1.2/debian/copyright2012-11-15 16:40:46.0 
+0100
@@ -0,0 +1,27 @@
+Package: lyskom-server
+Obtained from: ftp://ftp.lysator.liu.se/pub/lyskom/server
+Packaged for Debian by: Peter Krefting pet...@debian.org
+
+Copyright (C) 1991-2003 Lysator Academic Computer Association.
+The LysKOM server was written by Lars Aronsson, Thomas Bellman, David Byers,
+Per Cederqvist, Pär Emanuelsson, Peter Eriksson, Linus Tolke, Inge Wallin,
+Lars Willför et.al. Please the AUTHORS file for more information.
+
+   LysKOM is free software; you can redistribute it and/or modify it
+   under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 1, or (at your
+   option) any later version.
+
+   LysKOM is distributed in the hope that it will be useful, but
+   WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+   General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with LysKOM. If not, write to Lysator, 

Bug#693349: unblock: flashplugin-nonfree/1:3.1

2012-11-15 Thread Bob Bib
Package: release.debian.org
Severity: wishlist
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package flashplugin-nonfree.

In general, an updated version of this helper package has better handling of
the upstream non-free Adobe Flash Player.

debdiff is attached.

unblock flashplugin-nonfree/1:3.1

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)

Bug#693351: RM: kismet/2008-05-R1-4.3

2012-11-15 Thread Bob Bib
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: rm

Hi release team,
please remove kismet/2008-05-R1-4.3 package from testing, because it's too
outdated (the latest upstream version is Kismet-2011-03-R2) and unmaintained
(the 2008-05-R1-4.3 version in Debian archives is dated 10 Jun 2011) to be
included in Wheezy.

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115173935.4711.6008.reportbug@Chamaydan



Bug#693349: Acknowledgement (unblock: flashplugin-nonfree/1:3.1)

2012-11-15 Thread Bob Bib
I've missed a DebDiff, sorry.

flashplugin-nonfree_3.1.diff.gz
Description: GNU Zip compressed data


Re: [php-maint] Bug#692613: Bug#692613: php5: non-free files in upstream tarball (The Software shall be used for, Good, not Evil)

2012-11-15 Thread Ondřej Surý
I think the best course of action is to contact debian-release team
and ask for an exception (e.g. in Cc:).

Unless we get upstream to change the license (which is unlikely), it's
too late in release cycle for any radical change (like stripping the
json out completely).

On Thu, Nov 15, 2012 at 7:09 PM, Lior Kaplan kap...@debian.org wrote:
 On Thu, Nov 15, 2012 at 7:51 PM, Michael Biebl bi...@debian.org wrote:


 Since Fedora doesn't consider the json license as good [1], it seems
 we are not the only ones having this problem.

 Have you checked what other distros are doing about that, especially
 Fedora?


 Fedora says it's bad, but they still provide it (checked
 php-5.4.1-1.fc17.src.rpm from Fedora 17).

 Kaplan

 ___
 pkg-php-maint mailing list
 pkg-php-ma...@lists.alioth.debian.org
 http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-php-maint



-- 
Ondřej Surý ond...@sury.org


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/caljhhg_qm_eat2ruq9fkqraied4dg5k91x7s2eq7g8qc7kj...@mail.gmail.com



Re: Pre-approval request for t-p-u upload of weechat/0.3.8-2wheezy1

2012-11-15 Thread Adam D. Barratt
On Thu, 2012-11-15 at 08:59 +0100, Emmanuel Bouthenot wrote:
 On Mon, Nov 12, 2012 at 02:01:13PM +0100, Emmanuel Bouthenot wrote:
  I'd like to get your approval about the upload of weechat 0.3.8-2wheezy1
  to testing-proposed-updates in order to fix a security issue which could
  permit to a remote attacker to crash weechat by forging malicious IRC
  messages: http://bugs.debian.org/693026
 
 No opinions?

More likely that no-one's had chance to look at it yet, given that the
mail wasn't filed via the BTS, there were less than three days since the
original mail and we've still got quite a few other requests to
process. :-/

Regards,

Adam


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1353007391.547.3.ca...@jacala.jungle.funky-badger.org



Bug#683323: marked as done (unblock: python-apt/0.8.8)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 20:24:56 +0100
with message-id 20121115192456.gv17...@radis.cristau.org
and subject line Re: Bug#683323: unblock: python-apt/0.8.7
has caused the Debian Bug report #683323,
regarding unblock: python-apt/0.8.8
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
683323: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683323
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package python-apt

Since the version of testing, this contains mostly bug fixes and
many translation updates, but also (starting with 0.8.5) one new
module (apt.auth) which is a cleaned up version of an internal
software-properties module (and not used by any code in unstable
AFAIK).

The versions 0.8.5 and 0.8.6 FTBFS due to this new module, as
it did not pass the test suite due to two bugs: (1) missing
build-time dependency on version 0.9.6 of apt (and outdated
buildds) [fixed in 0.8.6], and (2) because it combined the
stderr and stdout of the apt-key command it calls which
fails to work on kFreeBSD if LD_PRELOAD is set, as gpg
(which is run by apt-key) is setuid there [and we use
fakeroot for the apt.auth tests, so it fails]. The latter
was fixed in 0.8.7.


unblock python-apt/0.8.7

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (500, 'unstable'), (500, 'testing'), (500, 
'stable'), (100, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.utf8, LC_CTYPE=en_GB.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

-- 
Julian Andres Klode  - Debian Developer, Ubuntu Member

See http://wiki.debian.org/JulianAndresKlode and http://jak-linux.org/.


pgplLYmIPMrTC.pgp
Description: PGP signature
---End Message---
---BeginMessage---
On Thu, Nov 15, 2012 at 15:56:56 +, Michael Vogt wrote:

 Thanks, I managed to find some bandwidth today and uploaded, looks
 good now on the buildds.
 
Unblocked.

Cheers,
Julien


signature.asc
Description: Digital signature
---End Message---


Bug#684450: marked as done (unblock: python-apt/0.8.8)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 20:24:56 +0100
with message-id 20121115192456.gv17...@radis.cristau.org
and subject line Re: Bug#683323: unblock: python-apt/0.8.7
has caused the Debian Bug report #683323,
regarding unblock: python-apt/0.8.8
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
683323: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683323
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package python-apt

Testing has 0.8.4 while newer releases close several bugs, among
them, removal of numerous obsolete dependencies such as python2.6

unblock python-apt/0.8.7

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (1001, 'testing')
Architecture: i386 (i686)

Kernel: Linux 3.2.0-3-686-pae (SMP w/2 CPU cores)
Locale: LANG=fi_FI.utf8, LC_CTYPE=fi_FI.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
---End Message---
---BeginMessage---
On Thu, Nov 15, 2012 at 15:56:56 +, Michael Vogt wrote:

 Thanks, I managed to find some bandwidth today and uploaded, looks
 good now on the buildds.
 
Unblocked.

Cheers,
Julien


signature.asc
Description: Digital signature
---End Message---


Re: Pre-approval request for t-p-u upload of weechat/0.3.8-2wheezy1

2012-11-15 Thread Julien Cristau
On Thu, Nov 15, 2012 at 08:59:07 +0100, Emmanuel Bouthenot wrote:

 On Mon, Nov 12, 2012 at 02:01:13PM +0100, Emmanuel Bouthenot wrote:
 [...]
 
  I'd like to get your approval about the upload of weechat 0.3.8-2wheezy1
  to testing-proposed-updates in order to fix a security issue which could
  permit to a remote attacker to crash weechat by forging malicious IRC
  messages: http://bugs.debian.org/693026
 
 No opinions?
 
My opinion is you can wait more than a couple days.

Cheers,
Julien


signature.asc
Description: Digital signature


Bug#693271: marked as done (unblock: lbzip2/2.2-2)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 20:30:00 +0100
with message-id 20121115193000.gx17...@radis.cristau.org
and subject line Re: Bug#693271: unblock: lbzip2/2.2-2
has caused the Debian Bug report #693271,
regarding unblock: lbzip2/2.2-2
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
693271: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693271
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package lbzip2.

The last version in testing was 2.1-2 and then it got removed (probably due to
serious bug #645999).

lbzip2 (2.2-2) unstable; urgency=low

   * debian/rules: Add a working build-arch target, closes: #685418.

 -- Mikolaj Izdebski zurg...@gmail.com  Mon, 20 Aug 2012 18:59:20 +0200

lbzip2 (2.2-1) unstable; urgency=low

   * New upstream release:
 - limited memory allocation, closes: #645999,
 - improved bzip2 compatibility, closes: #582476,
 - fixed several other minor bugs, closes: #673378.
   * debian/control:
 - drop version requirements on autotools,
 - bump Standards-Version to 3.9.3.
   * debian/copyright:
 - remove comment about maintainers involved in creation of the package,
 - update to reflect new upstream version.
   * debian/rules: execute Bourne shell scripts with sh instead of perl.
   * debian/compat: Bump to 9.
   * debian/watch: Use github.com directly instead of githubredir.

 -- Mikolaj Izdebski zurg...@gmail.com  Mon, 20 Aug 2012 07:29:04 +0200

unblock lbzip2/2.2-2

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
---End Message---
---BeginMessage---
On Wed, Nov 14, 2012 at 22:43:47 +, Adam D. Barratt wrote:

 On Thu, 2012-11-15 at 00:33 +0200, Bob Bib wrote:
  Please unblock package lbzip2.
  
  The last version in testing was 2.1-2 and then it got removed (probably due 
  to
  serious bug #645999).
 
 Not just that, but also because the diff from the version in testing at
 that point was too big to sanely review; that was more than two months
 ago now - see #685484.
 
 That diff hasn't got any smaller so I'm not sure what's changed, other
 than the fact that the package now hasn't been in the release for six
 weeks.
 
Closing.

Cheers,
Julien


signature.asc
Description: Digital signature
---End Message---


Re: Bug#692946: cdd-dev: copyright file missing after upgrade (policy 12.5)

2012-11-15 Thread Julien Cristau
On Thu, Nov 15, 2012 at 10:17:08 +0100, Andreas Beckmann wrote:

 On 2012-11-15 09:20, Andreas Tille wrote:
  Andreas,
  
  could you please
  
[ ] agree
[ ] disagree
  
  to the suggestion to lower the priority of this bug.  I would like to
  deal with this as quick as possible but I would like to hear your opinion
  about the action that should be done.
 
 I'm not sure how to deal with this bug properly: missing copyright file
 in empty transitional package, already caused by a lenny-squeeze
 update. Therefore Cc:ing -release@ for their opinion on this (currently
 RC) bug.
 
I don't see why this should be downgraded, and I'm not seeing a
rationale above.

 From the piuparts point of view I'd rather like to see this fixed in the
 package than working around this in piuparts (IIRC this is blocking
 about 50 rdepends from being checked).
 
 The transitional package should have been dropped for wheezy (but there
 wasn't any new upload after squeeze).
 
 For fixing this in jessie I'd propose to drop cdd-dev and add
   Package: blends-dev
   Conflicts: cdd-dev
   Replaces: cdd-dev
 to get rid of installations of the old faulty package.
 
Adding conflicts seems pointless.

Cheers,
Julien


signature.asc
Description: Digital signature


Re: segfault in xscreensaver, screen revealed

2012-11-15 Thread Adam D. Barratt
clone 693087 -1 -2 -3
reassign -1 ftp.debian.org
user ftp.debian@packages.debian.org
usertags -1 rm
retitle -1 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
user release.debian@packages.debian.org
reassign -2 release.debian.org
usertags -2 rm
retitle -2 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
tags -2 + wheezy
reassign -3 release.debian.org
usertags -3 rm
retitle -3 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
tags -3 + squeeze
thanks

On Thu, 2012-11-15 at 07:48 +0100, Yves-Alexis Perez wrote:
 Control: clone -1 -2 -3
 Control: reassign -2 ftpmasters

Hopefully fixed now. :-)

 On mar., 2012-11-13 at 21:56 +0100, Yves-Alexis Perez wrote:
  On mar., 2012-11-13 at 09:00 -0800, Ian Zimmerman wrote:
   Jan Is it possible to reproduce that xscreensaver crash also without
   Jan libpam-rsa module being used? (when using pam-unix login
   Jan alternative with the same scenario)
   
   No, it doesn't happen with pam-unix.  This had been kicked around the
   debian security team for a couple of days before this bug was posted.
   You may want to contact them to coordinate your response.
   
  Yes, we were made aware of the issue. 
  
  Seeing the gravity of the bug, the number of people using it, the time
  of last (upstream) release and the number of NMU, we're considering just
  removing it from Debian altogether, unless you have a decisive argument
  to keep it (and fix the bug quickly).
  
 Doing this now (hoping the Control: syntax will work).

Not so much. :-( Nor does ftpmasters@d.o or the ftpmasters package
exist. :-) Hopefully it's now as you intended.

 ftpmasters, release team: the security team is requesting the removal of
 the pam-rsa package because we were made aware of the above (#693087)
 bug: in some situations, pam_rsa module will cause a segfault in
 xscreensaver, leaving the screen unlocked.
 
 Package seeems to be mostly abandonned upstream (last release in 2007,
 called a “beta release” and no answer from the bug address on the
 upstream webpage) and, although the Debian maintainer seems around,
 there were only NMUs since 2007.
 
 In our opinion, considering the low pam-rsa usage (and even questionning
 the real benefit of the package) it'd be just best to remove it
 altogether.
 
 Thus, we'd like the removal from at least testing and unstable. For
 stable, I'm a bit unsure about how we're supposed to handle a package
 disparition in stable, so I'm available for discussion (although we
 don't think it's really supportable in the current state).

I've cloned a copy of the bug for stable, so we can look at that
separately.

Regards,

Adam


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1353008190.547.9.ca...@jacala.jungle.funky-badger.org



Processed: Re: segfault in xscreensaver, screen revealed

2012-11-15 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 clone 693087 -1 -2 -3
Bug #693087 [libpam-rsa] segfault in xscreensaver, screen revealed
Bug 693087 cloned as bugs 693358-693360
 reassign -1 ftp.debian.org
Bug #693358 [libpam-rsa] segfault in xscreensaver, screen revealed
Bug reassigned from package 'libpam-rsa' to 'ftp.debian.org'.
No longer marked as found in versions libpam-rsa/0.8-9-2.4.
Ignoring request to alter fixed versions of bug #693358 to the same values 
previously set
 user ftp.debian@packages.debian.org
Setting user to ftp.debian@packages.debian.org (was 
a...@adam-barratt.org.uk).
 usertags -1 rm
There were no usertags set.
Usertags are now: rm.
 retitle -1 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
Bug #693358 [ftp.debian.org] segfault in xscreensaver, screen revealed
Changed Bug title to 'RM: pam-rsa -- RoST; unmaintained, buggy and dangerous' 
from 'segfault in xscreensaver, screen revealed'
 user release.debian@packages.debian.org
Setting user to release.debian@packages.debian.org (was 
ftp.debian@packages.debian.org).
 reassign -2 release.debian.org
Bug #693359 [libpam-rsa] segfault in xscreensaver, screen revealed
Bug reassigned from package 'libpam-rsa' to 'release.debian.org'.
No longer marked as found in versions libpam-rsa/0.8-9-2.4.
Ignoring request to alter fixed versions of bug #693359 to the same values 
previously set
 usertags -2 rm
There were no usertags set.
Usertags are now: rm.
 retitle -2 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
Bug #693359 [release.debian.org] segfault in xscreensaver, screen revealed
Changed Bug title to 'RM: pam-rsa -- RoST; unmaintained, buggy and dangerous' 
from 'segfault in xscreensaver, screen revealed'
 tags -2 + wheezy
Bug #693359 [release.debian.org] RM: pam-rsa -- RoST; unmaintained, buggy and 
dangerous
Added tag(s) wheezy.
 reassign -3 release.debian.org
Bug #693360 [libpam-rsa] segfault in xscreensaver, screen revealed
Bug reassigned from package 'libpam-rsa' to 'release.debian.org'.
No longer marked as found in versions libpam-rsa/0.8-9-2.4.
Ignoring request to alter fixed versions of bug #693360 to the same values 
previously set
 usertags -3 rm
There were no usertags set.
Usertags are now: rm.
 retitle -3 RM: pam-rsa -- RoST; unmaintained, buggy and dangerous
Bug #693360 [release.debian.org] segfault in xscreensaver, screen revealed
Changed Bug title to 'RM: pam-rsa -- RoST; unmaintained, buggy and dangerous' 
from 'segfault in xscreensaver, screen revealed'
 tags -3 + squeeze
Bug #693360 [release.debian.org] RM: pam-rsa -- RoST; unmaintained, buggy and 
dangerous
Added tag(s) squeeze.
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
693087: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693087
693358: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693358
693359: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693359
693360: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693360
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.c.13530082928499.transcr...@bugs.debian.org



Bug#693351: RM: kismet/2008-05-R1-4.3

2012-11-15 Thread Julien Cristau
Control: tag -1 moreinfo

On Thu, Nov 15, 2012 at 19:39:35 +0200, Bob Bib wrote:

 Package: release.debian.org
 Severity: normal
 User: release.debian@packages.debian.org
 Usertags: rm
 
 Hi release team,
 please remove kismet/2008-05-R1-4.3 package from testing, because it's too
 outdated (the latest upstream version is Kismet-2011-03-R2) and unmaintained
 (the 2008-05-R1-4.3 version in Debian archives is dated 10 Jun 2011) to be
 included in Wheezy.
 
I'm not sure I want to consider requests for removal of a package from
somebody who is not the maintainer, when the package doesn't seem to
have any RC bug filed
(http://bugs.debian.org/cgi-bin/pkgreport.cgi?src=kismet).

Cheers,
Julien


signature.asc
Description: Digital signature


Processed: Re: Bug#693351: RM: kismet/2008-05-R1-4.3

2012-11-15 Thread Debian Bug Tracking System
Processing control commands:

 tag -1 moreinfo
Bug #693351 [release.debian.org] RM: kismet/2008-05-R1-4.3
Added tag(s) moreinfo.

-- 
693351: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693351
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.b693351.13530083348583.transcr...@bugs.debian.org



Bug#693272: marked as done (unblock: pyatspi/2.5.3+dfsg-2.1)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 20:34:43 +0100
with message-id 20121115193443.gy17...@radis.cristau.org
and subject line Re: Bug#693272: unblock: pyatspi/2.5.3+dfsg-2.1
has caused the Debian Bug report #693272,
regarding unblock: pyatspi/2.5.3+dfsg-2.1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
693272: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693272
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock pyatspi for a switch from conflicts/replaces/provides to 
a transitional package that APT handles much better.

pyatspi (2.5.3+dfsg-2.1) unstable; urgency=low

  * Non-maintainer upload with Samuel’s approval.
  * Ensure smooth upgrades from squeeze. Closes: #691160.
+ Rename python*-pyatspi2 to python*-pyatspi since the API is 
  compatible with the former python-pyatspi package and the module 
  is named pyatspi.
+ Create transitional python*-pyatspi2 packages.

Debdiff attached.

unblock pyatspi/2.5.3+dfsg-2.1

Thanks,
-- 
 .''`.  Josselin Mouette
: :' :
`. `'
  `-
diff -Nru pyatspi-2.5.3+dfsg/debian/changelog 
pyatspi-2.5.3+dfsg/debian/changelog
--- pyatspi-2.5.3+dfsg/debian/changelog 2012-08-27 13:50:12.0 +0200
+++ pyatspi-2.5.3+dfsg/debian/changelog 2012-11-09 10:26:03.0 +0100
@@ -1,3 +1,14 @@
+pyatspi (2.5.3+dfsg-2.1) unstable; urgency=low
+
+  * Non-maintainer upload with Samuel’s approval.
+  * Ensure smooth upgrades from squeeze. Closes: #691160.
++ Rename python*-pyatspi2 to python*-pyatspi since the API is 
+  compatible with the former python-pyatspi package and the module 
+  is named pyatspi.
++ Create transitional python*-pyatspi2 packages.
+
+ -- Josselin Mouette j...@debian.org  Fri, 09 Nov 2012 10:01:50 +0100
+
 pyatspi (2.5.3+dfsg-2) unstable; urgency=low
 
   * Make pyatspi depend on libgail-common. Closes: #682915.
diff -Nru pyatspi-2.5.3+dfsg/debian/control pyatspi-2.5.3+dfsg/debian/control
--- pyatspi-2.5.3+dfsg/debian/control   2012-08-27 13:49:31.0 +0200
+++ pyatspi-2.5.3+dfsg/debian/control   2012-11-09 10:04:57.0 +0100
@@ -15,11 +15,10 @@
 X-Python-Version: = 2.5
 Standards-Version: 3.9.3
 
-Package: python-pyatspi2
+Package: python-pyatspi
 Architecture: all
-Conflicts: python-pyatspi
-Replaces: python-pyatspi
-Provides: python-pyatspi
+Breaks: python-pytaspi2 ( 2.5.3+dfsg-2.1)
+Replaces: python-pytaspi2 ( 2.5.3+dfsg-2.1)
 Depends: ${misc:Depends},
  ${python:Depends},
  python-gi (= 2.90.1),
@@ -30,8 +29,21 @@
  .
  This package contains Python bindings for the client side aspects of at-spi2.
 
-Package: python3-pyatspi2
+Package: python-pyatspi2
+Section: oldlibs
+Priority: extra
+Architecture: all
+Depends: ${misc:Depends},
+ python-pyatspi (= ${source:Version})
+Description: Transitional package for assistive technology Python bindings
+ at-spi is the Assistive Technology Service Provider Interface.
+ .
+ This empty transitional package can be safely removed.
+
+Package: python3-pyatspi
 Architecture: all
+Breaks: python3-pytaspi2 ( 2.5.3+dfsg-2.1)
+Replaces: python3-pytaspi2 ( 2.5.3+dfsg-2.1)
 Depends: ${misc:Depends},
  ${python3:Depends},
  python3-gi (= 2.90.1),
@@ -41,3 +53,14 @@
  at-spi is the Assistive Technology Service Provider Interface.
  .
  This package contains Python3 bindings for the client side aspects of at-spi2.
+
+Package: python3-pyatspi2
+Section: oldlibs
+Priority: extra
+Architecture: all
+Depends: ${misc:Depends},
+ python3-pyatspi (= ${source:Version})
+Description: Transitional package for assistive technology Python3 bindings
+ at-spi is the Assistive Technology Service Provider Interface.
+ .
+ This empty transitional package can be safely removed.
diff -Nru pyatspi-2.5.3+dfsg/debian/python3-pyatspi2.install 
pyatspi-2.5.3+dfsg/debian/python3-pyatspi2.install
--- pyatspi-2.5.3+dfsg/debian/python3-pyatspi2.install  2012-06-29 
04:38:10.0 +0200
+++ pyatspi-2.5.3+dfsg/debian/python3-pyatspi2.install  1970-01-01 
01:00:00.0 +0100
@@ -1 +0,0 @@
-usr/lib/python3
diff -Nru pyatspi-2.5.3+dfsg/debian/python3-pyatspi.install 
pyatspi-2.5.3+dfsg/debian/python3-pyatspi.install
--- pyatspi-2.5.3+dfsg/debian/python3-pyatspi.install   1970-01-01 
01:00:00.0 +0100
+++ pyatspi-2.5.3+dfsg/debian/python3-pyatspi.install   2012-06-29 
04:38:10.0 +0200
@@ -0,0 +1 @@
+usr/lib/python3
diff -Nru pyatspi-2.5.3+dfsg/debian/python-pyatspi2.install 

Re: unblock request for dracut 020-2

2012-11-15 Thread Adam D. Barratt
On Thu, 2012-11-15 at 12:21 +0100, Thomas Lange wrote:
 dracut 020-2 fixes the important bug #685004. Please unblock it.
 
 It also includes the security fix for CVE-2012-4453 (Closes:
 #688956). This was already fixed in 020-1.1, but his version did not
 went into testing because 020-2 was upload before.

Unblocked.

Regards,

Adam


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/1353009505.547.11.ca...@jacala.jungle.funky-badger.org



Bug#693349: marked as done (unblock: flashplugin-nonfree/1:3.1)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 19:54:41 +
with message-id 1353009281.547.10.ca...@jacala.jungle.funky-badger.org
and subject line Re: Bug#693349: unblock: flashplugin-nonfree/1:3.1
has caused the Debian Bug report #693349,
regarding unblock: flashplugin-nonfree/1:3.1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
693349: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693349
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: wishlist
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package flashplugin-nonfree.

In general, an updated version of this helper package has better handling of
the upstream non-free Adobe Flash Player.

debdiff is attached.

unblock flashplugin-nonfree/1:3.1

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)---End Message---
---BeginMessage---
On Thu, 2012-11-15 at 21:18 +0400, Bob Bib wrote:
 In general, an updated version of this helper package has better handling of
 the upstream non-free Adobe Flash Player.

Unblocked.

Regards,

Adam---End Message---


Re: Pre-approval request for t-p-u upload of weechat/0.3.8-2wheezy1

2012-11-15 Thread Emmanuel Bouthenot
On Thu, Nov 15, 2012 at 08:27:29PM +0100, Julien Cristau wrote:
[...]

 My opinion is you can wait more than a couple days.

Anyway, I've learnt today that it has been discovered another security
issue which will lead to another CVE soon, hence I suggest to wait until
this one will be fixed in unstable.

I'll come back to you for an upload in t-p-u which will fix these two
bugs in a row.


Regards,

M.

-- 
Emmanuel Bouthenot
  mail: kolter@{openics,debian}.orggpg: 4096R/0x929D42C3
  xmpp: kol...@im.openics.org  irc: kolter@{freenode,oftc}


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/20121115201749.gb6...@openics.org



Bug#693166: marked as done (unblock: webkitkde/1.3~git20120518.9a111005-3)

2012-11-15 Thread Debian Bug Tracking System
Your message dated Thu, 15 Nov 2012 20:08:00 +
with message-id 1353010080.547.13.ca...@jacala.jungle.funky-badger.org
and subject line Re: Bug#693166: unblock: 
kpart-webkit/1.3~git20120518.9a111005-3
has caused the Debian Bug report #693166,
regarding unblock: webkitkde/1.3~git20120518.9a111005-3
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
693166: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=693166
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
---BeginMessage---
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package kpart-webkit

This upload fixes a crash which we the maintainers consider an important bug
(we didn't filled the bug in the Debian BTS, though). The patch simply checks
that a parent object does not returns NULL.

I also added a missing epoch on Build-Depends: kdelibs.

diffstat:

 changelog|   13 +
 control  |2 +-
 patches/series   |2 ++
 patches/webview.diff |   22 ++
 4 files changed, 38 insertions(+), 1 deletion(-)

Thanks!

unblock kpart-webkit/1.3~git20120518.9a111005-3

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (990, 'unstable'), (500, 'testing'), (101, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: mips
i386

Kernel: Linux 3.2.21+edid (SMP w/2 CPU cores)
Locale: LANG=es_AR.UTF-8, LC_CTYPE=es_AR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
diff -Nru webkitkde-1.3~git20120518.9a111005/debian/changelog webkitkde-1.3~git20120518.9a111005/debian/changelog
--- webkitkde-1.3~git20120518.9a111005/debian/changelog	2012-06-30 06:33:41.0 -0300
+++ webkitkde-1.3~git20120518.9a111005/debian/changelog	2012-11-13 18:04:18.0 -0300
@@ -1,3 +1,16 @@
+webkitkde (1.3~git20120518.9a111005-3) unstable; urgency=low
+
+  * Team upload.
+
+  [ Lisandro Damián Nicanor Pérez Meyer ]
+  * Bump Build-Depends on kdelibs to 4:4.8.3. Thanks Nobuhiro for noticing!
+(Closes: #684436).
+
+  [ Adrien Grellier ]
+  * Backport fix 0821d519 to avoid a crash.
+
+ -- Lisandro Damián Nicanor Pérez Meyer lisan...@debian.org  Tue, 13 Nov 2012 18:04:15 -0300
+
 webkitkde (1.3~git20120518.9a111005-2) unstable; urgency=low
 
   * fix dh: Unknown sequence build-stamp (Closes: #679472) 
diff -Nru webkitkde-1.3~git20120518.9a111005/debian/control webkitkde-1.3~git20120518.9a111005/debian/control
--- webkitkde-1.3~git20120518.9a111005/debian/control	2012-06-30 06:33:21.0 -0300
+++ webkitkde-1.3~git20120518.9a111005/debian/control	2012-08-09 21:45:37.0 -0300
@@ -4,7 +4,7 @@
 Maintainer: Debian KDE Extras Team pkg-kde-ext...@lists.alioth.debian.org
 Uploaders: Adrien Grellier adrien.grell...@laposte.net,
  Raúl Sánchez Siles rasas...@gmail.com,
-Build-Depends: cmake, debhelper (= 9), kdelibs5-dev (= 4:4.6), libqtwebkit-dev, pkg-kde-tools, dpkg-dev (=1.16.1)
+Build-Depends: cmake, debhelper (= 9), kdelibs5-dev (= 4:4.8.3), libqtwebkit-dev, pkg-kde-tools, dpkg-dev (=1.16.1)
 Standards-Version: 3.9.3
 Homepage: https://projects.kde.org/projects/extragear/base/kwebkitpart
 Vcs-Git: git://git.debian.org/pkg-kde/kde-extras/webkitkde.git
diff -Nru webkitkde-1.3~git20120518.9a111005/debian/patches/series webkitkde-1.3~git20120518.9a111005/debian/patches/series
--- webkitkde-1.3~git20120518.9a111005/debian/patches/series	1969-12-31 21:00:00.0 -0300
+++ webkitkde-1.3~git20120518.9a111005/debian/patches/series	2012-11-07 09:54:28.0 -0300
@@ -0,0 +1,2 @@
+
+webview.diff
diff -Nru webkitkde-1.3~git20120518.9a111005/debian/patches/webview.diff webkitkde-1.3~git20120518.9a111005/debian/patches/webview.diff
--- webkitkde-1.3~git20120518.9a111005/debian/patches/webview.diff	1969-12-31 21:00:00.0 -0300
+++ webkitkde-1.3~git20120518.9a111005/debian/patches/webview.diff	2012-11-07 09:54:28.0 -0300
@@ -0,0 +1,22 @@
+commit 0821d5191045306cecc0834929853c86ca085e03
+Author: Dawit Alemayehu ada...@kde.org
+Date:   Thu Sep 6 15:00:06 2012 -0400
+
+Do not crash when QWebHitTestResult::frame() returns NULL.
+
+BUG: 306102
+FIXED-IN: 1.3
+
+diff --git a/src/webview.cpp b/src/webview.cpp
+index e0d2407..b6ba0e8 100644
+--- a/src/webview.cpp
 b/src/webview.cpp
+@@ -547,7 +547,7 @@ void WebView::partActionPopupMenu(KParts::BrowserExtension::ActionGroupMap part
+ partActions.append(action);
+ }
+ }
+-} else if (m_result.frame()-parentFrame()  !m_result.isContentSelected()  m_result.linkUrl().isEmpty()) {
++

Processed: block 690655 with 690656

2012-11-15 Thread Debian Bug Tracking System
Processing commands for cont...@bugs.debian.org:

 block 690655 with 690656
Bug #690655 [release.debian.org] RM: openvas2 [wheezy] -- RoM; 
abandoned-upstream
690655 was not blocked by any bugs.
690655 was not blocking any bugs.
Added blocking bug(s) of 690655: 690656
 thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
690655: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690655
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems


--
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/handler.s.c.135301182032126.transcr...@bugs.debian.org



Re: Security NMU to t-p-u: bind9 9.8.1.dfsg.P1-4.4

2012-11-15 Thread Julien Cristau
On Sun, Nov  4, 2012 at 12:17:58 +0100, Philipp Kern wrote:

 [ Re-sent because the original mail seems to have hit the size limit. ]
 
 Hi,
 
 I would like to upload the attached bind9 security fix provided by
 Moritz Mühlenhoff to t-p-u (CVE-2012-4244). Can I proceed?
 
 bind9 in sid is a new upstream version and will likely take a while
 to migrate.
 
Sorry for the delay, please go ahead.

Cheers,
Julien


signature.asc
Description: Digital signature


Bug#693385: unblock: bind9/1:9.8.4.dfsg-1

2012-11-15 Thread Matthew Grant
Package: release.debian.org
Severity: normal
User: release.debian@packages.debian.org
Usertags: unblock

Please unblock package bind9

1) a rebase bind9 for wheezy to 9.8.4 will make security maintenance a
lot easier going forward.  To properly fix bugs - some security and
basic functionaliy, upstream have changed data structure code, and some
flags.  Makes patching tricky (see below).

2) Bug #690569 DNS wildcards fail to resolve with DNSsec enabled - a
basic DNS protocol bug.  To get DNS resolving going have to turn off
DNSSEC validation - a bit of a thinko.  Found there were too many
changes to 9.8.x ISC upstream since 9.8.1-P3 for me to consider patching
it reliably.  ISC don't give access to their VCS.

Note: also fixes CVE-2012-4244

Note: libdns81, libisc83 are updated to libdns88 and libisc84 in
upstream.

Thank you for looking into this. I really appreciate your time and
dedication to Debian.

Best Regards,

Matthew Grant

debdiff:

File lists identical (after any substitutions)

Control files: lines which differ (wdiff format)

Depends: libbind9-80 (= [-1:9.8.1.dfsg.P1-4.3),-] {+1:9.8.4.dfsg-1),+}
libc6 (= 2.4), libcap2 (= 2.10), [-libdns81-] {+libdns88+} (=
[-1:9.8.1.dfsg.P1-4.3),-] {+1:9.8.4.dfsg-1),+} libgssapi-krb5-2 (=
1.6.dfsg.2), [-libisc83-] {+libisc84+} (= [-1:9.8.1.dfsg.P1-4.3),-]
{+1:9.8.4.dfsg-1),+} libisccc80 (= [-1:9.8.1.dfsg.P1-4.3),-]
{+1:9.8.4.dfsg-1),+} libisccfg82 (= [-1:9.8.1.dfsg.P1-4.3),-]
{+1:9.8.4.dfsg-1),+} liblwres80 (= [-1:9.8.1.dfsg.P1-4.3),-]
{+1:9.8.4.dfsg-1),+} libssl1.0.0 (= 1.0.0), {+libxml2 (= 2.7.4),+}
debconf (= 0.5) | debconf-2.0, netbase, adduser, lsb-base (= 3.2-14),
bind9utils (= [-1:9.8.1.dfsg.P1-4.3),-] {+1:9.8.4.dfsg-1),+} net-tools
Installed-Size: [-816-] {+940+}
Version: [-1:9.8.1.dfsg.P1-4.3-] {+1:9.8.4.dfsg-1+}



unblock bind9/1:9.8.4.dfsg-1

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_NZ.UTF-8, LC_CTYPE=en_NZ.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: 
http://lists.debian.org/2012111507.9883.29621.report...@shalom-ext.internal.anathoth.net



Bug#693387: Pre-approval for unblock: sysvinit/2.88dsf-33

2012-11-15 Thread Michael Biebl
On 15.11.2012 23:32, Roger Leigh wrote:
 Package: release.debian.org
 Severity: normal
 User: release.debian@packages.debian.org
 Usertags: unblock
 
 Please unblock package sysvinit
 
 The attached debdiff includes a correction to the init script
 dependencies for the three bootclean scripts.  (#677097)

Why did you choose to not simply add mountall-bootclean to $local_fs?

This would appear like the more obvious fix to me.

Michael
-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature


mahara debdiffs

2012-11-15 Thread Melissa Draper
Debdiffs attached, release team cc'd.

Sorry for the delay. Had some urgent important interruptions to deal with.

As far as I know, I do not have any upload rights, so I believe this is
as far as I can go without assistance. My usual accomplice is busy until
next week some time, so if the patches are deemed ok, please proceed to
uploading if you can.
diff -Nru mahara-1.5.1/debian/changelog mahara-1.5.1/debian/changelog
--- mahara-1.5.1/debian/changelog	2012-10-28 02:11:42.0 +
+++ mahara-1.5.1/debian/changelog	2012-11-12 23:07:24.0 +
@@ -1,3 +1,36 @@
+
+mahara (1.5.1-3) unstable; urgency=high
+
+  * SECURITY UPDATE: Disable XML entity parsing to prevent XEE
+- debian/patches/CVE-2012-2239.patch: upstream patch
+
+  * SECURITY UPDATE: Multiple cross-site scripting vulnerabilities
+- Content passed to the error message was not escaped
+- Escape pieform errors displayed to users
+- debian/patches/CVE-2012-2243-0001.patch: upstream patch
+- XHTML files prone to embedded javascript
+- Prevent uploaded xhtml files from displaying verbatim
+- debian/patches/CVE-2012-2243-0002.patch: upstream patch
+
+  * SECURITY UPDATE: Arbitrary file execution via clam path
+- Remove executable bit from existing uploaded files
+- debian/patches/CVE-2012-2244-0001.patch: upstream patch
+- Ensure future files will not be executable
+- debian/patches/CVE-2012-2244-0002.patch: upstream patch
+- Remove direct path option from web configuration
+- debian/patches/CVE-2012-2244-0003.patch: upstream patch
+
+  * SECURITY UPDATE: Prevent click-jacking attacks
+- Add a HTTP header of X-Frame-Options to every page
+- debian/patches/CVE-2012-2246.patch: upstream patch
+
+  * SECURITY UPDATE: Prevent SVG images being displayed
+- SVG images displayed inline
+- Adds SVG files to the list of files to not display by default
+- debian/patches/CVE-2012-2247.patch: upstream patch
+
+ -- Melissa Draper meli...@catalyst.net.nz  Tue, 12 Nov 2012 04:08:09 +
+
 mahara (1.5.1-2.1) unstable; urgency=low
 
   * Non-maintainer upload
diff -Nru mahara-1.5.1/debian/patches/CVE-2012-2239.patch mahara-1.5.1/debian/patches/CVE-2012-2239.patch
--- mahara-1.5.1/debian/patches/CVE-2012-2239.patch	1970-01-01 00:00:00.0 +
+++ mahara-1.5.1/debian/patches/CVE-2012-2239.patch	2012-11-12 23:07:24.0 +
@@ -0,0 +1,70 @@
+Author: Hugh Davenport h...@catalyst.net.nz
+Description: Disable XML entity parsing
+Origin: upstream
+Bug: https://bugs.launchpad.net/mahara/+bug/1047111
+Last-Update: 2012-09-11
+
+Fix XML Security bug
+
+There is a security issue with the default XML parser for PHP, where ENTITY fields are
+loaded and substituted in text parts. 
+
+This allows possible attackers to read from internal networks, or files readable by the
+web server user.
+
+This includes reading of the config.php file, which contains sensitive information such
+as the database password, and the password salt field.
+
+The fix for this was to include a call to libxml_disable_entity_loader(true) during the
+initialization of a page. This is based on a report from Mike Haworth
+
+The vulnerability was present in the admin area when uploading Leap2A users, and also in
+the user page area where a user could provide a RSS feed with specific XML ENTITY fields.
+
+More information can be found at the following:
+ http://projects.webappsec.org/w/page/13247003/XML%20External%20Entities
+ http://websec.io/2012/08/27/Preventing-XEE-in-PHP.html
+
+diff --git a/htdocs/blocktype/externalfeed/db/upgrade.php b/htdocs/blocktype/externalfeed/db/upgrade.php
+index 90e79f9..a6ba403 100644
+--- a/htdocs/blocktype/externalfeed/db/upgrade.php
 b/htdocs/blocktype/externalfeed/db/upgrade.php
+@@ -106,5 +106,12 @@ function xmldb_blocktype_externalfeed_upgrade($oldversion=0) {
+ add_field($table, $field);
+ }
+ 
++if ($oldversion  2011091402) {
++// Reset all feeds to reset themselves
++set_field('blocktype_externalfeed_data', 'lastupdate', db_format_timestamp('0'));
++safe_require('blocktype', 'externalfeed');
++call_static_method('PluginBlocktypeExternalfeed', 'refresh_feeds');
++}
++
+ return true;
+ }
+diff --git a/htdocs/blocktype/externalfeed/version.php b/htdocs/blocktype/externalfeed/version.php
+index 24b1e09..cd84230 100644
+--- a/htdocs/blocktype/externalfeed/version.php
 b/htdocs/blocktype/externalfeed/version.php
+@@ -28,5 +28,5 @@
+ defined('INTERNAL') || die();
+ 
+ $config = new StdClass;
+-$config-version = 2011091401;
++$config-version = 2011091402;
+ $config-release = '1.0.3';
+diff --git a/htdocs/init.php b/htdocs/init.php
+index 07c8c47..0865428 100644
+--- a/htdocs/init.php
 b/htdocs/init.php
+@@ -58,6 +58,10 @@ if (!is_readable($CFG-docroot . 'config.php')) {
+ 
+ init_performance_info();
+ 
++if (function_exists('libxml_disable_entity_loader')) {

Bug#693387: Pre-approval for unblock: sysvinit/2.88dsf-33

2012-11-15 Thread Michael Biebl
On 16.11.2012 01:48, Michael Biebl wrote:
 On 15.11.2012 23:32, Roger Leigh wrote:
 Package: release.debian.org
 Severity: normal
 User: release.debian@packages.debian.org
 Usertags: unblock

 Please unblock package sysvinit

 The attached debdiff includes a correction to the init script
 dependencies for the three bootclean scripts.  (#677097)
 
 Why did you choose to not simply add mountall-bootclean to $local_fs?
 

As already mentioned on IRC: checkroot-bootclean is kinda odd.
It cleans up /run/, /run/lock *after* the tmpfs has been mounted, so
this cleanup looks entirely pointless.

An for cleaning up /tmp in checkroot-bootclean: Since the goal here is
to cleanup /tmp before it is later shadowed by a mount (via mountall),
the mountall script should have a dependency on checkroot-bootclean.
Otherwise it can happen that you mount /tmp while the cleanup is still
running. Or am I missing something?

Michael


-- 
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?



signature.asc
Description: OpenPGP digital signature


zangband 1:2.7.5pre1-5 request for unblock

2012-11-15 Thread Drew Parsons
Hi Release Team,

zangband 1:2.7.5pre1-5 fixes RC bug #688259.

I believe I need to request manual intervention to unblock it so it can
reach testing and wheezy.

Thanks,

Drew 





signature.asc
Description: This is a digitally signed message part


#691883 mahara debdiffs

2012-11-15 Thread Timo Juhani Lindfors
Hi,

hmm, the patches look ok, especially the DEP-3 headers are useful.

However, the debdiff seems to be for squeeze and not for wheezy? Are in
fact both squeeze and wheezy affected by the bugs? If yes, we need two
uploads.

-Timo


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/84d2zedrnq@sauna.l.org



Bug#693387: Pre-approval for unblock: sysvinit/2.88dsf-33

2012-11-15 Thread Christian PERRIER
Quoting Roger Leigh (rle...@debian.org):
 Package: release.debian.org
 Severity: normal
 User: release.debian@packages.debian.org
 Usertags: unblock
 
 Please unblock package sysvinit
 
 The attached debdiff includes a correction to the init script
 dependencies for the three bootclean scripts.  (#677097)
 
 It also includes some translation updates.  However, these can
 be removed if that's not OK at this point.  They were committed
 earlier in git; but I can create a branch for wheezy otherwise
 and it'll just be the three one line changes.


They (particularly the Spanish one) are an important goal of the i18n
team. Having sysvinit translated into Spanish will make this language
reach the 100% mark in wheezy when it comes at debconf translations.

As, from what I understand, the release team still accepts translation
updates when they go along with another fix, I think it fits the
unblock policy.




signature.asc
Description: Digital signature


Re: zangband 1:2.7.5pre1-5 request for unblock

2012-11-15 Thread Niels Thykier
On 2012-11-16 04:10, Drew Parsons wrote:
 Hi Release Team,
 

Hi,

 zangband 1:2.7.5pre1-5 fixes RC bug #688259.
 

Unfortunately, it also bumps the debhelper compat from 5 - 9, which is
not something we are willing to accept during the freeze.

 I believe I need to request manual intervention to unblock it so it can
 reach testing and wheezy.
 
 Thanks,
 
 Drew 
 
 
 

Just for future reference, it is easier for us if unblock requests are
filed as bugs (reportbug release.debian.org).

~Niels


-- 
To UNSUBSCRIBE, email to debian-release-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Archive: http://lists.debian.org/50a5efd7.6020...@thykier.net