Bug#1070484: bookworm-pu: package tryton-client/tryton-client_6.0.26-1+deb12u1
* Mathias Behrle: " Bug#1070484: bookworm-pu: package tryton-client/tryton-client_6.0.26-1+deb12u1" (Mon, 6 May 2024 11:19:28 +0200): > Package: release.debian.org > Severity: normal > Tags: bookworm > X-Debbugs-Cc: tryton-cli...@packages.debian.org > Control: affects -1 + src:tryton-client > User: release.debian@packages.debian.org > Usertags: pu > > [ Reason ] > Backport the patch to send only compressed content from > authenticated sessions. > https://foss.heptapod.net/tryton/tryton/-/commit/96ccd17bd4db4be46bb42eb4217ba5c7dcb7de82 > > The security release > https://discuss.tryton.org/t/security-release-for-issue-13142/7196 > and filed for Debian as 1070...@bugs.debian.org > introduced a regression for the client shown at > https://foss.heptapod.net/tryton/tryton/-/issues/13203 > > [ Impact ] > Without the patch a user could be confronted with an error in the client > connecting to a patched server. > > [ Tests ] > The test suite completes without errors. The patch is now publicly > available and in use since 2 weeks. > > [ Risks ] > The patch has minimal complexity and is from the upstream author > who is generally very knowledgable about his code. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > [ Changes ] > The upstream commit was added as a patch that allows gzip > compressed content only for authenticated users. > > [ Other info ] > This patch follows 1070...@bugs.debian.org. Friendly ping like for 1070...@bugs.debian.org: " I see that requests for bookworm-pu of other packages were accepted in the meantime. If there is something missing or wrong with this request please let me know. " Thanks, Mathias -- Mathias Behrle PGP/GnuPG key availabable from any keyserver, ID: 0xD6D09BE48405BBF6 AC29 7E5C 46B9 D0B6 1C71 7681 D6D0 9BE4 8405 BBF6
Bug#1070478: bookworm-pu: package tryton-server/tryton-server_6.0.29-2+deb12u2
* Mathias Behrle: " Bug#1070478: bookworm-pu: package tryton-server/tryton-server_6.0.29-2+deb12u2" (Mon, 6 May 2024 10:35:02 +0200): > Package: release.debian.org > Severity: normal > Tags: bookworm > X-Debbugs-Cc: tryton-ser...@packages.debian.org > Control: affects -1 + src:tryton-server > User: release.debian@packages.debian.org > Usertags: pu > > [ Reason ] > Backport the patch to fix the vulnerabilty to zip bomb > attacks via decoded gzip content from unauthenticated users. > https://discuss.tryton.org/t/security-release-for-issue-13142/7196 > > In coordination with the security team it was classified as NO-DSA and > rather be applicable via bookworm-pu. > > [ Impact ] > Without the patch any unauthenticated users could perform zimp bomb > attacks against tryton-server. > > [ Tests ] > The test suite completes without errors. The patch is now publicly > available and in use since 20 days. > > [ Risks ] > The patch has minimal complexity and is from the upstream author > who is generally very knowledgable about his code. > > [ Checklist ] > [x] *all* changes are documented in the d/changelog > [x] I reviewed all changes and I approve them > [x] attach debdiff against the package in (old)stable > [x] the issue is verified as fixed in unstable > > [ Changes ] > The upstream commit was added as a patch that allows gzip > compressed content only for authenticated users. > > 01_avoid_call_to_pypi.patch was refreshed to apply cleanly with no > further changes. > > [ Other info ] > This patch requires also a patch for tryton-client in a separate upload > to prevent a regression of tryton-client when it tries to send gzipped > content without authentication. Friendly ping for this one and 1070...@bugs.debian.org as well. I see that requests for bookworm-pu of other packages were accepted in the meantime. If there is something missing or wrong with this request please let me know. Thanks, Mathias -- Mathias Behrle PGP/GnuPG key availabable from any keyserver, ID: 0xD6D09BE48405BBF6 AC29 7E5C 46B9 D0B6 1C71 7681 D6D0 9BE4 8405 BBF6
NEW changes in oldstable-new
Processing changes file: dns-root-data_2024041801~deb11u1_all-buildd.changes ACCEPT
NEW changes in stable-new
Processing changes file: intel-microcode_3.20240514.1~deb12u1_amd64-buildd.changes ACCEPT Processing changes file: intel-microcode_3.20240514.1~deb12u1_i386-buildd.changes ACCEPT
NEW changes in oldstable-new
Processing changes file: intel-microcode_3.20240514.1~deb11u1_amd64-buildd.changes ACCEPT Processing changes file: intel-microcode_3.20240514.1~deb11u1_i386-buildd.changes ACCEPT
NEW changes in oldstable-new
Processing changes file: dns-root-data_2024041801~deb11u1_source.changes ACCEPT Processing changes file: intel-microcode_3.20240514.1~deb11u1_source.changes ACCEPT
NEW changes in stable-new
Processing changes file: intel-microcode_3.20240514.1~deb12u1_source.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_sourceonly.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_amd64-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_arm64-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_armel-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_armhf-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_i386-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_mips64el-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_mipsel-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_ppc64el-buildd.changes ACCEPT Processing changes file: libarchive_3.6.2-1+deb12u1_s390x-buildd.changes ACCEPT
Processed: intel-microcode 3.20240514.1~deb12u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1072239 = bookworm pending Bug #1072239 [release.debian.org] bookworm-pu: package intel-microcode/3.20240514.1~deb12u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1072239: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072239 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: intel-microcode 3.20240514.1~deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1072238 = bullseye pending Bug #1072238 [release.debian.org] bullseye-pu: package intel-microcode/3.20240514.1~deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1072238: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072238 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Processed: dns-root-data 2024041801~deb11u1 flagged for acceptance
Processing commands for cont...@bugs.debian.org: > package release.debian.org Limiting to bugs with field 'package' containing at least one of 'release.debian.org' Limit currently set to 'package':'release.debian.org' > tags 1072653 = bullseye pending Bug #1072653 [release.debian.org] bullseye-pu: package dns-root-data/2024041801~deb11u1 Added tag(s) pending; removed tag(s) confirmed. > thanks Stopping processing here. Please contact me if you need assistance. -- 1072653: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072653 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1072653: dns-root-data 2024041801~deb11u1 flagged for acceptance
package release.debian.org tags 1072653 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: dns-root-data Version: 2024041801~deb11u1 Explanation: update root hints; update expired security information
Bug#1072239: intel-microcode 3.20240514.1~deb12u1 flagged for acceptance
package release.debian.org tags 1072239 = bookworm pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm. Thanks for your contribution! Upload details == Package: intel-microcode Version: 3.20240514.1~deb12u1 Explanation: mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel processors
Bug#1072238: intel-microcode 3.20240514.1~deb11u1 flagged for acceptance
package release.debian.org tags 1072238 = bullseye pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bullseye. Thanks for your contribution! Upload details == Package: intel-microcode Version: 3.20240514.1~deb11u1 Explanation: mitigate for INTEL-SA-01051 [CVE-2023-45733], INTEL-SA-01052 [CVE-2023-46103], INTEL-SA-01036 [CVE-2023-45745, CVE-2023-47855] and unspecified functional issues on various Intel processors
Bug#1072239: bookworm-pu: package intel-microcode/3.20240514.1~deb12u1
I have uploaded it source-only a few days ago, but missed emailing this bug report about it :-( Thank you, and sorry for the delay! On Wed, Jun 5, 2024, at 18:19, Jonathan Wiltshire wrote: > Please go ahead. -- Henrique de Moraes Holschuh
Bug#1072238: bullseye-pu: package intel-microcode/3.20240514.1~deb11u1
I have uploaded it source-only a few days ago, but missed emailing this bug report about it :-( Thank you, and sorry for the delay! On Wed, Jun 5, 2024, at 18:18, Jonathan Wiltshire wrote: > Please go ahead. -- Henrique de Moraes Holschuh
Bug#1061200: transition: vtk9
Hi Sebastian, thanks for the note. Yes, I started to work on it. liggghts is already fixed. Regards Anton Am So., 9. Juni 2024 um 18:07 Uhr schrieb Sebastian Ramacher < sramac...@debian.org>: > Hi Anton > > On 2024-06-08 09:44:05 +0200, Anton Gladky wrote: > > Uploaded and built on all relevant platforms. > > Please, schedule the rebuild. > > There are some failures. #1072822 in gdcm looks like an issue in vtk9 > though. could you please take a look? > > Cheers > > > > > Thank you. > > > > Anton > > > > > > Am So., 2. Juni 2024 um 13:10 Uhr schrieb Sebastian Ramacher < > > sramac...@debian.org>: > > > > > Control: tags -1 confirmed > > > > > > On 2024-01-20 18:15:32 +0100, Anton Gladky wrote: > > > > Package: release.debian.org > > > > Severity: normal > > > > User: release.debian@packages.debian.org > > > > Usertags: transition > > > > X-Debbugs-Cc: v...@packages.debian.org > > > > Control: affects -1 + src:vtk9 > > > > > > > > > > > > Dear release team, > > > > > > > > please schedule vtk9.3 transition. > > > > > > > > Ben file: > > > > > > > > title = "vtk9"; > > > > is_affected = .depends ~ "libvtk9\.1|libvtk9\.1\-qt" | .depends ~ > > > "libvtk9\.3|libvtk9\.3\-qt"; > > > > is_good = .depends ~ "libvtk9\.3|libvtk9\.3\-qt"; > > > > is_bad = .depends ~ "libvtk9\.1|libvtk9\.1\-qt"; > > > > > > > > I have done a full rebuild and some failures are detected. Bugs > (most of > > > them with patches) will > > > > be filed in the next time. > > > > > > Please go ahead. > > > > > > Cheers > > > -- > > > Sebastian Ramacher > > > > > -- > Sebastian Ramacher >
Bug#1072859: marked as done (nmu: rust-bindgen-cli_0.66.1-6)
Your message dated Sun, 9 Jun 2024 19:00:23 +0200 with message-id and subject line Re: Bug#1072859: nmu: rust-bindgen-cli_0.66.1-6 has caused the Debian Bug report #1072859, regarding nmu: rust-bindgen-cli_0.66.1-6 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact ow...@bugs.debian.org immediately.) -- 1072859: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072859 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems --- Begin Message --- Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: binnmu X-Debbugs-Cc: rust-bindgen-...@packages.debian.org, noisyc...@tutanota.com Control: affects -1 + src:rust-bindgen-cli Hello, In order to fully fix bug #1069047, 'rust-bindgen-cli' needs to be rebuilt against the version of 'librust-bindgen-dev' (0.66.1-6) that landed in unstable just this morning. The previous build did not pick up the needed changes. Thank you. nmu rust-bindgen-cli_0.66.1-6 . ANY . unstable . -m "Rebuild against patched librust-bindgen-dev (>= 0.66.1-6)" --- End Message --- --- Begin Message --- On 2024-06-09 12:49:40 +0200, NoisyCoil wrote: > Package: release.debian.org > Severity: normal > User: release.debian@packages.debian.org > Usertags: binnmu > X-Debbugs-Cc: rust-bindgen-...@packages.debian.org, noisyc...@tutanota.com > Control: affects -1 + src:rust-bindgen-cli > > Hello, > > In order to fully fix bug #1069047, 'rust-bindgen-cli' needs to be rebuilt > against the version of 'librust-bindgen-dev' (0.66.1-6) that landed in > unstable just this morning. The previous build did not pick up the needed > changes. > > Thank you. > > > nmu rust-bindgen-cli_0.66.1-6 . ANY . unstable . -m "Rebuild against patched > librust-bindgen-dev (>= 0.66.1-6)" Scheduled Cheers -- Sebastian Ramacher--- End Message ---
Bug#1061200: transition: vtk9
Hi Anton On 2024-06-08 09:44:05 +0200, Anton Gladky wrote: > Uploaded and built on all relevant platforms. > Please, schedule the rebuild. There are some failures. #1072822 in gdcm looks like an issue in vtk9 though. could you please take a look? Cheers > > Thank you. > > Anton > > > Am So., 2. Juni 2024 um 13:10 Uhr schrieb Sebastian Ramacher < > sramac...@debian.org>: > > > Control: tags -1 confirmed > > > > On 2024-01-20 18:15:32 +0100, Anton Gladky wrote: > > > Package: release.debian.org > > > Severity: normal > > > User: release.debian@packages.debian.org > > > Usertags: transition > > > X-Debbugs-Cc: v...@packages.debian.org > > > Control: affects -1 + src:vtk9 > > > > > > > > > Dear release team, > > > > > > please schedule vtk9.3 transition. > > > > > > Ben file: > > > > > > title = "vtk9"; > > > is_affected = .depends ~ "libvtk9\.1|libvtk9\.1\-qt" | .depends ~ > > "libvtk9\.3|libvtk9\.3\-qt"; > > > is_good = .depends ~ "libvtk9\.3|libvtk9\.3\-qt"; > > > is_bad = .depends ~ "libvtk9\.1|libvtk9\.1\-qt"; > > > > > > I have done a full rebuild and some failures are detected. Bugs (most of > > them with patches) will > > > be filed in the next time. > > > > Please go ahead. > > > > Cheers > > -- > > Sebastian Ramacher > > -- Sebastian Ramacher
Processed: nmu: rust-bindgen-cli_0.66.1-6
Processing control commands: > affects -1 + src:rust-bindgen-cli Bug #1072859 [release.debian.org] nmu: rust-bindgen-cli_0.66.1-6 Added indication that 1072859 affects src:rust-bindgen-cli -- 1072859: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072859 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1072859: nmu: rust-bindgen-cli_0.66.1-6
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: binnmu X-Debbugs-Cc: rust-bindgen-...@packages.debian.org, noisyc...@tutanota.com Control: affects -1 + src:rust-bindgen-cli Hello, In order to fully fix bug #1069047, 'rust-bindgen-cli' needs to be rebuilt against the version of 'librust-bindgen-dev' (0.66.1-6) that landed in unstable just this morning. The previous build did not pick up the needed changes. Thank you. nmu rust-bindgen-cli_0.66.1-6 . ANY . unstable . -m "Rebuild against patched librust-bindgen-dev (>= 0.66.1-6)"
Bug#1072856: bookworm-pu: package djangorestframework/3.14.0-2
Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: djangorestframew...@packages.debian.org Control: affects -1 + src:djangorestframework User: release.debian@packages.debian.org Usertags: pu [ Reason ] The user Simon Lyngshede spottet an issue with version 3.14.0-2 in bookworm which can result in a HTML error 500 in the priject that is using this version as the Debian package is missing the file bootstrap-tweaks.css in the static folder. https://bugs.debian.org/1068747 This is happen due a to agressive removing of existing CSS files while package build. [ Impact ] The potential impact is limited and no data loss will happen, but the Django application will simply not work and throw an error 500 if the CSS file can not be found. [ Tests ] Currently there are no upstream or autopkgtests which will detect such a missing file. Upstream will probably never create such a test because they ship the needed files within the source. [ Risks ] The risk of a potential data loss isn't existing, but the application that is using that package might loose all of it's functionality. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] The change itself is rather simple, it's a one line fix in debian/rules. Please see below the output of debdiff. [ Other info ] Currently nothing I'm aware of that is needed to get mentioned here. -- Regards Carsten $ debdiff ../djangorestframework_3.14.0-2.dsc ../djangorestframework_3.14.0-2+deb12u1.dsc diff -Nru djangorestframework-3.14.0/debian/changelog djangorestframework-3.14.0/debian/changelog --- djangorestframework-3.14.0/debian/changelog 2023-01-31 12:59:37.0 +0100 +++ djangorestframework-3.14.0/debian/changelog 2024-06-09 08:20:01.0 +0200 @@ -1,3 +1,14 @@ +djangorestframework (3.14.0-2+deb12u1) bookworm; urgency=medium + + [ Carsten Schoenert ] + * [0e3d1fc] d/gbp.conf: Pick up some defaults, adjust to debian/bookworm + + [ Simon Lyngshede ] + * [7867bee] d/rules: Don't exclude bootstrap-tweaks.css file +(Closes: #1068747) + + -- Carsten Schoenert Sun, 09 Jun 2024 08:20:01 +0200 + djangorestframework (3.14.0-2) unstable; urgency=medium * Team upload diff -Nru djangorestframework-3.14.0/debian/gbp.conf djangorestframework-3.14.0/debian/gbp.conf --- djangorestframework-3.14.0/debian/gbp.conf 2023-01-31 12:59:37.0 +0100 +++ djangorestframework-3.14.0/debian/gbp.conf 2024-06-09 08:19:45.0 +0200 @@ -1,2 +1,11 @@ [DEFAULT] -debian-branch=debian/master +compression = gz +debian-branch = debian/bookworm +upstream-branch = upstream +pristine-tar = True + +[pq] +patch-numbers = False + +[dch] +id-length = 7 diff -Nru djangorestframework-3.14.0/debian/rules djangorestframework-3.14.0/debian/rules --- djangorestframework-3.14.0/debian/rules 2023-01-31 12:59:37.0 +0100 +++ djangorestframework-3.14.0/debian/rules 2024-06-09 08:19:45.0 +0200 @@ -21,7 +21,7 @@ # Don't embed what's already provided elsewhere $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/fonts/* $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/css/font-awesome*.css - $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/css/bootstrap*.css + $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/css/bootstrap*.min.css $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/css/prettify*.css $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/js/bootstrap*.js $(RM) debian/python3-djangorestframework/usr/lib/python3/dist-packages/rest_framework/static/rest_framework/js/jquery*.js
Processed: bookworm-pu: package djangorestframework/3.14.0-2
Processing control commands: > affects -1 + src:djangorestframework Bug #1072856 [release.debian.org] bookworm-pu: package djangorestframework/3.14.0-2 Added indication that 1072856 affects src:djangorestframework -- 1072856: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072856 Debian Bug Tracking System Contact ow...@bugs.debian.org with problems
Bug#1072813: release.debian.org: Help doris migrate to testing
Dear Paul, thanks for your quick reply. On Sat, 8 Jun 2024 22:34:07 +0200 Paul Gevers wrote: Hi, On 08-06-2024 11:17 a.m., Antonio Valentino wrote: > Could you please clarify if there is something on my side that I should > do to allow doris to migrate? You could bootstrap doris on other architectures too, such that it's not only available on amd64 and this check of the migration tooling wouldn't block the package. It's a hint you might have not thought about doing it. If bootstrapping doris on non-amd64 isn't trivial, we can add a hint to ignore the installability on arm64. Paul The main problem with non-amd64 architecture is that I do not have easy access to them, I'm only DM. I think that in the past we had binaries for other platforms but it was quite a pain. For any small issue I needed to setup a quite lengthy process of requiring access to one of the porter-boxes, wait for the access to be granted, fix the issue, end them at the end, ask to a sponsor to build and upload binaries for different platforms. If it is not a big issue on your side I would prefer to keep amd64 only. kind regards -- Antonio Valentino
