Bug#1068401: Pending uplad (Was: Bug#1068401: ltrsift dependencies unsatisfiable on 32-bit non-i386 architectures.)

2024-04-04 Thread Andreas Tille
Hi Sascha, Am Thu, Apr 04, 2024 at 10:33:16PM +0200 schrieb Sascha Steinbiss: > Interesting to see that there is no ltrsift-examples package indeed. But > I must have had my reasons back then... > > Anyway, to be honest I don't see much long-term future for LTRsift. I am > actually surprised to

Bug#1068350: [musl] Re: Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie → seems to be a toolchain bug after all, it does too hit glibc

2024-04-04 Thread Markus Wichmann
Am Fri, Apr 05, 2024 at 05:04:37AM + schrieb Thorsten Glaser: > Should be correct: > > /usr/libexec/gcc/s390x-linux-gnu/13/collect2 -fno-lto -dynamic-linker > /lib/ld-musl-s390x.so.1 -nostdlib -static -static -pie --no-dynamic-linker -o > mksh /usr/lib/s390x-linux-musl/rcrt1.o

Bug#1068434: ITP: python-asv-runner -- Core Python benchmark code for ASV

2024-04-04 Thread Yogeswaran Umasankar
Package: wnpp Severity: wishlist Owner: Yogeswaran Umasankar X-Debbugs-Cc: debian-de...@lists.debian.org, kd8...@gmail.com * Package name: python-asv-runner Version : 0.2.1 Upstream Contact: Rohit Goswami , Michael Droettboom * URL :

Bug#1068350: [musl] Re: Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie → seems to be a toolchain bug after all, it does too hit glibc

2024-04-04 Thread Thorsten Glaser
Markus Wichmann dixit: >can check with readelf -r what the relocation types are. If they are not >relative, they will not be processed. Gotcha! They are all R_390_RELATIVE except for: 00045ff0 00110016 R_390_64 00042c58 u_ops + 70 00045ff8 00110016 R_390_64

Bug#1037521: (no subject)

2024-04-04 Thread Yogeswaran Umasankar
eribe...@debian.org, Matthias Geiger Bcc: Subject: Re: false positive NONVERBOSE BUILD for rust code in Python modules Reply-To: Hi, I am having similar issue in another package 'python-cotengrust' [0]. The link for buildlog [1]. [0]

Bug#1054514: [PATCH v2 1/1] Revert "drm/qxl: simplify qxl_fence_wait"

2024-04-04 Thread Greg KH
On Thu, Apr 04, 2024 at 07:14:48PM +0100, Alex Constantino wrote: > This reverts commit 5a838e5d5825c85556011478abde708251cc0776. > > Changes from commit 5a838e5d5825 ("drm/qxl: simplify qxl_fence_wait") would > result in a '[TTM] Buffer eviction failed' exception whenever it reached a > timeout.

Bug#1068433: riseup-vpn dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: riseup-vpn Version: 0.21.11+ds1-5 Tags: trixie, sid Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, riseup-vpn depends on both libqt5widgets5 and libqt5widgets5t64. As a result it is uninstallable on architectures that are

Bug#1068432: reapr dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: reapr Version: 1.0.18+dfsg-5 Tags: trixie, sid Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, reapr depends on both libtabixpp0 and libtabixpp0t64. As a result it is uninstallable on architectures that are undergoing the

Bug#1068350: [musl] Re: Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie → seems to be a toolchain bug after all, it does too hit glibc

2024-04-04 Thread Markus Wichmann
Hi, in static-pie, relocations get processed in _start, before main() is called. In musl, this is done by linking with rcrt1.o as start file instead of crt1.o. And that file processes all relative relocations. You can check with readelf -r what the relocation types are. If they are not relative,

Bug#998514: related bug #1065133

2024-04-04 Thread Matija Nalis
Suggested init.d script to orphan-sysvinit-scripts package: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1065133 -- Opinions above are GNU-copylefted.

Bug#1065133: orphan-sysvinit-scripts: Please support pdns-recursor

2024-04-04 Thread Matija Nalis
On Tue, Mar 26, 2024 at 12:39:23PM +0100, Lorenzo wrote: > Hi Matija, > > could you please test the attached refreshed script and report if it > works as expected for your use case? Thanks! I can confirm that attached /etc/init.d/pdns-recursor seems to work just fine on my SysV based Debian

Bug#1068431: rakarrack dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: rakarrack Version: 0.6.1-8 Tags: trixie, sid Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, rakarrack depends on both libasound2 and libasound2t64. As a result it is uninstallable on architectures that are undergoing the

Bug#1067752: anacrontab(5) incorrectly says the only @period is @monthly (@yearly also supported)

2024-04-04 Thread Thorsten Glaser
Hi, I don’t think a /etc/cron.yearly/ should be created as directory, given that the default /etc/crontab never executes anything in it even if anacron may do. bye, //mirabilos -- Gestern Nacht ist mein IRC-Netzwerk explodiert. Ich hatte nicht damit gerechnet, darum bin ich blutverschmiert… wer

Bug#1068430: libqt5-ukui-style1 dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: libqt5-ukui-style1 Version: 1.0.8-1 Tags: trixie, sid Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, libqt5-ukui-style1 depends on both libqt5widgets5 and libqt5widgets5. As a result it is uninstallable on architectures

Bug#1067796: mailscripts: FTBFS: email-print-mime-structure:51: error: Unused "type: ignore" comment

2024-04-04 Thread Daniel Kahn Gillmor
On Wed 2024-04-03 13:03:19 +0800, Sean Whitton wrote: > Thanks, but can you sign this off? Ty! Sure, attached. Let me know if you need anything different. --dkg From b522c1cc6201f75ab6103954016bbb719d4dd2fa Mon Sep 17 00:00:00 2001 From: Daniel Kahn Gillmor Date: Tue, 30 Jan 2024

Bug#881720: SSH public key authentication failed: Unable to extract public key from private key file: Method unimplemented in libgcrypt backend on curl 7.74.0

2024-04-04 Thread Ben
This problem continues to occur with curl 7.74.0 on Debian GNU/Linux 11 (bullseye) on WSL: curl 7.74.0 (x86_64-pc-linux-gnu) libcurl/7.74.0 OpenSSL/1.1.1w zlib/1.2.11 brotli/1.0.9 libidn2/2.3.0 libpsl/0.21.0 (+libidn2/2.3.0) libssh2/1.9.0 nghttp2/1.43.0 librtmp/2.3 Release-Date: 2020-12-09,

Bug#1068429: nmu: pypy3_7.3.15+dfsg-1

2024-04-04 Thread plugwash
Package: release.debian.org Severity: normal User: release.debian@packages.debian.org Usertags: binnmu pypy3 needs rebuilding for the time64 transition (it currently depends on libssl3). nmu pypy3_7.3.15+dfsg-1 . ANY . unstable . -m "rebuild for time64" -- System Information: Debian

Bug#1053334: galera-4: FTBFS because of expired certificates

2024-04-04 Thread Otto Kekäläinen
Galera patch releases have been accepted as stable updates before. That is also what users expect. Thanks for reminding about this though, I yad forgotten about it. Will do it next weekend.

Bug#1068428: pyode: python3-pyode is empty

2024-04-04 Thread Benjamin Drung
Package: pyode Version: 1.2.0.dev15-4 Severity: grave Tags: patch Justification: renders package unusable User: ubuntu-de...@lists.ubuntu.com Usertags: origin-ubuntu noble ubuntu-patch X-Debbugs-Cc: bdr...@debian.org Dear Maintainer, the python3-pyode package is empty, because it silently fails

Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie → seems to be a toolchain bug after all, it does too hit glibc

2024-04-04 Thread Thorsten Glaser
Dixi quod… >Now I (or someone) is going to have to reduce that to a testcase, so No success with that, unfortunately. >But this does seem to be a toolchain bug: adding -static-pie to the >glibc dynamic-pie link command and… > >(gdb) print initcoms >$1 = {0xda494 "typeset", 0x0, 0x0, 0x0,

Bug#1068427: RFS: dpkg-dev-el/37.12 -- Emacs helpers specific to Debian development

2024-04-04 Thread Xiyue Deng
Package: sponsorship-requests Severity: normal Dear mentors, I am looking for a sponsor for my package "dpkg-dev-el": * Package name : dpkg-dev-el Version : 37.12 Upstream contact : Debian Emacsen Team * URL : [fill in URL of upstream's web site] * License

Bug#1068426: pkgconf fails to deduplicate -L in Debian bookworm

2024-04-04 Thread Earl Chew
Package: pkgconf Version: 1.8.1-1 Severity: normal X-Debbugs-Cc: earl_c...@yahoo.com Dear Maintainer, In Debian bullseye, pkgconf would deduplicate -L options: # foo.pc libdir=/opt/lib Name: foo Description: The foo library Version: 1.0.0 Requires.private: bar Libs:

Bug#1068415: nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

2024-04-04 Thread Tomasz Buchert
On 04/04/24 21:36, Salvatore Bonaccorso wrote: > Source: nghttp2 > Version: 1.60.0-1 > Severity: grave > Tags: security upstream > Justification: user security hole > X-Debbugs-Cc: car...@debian.org, Debian Security Team > > > Hi, > > The following vulnerability was published for nghttp2. > >

Bug#1068425: pflogsumm: Postfix logs days in month < 10 with leading zeroes, pflogsumm expects space padding

2024-04-04 Thread Magnus Stenman
Package: pflogsumm Version: 1.1.5-8 Severity: important Tags: patch X-Debbugs-Cc: st...@hkust.se Dear Maintainer, Pflogsumm reports zero mails on day 1-9 of every month Stock debian postfix version Patch: --- /usr/sbin/pflogsumm.orig2024-04-05 00:45:38.214914066 +0200 +++

Bug#1068348: xz-utils: Should activate trigger to force regenerating initramfs

2024-04-04 Thread Guillem Jover
Hi! On Thu, 2024-04-04 at 23:13:03 +0200, Sebastian Andrzej Siewior wrote: > On 2024-04-04 00:14:27 [+0200], Guillem Jover wrote: > > I initially was thinking that a conditionally triggered activation > > when upgrading from the affected versions would be sufficient, but if > > people have

Bug#1068084: intel-microcode 3.20240312.1~deb12u1 flagged for acceptance

2024-04-04 Thread Jonathan Wiltshire
package release.debian.org tags 1068084 = bookworm pending thanks Hi, The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm. Thanks for your contribution! Upload details == Package: intel-microcode Version:

Bug#1068424: populations - still depends on old libqt5gui5 after binnmu

2024-04-04 Thread Peter Green
Package: populations Version: 1.2.33+svn0120106+dfsg-6 Severity: grave Tags: trixie, sid User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, populations still depends on libqt5xml5, rather than libqt5xml5t64. As a result it is uninstallable on

Bug#1068423: steam-installer: steam.desktop not removed when steam-installer is purged

2024-04-04 Thread Jared Epp
Package: steam-installer Version: 1:1.0.0.75+ds-6 Severity: minor X-Debbugs-Cc: jared...@pm.me Dear Maintainer, I just removed steam with "apt purge steam-installer". In the process it warned me that ~/.steam would not be removed and I should remove it manually (I did). But I also noticed

Bug#1057850: libnss-db: Uses db5.3, no replacement in sight

2024-04-04 Thread Paulo Henrique de Lima Santana
Hi Cris, Would be possible reintroduce libnss-db to testing? I'm asking because I'm maintainer of the pglistener package and I know there aren't plans to update the sofwtare with another database solution. And now I can't have pglistener on testing. Best regards, On Sat, 09 Dec 2023

Bug#1068382: sbuild: Support tarballs not including ./ when using the unshare chroot mode

2024-04-04 Thread Johannes Schauer Marin Rodrigues
Hi, Quoting Santiago Vila (2024-04-04 20:03:08) > El 4/4/24 a las 19:29, Johannes Schauer Marin Rodrigues escribió: > > Also I'm curious: what is your motivation for using unshare mode if you are > > creating your chroots using superuser privileges? > > > > And are you really storing your chroots

Bug#1068419: perdition: dependencies unsatisfiable after binnmu for time64 transition.

2024-04-04 Thread Preuße
Control: tags -1 + patch On 04.04.2024 21:57, Peter Green wrote: Hi, After being rebuilt for the time64 transition, perdition depends on both libvanessa-socket2 and libvanessa-socket2. As a result it is uninstallable. Interesting in this case, the uninstallability seems to apply to all

Bug#1068199: librocfft0: callback test failures on gfx900 and gfx1030

2024-04-04 Thread Cordell Bloor
Ah. That makes sense. Thanks, Christian! On 2024-04-04 04:30, Christian Kastner wrote: I just rebuilt rocfft to 6.0.2 but the issue is still present. But that was naive, there are other < 6.0 components in the stack that could affect this. The problem appeared in rocfft 5.5.1 when rocm-hipamd

Bug#1060896: No longer just experimental

2024-04-04 Thread Jeremy Stanley
Unfortunately, this applies to unstable now too, and did apply to trixie until it resulted in autoremoval of the package. Would it help if I were to backport the fix from upstream? Or is the plan to just wait? (I can always build my own local package from upstream source, but this doesn't really

Bug#1068348: xz-utils: Should activate trigger to force regenerating initramfs

2024-04-04 Thread Thorsten Glaser
Sebastian Andrzej Siewior dixit: >the older "previous" kernel has it. And that won’t be fixed even with a trigger. Used to be -uk all would, but (#1065698) that doesn’t work any more. Given how widespread the info already is and that it affects sid and a subset of trixie users, maybe go with

Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie → seems to be a toolchain bug after all, it does too hit glibc

2024-04-04 Thread Thorsten Glaser
Dixi quod… >Hmm, actually… I could… test whether that one fixes static-pie >on zelenka. Or at least the same approach. I’ll get back with >report from that. Having looked at the spec file, the only extra things the stock specs do that the overriding specs don’t is: *link: […]

Bug#1068399: lomiri-system-settings - uninstallable on armel, armhf and mips64el due to depends/build-depends cycles.

2024-04-04 Thread Mike Gabriel
Control: reassign -1 lomiri-system-settings-security-privacy Control: found -1 1.0.2-2 On Do 04 Apr 2024 17:53:07 CEST, Peter Green wrote: Package: lomiri-system-settings Version: 1.1.0-2 Severity: grave lomiri-system-settings depends on lomiri-system-settings-security-privacy, which is

Bug#1068422: can't import dask.dataframe - TypeError: descriptor '__call__' for 'type' objects doesn't apply to a 'property' object

2024-04-04 Thread Rebecca N. Palmer
Package: python3-dask Version: 2023.12.1+dfsg-2 Severity: serious Control: affects -1 src:pandas Control: block 1068104 by -1 Importing dask.dataframe currently fails with the error TypeError: descriptor '__call__' for 'type' objects doesn't apply to a 'property' object amd64

Bug#1068399: lomiri-system-settings - uninstallable on armel, armhf and mips64el due to depends/build-depends cycles.

2024-04-04 Thread Mike Gabriel
On Do 04 Apr 2024 17:53:07 CEST, Peter Green wrote: Package: lomiri-system-settings Version: 1.1.0-2 Severity: grave lomiri-system-settings depends on lomiri-system-settings-security-privacy, which is not availble on armel, armhf or mips64el. The reason, or at least one reason, it is not

Bug#1068348: xz-utils: Should activate trigger to force regenerating initramfs

2024-04-04 Thread Sebastian Andrzej Siewior
On 2024-04-04 00:14:27 [+0200], Guillem Jover wrote: > Hi! Hi, > I initially was thinking that a conditionally triggered activation > when upgrading from the affected versions would be sufficient, but if > people have already upgraded, then that will still leave them with the > malicious stuff in

Bug#1067639: sasl2-bin: terminates with smashed stack and kills qemu-user?!

2024-04-04 Thread Thorsten Glaser
Sometimes, it does not crash with a smashed stack but instead: Setting up sasl2-bin (2.1.28+dfsg1-6+b1) ... BDB0002 __fop_file_setup: Retry limit (100) exceeded saslpasswd2: generic failure dpkg: error processing package sasl2-bin (--configure): installed sasl2-bin package post-installation

Bug#1068421: kanshi: kanshi output configurations do not persist across swaymsg reload

2024-04-04 Thread Daniel Kahn Gillmor
Package: kanshi Version: 1.5.1-2 Severity: normal X-Debbugs-Cc: Daniel Kahn Gillmor I'm using sway 1.9-1 with kanshi. When i plug in an external monitor, kanshi matches it appropriately against my configuration, and it configures the monitor appropriately. However, when i do `swaymsg reload`,

Bug#922161: Grub null src bitmap error while trying to drop background image

2024-04-04 Thread Jmkr
I forgot to mention the exact GRUB versions: - My Debian 10.13 Netinst based installer had GRUB: 2.06-3~deb10u1 - My Debian 10 based installed system had GRUB: 2.06-3~deb10u4 - My Debian 11.9 Netinst based installer had GRUB: 2.06-3~deb11u6 - My Debian 11 based installed system had GRUB:

Bug#1068401: Pending uplad (Was: Bug#1068401: ltrsift dependencies unsatisfiable on 32-bit non-i386 architectures.)

2024-04-04 Thread Sascha Steinbiss
Hi Andreas, after routine-update dh_missing failed due to compat level 13 which defaults to fail if some files are not installed. Yep, encountered that in other places as well when updating a few (old!) things. This made me aware that upstream in principle installs a test suite we could use

Bug#1068350: [musl] Re: Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie

2024-04-04 Thread Rich Felker
On Thu, Apr 04, 2024 at 07:50:40PM +, Thorsten Glaser wrote: > Szabolcs Nagy dixit: > > >the next culprit is gcc (each target can have their own > > gcc-13_13.2.0-23 > > >static pie specs) or the way you invoked gcc (not visible > > As I wrote earlier, though with more flags. Dropping all

Bug#1068370: elpa-dpkg-dev-el: Comp warnings due to XEmacs compatible code

2024-04-04 Thread Xiyue Deng
David Bremner writes: > Xiyue Deng writes: > >> >> Will re-evaluate if XEmacs compatibility would be dropped. >> >> [1] >> https://salsa.debian.org/emacsen-team/dpkg-dev-el/-/commit/132669ed6d6ee19a440234b943625da9cd6e2d9b >> > > Does the package currently work (somehow?) with XEmacs? At least

Bug#1068350: [musl] Re: Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie

2024-04-04 Thread Thorsten Glaser
Rich Felker dixit: >I seem to recall the musl-gcc wrapper does not handle static-pie >right. Hmm. Inhowfar? And it does seem to work fine on the other architectures. >A real cross toolchain should. I fear that that’s out of question for Debian. I’ve got a github action test setup for mksh

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-freeo

2024-04-04 Thread Bill Allombert
On Thu, Apr 04, 2024 at 01:22:19PM -0700, Russ Allbery wrote: > I'm not sure what I think about that. We have a general escape hatch > already for non-free packages in Policy 2.2.3 that says they may not fully > comply with Policy, which may be sufficient. But precisely, we _do_ want non-free

Bug#834736: [buildd-tools-devel] Bug#834736: sbuild: Use basic format for ISO 8601 timestamps (for build logs filenames)

2024-04-04 Thread Johannes Schauer Marin Rodrigues
Hi, Quoting Santiago Vila (2024-04-04 20:35:47) > El 4/4/24 a las 19:44, Johannes Schauer Marin Rodrigues escribió: > > instead of doing that, you could've worked around this by just placing the > > build log into a dedicated temporary directory and then copying it to where > > you > > want it

Bug#1065339: src:r-cran-rstanarm: FTBFS on mips64el and risc64

2024-04-04 Thread Andreas Tille
Control: retitle -1 src:r-cran-rstanarm: FTBFS on mips64el and risc64 Control: reopen -1 Control: tags -1 upstream Control: forwarded -1 https://github.com/stan-dev/rstanarm/issues/619 thanks As per autobuilders log[1] the package fails to build on mips64el and risc64 with ... g++ -std=gnu++17

Bug#1053334: galera-4: FTBFS because of expired certificates

2024-04-04 Thread Santiago Vila
El 23/12/23 a las 3:07, Otto Kekäläinen escribió: Sure, this will be fixed (automatically) with uploading latest upstream minor release as stable update, and I intend to do it in coming 1-2 weeks. Hi. Can you elaborate on that? Release managers do not usually allow new upstream releases in

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-freeo

2024-04-04 Thread Russ Allbery
Philipp Kern writes: > On 04.04.24 20:51, Bill Allombert wrote: >> I still think we should allow Autobuild: no as an escape hatch. If we >> want to require non-free package to be autobuildable, we should be more >> explicit about it (and probably require more feedback from >> debian-devel). >

Bug#1068420: pidgin-gnome-keyring - still depends on old libpurple after binnmu

2024-04-04 Thread Peter Green
Package: pidgin-gnome-keyring Version: 2.0-2 Severity: grave Tags: trixie, sid User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, obs-advanced-scene-switcher still depends on libpurple0, rather than libpurple0t64. As a result it is uninstallable on

Bug#1068363: src:autopkgtest: flaky autopkgtest (host dependent?) on ppc64el

2024-04-04 Thread Paul Gevers
Control: retitle -1 autopkgtest: test_copy_timeout fails on tmpfs Hi, On 04-04-2024 10:08 a.m., Paul Gevers wrote: Overall, I expect the host to be *faster* than the old hosts, but ironically the tests that seems to fail is: __main__.SchrootRunner.test_copy_timeout. Yes, it's too fast. The

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-freeo

2024-04-04 Thread Philipp Kern
Hi, On 04.04.24 20:51, Bill Allombert wrote: I still think we should allow Autobuild: no as an escape hatch. If we want to require non-free package to be autobuildable, we should be more explicit about it (and probably require more feedback from debian-devel). There is no requirement for

Bug#1068419: perdition: dependencies unsatisfiable after binnmu for time64 transition.

2024-04-04 Thread Peter Green
Package: perdition Version: 2.2-3.3 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, perdition depends on both libvanessa-socket2 and libvanessa-socket2. As a result it is uninstallable. Interesting in this case, the

Bug#1068350: musl: miscompiles (runtime problems) on riscv64 and s390x with static-pie

2024-04-04 Thread Thorsten Glaser
Szabolcs Nagy dixit: >the next culprit is gcc (each target can have their own gcc-13_13.2.0-23 >static pie specs) or the way you invoked gcc (not visible As I wrote earlier, though with more flags. Dropping all the -D… and -W… and -I… and other irrelevant ones: musl-gcc -Os -g -fPIE -fno-lto

Bug#1068418: rust-openssl: CVE-2024-3296

2024-04-04 Thread Salvatore Bonaccorso
Source: rust-openssl Version: 0.10.64-1 Severity: important Tags: security upstream Forwarded: https://github.com/sfackler/rust-openssl/issues/2171 X-Debbugs-Cc: car...@debian.org, Debian Security Team Hi, The following vulnerability was published for rust-openssl. CVE-2024-3296[0]: | A

Bug#1068416: ssh-agent: improve systemd user session integration

2024-04-04 Thread Daniel Kahn Gillmor
Package: openssh-client Version: 1:9.7p1-4 Severity: wishlist X-Debbugs-Cc: Daniel Kahn Gillmor Tags: patch Hi Debian OpenSSH maintainers! ssh-agent is a critical piece of infrastructure for my workflow, and i want it better integrated with my user session, which is managed by systemd's

Bug#1068417: trafficserver: CVE-2024-31309: HTTP/2 CONTINUATION frames can be utilized for DoS attacks

2024-04-04 Thread Salvatore Bonaccorso
Source: trafficserver Version: 9.2.3+ds-1+deb12u1 Severity: grave Tags: security upstream X-Debbugs-Cc: car...@debian.org, Debian Security Team Control: found -1 8.1.9+ds-1~deb11u1 Hi, The following vulnerability was published for trafficserver. CVE-2024-31309[0]. If you fix the vulnerability

Bug#996202: EFI Secure Boot for systemd-boot

2024-04-04 Thread Luca Boccassi
On Fri, 22 Mar 2024 18:13:35 + Luca Boccassi wrote: > On Mon, 4 Mar 2024 at 23:58, Luca Boccassi wrote: > > > > On Mon, 4 Mar 2024 at 23:28, Steve McIntyre wrote: > > > > > Modulo those questions, let's talk infrastructure. Off the top of my > > > head, in no particular order... > > > > > > 

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-freeo

2024-04-04 Thread Bill Allombert
On Thu, Apr 04, 2024 at 09:25:36PM +0200, Philipp Kern wrote: > Hi, > > On 04.04.24 20:51, Bill Allombert wrote: > > I still think we should allow Autobuild: no as an escape hatch. > > If we want to require non-free package to be autobuildable, we should > > be more explicit about it (and

Bug#1068415: nghttp2: CVE-2024-28182: Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

2024-04-04 Thread Salvatore Bonaccorso
Source: nghttp2 Version: 1.60.0-1 Severity: grave Tags: security upstream Justification: user security hole X-Debbugs-Cc: car...@debian.org, Debian Security Team Hi, The following vulnerability was published for nghttp2. CVE-2024-28182[0]: | nghttp2 is an implementation of the Hypertext

Bug#1068414: obs-advanced-scene-switcher - still depends on old libcurl after binnmu

2024-04-04 Thread Peter Green
Package: obs-advances-scene-switcher Version: 1.23.1-2 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, obs-advanced-scene-switcher still depends on libcurl4, rather than libcurl4t64. As a result it is uninstallable on architectures

Bug#1068413: python3-wilderness: Warning while installing with apt

2024-04-04 Thread Enrique Garcia
Package: python3-wilderness Version: 0.1.10-1 Severity: minor X-Debbugs-Cc: cqu...@arcor.de While installing the apt python3-wilderness with apt (actually as part of some other package dependency) I saw the following warning: Configuring python3-wilderness (0.1.10-1) ...

Bug#1068412: apache2: CVE-2024-27316 CVE-2024-24795 CVE-2023-38709

2024-04-04 Thread Moritz Mühlenhoff
Source: apache2 X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerabilities were published for apache2. CVE-2024-27316[0]: https://www.kb.cert.org/vuls/id/421644 https://www.openwall.com/lists/oss-security/2024/04/04/4 CVE-2024-24795[1]:

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-freeo

2024-04-04 Thread Bill Allombert
On Thu, Apr 04, 2024 at 11:42:34AM -0700, Russ Allbery wrote: > Tobias Frost writes: > > On Wed, Apr 03, 2024 at 10:58:37PM +0200, Aurelien Jarno wrote: > > >> Thanks Philipp. Following that result, please find a patch proposal: > >> > >> --- a/policy/ch-source.rst > >> +++

Bug#1068411: bookworm-pu: package schleuder/4.0.3-7+deb12u1

2024-04-04 Thread Georg Faerber
Package: release.debian.org Severity: normal Tags: bookworm User: release.debian@packages.debian.org Usertags: pu Control: affects -1 + src:schleuder Dear release team, Schleuder, as currently present in bookworm, 4.0.3-7, is affected by multiple bugs, which I would like to address via this

Bug#1068410: libwireshark-dev: Package is missing mandatory "dfilter-loc.h"

2024-04-04 Thread Thorsten
Package: libwireshark-dev Version: 4.2.2-1.1+b1 Severity: important X-Debbugs-Cc: contact.thors...@gmail.com Dear Maintainer, * What led up to the situation? Trying to build an external package dissector. * What exactly did you do (or not do) that was effective (or ineffective)?

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-free

2024-04-04 Thread Russ Allbery
Tobias Frost writes: > On Wed, Apr 03, 2024 at 10:58:37PM +0200, Aurelien Jarno wrote: >> Thanks Philipp. Following that result, please find a patch proposal: >> >> --- a/policy/ch-source.rst >> +++ b/policy/ch-source.rst >> @@ -338,9 +338,9 @@ >> For example, the build target should pass

Bug#1068401: Pending uplad (Was: Bug#1068401: ltrsift dependencies unsatisfiable on 32-bit non-i386 architectures.)

2024-04-04 Thread Andreas Tille
Control: tags -1 pending thanks Hi Sascha, after routine-update dh_missing failed due to compat level 13 which defaults to fail if some files are not installed. This made me aware that upstream in principle installs a test suite we could use for an autopkgtest. I also realised that you once

Bug#834736: [buildd-tools-devel] Bug#834736: sbuild: Use basic format for ISO 8601 timestamps (for build logs filenames)

2024-04-04 Thread Santiago Vila
El 4/4/24 a las 19:44, Johannes Schauer Marin Rodrigues escribió: instead of doing that, you could've worked around this by just placing the build log into a dedicated temporary directory and then copying it to where you want it after the build is finished. That would be an option, yes, but

Bug#1068409: dovecot-core: avoid linking against libsystemd0

2024-04-04 Thread Jörg-Volker Peetz
Package: dovecot-core Version: 1:2.3.21+dfsg1-3+b1 Severity: wishlist Dear Maintainer(s), in light of the recent xz security breach, I'd like to ask if it would be possible to rework systemd readiness notification and socket activation patches to not link against libsystemd as just achieved for

Bug#1068408: Kicad bundle broken

2024-04-04 Thread Terrance Hendrik
Package: kicad Version: 7.0.11+dfsg-1 I am using Debian testing/trixie, the Kicad bundle has multiple issues. 1. kicad-footprints kicad-packages3d kicad-symbols kicad-templates (7.x) are all missing. I also checked stable sources. ``` # apt install kicad-footprints= Completing package version

Bug#1054514: [PATCH v2 1/1] Revert "drm/qxl: simplify qxl_fence_wait"

2024-04-04 Thread Alex Constantino
This reverts commit 5a838e5d5825c85556011478abde708251cc0776. Changes from commit 5a838e5d5825 ("drm/qxl: simplify qxl_fence_wait") would result in a '[TTM] Buffer eviction failed' exception whenever it reached a timeout. Due to a dependency to DMA_FENCE_WARN this also restores some code deleted

Bug#1054514: [PATCH v2 0/1] Revert "drm/qxl: simplify qxl_fence_wait"

2024-04-04 Thread Alex Constantino
Changes since v1: - replace new code logic in v1 with past code version by reverting commit 5a838e5d5825 ("drm/qxl: simplify qxl_fence_wait") - add missing code dependency from commit d72277b6c37d ("dma-buf: nuke DMA_FENCE_TRACE macros v2") --- Hi, To clarify, the reason for my original

Bug#1068192: debian-policy: extended forbidden network access to contrib and non-free

2024-04-04 Thread Tobias Frost
On Wed, Apr 03, 2024 at 10:58:37PM +0200, Aurelien Jarno wrote: > Hi, > > On 2024-04-03 12:37, Philipp Kern wrote: > > Hi, > > > > On Tue, Apr 02, 2024 at 06:58:35AM +0200, Aurelien Jarno wrote: > > > On 2024-04-02 09:21, Sean Whitton wrote: > > > > Hello, > > > > > > > > On Mon 01 Apr 2024 at

Bug#1068382: sbuild: Support tarballs not including ./ when using the unshare chroot mode

2024-04-04 Thread Santiago Vila
El 4/4/24 a las 19:29, Johannes Schauer Marin Rodrigues escribió: Also I'm curious: what is your motivation for using unshare mode if you are creating your chroots using superuser privileges? And are you really storing your chroots in /srv instead of letting them get picked up automatically in

Bug#834736: [buildd-tools-devel] Bug#834736: sbuild: Use basic format for ISO 8601 timestamps (for build logs filenames)

2024-04-04 Thread Johannes Schauer Marin Rodrigues
Hi, Quoting Santiago Vila (2024-04-04 15:02:05) > El 4/4/24 a las 14:07, Johannes Schauer Marin Rodrigues escribió: > > well this is an old bug. How have you worked around it being open for the > > past > > six years? > > This is important for me, so I'm still patching my own sbuild version.

Bug#1068382: sbuild: Support tarballs not including ./ when using the unshare chroot mode

2024-04-04 Thread Johannes Schauer Marin Rodrigues
Hi, Quoting Santiago Vila (2024-04-04 15:24:13) > > how did you create that tarball? > > debootstrap to a directory > cd /chroot/directory > tar czvf /srv/whatever.tar.gz * > > Yes, I know what using "." instead of "*" would solve the problem, but as I > said, > sbuild already supports

Bug#1063140: mpg123: NMU diff for 64-bit time_t transition

2024-04-04 Thread Thomas Orgis
Am Thu, 4 Apr 2024 09:36:37 +0200 schrieb Sebastian Ramacher : > Now I get the following on arm{hf,el}: > > --- debian/libmpg123-0.symbols (libmpg123-0_1.32.6~dev+20240403022201-1_armhf) > +++ dpkg-gensymbolspYII3c 2024-04-03 09:52:12.863133592 + > @@ -8,8 +8,8 @@ >

Bug#1067630: Fix arbitrary Lisp execution vulnerability (CVE-2024-30202)

2024-04-04 Thread Benjamin Moody
Dear maintainers: This bug report refers to a couple of distinct issues: 1. Evaluating arbitrary Lisp code when a file is opened. 2. Evaluating arbitrary LaTeX code in various circumstances. While the second issue is important to consider, I'd like to focus on the first part. This is a grave

Bug#1068407: xfce4-terminal: processes sleep after a while when switching to a different workspace

2024-04-04 Thread Julian Gilbey
Package: xfce4-terminal Version: 1.1.1-1 Severity: normal This is a weird bug, and I have no idea how to locate the source. I'm running in an Xfce4 environment (xfce4-session, xfce4-panel, xfce4-screensaver, xfce4-terminal and various other applications such as firefox) on a Debian testing

Bug#1068341: bioawk: FTBFS randomly due to Makefile bug: cp: cannot create regular file 'ytab.c': File exists

2024-04-04 Thread Santiago Vila
Nilesh: Would it help if I do a "team upload" to fix this? (Using the proposed patch) Or would you prefer to fix it yourself? Just go ahead with a fix. I don't have much time these days. Please also drop me from uploaders field for this package won't have time to maintain this. Yes, I

Bug#1064971: Can the fix be done for oldstable debian?

2024-04-04 Thread Dick Hollenbeck
I am using debian oldstable, how can I use this fix there?

Bug#1068387: ncl: FTBFS with HDF 4.3.0.

2024-04-04 Thread Sebastiaan Couwenberg
Control: tags -1 patch On 4/4/24 6:22 PM, Sebastiaan Couwenberg wrote: The FTBFS with HDF 4.3.0 is not fixed in 6.6.2.dfsg.1-5. You need the attached patch to fix the error with HDF 4.3.0 by including df.h instead of dfi.h. The package then still FTBFS but due to dh_install: dh_install

Bug#1068406: todo.txt-gtd: please drop extraneous dependency on python3-mock

2024-04-04 Thread Alexandre Detiste
Source: todo.txt-gtd Version: 0.9 Severity: normal Dear Maintainer, This obsolete library is slowly being removed from Debian. Upstream projects are moving to unittest.mock from the standard library. This one project doesn't need "mock" at all. Greetings $ grep mock -r debian/control:

Bug#1068345: trixie-pu: package chromium/123.0.6312.105-1~deb13u1

2024-04-04 Thread Andres Salomon
On 4/4/24 07:31, Paul Gevers wrote: Hi Andres, On 04-04-2024 9:56 a.m., Paul Gevers wrote: I have $(reschedule --days=0)-ed your upload to DELAYED. I'll do a final check when that lands before unblocking. The upload seems to be not a pure changelog only change. The tpu upload has a

Bug#1058552: [Pkg-javascript-devel] Bug#1058552: science.js: FTBFS: SyntaxError: Error parsing /<>/package.json: Unexpected end of JSON input

2024-04-04 Thread Jonas Smedegaard
Quoting James Valleroy (2024-04-04 16:13:07) > On 3/28/24 4:08 AM, Petter Reinholdtsen wrote: > > [James Valleroy 2024-02-12] > >> Here is a patch that fixes the build: > > > > Thank you. Can you explain why changing the output from package.json to > > mktemp and then moving the result to

Bug#1068405: ofxstatement-plugins: please drop dependency on python3-six

2024-04-04 Thread Alexandre Detiste
Source: ofxstatement-plugins Version: 20210310+nmu1 Severity: normal Dear, This obsolete library is slowly being removed from Debian. Upstream projects are moving to unittest.mock from the standard library. This one project doesn't need "mock" at all. Greetings $ grep mock -r

Bug#1065980: gfarm: FTBFS on arm{el,hf}:

2024-04-04 Thread Peter Green
tags 1065980 +patch thanks This build failure was caused by missing "feature test macros" meaning that the relevant functions were not enabled in the system headers. A debdiff adding them is attached.diff -Nru gfarm-2.7.20+dfsg/debian/changelog gfarm-2.7.20+dfsg/debian/changelog ---

Bug#1068404: mariadb-plugin-s3 dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: mariadb-plugin-s3 Version: 1:10.11.7-3 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, mariadb-plugin-s3 depends on both libcurl4 and libcurl4t64. As a result it is uninstallable on architectures that are undergoing the

Bug#1068403: mariadb-plugin-hashicorp-key-management dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: mariadb-plugin-hashicorp-key-management Version: 1:10.11.7-3 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, mariadb-plugin-hashicorp-key-management depends on both libcurl4 and libcurl4t64. As a result it is

Bug#1068341: bioawk: FTBFS randomly due to Makefile bug: cp: cannot create regular file 'ytab.c': File exists

2024-04-04 Thread Nilesh Patra
On 4 April 2024 2:28:07 am IST, Santiago Vila wrote: >Hi. I've just realized that (as a member of Debian Med) >I could fix this myself. > >Nilesh: Would it help if I do a "team upload" to fix this? >(Using the proposed patch) > >Or would you prefer to fix it yourself? Just go ahead with a

Bug#1068387: ncl: FTBFS with HDF 4.3.0.

2024-04-04 Thread Sebastiaan Couwenberg
reopen 1068387 thanks The FTBFS with HDF 4.3.0 is not fixed in 6.6.2.dfsg.1-5. On 4/4/24 1:53 PM, Bas Couwenberg wrote: Your package FTBFS while performing test rebuilds with HDF 4.3.20. The attached debdiff contains changes to fix FTBFS issues unrelated to HDF 4.3.20. This patch was

Bug#1068402: lua-lxc dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: lua-lxc Version: 1:3.0.2-2 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, lua-lxc depends on both liblxc1 and libliblxc1t64. As a result it is uninstallable on architectures that are undergoing the time64 transition

Bug#1068401: ltrsift dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: ltrsift Version: 1.0.2-9 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, ltrsift depends on both libgenometools0 and libgenometools0t64. As a result it is uninstallable on architectures that are undergoing the time64

Bug#1066763: liferea: FTBFS: dh_auto_test: error: make -j8 test "TESTSUITEFLAGS=-j8 --verbose" VERBOSE=1 returned exit code 2

2024-04-04 Thread Paul Gevers
control: notfound -1 1.15.4-1 On 04-04-2024 5:42 p.m., Paul Gevers wrote: I've scheduled retries on the reproducible build infrastructure. amd64 and i386 both build fine (while on amd64 there was the same failure in the past as in this bug report). So, marking the bug as not affecting the

Bug#1068400: lomiri-filemanager-app dependencies unsatisfiable on 32-bit non-i386 architectures.

2024-04-04 Thread Peter Green
Package: lomiri-filemanager-app Version: 1.0.4+dfsg-1 Severity: grave User: debian-...@lists.debian.org Usertag: time-t After being rebuilt for the time64 transition, lomiri-filemanager-app depends on both libsmbclient and libsmbclient0. As a result it is uninstallable on architectures that are

Bug#1068399: lomiri-system-settings - uninstallable on armel, armhf and mips64el due to depends/build-depends cycles.

2024-04-04 Thread Peter Green
Package: lomiri-system-settings Version: 1.1.0-2 Severity: grave lomiri-system-settings depends on lomiri-system-settings-security-privacy, which is not availble on armel, armhf or mips64el. The reason, or at least one reason, it is not available is because

Bug#1066763: liferea: FTBFS: dh_auto_test: error: make -j8 test "TESTSUITEFLAGS=-j8 --verbose" VERBOSE=1 returned exit code 2

2024-04-04 Thread Paul Gevers
Hi, On Fri, 15 Mar 2024 22:42:34 +0100 Paul Gevers wrote: The problem is somewhere in liblzma. In hind-sight, this is all to likely that it's caused by CVE-2024-3094, the xz backdoor. I've scheduled retries on the reproducible build infrastructure. As the version in unstable is stuck in

  1   2   >