Bug#1018018: wmforkplop: FTBFS with imlib2 1.9.1

2022-08-24 Thread Markus Koschany
Package: wmforkplop Version: 0.9.3-2.2 Severity: important Tags: ftbfs sid bookwork User: a...@debian.org Usertags: imlib2-1.9.1 X-Debbugs-Cc: a...@debian.org Dear maintainer, your package fails to build from source with imlib2 1.9.1 in experimental. imlib2-config has been dropped by upstream in

Bug#1018017: ukui-greeter: FTBFS in unstable

2022-08-24 Thread Markus Koschany
Package: ukui-greeter Version: 3.0.3-1 Severity: serious X-Debbugs-Cc: a...@debian.org Dear maintainer, ukui-greeter currently fails to build from source in unstable. BiometricAuth/giodbus.cpp:22:10: fatal error: gio-unix-2.0/gio/gunixfdlist.h: No such file or directory 22 | #include

Bug#1013959: Upgrade package to latest upstream version

2022-08-23 Thread Markus Koschany
> Dear maintainer, > > Please upgrade mockito to the latest version, 4.6.1. Hello, The latest 4.x series introduces many breaking changes and not all reverse- dependencies are ready for that. As long as projects continue to use 2.x it would require some effort from our side to port them to

Bug#941480: Please package the new version of mediathekview

2022-08-21 Thread Markus Koschany
Let's use this bug report for updating mediathekview instead of https://bugs.debian.org/1011165 Quote from the other bug report: I have pushed a new branch which includes version 13.9.1. https://salsa.debian.org/debian/mediathekview/-/tree/experimental As you can see I have started from

Bug#1011165: org.h2.jdbc.JdbcSQLSyntaxErrorException: schema "MEDIATHEKVIEW" not found

2022-08-21 Thread Markus Koschany
Control: severity -1 wishlist Control: retitle -1 mediathekview update discussion I have fixed the underlying problem by using an internal version of the h2 database now. I will try to package tilesfx and glazedlists next. signature.asc Description: This is a digitally signed message part

Bug#1011165: org.h2.jdbc.JdbcSQLSyntaxErrorException: schema "MEDIATHEKVIEW" not found

2022-08-21 Thread Markus Koschany
Hi Helge, Am Sonntag, dem 21.08.2022 um 08:46 +0200 schrieb Helge Kreutzmann: > Hello Markus, > On Tue, Aug 09, 2022 at 03:09:08PM +0200, Markus Koschany wrote: > > I have pushed a new branch which includes version 13.9.1. > > … > > > Those are the major iss

Bug#1012214: gradle: FTBFS with jansi 2

2022-08-20 Thread Markus Koschany
Control: retitle -1 gradle: FTBFS with jansi 2 Let me try to fix this signature.asc Description: This is a digitally signed message part

Bug#1012214: gradle: unknown option --add-opens breaks OpenJDK 11 packages

2022-08-20 Thread Markus Koschany
Am Samstag, dem 20.08.2022 um 16:35 + schrieb Thorsten Glaser: > Markus Koschany dixit: > > > The newly added --add-opens option is only valid for OpenJDK 17. I > > understand that we switch to it for Debian 12 but it currently breaks > > all packages that are bui

Bug#1017644: ITP: libtitanium-json-ld-java -- implementation of the JSON-LD 1.1 specification in Java

2022-08-18 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org,debian-j...@lists.debian.org * Package name: libtitanium-json-ld-java Version : 1.3.1 Upstream Author : Filip Kolarik and the original authors and contributors

Bug#1017642: ITP: libjsonp2-java -- Jakarta JSON Processing

2022-08-18 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org,debian-j...@lists.debian.org * Package name: libjsonp2-java Version : 2.1.1 Upstream Author : Oracle and/or its affiliates * URL : https://github.com

Bug#1016964: RM: hawknl -- ROM; rc-buggy;unmaintained;

2022-08-10 Thread Markus Koschany
Package: ftp.debian.org Severity: normal X-Debbugs-Cc: a...@debian.org,debian-devel-ga...@lists.debian.org Dear ftp-team, please remove hawknl from Debian. hawknl has not been updated in the past 13 years, it is obsolete and rc-buggy. I have discussed the removal on our public team mailing list.

Bug#1011165: org.h2.jdbc.JdbcSQLSyntaxErrorException: schema "MEDIATHEKVIEW" not found

2022-08-09 Thread Markus Koschany
Hello, I have pushed a new branch which includes version 13.9.1. https://salsa.debian.org/debian/mediathekview/-/tree/experimental As you can see I have started from scratch because this is basically a new package now. In order to complete this upgrade we need at least an upgrade of okhttp to

Bug#1013042: spring: ftbfs with GCC-12

2022-08-03 Thread Markus Koschany
Control: tags -1 pending On Fri, 17 Jun 2022 00:56:44 +0200 Reiner Herrmann wrote: > Control: tags -1 + fixed-upstream > > The build failure has been fixed upstream [0]. > The fix is already contained in the new upstream release 106.0. > > [0]

Bug#938351: marked as pending in renpy

2022-07-14 Thread Markus Koschany
Am Donnerstag, dem 14.07.2022 um 22:43 +0200 schrieb Moritz Mühlenhoff: > The latest 8.0.0 release now supports Python 3-based games: > https://www.renpy.org/release/8.0.0?mode=release-8=8.0.0 Hi Moritz, That's great news. Thanks for pointing it out. signature.asc Description: This is a

Bug#981731: Multi-threaded bullet

2022-07-11 Thread Markus Koschany
Am Sonntag, dem 10.07.2022 um 20:27 -0700 schrieb Dima Kogan: > Markus Koschany writes: > > > I have no strong preferences here. I would rebuild all > > reverse-dependencies with the multi-threaded version and see if that > > works. If this is successful, we could j

Bug#981731: Multi-threaded bullet

2022-07-10 Thread Markus Koschany
Hi Dima, Am Sonntag, dem 10.07.2022 um 14:35 -0700 schrieb Dima Kogan: > Hi. I'm updating the Debian package to the latest upstream version now. > And I can do the multi-threaded builds. > > Which of these do we want? All of them? > > Also, is there a good reason to build both multi- and

Bug#1014409: ftp.debian.org: please import libscram-java into bullseye-security

2022-07-05 Thread Markus Koschany
Package: ftp.debian.org Severity: important X-Debbugs-Cc: a...@debian.org Dear ftp-team, please import libscram-java into bullseye-security. A security upload of libpgjava was rejected with the following error message: libpostgresql-jdbc-java_42.2.15-1+deb11u1_all.deb: Built-Using refers to

Bug#1014200: buster-pu: package ublock-origin/1.37.0+dfsg-1~deb10u1

2022-07-01 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: buster User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to update the ublock-origin add-on for Firefox and Chromium. This is just a normal update which improves the ability to block ads,

Bug#1014199: bullseye-pu: package ublock-origin/1.37.0+dfsg-1~deb11u1

2022-07-01 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to update the ublock-origin add-on for Firefox and Chromium. This is just a normal update which improves the ability to block

Bug#1014145: buster-pu: package isync/1.3.0-2.2~deb10u1

2022-06-30 Thread Markus Koschany
ion. + + -- Markus Koschany Tue, 28 Jun 2022 15:58:18 +0200 + isync (1.3.0-2.2~deb10u1) buster; urgency=medium * Non-maintainer upload. diff -Nru isync-1.3.0/debian/patches/CVE-2021-3657.patch isync-1.3.0/debian/patches/CVE-2021-3657.patch --- isync-1.3.0/debian/patches/CVE-2021-3657.pa

Bug#1013565: libitext5-java: FTBFS: dh_auto_test: error:

2022-06-26 Thread Markus Koschany
Same here. Looks related to maven-resource-plugins / maven-filtering and #1013582 and #1013586 signature.asc Description: This is a digitally signed message part

Bug#1013586: Bug#1013595: plexus-io: FTBFS: Failed to execute goal org.apache.maven.plugins:maven-resources-plugin:3.1.0:testResources

2022-06-26 Thread Markus Koschany
I believe this is related to a bug in maven-filtering or maven-resources- plugin. According to https://issues.apache.org/jira/browse/MRESOURCES-237 the behavior how symlinks are handled has changed between version 2.7 and 3.0.x of maven-resources-plugin. This is apparently fixed in

Bug#1013582: libapache-jena-java: Jena shell utilities are missing

2022-06-24 Thread Markus Koschany
> I would also call the binary package > apache-jena-bin and omit the lib prefix because this one is reserved for > libraries only. On second thought, maybe we can just ship the shell scripts with libapache- jena-java. It is an arch:all package anyway and space is not an issue here.

Bug#1013582: libapache-jena-java: Jena shell utilities are missing

2022-06-24 Thread Markus Koschany
Control: severity -1 wishlist Am Freitag, dem 24.06.2022 um 13:17 +0200 schrieb David Haller: > Package: libapache-jena-java > Version: 3.17.0-3 > Severity: normal > X-Debbugs-Cc: david.hal...@fau.de > > Hello there, > > the package includes the Java libraries of Jena only, but not their

Bug#1011712: olm: FTBFS: unsatisfiable build-dependency: binaryen (< 105+) but 106-1 is to be installed

2022-06-23 Thread Markus Koschany
Hi, I didn't know that there was some coordination required between binaryen and emscripten. Nobody talked about that in the past. Sorry to ditch your request but I don't plan to maintain emscripten. The only reason why I introduced binaryen and wabt to Debian was to compile web assembly code

Bug#1013355: groovy: FTBFS with jansi 2.4.0-1

2022-06-22 Thread Markus Koschany
Forgot to CC the bug report Am Mittwoch, dem 22.06.2022 um 18:14 +0200 schrieb Emmanuel Bourg: > Le 2022-06-22 17:54, Markus Koschany a écrit : > > > groovy FTBFS with jansi 2.4.0. I intend to either prepare a patch or > > upgrade to a newer upstream release in the future

Bug#1013355: groovy: FTBFS with jansi 2.4.0-1

2022-06-22 Thread Markus Koschany
Package: groovy Version: 2.4.21-1 Severity: serious X-Debbugs-Cc: a...@debian.org groovy FTBFS with jansi 2.4.0. I intend to either prepare a patch or upgrade to a newer upstream release in the future. Markus

Bug#1012215: gradle-debian-helper: unknown option --add-opens breaks OpenJDK 11 packages

2022-06-01 Thread Markus Koschany
Am Mittwoch, dem 01.06.2022 um 17:36 +0200 schrieb Emmanuel Bourg: > gradle-debian-helper/2.2 already checks if the JDK supports modules before > adding the --add-opens options, but it checks the default JDK and not the one > specified by JAVA_HOME, that's why it fails when OpenJDK 8 is used. ok,

Bug#1012215: gradle-debian-helper: unknown option --add-opens breaks OpenJDK 11 packages

2022-06-01 Thread Markus Koschany
Am Mittwoch, dem 01.06.2022 um 15:03 +0200 schrieb Emmanuel Bourg: > The --add-opens option was introduced in Java 9, so this shouldn't cause an > issue with Java 11. What error did you get? The compiler complains about "unknown option --add-opens" when I try to rebuild kotlin in unstable.

Bug#1012215: gradle-debian-helper: unknown option --add-opens breaks OpenJDK 11 packages

2022-06-01 Thread Markus Koschany
Package: gradle-debian-helper Version: 2.2 Severity: serious X-Debbugs-Cc: a...@debian.org Hi, The newly added --add-opens option is only valid for OpenJDK 17. I understand that we switch to it for Debian 12 but it currently breaks all packages that are built with OpenJDK 11. I am currently in

Bug#1012214: gradle: unknown option --add-opens breaks OpenJDK 11 packages

2022-06-01 Thread Markus Koschany
Package: gradle Version: 4.4.1-14 Severity: serious X-Debbugs-Cc: a...@debian.org Hi, The newly added --add-opens option is only valid for OpenJDK 17. I understand that we switch to it for Debian 12 but it currently breaks all packages that are built with OpenJDK 11. I am currently in the

Bug#1012066: buster-pu: package wireshark/2.6.20-0+deb10u3

2022-05-29 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: buster User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hi, I would like to update and sync the version of wireshark in Buster. It is identical to the version in Stretch. Multiple CVE have been fixed. They

Bug#1011492: tika: FTBFS cannot find symbols

2022-05-23 Thread Markus Koschany
Source: tika Version: 1.22-2 Severity: serious X-Debbugs-Cc: a...@debian.org I just stumbled upon this FTBFS while rebuilding some packages for a new jsoup release. There are some missing symbols but it is not related to jsoup. I am just filing this bug report for further investigation later.

Bug#963777: condor: CVE-2019-18823

2022-05-22 Thread Markus Koschany
Control: tags -1 patch Please find attached the patch to address CVE-2019-18823 for version 8.6.8~dfsg.1-2, also applied in Debian 10 "Buster". Markus From: Markus Koschany Date: Fri, 20 May 2022 14:08:49 +0200 Subject: CVE-2019-18823 Bug-Debian: https://bugs.debian.org/963777 Ori

Bug#1008634: condor: CVE-2022-26110 / HTCONDOR-2022-0003

2022-05-22 Thread Markus Koschany
Control: tags -1 patch Please find attached the patches to address CVE-2022-26110 for version 8.6.8~dfsg.1-2, also applied in Debian 10 "Buster". Markus From: Markus Koschany Date: Fri, 20 May 2022 14:09:15 +0200 Subject: CVE-2022-26110_1 Origin: https://github.com/htcondor/htcon

Bug#1011165: org.h2.jdbc.JdbcSQLSyntaxErrorException: schema "MEDIATHEKVIEW" not found

2022-05-17 Thread Markus Koschany
Control: severity -1 serious Am Dienstag, dem 17.05.2022 um 21:59 +0200 schrieb mt...@nurfuerspam.de: > Package: mediathekview > Version: 13.2.1-4 > Severity: important > > Dear Maintainer, > > after libh2-java was updated from version 2.1.210+really1.4.197-1 to 2.1.212- > 1 > there is an

Bug#1010657: google-oauth-client-java: CVE-2021-22573 - IdTokenVerifier does not verify the signature of ID Token

2022-05-15 Thread Markus Koschany
Hi tony, Am Sonntag, dem 15.05.2022 um 11:17 -0700 schrieb tony mancill: > [...] > Any thoughts?  It's a tad messy either way, but using current versions > simplifies the porting of patches. I haven't investigated the CVE closely enough but the current reverse- dependencies in Bullseye don't

Bug#1010558: jetty9: FTBFS An API incompatibility was encountered while executing org.apache.maven.plugins:maven-assembly-plugin

2022-05-04 Thread Markus Koschany
Package: jetty9 Version: 9.4.46-1 Severity: serious X-Debbugs-Cc: a...@debian.org Hi, I have just discovered that jetty9 fails to build from source. An API incompatibility was encountered while executing org.apache.maven.plugins:maven-assembly-plugin Probably some recently upgraded

Bug#1008668: bug #1008668: tomcat9: logrotated is not able to truncate catalina.out

2022-04-14 Thread Markus Koschany
Am Donnerstag, dem 14.04.2022 um 16:23 +0530 schrieb Utkarsh Gupta: > Hi Emmanuel, > > We have bug #1008668 that's causing problems on the Ubuntu side and is > also reproducible via the Debian package (essentially, it's the same > in both places). Hi Utkarsh, I have been trying to reproduce

Bug#1007923: maven-*-helper JAR placement seems to contradict Java policy

2022-03-29 Thread Markus Koschany
Am Montag, dem 28.03.2022 um 21:06 -0700 schrieb tony mancill: > [...] > I am interested to hear other opinions from the Debian Java Team. I have no objections with implementing this change and I agree that a versionless symlink is preferable for consistency reasons. The current behavior doesn't

Bug#1008026: usbguard: CVE-2019-25058: unauthorized access via D-Bus

2022-03-20 Thread Markus Koschany
Package: usbguard X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for usbguard. CVE-2019-25058[0]: | An issue was discovered in USBGuard before 1.1.0. On systems with the | usbguard-dbus daemon running, an unprivileged user

Bug#1008024: libpano13: CVE-2021-33293 out-of-bounds read

2022-03-20 Thread Markus Koschany
Package: libpano13 X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for libpano13. CVE-2021-33293[0]: | Panorama Tools libpano13 v2.9.20 was discovered to contain an out-of- | bounds read in the function

Bug#1008022: keepass2: CVE-2022-0725 information disclosure

2022-03-20 Thread Markus Koschany
Package: keepass2 X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for keepass2. CVE-2022-0725[0]: | A flaw was found in KeePass. The vulnerability occurs due to logging | the plain text passwords in the system log and leads

Bug#1008015: openvpn: CVE-2022-0547: authentication bypass in external authentication plug-ins

2022-03-20 Thread Markus Koschany
Package: openvpn X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for openvpn. CVE-2022-0547[0]: | OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass | in external authentication plug-ins when more than one of

Bug#1008008: CVE-2022-21698: denial of service in client_golang

2022-03-20 Thread Markus Koschany
Package: golang-github-prometheus-client-golang X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for golang-github-prometheus-client- golang. CVE-2022-21698[0]: | client_golang is the instrumentation library for Go

Bug#1007945: Broken bind9 security update

2022-03-19 Thread Markus Koschany
Am Samstag, dem 19.03.2022 um 10:55 +0100 schrieb Christopher Huhn: > Hi y'all > > It looks like the bind9 security update for Stretch is severely broken, > cf. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1007945 > > We had to emergency downgrade to get our DNS servers working again.

Bug#1006647: libeclipse-jdt-core-java 4.21 breaks Java 8 compatibility for Tomcat

2022-03-02 Thread Markus Koschany
Hi, Am Mittwoch, dem 02.03.2022 um 16:43 +0200 schrieb Per Lundberg: [...] > (Speaking about tomcat10, I noted the package in experimental is really > old - doesn't seem to have been updated for a few years. Do you know if > anyone is working on updating the package to e.g. Tomcat 10.0.17 or

Bug#1006647: libeclipse-jdt-core-java 4.21 breaks Java 8 compatibility for Tomcat

2022-03-02 Thread Markus Koschany
Hello Per, Am Mittwoch, dem 02.03.2022 um 12:54 +0200 schrieb Per Lundberg: > reassign 1006647 tomcat9 > thanks > > This might better belong to this package, since the problem is that > tomcat9-common depends on default-jre-headless | java8-runtime-headless > > java8-runtime, while in reality

Bug#1006140: New version can't load old databases

2022-02-24 Thread Markus Koschany
Hi Jochen, Am Donnerstag, dem 24.02.2022 um 11:26 +0100 schrieb Jochen Sprickerhof: > > > - Keep the current (old) version of h2 in Debian till jameica is >    updated, given that jameica is the only user. > > - Upload the old version of h2 as jameica-h2database and move the jar to >   

Bug#1006140: New version can't load old databases

2022-02-19 Thread Markus Koschany
Am Samstag, dem 19.02.2022 um 23:13 +0100 schrieb Jochen Sprickerhof: > * Markus Koschany [2022-02-19 22:38]: > > Ok. Did you file an upstream bug report already? > > I did not yet. Upstream bundles the old binary version so I don't think > I can convince them to do a quick

Bug#1006140: New version can't load old databases

2022-02-19 Thread Markus Koschany
Hi Jochen, Am Samstag, dem 19.02.2022 um 21:21 +0100 schrieb Jochen Sprickerhof: > Hi Markus, > > thanks for your quick reply. > > * Markus Koschany [2022-02-19 21:01]: > > That means only hibiscus/jameica require our attention. I would try to > > remove > >

Bug#1003894: fixed in h2database 2.1.210-1

2022-02-19 Thread Markus Koschany
Control: fixed -1 1.4.197-4+deb10u1 Control: fixed -1 1.4.197-4+deb11u1 signature.asc Description: This is a digitally signed message part

Bug#1006140: New version can't load old databases

2022-02-19 Thread Markus Koschany
Hi, Am Samstag, dem 19.02.2022 um 18:52 +0100 schrieb Jochen Sprickerhof: > Package: libh2-java > Version: 2.1.210-1 > Severity: important > X-Debbugs-Cc: jspri...@debian.org, Markus Koschany > Control: -1 affects mediathekview jameica hibiscus > > Hi, > > the new

Bug#1001823: Bug#733469: Patch to fix both issues

2022-02-14 Thread Markus Koschany
Hi, Am Donnerstag, dem 10.02.2022 um 18:55 +0100 schrieb Jens Rottmann: > Tags: patch > > I dug deeper, turns out I was wrong, the 2 crashes when renaming or deleting > saves weren't related after all. > > Anyway, I made a patch fixing both of them. Note that it's meant to be > applied _after_

Bug#1005374: buster-pu: package apache-log4j1.2/1.2.17-8+deb10u1

2022-02-12 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: buster User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to fix CVE-2021-4104, CVE-2022-23302, CVE-2022-23305 and CVE-2022-23307 in apache-log4j1.2. These issues are less severe because

Bug#1005372: bullseye-pu: package apache-log4j1.2/1.2.17-10

2022-02-12 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hello, I would like to fix CVE-2021-4104, CVE-2022-23302, CVE-2022-23305 and CVE-2022-23307 in apache-log4j1.2. These issues are less severe because

Bug#1005353: buster-pu: package apache-log4j2/2.11.1-2

2022-02-11 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: buster User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hi, I would like to fix CVE-2021-44832 in Buster. Apache Log4j2 has been affected by some serious remote code execution vulnerabilities in the past

Bug#1005351: bullseye-pu: package apache-log4j2/2.16.0-1~deb11u1

2022-02-11 Thread Markus Koschany
Package: release.debian.org Severity: normal Tags: bullseye User: release.debian@packages.debian.org Usertags: pu X-Debbugs-Cc: a...@debian.org Hi, I would like to fix CVE-2021-44832 in Bullseye. Apache Log4j2 has been affected by some serious remote code execution vulnerabilities in the

Bug#1004482: liblog4j1.2-java: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302

2022-02-10 Thread Markus Koschany
Hi, Am Donnerstag, dem 10.02.2022 um 17:22 +0100 schrieb Christoph Anton Mitterer: > Hey. > > Is that going to be fixed in stable, too? > > Cheers, > Chris. Yes, these issues will be fixed with a stable point update. Regards, Markus signature.asc Description: This is a digitally signed

Bug#1001823: Ping?

2022-02-09 Thread Markus Koschany
Hello Jens, thanks for reporting this issue and for your patch! Unfortunately nobody had time to look at it yet. There might be more issues due to the Python 3 port but I could apply your patch for a start after some play testing. I try to do this at the weekend. Regards, Markus signature.asc

Bug#1004284: tomcat9: postinst creates wrong userhome via systemd-sysusers

2022-02-07 Thread Markus Koschany
Control: tags -1 moreinfo Hello, > Dear Maintainer, > > Debian creates in the postinst script via systemd-sysusers > a system user named tomcat whose home directory is /var/lib/tomcat. > This directory does not exist, but /var/lib/tomcat9 The idea was to create a general tomcat system user

Bug#1004482: liblog4j1.2-java: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302

2022-01-31 Thread Markus Koschany
Am Sonntag, dem 30.01.2022 um 16:49 -0800 schrieb tony mancill: > On Mon, Jan 31, 2022 at 01:18:49AM +0100, Emmanuel Bourg wrote: > > Le 31/01/2022 à 00:47, Markus Koschany a écrit : > > > > > Thanks tony! I'm currently rebuilding all reverse-dependencies of > > >

Bug#1004482: liblog4j1.2-java: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302

2022-01-30 Thread Markus Koschany
Am Sonntag, dem 30.01.2022 um 15:20 -0800 schrieb tony mancill: > > Hi Markus, > > You might take some inspiration and/or patches from the reload4j > project. > >   https://reload4j.qos.ch/  > > I have been using it as drop-in replacement for the log4j 1.2.x jar for > applications at

Bug#1004482: liblog4j1.2-java: CVE-2022-23307 CVE-2022-23305 CVE-2022-23302

2022-01-30 Thread Markus Koschany
Control: owner -1 ! On Fri, 28 Jan 2022 17:04:08 +0100 Christoph Anton Mitterer wrote: > Package: liblog4j1.2-java > Version: 1.2.17-10 > Severity: grave > Tags: security upstream > Justification: user security hole > X-Debbugs-Cc: Debian Security Team > > Hey. > > A number of holes was found

Bug#1002709: webext-ublock-origin-firefox: ublock-origin makes firefox-esr 91 consumes 100% of a CPU core

2022-01-06 Thread Markus Koschany
Control: affects 986027 webext-ublock-origin-firefox Am Donnerstag, dem 06.01.2022 um 16:20 + schrieb Amr Ibrahim: > Am Freitag, dem 31.12.2021 um 20:53 +0100 schrieb Markus Koschany: > > > If you install version 1.40.2+dfsg-1 from unstable, does this resolve > > your probl

Bug#970721: xom: new releases available

2022-01-04 Thread Markus Koschany
Am Dienstag, dem 04.01.2022 um 16:45 +0200 schrieb Andrius Merkys: > Hello, > > I have packaged successfully packaged xom v1.3.7 locally and launched > ratt to test-rebuild the reverse dependencies. 81 of 137 of them are > done at the moment, all of the failures happened in already RC-buggy >

Bug#1002709: webext-ublock-origin-firefox: ublock-origin makes firefox-esr 91 consumes 100% of a CPU core

2021-12-31 Thread Markus Koschany
Hi, thanks for the report. If you install version 1.40.2+dfsg-1 from unstable, does this resolve your problem? I have noticed similar issues with Firefox on websites which make heavy use of Javascript but I don't experience them with Chromium. Regards, Markus signature.asc Description: This

Bug#938351: marked as pending in renpy

2021-12-18 Thread Markus Koschany
Renpy still has not been ported to Python 3 yet. The status of renpy and other Python 2 games was previously discussed on debian-devel-games. https://lists.debian.org/debian-devel-games/2020/12/msg00013.html A removal request was filed: https://bugs.debian.org/1001888 I don't think a removal

Bug#1001888: RM: renpy -- RoQA; depends on Python 2 and deprecated libavresample, RC-buggy

2021-12-18 Thread Markus Koschany
Am Samstag, dem 18.12.2021 um 15:33 +0100 schrieb Sebastian Ramacher: > On 2021-12-18 15:05:18 +0100, Markus Koschany wrote: > > Am Samstag, dem 18.12.2021 um 12:49 +0100 schrieb Sebastian Ramacher: > > > Package: ftp.debian.org > > > Severity: normal > > > X-

Bug#1001891: apache-log4j2: CVE-2021-45105: Certain strings can cause infinite recursion

2021-12-18 Thread Markus Koschany
Control: owner -1 ! Am Samstag, dem 18.12.2021 um 14:37 +0100 schrieb Salvatore Bonaccorso: > Source: apache-log4j2 > Version: 2.16.0-1 > Severity: grave > Tags: security upstream > Forwarded: https://issues.apache.org/jira/browse/LOG4J2-3230 > X-Debbugs-Cc: car...@debian.org, Debian Security

Bug#1001888: RM: renpy -- RoQA; depends on Python 2 and deprecated libavresample, RC-buggy

2021-12-18 Thread Markus Koschany
Am Samstag, dem 18.12.2021 um 12:49 +0100 schrieb Sebastian Ramacher: > Package: ftp.debian.org > Severity: normal > X-Debbugs-Cc: sramac...@debian.org, re...@packages.debian.org > > Please remove renpy from unstable. It was not included in bullseye since > it still depends on Python 2 (#938351).

Bug#1001729: apache-log4j2: CVE-2021-45046: Incomplete fix for CVE-2021-44228 in certain non-default configurations

2021-12-14 Thread Markus Koschany
Control: owner -1 ! Am Dienstag, dem 14.12.2021 um 21:37 +0100 schrieb Salvatore Bonaccorso: > Source: apache-log4j2 > Version: 2.15.0-1 > Severity: grave > Tags: security upstream > Justification: user security hole > Forwarded: https://issues.apache.org/jira/browse/LOG4J2-3221 > X-Debbugs-Cc:

Bug#1001590: File conflict with older versions

2021-12-12 Thread Markus Koschany
Am Sonntag, dem 12.12.2021 um 19:05 +0100 schrieb Philipp Marek: > Package: liblog4j2-java > Version: 2.13.3-1 > Severity: normal > X-Debbugs-Cc: phil...@marek.priv.at > > > When installing I get this: (sorry about the German) > >     Entpacken von liblog4j2-java (2.13.3-1) ... >     dpkg:

Bug#1001478: apache-log4j2: CVE-2021-44228:: Remote code injection via crafted log messages

2021-12-11 Thread Markus Koschany
Am Samstag, dem 11.12.2021 um 10:52 -0800 schrieb tony mancill: > On Fri, Dec 10, 2021 at 10:42:24PM +0100, Markus Koschany wrote: > > Control: owner -1 ! > > > > I am currently investigating the fix for CVE-2021-44228. > > Hi Markus, > > Thank y

Bug#1001478: apache-log4j2: CVE-2021-44228:: Remote code injection via crafted log messages

2021-12-10 Thread Markus Koschany
Control: owner -1 ! I am currently investigating the fix for CVE-2021-44228. Markus signature.asc Description: This is a digitally signed message part

Bug#996696: google-http-client-java: please upgrade to version 1.40.1

2021-11-25 Thread Markus Koschany
On Tue, 26 Oct 2021 21:05:57 -0400 Olek Wojnar wrote: > Markus, > > Sorry for the slow reply, it has been an extraordinarily crazy time over > here recently. I'm barely keeping up on emails but I'm hoping that things > quiet down a little in the coming weeks and allow me to catch up. This is >

Bug#1000265: typo in fix for CVE-2021-21996 breaks file.managed on stretch

2021-11-20 Thread Markus Koschany
On Sat, 20 Nov 2021 16:46:34 + Jamie Heilman wrote: > Package: salt-common > Version: 2016.11.2+ds-1+deb9u8 > Severity: grave > > The patch for 994016 in the > /usr/lib/python2.7/dist-packages/salt/fileclient.py file included: > > +    # clean_path returns an empty string if the check

Bug#984403: warzone2100 version 3.4.0 to 4.2.1 CMake build problem

2021-11-15 Thread Markus Koschany
Hi Russell, is your build problem related to Debian bug #984403 "FTBFS with GCC 11" ? I don't intend to investigate this problem soon. We need a new upstream version too. I presume this will fix the current build failures. Regards, Markus #Am Samstag, dem 13.11.2021 um 15:57 +1100 schrieb

Bug#998606: gradle: FTBFS: Could not resolve commons-io:commons-io:debian.

2021-11-04 Thread Markus Koschany
Am Donnerstag, dem 04.11.2021 um 20:54 +0100 schrieb Lucas Nussbaum: > Source: gradle > Version: 4.4.1-13 > Severity: serious > Justification: FTBFS > Tags: bookworm sid ftbfs > User: lu...@debian.org > Usertags: ftbfs-20211104 ftbfs-bookworm > > Hi, > > During a rebuild of all packages in sid,

Bug#998238: syncany: FTBFS: Could not resolve commons-io:commons-io:2.4.

2021-11-01 Thread Markus Koschany
Am Montag, dem 01.11.2021 um 07:20 -0700 schrieb tony mancill: > On Mon, Nov 01, 2021 at 02:06:32PM +0100, Andreas Beckmann wrote: > > Source: syncany > > Version: 0.4.9~alpha-3 > > Severity: serious > > Tags: ftbfs > > Justification: fails to build from source > > > > Hi, > > > > syncany

Bug#997977: /lib/systemd/system/monopd.service:8: Special user nobody configured, this is not safe!

2021-10-28 Thread Markus Koschany
Am Donnerstag, dem 28.10.2021 um 14:24 +0800 schrieb Jason L. Quinn: > Package: monopd > Version: 0.10.2-4 > Severity: grave > Tags: security > Justification: user security hole > X-Debbugs-Cc: jason.lee.quinn+deb...@gmail.com, Debian Security Team > > > Dear Maintainer, > > Recently upgraded

Bug#996693: google-http-client-java: please upgrade to version 1.40.1

2021-10-22 Thread Markus Koschany
Hi, could you both comment on Debian bugs #996693 and #996696 please? Regards, Markus signature.asc Description: This is a digitally signed message part

Bug#924005: client certificate verification regression with puppetdb

2021-10-18 Thread Markus Koschany
Control: severity -1 normal On Fri, 8 Mar 2019 09:59:14 +0100 "=?UTF-8?Q?Stefan_B=c3=bchler?=" wrote: > Package: jetty9 > Version: 9.4.15-1 > Severity: important > > Hi. > > The update (libjetty9-java and libjetty9-extra-java) to 9.4.15-1 broke > our puppetdb setup; a downgrade to 9.4.14-1

Bug#994440: jetty9 systemd unit too strict for normal use

2021-10-18 Thread Markus Koschany
Hello, thanks for the report. On Thu, 16 Sep 2021 08:17:29 +0200 Martin van Es wrote: > Package: jetty9 > Version: 9.4.16-0+deb10u1 > Severity: important > > On a default jetty9 install, the systemd unit file restricts readwrite > operations to /var/lib/jetty9/ using the systemd ProtectSystem

Bug#996696: google-api-client-java: please drop add_depend.patch

2021-10-17 Thread Markus Koschany
Source: google-api-client-java Version: 1.27.1-1 Severity: important X-Debbugs-Cc: a...@debian.org Hi, google-api-client-java ships the add_depend.patch which sets the scope of three depedencies including google-http-client to scope=provided. This forces other reverse-dependencies of

Bug#996693: google-http-client-java: please upgrade to version 1.40.1

2021-10-17 Thread Markus Koschany
Source: google-http-client-java Version: 1.32.1-1 Severity: normal X-Debbugs-Cc: a...@debian.org Hi, I am working on packaging the openrefine project and google-http-client-java is one of its dependencies. I didn't notice we already ship google-http-client-java in Debian thus I had created my

Bug#996255: ITP: libowasp-encoder-java -- OWASP Java Encoder Project

2021-10-12 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org, debian-j...@lists.debian.org * Package name: libowasp-encoder-java Version : 1.2.3 Upstream Author : OWASP (Open Web-Application Security Project) * URL

Bug#996249: ublock-origin: Invalid debian/changelog file

2021-10-12 Thread Markus Koschany
Control: severity -1 minor Am Dienstag, dem 12.10.2021 um 16:08 +0200 schrieb Philipp Hahn: > Source: ublock-origin > Version: 1.37.0+dfsg-1~deb10u1 > Severity: important > X-Debbugs-Cc: debian-rele...@lists.debian.org > > Dear Maintainer, > > the just releases Debian 10.1 Buster contains your

Bug#996182: ITP: google-api-services-sheets-java -- Google Sheets API Client Library for Java

2021-10-11 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org, debian-j...@lists.debian.org * Package name: google-api-services-sheets-java Version : 1.32.1-1 Upstream Author : Google * URL : https://github.com

Bug#996180: ITP: google-api-services-drive-java -- Google Drive API Client Library for Java

2021-10-11 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org, debian-j...@lists.debian.org * Package name: google-api-services-drive-java Version : 1.32.1-1 Upstream Author : Google Inc. * URL : https

Bug#996179: ITP: libokhttp-signpost-java -- Signpost extension for signing OkHttp requests

2021-10-11 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org, debian-j...@lists.debian.org * Package name: libokhttp-signpost-java Version : 1.1.0-1 Upstream Author : Patrik Åkerfeldt * URL : http://github.com

Bug#996178: ITP: libwikidata-toolkit-java -- Wikidata Toolkit

2021-10-11 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org, debian-j...@lists.debian.org * Package name: libwikidata-toolkit-java Version : 0.12.1 Upstream Author : Markus Kroetzsch, Julian Mendez, Fredo Erxleben

Bug#995892: jodconverter: incompatible with libxstream-java 1.4.18

2021-10-07 Thread Markus Koschany
whenever an object was deserialized. I am attaching a patch that whitelists all classes of com.artofsolving.jodconverter and thus should make deserialization work again. Regards, Markus From: Markus Koschany Date: Tue, 28 Sep 2021 21:21:14 +0200 Subject: libxstream-java --- .../java/com/artofsolving

Bug#995821: ITP: libthumbnailator-java -- thumbnail generation library for Java

2021-10-06 Thread Markus Koschany
Package: wnpp Severity: wishlist Owner: Markus Koschany X-Debbugs-Cc: debian-de...@lists.debian.org, a...@debian.org * Package name: libthumbnailator-java Version : 0.4.14 Upstream Author : Chris Kroells * URL : https://github.com/coobird/thumbnailator * License

Bug#985690: sweethome3d: depends on libfreehep-util-java and libfreehep-xml-java

2021-10-04 Thread Markus Koschany
On Mon, 22 Mar 2021 09:57:02 +0200 Andrius Merkys wrote: > Package: sweethome3d > Version: 6.4.2+dfsg-1 > > Hello, > > sweethome3d depends on libfreehep-util-java and libfreehep-xml-java: > > $ sudo apt-get autoremove libfreehep-util-java libfreehep-xml-java > > $ sweethome3d > [warning]

Bug#995205: jsap: does not correctly initialize the security framework of xstream

2021-09-27 Thread Markus Koschany
ncy=medium + + * Non-maintainer upload. + * + + -- Markus Koschany Mon, 27 Sep 2021 22:36:22 +0200 + jsap (2.1-4) unstable; urgency=medium * Setting Salsa VCS paths diff -Nru jsap-2.1/debian/patches/series jsap-2.1/debian/patches/series --- jsap-2.1/debian/patches/series 1970-01-01 01:00:00

Bug#987179: tomcat9: catalina.out created with root owner, then logrotate fails to process it

2021-09-24 Thread Markus Koschany
On Mon, 19 Apr 2021 10:13:50 +0200 Adam Cecile wrote: > Package: tomcat9 > Version: 9.0.43-1 > Severity: important > > Hello, > > I just deployed 9 servers using Debian 11 and I have a rather serious issue > with them. > > root@debian11.server:~# ls -lah /var/log/tomcat9/catalina.out >

Bug#925473: tomcat9: sysvinit script missing

2021-09-21 Thread Markus Koschany
Am Dienstag, dem 21.09.2021 um 16:10 + schrieb Thorsten Glaser: [...] > I have no idea why Emmanuel, the primary maintainer, has been set > so strongly against merging this patch for as long as I promise to > take care of it and deal with any related fallout > (maybe some systemd > fan paid

Bug#994080: qemu-system-x86: Upgrading to 1:2.8+dfsg-6+deb9u15 breaks user-mode networking in guest

2021-09-11 Thread Markus Koschany
Am Samstag, dem 11.09.2021 um 03:49 -0500 schrieb Matt Roberds: > Package: qemu-system-x86 > Version: 1:2.8+dfsg-6+deb9u15 > Severity: important > X-Debbugs-Cc: debian-...@lists.debian.org > > Hello all! > > Quick version: > == > > I recently upgraded the qemu packages on my host

Bug#984807: Add stdmusic to freeciv-sound-standard package

2021-09-08 Thread Markus Koschany
Hi Marko, On Mon, 8 Mar 2021 17:32:03 +0200 Marko Lindqvist wrote: > Package: freeciv-sound-standard > Version: 2.6.3-1 > > In addition to the standard sound effects set, freeciv-sound-standard > package should include standard music set. In the standard music set, > there's only one track of

<    1   2   3   4   5   6   7   8   9   10   >