Bug#333862: debian-policy: Policy forbids account creation

2005-10-19 Thread Matt Zimmerman
On Fri, Oct 14, 2005 at 10:07:04AM +0200, Marc Haber wrote: Package: debian-policy Version: 3.6.2.1 Severity: normal Policy 9.2.1 says: Packages other than base-passwd must not modify /etc/passwd, /etc/shadow, /etc/group or /etc/gshadow. This makes, for example, the passwd package RC

Bug#291148: [PROPOSAL] Add a 'status' option in init.d scripts

2005-06-25 Thread Matt Zimmerman
I agree with Manoj's suggestion. The best way to go about it would be to draft a complete proposal (including standardizing the output format), start patching packages in unstable, and go from there. FWIW, I think it would be appropriate to add an option to start-stop-daemon to support this use

Bug#299007: base-files: Insecure PATH

2005-03-21 Thread Matt Zimmerman
On Tue, Mar 22, 2005 at 02:37:14PM +1100, [EMAIL PROTECTED] wrote: Could the settings Severity: critical Justification: root security hole please be re-instated on this bug? In some common scenarios, current arrangements allow root access. Could this be done, please, while we

Re: Bad version number based on date advice in policy?

2003-12-08 Thread Matt Zimmerman
On Sun, Dec 07, 2003 at 03:47:07PM +0100, Josip Rodin wrote: Epochs are more inelegant because they never go away, and rather have a tendency of needing increases, which has a tendency of getting more confusing; the ^(0\.)+ parts, on the other hand, disappear when the program authors migrate

Re: Bug#218861: apt: apt-get should warn about removing required packages

2003-11-03 Thread Matt Zimmerman
On Mon, Nov 03, 2003 at 06:52:08AM +, Colin Watson wrote: Libraries can't be essential, because it would make it too hard to remove them when their sonames change. Understood...but I was actually asking why policy seems to say that a system lacking Priority: required packages could have a

Re: Bug#218861: apt: apt-get should warn about removing required packages

2003-11-02 Thread Matt Zimmerman
On Sun, Nov 02, 2003 at 08:34:13PM -0500, Andres Salomon wrote: [EMAIL PROTECTED]:~$ apt-cache show procps | grep Priority Priority: required [EMAIL PROTECTED]:~$ sudo apt-get remove procps Reading Package Lists... Done Building Dependency Tree... Done The following packages will be

Re: Some 2 year old proposals

2003-08-21 Thread Matt Zimmerman
On Thu, Aug 21, 2003 at 11:35:28AM -0500, Manoj Srivastava wrote: * #80343: [PROPOSAL] policy should say no files should be owned by nobody Package: debian-policy; Severity: wishlist; Reported by:

Bug#172436: Security concerns regarding browser proposal

2003-08-04 Thread Matt Zimmerman
On Mon, Aug 04, 2003 at 02:07:26AM +0100, Colin Watson wrote: On Sun, Aug 03, 2003 at 07:48:43PM -0400, Matt Zimmerman wrote: It might be a good idea to specify how quoting should be handled, both for shell metacharacters and format specifiers. Odd, I thought I'd mentioned http

Bug#172436: Security concerns regarding browser proposal

2003-08-04 Thread Matt Zimmerman
On Sun, Aug 03, 2003 at 11:03:21PM -0400, Joey Hess wrote: Matt Zimmerman wrote: It might be a good idea to specify how quoting should be handled, both for shell metacharacters and format specifiers. Well, it's been discussed several times before, but what the hey, I guess I can discuss

Bug#203650: Poor recommendation in dpkg-statoverride section

2003-08-04 Thread Matt Zimmerman
On Sun, Aug 03, 2003 at 11:49:43AM +0100, Julian Gilbey wrote: Then change the line in the postinst: + if [ $1 = configure ] + then for i in /usr/bin/foo /usr/sbin/bar do - if ! dpkg-statoverride --list $i /dev/null + if [ dpkg --compare-versions $2 lt 2.3.4-2 ]

Bug#172436: Security concerns regarding browser proposal

2003-08-03 Thread Matt Zimmerman
It might be a good idea to specify how quoting should be handled, both for shell metacharacters and format specifiers. From the existing text, it seems that command part means shell command part, and it is impossible to implement this securely without specifying a scheme for handling shell

Bug#160908: debian-policy: Stray plus character in text

2002-09-14 Thread Matt Zimmerman
Package: debian-policy Version: 3.5.7.0 Severity: minor nostrip This string means that the debugging symbols should not be stripped from the binary during installation, so that debugging information may be included in the + package. From looking at the SGML source, this '+' appears to be

Re: make it official

2002-07-28 Thread Matt Zimmerman
On Sun, Jul 28, 2002 at 01:14:57PM -0500, Branden Robinson wrote: --- virtual-package-names-list.txt~ 2002-07-28 13:11:31.0 -0500 +++ virtual-package-names-list.txt 2002-07-28 13:13:37.0 -0500 @@ -63,6 +63,7 @@ awk Anything providing suitable

Re: The Serious severity

2002-05-02 Thread Matt Zimmerman
On Thu, May 02, 2002 at 07:15:09PM -0400, Joey Hess wrote: Manoj Srivastava wrote: No, the same functionality is _NOT_ served by tags. Like it or not, our bug listing are done by severity, and shoving policy violation into a tag degrades the importance of not violating policy.

Bug#96597: changing policy requirements for debian native packages to _MUST_

2002-03-05 Thread Matt Zimmerman
On Mon, Mar 04, 2002 at 10:38:15PM -0500, Joey Hess wrote: The method of finding a package's changelog that I had always assumed would be used is: if (the package is native via dpkg) return /usr/share/doc/package/changelog.gz else return

Bug#91257: re-proposing this

2001-05-06 Thread Matt Zimmerman
On Sun, May 06, 2001 at 01:45:28AM -0500, Sam TH wrote: On Sun, May 06, 2001 at 12:46:04AM -0500, Branden Robinson wrote: fonts shipped, such as their license information). If one or more of the fonts so packaged are necessary for proper

Re: Where to place images?

2001-03-11 Thread Matt Zimmerman
On Sun, Mar 11, 2001 at 11:52:41AM +0100, Tollef Fog Heen wrote: However, I'd like to put images in something like /usr/share/web-images, since I _might_ end up cluttering around and overwriting files which I shouldn't, by placing the images in /var/www/mailman-images. Also, it looks messy,

Re: how to build debugging binaries

2001-01-29 Thread Matt Zimmerman
On Mon, Jan 29, 2001 at 10:09:45AM -0500, Bob Hilliard wrote: Hamish Moffatt [EMAIL PROTECTED] writes: On Sun, Jan 28, 2001 at 04:14:47PM -0500, Matt Zimmerman wrote: s/packages should/packages conforming to policy version 3.2.0 or greater should/ should referring to the Policy

Bug#83924: upgrading-checklist.text should mention DEB_BUILD_OPTIONS specifically

2001-01-28 Thread Matt Zimmerman
Package: debian-policy Version: 3.2.1.2 Severity: minor upgrading-checklist.text states: - By default executables should not be built with the debugging option -g. Instead, it is recommended to support building the package with debugging information optionally. It would be

Re: init script config files

2000-07-08 Thread Matt Zimmerman
On Fri, Jul 07, 2000 at 04:49:29PM -0700, Joey Hess wrote: tony mancill wrote: While we're discussing this, I'd like to hear comments on the idea of using an /etc/rc.config.d/$package scheme, like that in HP-UX. This file is a shell script that gets sourced by the /etc/init.d/$package.