Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:redmine User: [email protected] Usertags: pu
[ Reason ] I am one of the maintainers of the redmine package. During the time that I have been involved with the package, we have not made an effort to fix bugs in stable. The package has historically been in bad shape, but a significant effort has been made to improve the package, and the version in untable is now much closer to Debian's standards. I would now like to bring the package in stable up to Debian's standards as well. Stable currently has redmine 6.0.5+ds-1. Unstable has 6.1.3+ds-1. Upstream actively fixes security and other bugs in old branches for a significant period of time. These updates for older branches are usually released quarterly. At the time of this writing, upstream lists the following supported versions on their website: Latest releases 5.1.13 (2026-06-15) 6.0.10 (2026-06-15) 6.1.3 (2026-06-15) 7.0.0 (2026-06-30) https://www.redmine.org/projects/redmine/wiki/Download The changelog for the 6.0.x series shows a significant amount of bugs (security and otherwise) fixed between the 6.0.5 and 6.0.10 releases. https://www.redmine.org/projects/redmine/wiki/Changelog_6_0 I know that typically it is preferable to backport individual patches to fix bugs in stable. Given the large number of such bugs, I do not think that any of the redmine maintainers have the time to commit to such efforts. Because upstream is already doing the work of fixing bugs on these older branches, I would like to seek permission to simply upload these stable releases in their entirety. If approved, I would perform a new upload every quarter with the new upstream releases. [ Impact ] One of these changes is a security bug with CVE-2026-1836. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140483 If not approved, it would be possible to cherry-pick just this fix and backport it. However, I count at least 17 other security bugs (and dozens of non-security bugs) listed in the changelog that do not have CVEs assigned to them. It is unlikely that any of the redmine maintainers have time to manually cherry-pick patches to address all of these issues. [ Tests ] Upstream ships a test suite with over 5,000 tests (and 24,000 assertions) that runs during build, as well as autopkgtests designed by the package maintainers. https://salsa.debian.org/ruby-team/redmine/-/pipelines/1147370 Five of the upstream tests produce errors when backported to trixie, which are caused by the output of the system not exactly matching the assertions expected in the tests. It appears the root cause is that trixie has rails-dom-testing 2.2.0, but the upstream tests expect 2.3.0, which changed the way whitespaces are handled (several of the errors have whitespace differences). There is also some possiblity that the difference between rails 7.2.2.2 in trixie and rails 7.2.3.1 expected by upstream, which can explain the different in certain URLs automatically generated by the system. I have manually installed and tested the proposed 6.0.10+ds-1 packages, particularly in the creation of issue attachments, and have verified that the functionality works correctly in a live environment. [ Risks ] While most of the changes between 6.0.5 and 6.0.10 are bug fixes, there are some modifications that go beyond the minimum requirements to fix the bugs. Sometimes there is a gray area between the minimum change required to fix a bug and general quality-of-life improvements, and upstream tends to error on the side of including related improvements when backporting bug fixes. In addition, as is common for Ruby on Rails projects, upstream uses a very tight list of dependency versions. We have to modify many of these in unstable to work with what is available in Debian. Some of the upstream changes in these releases modify the Gemfile (which lists version dependencies). Most of these are small changes within the tolerance of the packages in trixie, but there is some chance that these changes could introduce bugs that are not caught in the automatic and manual testing. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Changes ] The changes are made in the following 9 commits: 1. Update Files-Excluded paths. https://salsa.debian.org/ruby-team/redmine/-/commit/fe3a1fd2a4c93c5a45d333ebdcf44e0e944df501 * Update Files-Excluded to match the paths in the new upstream release. * Bump my debian/copyright years. 2. Initial upstream/trixie branch. https://salsa.debian.org/ruby-team/redmine/-/commit/5f5e37ea36e7e01c22baa76d6bba7028e9e659b0 3. Update gbp.conf for Debian trixie. https://salsa.debian.org/ruby-team/redmine/-/commit/1f3ca9eb79fd518d6cfdad857649687f9a033bfe * Update gbp.conf to point to the trixie branches. 4 and 5. Import the 6.0.10 upstream. https://salsa.debian.org/ruby-team/redmine/-/commit/8583d5990d44da66aef3801be0bd833657b93019 https://salsa.debian.org/ruby-team/redmine/-/commit/114ef9df6d19f32ebf28715f7bb2894d0a5173e4 6. Adjust the patches for the new upstream release. https://salsa.debian.org/ruby-team/redmine/-/commit/968aa4b6652d05d2d2316d3a96a25ab3cdab5e42 * debian/patches/0003-Use-production-environment-by-default.patch This is a simple refresh to fix offsets. * debian/patches/autoload-thin-gem This is also a simple refresh to fix offsets. * debian/patches/gemfile-deps-adjustment.patch The upstream Gemfile has very specific version constraints and has to be adjusted for what is available in Debian. * debian/patches/use_system_jquery_libs.patch This patch has to be adjusted for updated file locations. The previous patch also deleted a file, which is no longer needed. 7. Add debian/patches/skip-certain-tests-on-trixie.patch https://salsa.debian.org/ruby-team/redmine/-/commit/0d3079cbfae34ddbda0f6e991bb23534c6a8588d * This patch skips the five tests described above that fail in trixie due to the older testing environment. 8. Bump upstream copyright years. https://salsa.debian.org/ruby-team/redmine/-/commit/f35161d6887841d0fe787c43afcbb0c8c1938b24 9. Refactor debian/copyright. https://salsa.debian.org/ruby-team/redmine/-/commit/cbcb219b6b75867f9cc1872c109943c05b17244a * The version of debian/copyright shipping in trixie had become out-of-sync with the upstream project, including the main license switching from GPL-2 to GPL-2+. [ Other info ] $ debdiff redmine_6.0.10+ds-1_amd64.changes redmine_6.0.5+ds-1_amd64.changes [The following lists of changes regard files as different if they have different names, permissions or owners.] Files in first .changes but not in second ----------------------------------------- -rw-r--r-- root/root /usr/share/redmine/app/assets/images/hourglass-empty.svg Control files of package redmine: lines which differ (wdiff format) ------------------------------------------------------------------- Installed-Size: [-9940-] {+9919+} Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+} Control files of package redmine-mysql: lines which differ (wdiff format) ------------------------------------------------------------------------- Installed-Size: [-146-] {+138+} Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+} Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+} Control files of package redmine-pgsql: lines which differ (wdiff format) ------------------------------------------------------------------------- Installed-Size: [-146-] {+138+} Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+} Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+} Control files of package redmine-sqlite: lines which differ (wdiff format) -------------------------------------------------------------------------- Installed-Size: [-146-] {+138+} Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+} Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+}
