Bug#1108828: aptly: autopkgtest regression: CreateMirror31Test

2025-07-05 Thread Sébastien Delafond
tag 1108828 + trixie-ignore thanks Hello, this is definitely a test-only issue, and upstream already has fixes related to that in 1.6.2, but they were unfortunately a bit too large for me to upload them to unstable during the freeze. I will however still take some time this upcoming week, to try

Bug#1100788: 1100788

2025-03-27 Thread Sébastien Delafond
Since the entire upstream test suite was added in autopkgtests, I haven't seen `repo.aptly.info` being flaky or unreliable, which is obviously what triggered both the failures you reported. I'll keep an eye out for future failures, but at this point I don't think there is value in the tradeoff of

Bug#1100788: aptly: CI error with gnupg 2.4 - Timing issue?

2025-03-18 Thread Sébastien Delafond
Hi Andreas, On Tue, Mar 18 2025, Andreas Metzler wrote: > t06_publish ➔ PublishSnapshot38Test ... FAIL 17s > [...] > raise Exception("content doesn't match:\n" + diff + "\n") > Exception: content doesn't match: > --- > +++ > @@ -1,7 +1,7 @@ > +Signing file 'main_installer-s39

Bug#1092139: O: s3curl -- Easily interact with AWS S3 HTTP services

2025-01-05 Thread Sébastien Delafond
On Sun, Jan 05 2025, Chris Hofstaedtler wrote: >> I intend to orphan the s3curl package for the following reasons: >> >> - dead upstream - many alternatives > > Given this is the case, could I please ask you to file an RM bug > instead? > > Otherwise we'll just drag this package forward with ran

Bug#1087613: upstream issue https://github.com/pimutils/khal/issues/1367

2024-11-25 Thread Sébastien Delafond
The corresponding upstream issue is https://github.com/pimutils/khal/issues/1367, and boils down to an incompatibility with icalendar >= 6. I confirmed the patch from https://github.com/pimutils/khal/pull/1364 fixes it. Cheers, -- Seb

Bug#947287: fixed in python-certifi 2024.8.30+dfsg-1

2024-10-09 Thread Sébastien Delafond
On Wed, Oct 09 2024, Guillem Jover wrote: > It would be nice if you could retroactively include references to > the three CVEs in that changelog entry: > > CVE-2022-23491, CVE-2023-37920, CVE-2024-39689 > > So that the security tracker can automatically mark them as fixed. I plan on editing the

Bug#1083225: v17 and pypdf2

2024-10-03 Thread Sébastien Delafond
I'm actively trying to sort out this situation with upstream, since v17 is, unfortunately and unexpectedly, still somewhat in limbo with regard to this pypdf/pypdf2 issue. Cheers, -- Seb

Bug#1061261: odoo: Uses deprecated/to be removed PyPDF2

2024-09-03 Thread Sébastien Delafond
On Tue, Sep 03 2024, Colin Watson wrote: > I had a brief look at this and noticed that this package was > previously ported to pypdf, but that the port was reverted in > https://salsa.debian.org/freexian-team/packages/odoo/-/commit/d68da30bd5746f41e33c19ba5c2b8bc0f100e4d6. > > CCing Sébastien - was

Bug#1064843: odoo-16: minor upgrades available

2024-02-27 Thread Sébastien Delafond
Control: severity -1 normal Control: tag -1 + pending Hello, odoo-16 is the official and latest version available in Debian ("saas" are not meant to be deployed locally) right now; 17 and 18 will be packaged soon. Upgrading from one major version to the next is not directly supported in Debian:

Bug#1059326: Workaround

2023-12-22 Thread Sébastien Delafond
In case someone out there is stuck real bad with this bug in bookworm, here's a very nasty workaround for which I of course decline all responsibility: $ mkdir /usr/share/fonts/type1/gsfonts $ ln -sf /usr/share/fonts/X11/Type1/C059-Roman.pfb /usr/share/fonts/type1/gsfonts/n021003l.pfb Cheers

Bug#1059326: fixed in 4.0.8-1

2023-12-22 Thread Sébastien Delafond
Control: fixed 1059326 4.0.8-1 The earliest fixed version is most likely between 4.0.4-7 and 4.0.4-11. Cheers, -- Seb

Bug#1029736: Odoo-14 fails to start

2023-03-03 Thread Sébastien Delafond
On Thu, Mar 02 2023, Glenn wrote: > I think this bug could be more serious than wishlist, as the server > doesnt start, for me at least. > > When trying to start it with the same line from its init file, it > concludes with the error; No module named 'PyPDF2.utils' Hi Glenn, the bug you're hittin

Bug#1022721: New aptly upstream version 1.5.0

2023-01-31 Thread Sébastien Delafond
On Mon, Jan 30 2023, Roland Mas wrote: > golang-github-cavaliergopher-grab has been accepted into > unstable. Shall I proceed with the aptly upload or would one of you > guys prefer doing it? You can go ahead. Cheers, -- Seb

Bug#1022721: New aptly upstream version 1.5.0

2023-01-04 Thread Sébastien Delafond
On 02/01 15:04, Roland Mas wrote: > I took the liberty of packaging the cavaliergopher/grab library Thanks for uploading that to NEW and closing the associated RFP. > I also updated the packaging for aptly 1.5.0, which I committed and > pushed to salsa, but I'd rather you had a look before upload

Bug#1024641: Aptly does not support zstd compression

2022-11-22 Thread Sébastien Delafond
On 22/11 11:01, Kyle Edwards wrote: > Package: aptly > Version: 1.4.0+ds1-7 > > Aptly 1.4.0 does not support the zstd compression found in Ubuntu 22.04 > packages. Please upgrade Aptly to 1.5.0 to support the new zstd compression. This was fixed in 1.4.0+ds1-7, as per #1010465[fn:1]. Are you actu

Bug#1024166: blist: dead upstream, no maintainer upload since 2015

2022-11-16 Thread Sébastien Delafond
On 15/11 14:51, Louis-Philippe Véronneau wrote: > I'm CC-ing Sebastien Delafond explicitly, as he seems to be the > maintainer of all the packages in the archive that depend or > build-depend on blist (python-raccoon, python-panwid, elastalert). > > In a perfect world, those packages should migrate

Bug#1012287: aptly: Please provide a bullseye-backports version

2022-06-02 Thread Sébastien Delafond
On 03/06 03:21, Bastian Germann wrote: > Source: aptly > Version: 1.4.0+ds1-7 > > Now that aptly can publish zstd packages can you please upload the > current version to bullseye-backports? That would be very helpful, > e.g., to mirror Ubuntu jammy. > > I can also upload it myself if you agree.

Bug#1005290: 1005290

2022-02-25 Thread Sébastien Delafond
Hi Enrico, see the comment from upstream here: https://github.com/aptly-dev/aptly/issues/1031#issuecomment-1046299497 I'm tempted to mark this as minor+wontfix, leaving it open to serve as a reference for other users. What do you think? Cheers, -- Seb

Bug#824609: Reproducer for #824609?

2022-01-28 Thread Sébastien Delafond
Hi Sam, upstream apparently cannot reproduce the issue anymore[0]. Do you still this see on your end? Cheers, -- Seb [0] https://github.com/aptly-dev/aptly/issues/403#issuecomment-1024176943

Bug#1003027: roundcube: XSS vulnerability via HTML messages with malicious CSS content

2022-01-06 Thread Sébastien Delafond
On 06/01 06:10, Salvatore Bonaccorso wrote: > CVE-2021-46144 has been assigned for the roundcube issue. Thanks for taking care of this Salvatore. I'll review the debdiffs once Guilhem sends them, and will take care of the DSA afterwards. Cheers, -- Seb

Bug#924139: OVAL generation code migrated to python3

2021-12-05 Thread Sébastien Delafond
As far as OVAL is concerned, all the relevant MRs are merged in, and the OVAL files are now being generated on www-master[0] using python3: [...] /usr/bin/python3 generate.py -q -d .. -j DebianSecTracker.json -r bullseye >oval-definitions-bullseye.xml Cheers, -- Seb [0] https://www-mast

Bug#924139: OVAL python3

2021-11-15 Thread Sébastien Delafond
With https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/737 now merged, python3 support is in https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/740. I'll open an RT ticket to get https://salsa.debian.org/seb/debian.org/-/commit/72fbf295abfd042835ce786344a13bcf8a81148b inc

Bug#998757: salsa MR

2021-11-10 Thread Sébastien Delafond
https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/752

Bug#998757: security.debian.org: OVAL feed issues

2021-11-07 Thread Sébastien Delafond
On 07/11 10:22, Noah Meyerhans wrote: > [...] These two OVAL definitions list essentially identical criteria, > yet their actual status in bullseye is quite different: > > CVE-2020-28200 is still present in bullseye and is a legitimate > finding by any scanner based on these definitions: > https:

Bug#924139: OVAL generation code migrated to python3

2021-10-09 Thread Sébastien Delafond
See https://salsa.debian.org/webmaster-team/webwml/-/merge_requests/737.

Bug#988673: centreon-connectors: diff for NMU version 19.10.0-1.1

2021-09-08 Thread Sébastien Delafond
On 08/09 16:54, Adrian Bunk wrote: > I've prepared an NMU for centreon-connectors (versioned as > 19.10.0-1.1) and uploaded it to DELAYED/14. Please feel free to tell > me if I should cancel it. Hi Adrian, thanks a lot for taking of this, it's really appreciated. Cheers, -- Seb

Bug#987084: unblock: wordpress/5.7.1+dfsg1-1

2021-04-19 Thread Sébastien Delafond
For the Security Team, unblocking 5.7.1 is the preferred option as it will make supporting WP for the entire bullseye lifecycle much easier. If the Release Team thinks it's too late at this point for such an unblock, we'd favor going with 5.6.3 instead. Cheers, -- Seb

Bug#983104: RFS: mupdf/1.14.0+ds1-4+deb10u3 [NMU, CVE-2020-16600] -- lightweight PDF viewer

2021-02-22 Thread Sébastien Delafond
On 19/02 13:53, Bastian Germann wrote: > * Package name: mupdf >Version : 1.14.0+ds1-4+deb10u3 > [...] > * Avoid a use-after-free in fz_drop_band_writer (CVE-2020-16600) Hi Bastian, thanks for your work on this. We think this update should go via stable-proposed-updates: htt

Bug#983090: python-django: CVE-2021-23336

2021-02-22 Thread Sébastien Delafond
On 19/02 09:25, Chris Lamb wrote: > > Django is vulnerable because it embeds parse_qsl: > > > > https://www.djangoproject.com/weblog/2021/feb/19/security-releases/ > > Security team, let me know if you would like an update for stable. Hi Chris, we think this should rather go via s-p-u. Cheer

Bug#982493: openvswitch: CVE-2020-35498

2021-02-15 Thread Sébastien Delafond
On 12/02 16:07, Thomas Goirand wrote: > Please find the attached debdiff for the upload to security-master. Hi Thomas, this looks good, please upload to security-master. Cheers, -- Seb

Bug#980585: ruby-in-parallel: FTBFS: ERROR: Test "ruby2.7" failed: Failure/Error: expect(@result_3).to_not eq(true)

2021-01-20 Thread Sébastien Delafond
On 21/01 12:46, Utkarsh Gupta wrote: > I can create an issue in the original fork. However, just know that > this library is *not* being maintained at all. So there won't be much > help from anywhere. I'm not expecting upstream to fix it either, but it'd feel more comfortable to close this bug on

Bug#980585: ruby-in-parallel: FTBFS: ERROR: Test "ruby2.7" failed: Failure/Error: expect(@result_3).to_not eq(true)

2021-01-20 Thread Sébastien Delafond
On 21/01 12:31, Utkarsh Gupta wrote: > Aah, okay. So I ran sbuild + autopkgtest 10 times, all passed for me. > But when I ran these tests locally with rake, it failed for me exactly > like the report just for the first time. And then passed all 9 times > afterward. I haven't been able to reproduce

Bug#980585: ruby-in-parallel: FTBFS: ERROR: Test "ruby2.7" failed: Failure/Error: expect(@result_3).to_not eq(true)

2021-01-20 Thread Sébastien Delafond
Hi Utkarsh, since you took care of the last upload, do you also plan to fix this FTBFS? If not, please let me know and I'll look into it. Cheers, -- Seb

Bug#977537: odoo: Use JS libraries already packaged in Debian

2021-01-03 Thread Sébastien Delafond
Here's upstream's take on the problematic items in this list: > use libjs-jquery-form The version in Debian is too old right now, and won't work properly. > libjs-underscore The version in Debian is more recent, and needs to be validated. > libjs-cropper Different upstreams: Odoo: 1.5.5 fr

Bug#947431: xerces-c: CVE-2018-1311: use-after-free vulnerability processing external DTD

2020-12-12 Thread Sébastien Delafond
On 11/12 18:59, Sylvain Beucler wrote: > I did more tests during the past few hours (checking that > XERCES_DISABLE_DTD does address the memory leak and using a couple > reverse dependencies) and just uploaded the buster update to security > master. I've just rejected this upload, so you can reuse

Bug#947431: xerces-c: CVE-2018-1311: use-after-free vulnerability processing external DTD

2020-12-10 Thread Sébastien Delafond
On 09/12 17:46, Sylvain Beucler wrote: > Here's a debdiff against buster. > > The testsuite passes, provided we modify MemHandlerTest1 to take the > leak into account. Hi Sylvain, thanks for the debdiff, it looks good and the trade-off makes sense. You can upload to security-master and I'll take

Bug#973562: wordpress: Wordpress 5.5.2 security release

2020-11-02 Thread Sébastien Delafond
On 02/11 08:01, Craig Small wrote: > Wordpress versions less than 5.5.2 have the following security > vulnerabilities: > > CVE-2020-28039: Protected meta that could lead to arbitrary file deletion. > CVE-2020-28035: XML-RPC privilege escalation. > CVE-2020-28036: XML-RPC privilege escalation. > CV

Bug#971591: Please update testinfra to 5.3.0

2020-10-29 Thread Sébastien Delafond
On 27/10 16:20, Baptiste Beauplat wrote: > I've just been given out the access on salsa. Ready to welcome > testinfra :) Done: https://salsa.debian.org/python-team/packages/testinfra Cheers, -- Seb

Bug#971591: Please update testinfra to 5.3.0

2020-10-26 Thread Sébastien Delafond
On 23/10 17:11, Baptiste Beauplat wrote: > Sure. I initially suggested debian because I'm not in the python > team. I guess that will be the opportunity to join in :) All right; can you let me know once you've joined, and then we can see about transferring it there? Cheers, -- Seb

Bug#971591: Please update testinfra to 5.3.0

2020-10-23 Thread Sébastien Delafond
On 15/10 09:30, Baptiste Beauplat wrote: > From what I can see on the package tracker, testinfra hasn't been very > active packaging wise. No source upload have been done and the package > hasn't migrated to testing, since 2019. > > I do believe that having testinfra in a Debian stable release wou

Bug#947187: Unmaintained

2020-10-02 Thread Sébastien Delafond
tag 947187 + wontfix close 947187 thanks This is now unmaintained upstream: Note: As of June 2020 I do not have time to maintain this repository anymore and I've thus made it read-only. FTR, here's where I was with the packaging (the package itself could be built, but dh_test failed): htt

Bug#968497: fixed in astra-toolbox 1.8.3-2

2020-09-02 Thread Sébastien Delafond
On 02/09 09:23, Gianfranco Costamagna wrote: > source only uploads for non-free are a sad story... Ah, forgot about that again. > I'll try to upload the binary shortly! Do you want me to do that today? Cheers, -- Seb

Bug#969371: hdf5plugin

2020-09-01 Thread Sébastien Delafond
Upstream uses hdf5plugin, but it can be patched out in 2 lines once https://salsa.debian.org/alteholz/bitshuffle/-/merge_requests/1 is merged.

Bug#959180: tornado6

2020-06-18 Thread Sébastien Delafond
I plan on testing whether relaxing the constraint plus including 902ef59 is enough to get the current version of mitmproxy running with tornado6. If that doesn't work, I'll look into packaging 5.1.1. Cheers, -- Seb

Bug#962323: python-django: CVE-2020-13254 CVE-2020-13596

2020-06-16 Thread Sébastien Delafond
On 15/06 10:49, Chris Lamb wrote: > > The full debdiffs are attached. Can you especially check the > > versioning scheme and distribution fields for me? I often get this > > wrong and end up confusing myself. Really appreciated. > > They are now attached. They look fine, please upload to security

Bug#962323: python-django: CVE-2020-13254 CVE-2020-13596

2020-06-09 Thread Sébastien Delafond
On 06/06 10:15, Chris Lamb wrote: > > python-django: CVE-2020-13254 CVE-2020-13596 > > Security team, would you like an update for stretch and/or buster to > address these issues? It's fixed in sid, experimental as well as > jessie LTS. Bullseye is just pending migration time AFAICT. Hi Chris, y

Bug#950198: ring

2020-06-04 Thread Sébastien Delafond
Hi Alexandre, I noticed opendht 2.1 is now in sid. Is there anything I can do to help with the next steps, however you see fit? Cheers, -- Seb

Bug#950198: restinio

2020-05-06 Thread Sébastien Delafond
On 04/05 10:31, Sébastien Delafond wrote: > > I add a basic d/salsa-ci.yml, that should tell us what's going on. > > All the unit tests are passing in salsa: > > https://salsa.debian.org/debian/restinio/-/jobs/717236#L1500 Hi Alexandre, in the current state, do yo

Bug#950198: restinio

2020-05-04 Thread Sébastien Delafond
On 04/05 09:18, Sébastien Delafond wrote: > I re-ran the build this morning from the repository you created, and it > passes here in sbuild; TTBOMK it's only binding its test router to > 127.0.0.1, and not trying to reach anything outside, but I may be > missing something. >

Bug#950198: restinio

2020-05-04 Thread Sébastien Delafond
On 03/05 19:40, Alexandre Viau wrote: > Also, I notice that the package's Changelog already has two entries, > but was it even uploaded once? Should it say UNRELEASED instead, until > it is uploaded, or should I understand that it was uploaded? This was my mistake, it should have said UNRELEASED a

Bug#957071: fixed-upstream

2020-04-27 Thread Sébastien Delafond
Control: tag -1 fixed-upstream Fixed by https://github.com/CCExtractor/ccextractor/pull/1226, merged on master. Cheers, -- Seb

Bug#950198: restinio

2020-04-27 Thread Sébastien Delafond
On 27/04 13:13, Felix Salfelder wrote: > I hope it is more clear now, how I prefer to use the small tarball > over running the tests, as a matter of principle It was perfectly clear the first time, and this is where we can agree to disagree. Starting on this project I had a couple of goals, and wh

Bug#950198: restinio

2020-04-27 Thread Sébastien Delafond
On 27/04 11:02, Felix Salfelder wrote: > > - salsa-ci > > > > - open an issue upstream to integrate my two cmake patches for the > > scenario "build a release without shipping binaries, yet > > insist on running the tests during our build" > > I will see what I can do about these. Be

Bug#950198: restinio

2020-04-27 Thread Sébastien Delafond
I've pushed my version of restinio's packaging to https://salsa.debian.org/seb/restinio's master branch. I started from Felix's initial effort, but a lot of things were missing: - d/copyright severely lacking - missing build-deps (most notably on cmake) initially prevented building as-is

Bug#954050: RFS: persist-el/0.4+dfsg-1 [ITP] -- persist variables between Emacs Sessions

2020-04-21 Thread Sébastien Delafond
On 21/04 20:23, Thomas Koch wrote: > I just uploaded persist-el. Thank you and sorry for the delay. As I had announced in my previous email, I already did that; see msg=19 of #954050, and https://ftp-master.debian.org/new/persist-el_0.4+dfsg-1.html. I'll most definitely be out of your way for the

Bug#950198: 950198

2020-04-12 Thread Sébastien Delafond
On 07/04 14:06, Alexandre Viau wrote: > - https://bugs.debian.org/950198 Hi Alexandre, I will look into Felix's packaging of restinio soon. Cheers, -- Seb

Bug#954050: RFS: persist-el/0.4+dfsg-1 [ITP] -- persist variables between Emacs Sessions

2020-04-12 Thread Sébastien Delafond
On 11/04 06:31, Nicholas D Steeves wrote: > #947017 "ITP: org-drill" is blocked by this RFS (#954050) for a > required dependency (persist-el). Please sponsor at your earliest > convenience to we can resume progress on getting org-drill back into > Debian. Hello, I have very little bandwidth the

Bug#954614: 954614

2020-03-30 Thread Sébastien Delafond
block 954614 by 954572 thanks This is due to #954572: since ruby-method-source got bumped to 1.0.0, the requirements for ruby-pry-byebug are not satisfiable anymore. Since puppet-beaker depend on that, it also fails to run its tests. Ultimately the solution is to fix #955340. Cheers, -- Seb

Bug#711554: pyhst2

2020-03-23 Thread Sébastien Delafond
retitle -1 ITP: pyhst2 -- Python High Speed Tomographic reconstruction tag -1 + pending owner -1 s...@debian.org thanks

Bug#723017: xrayutilities: changing from RFP to ITP

2020-03-13 Thread Sébastien Delafond
retitle 723017 ITP: xrayutilities -- Python x-ray data reduction and analysis owner 723017 s...@debian.org tag 723017 + pending thanks

Bug#951458: no-dsa

2020-02-21 Thread Sébastien Delafond
Hi Axel, for the record, the Security Team doesn't think this warrants a DSA. Cheers, -- Seb

Bug#948491: centengine crashes regulary

2020-01-09 Thread Sébastien Delafond
On 09/01 14:24, Pascal Vibet - ADACIS wrote: > I have an seg-fault in centengine process > [...] Hi Pascal, thanks for opening this; could you report it upstream at https://github.com/centreon/centreon-engine/issues/ ? Cheers, -- Seb

Bug#947017: [ATT seb] Re: Bug#947017: RFP: org-drill -- emacs self-learning mode with spaced repetition

2020-01-08 Thread Sébastien Delafond
On 08/01 09:56, tho...@koch.ro wrote: > I intend to start using org-drill again once it is in Debian. > I've never sponsored yet, but I'm a DD now and should learn how to do it. > So I can upload. Perfect: it's a much better solution than me uploading it. Cheers, -- Seb

Bug#947017: [ATT seb] Re: Bug#947017: RFP: org-drill -- emacs self-learning mode with spaced repetition

2020-01-07 Thread Sébastien Delafond
On 07/01 15:07, Nicholas D Steeves wrote: > Since you're the elpa-org-mode maintainer Would you like to package > org-drill, which was broken out into its own project for org-mode 9.3 > (possibly earlier)? > > Failing that, could I add you as an uploader? I'm happy to do the > work to package it,

Bug#947287: python3-certifi: ships useless cacert.pem file

2019-12-23 Thread Sébastien Delafond
On 24/12 00:19, Thorsten Glaser wrote: > While the package is patched to return the system location, > it still ships /usr/lib/python3/dist-packages/certifi/cacert.pem > which causes the .deb to be larger than it must. > > Furthermore it might lead people to believe using that bundle > is acceptab

Bug#944819: docker-based tests

2019-11-24 Thread Sébastien Delafond
Hi Antonio, the solution currently implemented does indeed test the installed package: it will install it using /etc/apt/sources.list.d/autopkgtest.list, and run the entire upstream test suite against that. You are right that all of this happens in a docker container. This is because that all the

Bug#941530: jackson-databind: CVE-2019-16942 CVE-2019-16943

2019-10-03 Thread Sébastien Delafond
On 02/10 09:43, Salvatore Bonaccorso wrote: > Whilst I'm not yet sure if we should really release a futher DSA for > jackson-databind (we will come back to you on that), a possible idea > for bullseye (might be better cloned/filled as new bug, but want to > mention it here already): Let's do a DSA

Bug#933929: python-rtslib-fb < 2.1.69 prevents ceph-iscsi from being uploaded to unstable

2019-09-16 Thread Sébastien Delafond
Hello, just a quick follow-up to let you know that this bug is still preventing ceph-iscsi from being uploaded to sid. As such, I'm again offering my help if you think the version bump itself is OK, but you don't have enough time to take care of it. Cheers, -- Seb

Bug#939626: Upstream

2019-09-11 Thread Sébastien Delafond
Upstream indicates that: We are working actively on that subject. So the next release of centreon-broker won't need qt4 nor qt5. Qt will be completely removed from it. We hope this change to be finish for the next release of Centreon. This is targetted for 19.10, to be released in October

Bug#934356: stretch-pu: package mitmproxy/0.18.2-6

2019-08-28 Thread Sébastien Delafond
I've tried a bunch of things, essentially reusing my older pbuilder-based build setup (as opposed to the newer sbuild-based one), to no avail: I keep getting those extra upper-bound versioned dependencies in the resulting package. At this point I see two options: - build a +deb9u2 that uses deb

Bug#934356: stretch-pu: package mitmproxy/0.18.2-6

2019-08-26 Thread Sébastien Delafond
On 26/08 17:42, Adam D. Barratt wrote: > Our tooling has highlighted a dependency issue. I've not had chance to > check if it already existed in the earlier package, but: > > unsat-dependency: python-cryptography (< 1.6) > > stretch has python-cryptography 1.7.1 This is a regression somewh

Bug#934026: python-django: CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235

2019-08-10 Thread Sébastien Delafond
On 08/08 11:02, Chris Lamb wrote: > +python-django (1:1.10.7-2+deb9u5) stretch-security; urgency=high > [...] > +python-django (1:1.11.23-1~deb10u1) buster-security; urgency=high Thanks, these both look good; please upload to security-master. Cheers, -- Seb

Bug#934026: python-django: CVE-2019-14232 CVE-2019-14233 CVE-2019-14234 CVE-2019-14235

2019-08-07 Thread Sébastien Delafond
On 06/08 10:20, Chris Lamb wrote: > Security team (added to CC), would you be interested in uploads for > buster (currently 1:1.11.22-1~deb10u1) and stretch (currently > 1:1.10.7-2+deb9u5)? Hi Chris, yes, thank you. Can you email us debdiffs ? I'll then take care of the review and DSAs. Cheers,

Bug#931383: Add man page

2019-07-03 Thread Sébastien Delafond
Hello, upstream doesn't ship one, and I unfortunately do not have the time to write it myself. If someone does, and also commits to keeping it synchronized with upstream releases, I'll include it in the package. Cheers, -- Seb

Bug#927164: py3status: missing dependency

2019-04-15 Thread Sébastien Delafond
On 15/04 21:31, Alessandro -oggei- Ogier wrote: > I'd like to point out that package in fact depends on file(1) > and when that package isnt installed py3status fails with an error. > > Since on a freshly installed Debian system file package is not an > essential, this dependency should be exp

Bug#907495: please ship the x11idle binary

2019-03-27 Thread Sébastien Delafond
On 27/03 09:26, Michal Politowski wrote: > Actually I think there is no need to compile x11idle. As the footnote > https://orgmode.org/manual/Resolving-idle-time.html#DOCF82 says, > Debian already provides xprintidle, which seems to work for me. > > Maybe elpa-org could just suggest that package

Bug#921725: libu2f-host: CVE-2018-20340

2019-02-11 Thread Sébastien Delafond
On Feb/09, Nicolas Braud-Santoni wrote: > Ah, I was bitten in the arse by #884428 again. > The upload to security-master should now be fine :) > > Sorry for accidentally duplicating your work, I didn't realise you had > prepared a backported fix for stable before the issue went public :) Thanks

Bug#921725: libu2f-host: CVE-2018-20340

2019-02-09 Thread Sébastien Delafond
On Feb/08, Nicolas Braud-Santoni wrote: > I backported the fix and prepared an upload. > The debdiff is attached, and the commands used to produced it are documented > below. > > May I proceed with an upload to security-master? It looks OK to me, so if it passes testing on your end please upload

Bug#921726: libu2f-host: CVE-2018-20340

2019-02-08 Thread Sébastien Delafond
Package: libu2f-host X-Debbugs-CC: t...@security.debian.org Severity: grave Tags: security Hi, The following vulnerability was published for libu2f-host. CVE-2018-20340[0]: Unchecked buffer in libu2f-host before 1.1.7 ... If you fix the vulnerability please also make sure to include the CVE (Co

Bug#888903: [Pkg-javascript-devel] Bug#888903: 888903

2019-01-31 Thread Sébastien Delafond
On Jan/31, Jonas Smedegaard wrote: > The underlying issue is that the "js" in python-jsbeautifier stands > for JavaScript, and python-jsbeautifier fail to properly expose the > JavaScript part of the project as a shared library! > > The straightforward solution is for python-jsbeautifier to also b

Bug#888903: 888903

2019-01-31 Thread Sébastien Delafond
To me the straightforward solution here is not dpkg-alternative, but what Ivo recommended, since it only involves modifying *one* package. Cheers, -- Seb

Bug#917200: Fixed

2019-01-10 Thread Sébastien Delafond
https://salsa.debian.org/qt-kde-team/qt/pyside2/merge_requests/2

Bug#917001: MR

2019-01-02 Thread Sébastien Delafond
Here is the corresponding MR: https://salsa.debian.org/python-team/modules/python-twilio/merge_requests/1 Cheers, -- Seb

Bug#915765: MR

2019-01-02 Thread Sébastien Delafond
Here is the corresponding MR: https://salsa.debian.org/python-team/modules/pystaticconfiguration/merge_requests/1 Cheers, -- Seb

Bug#915765: FTBFS with pytest 3.10

2018-12-14 Thread Sébastien Delafond
Control: forwarded -1 Control: tag -1 + upstream Let's wait a bit for upstream's take on this issue, that was triggered when pytest 3.10 entered unstable last month. If need be, we could disable TestConfigurationWatcher::* when building the python2 package. Cheers, -- Seb

Bug#893723: 1.9.10 closing 4 bugs

2018-12-12 Thread Sébastien Delafond
Hi fellows, I've got a 1.9.10 nagvis package ready in salsa[0], that fixes four of the currently open bugs including this one. I've also manually included 1:1.7.10+dfsg1-3.2, which wasn't present in the salsa repository. Would you like an actual MR ? I'm also attaching a debdiff of debian/* to th

Bug#893723: 893723

2018-12-11 Thread Sébastien Delafond
Control: tag -1 + upstream Control: forwarded -1 https://github.com/NagVis/nagvis/issues/79 This has apparently been closed in "recent releases", although upstream doesn't mention when that happened exactly. Scouring through git log, it appears to be in this commit: commit da8746985d21b517a66ec

Bug#910228: NMU

2018-12-05 Thread Sébastien Delafond
Hi, I just uploaded ruby-gitlab 4.5.0-2 to DELAYED/10. Don't hesitate to cancel or reschedule it if you need to. Cheers, --Seb

Bug#888011: #888011

2018-12-04 Thread Sébastien Delafond
Python3 package, plus upstream bump to 0.3.7, available at: https://github.com/sdelafond/python-jenkinsapi Would you be willing to share or hand over maintenance of this package, ideally on salsa ? Cheers, -- Seb

Bug#910228: Renaming to /usr/bin/ruby-gitlab

2018-11-27 Thread Sébastien Delafond
https://salsa.debian.org/ruby-team/ruby-gitlab/merge_requests/1

Bug#912106: test_auth_aws_region

2018-11-26 Thread Sébastien Delafond
The test_auth_aws_region test tries to make an actual HTTP request, it should be disabled in debian/rules. Cheers, -- Seb

Bug#910228: /usr/bin/ruby-gitlab

2018-11-26 Thread Sébastien Delafond
I'm OK with ruby-gitlab shipping /usr/bin/ruby-gitlab and /usr/share/man/man1/ruby-gitlab.1.gz, so unless someone disagrees I will do that this week. Cheers, -- Seb

Bug#910088: python-pyperclip: please provide a backport of python-pyperclip

2018-10-02 Thread Sébastien Delafond
On Oct/02, Mattia Rizzolo wrote: > Could you please provide a stretch-backports of python-pyperclip? > > If you wish, I'm happy to build such backport myself. Yes, that will be fine: please do ! Cheers, --Seb

Bug#907495: 907495

2018-09-09 Thread Sébastien Delafond
Sure, shipping this as a separate binary package makes sense. A patch would be most welcome. Cheers, --Seb

Bug#725408: org-mode-doc_9.1.14-1_amd64.changes ACCEPTED into unstable

2018-08-23 Thread Sébastien Delafond
On Aug/23, Nicholas D Steeves wrote: > Is that wrong info page bug still valid? It just occured to me that > it should be possible to add a few lines to the elpa-org-mode that > rebinds infopath to put org-mode-doc ahead of emacs' built-in when > elpa-org-mode is loaded. > > If the non emacs bin/

Bug#906976: mitmproxy: FTBFS in buster/sid

2018-08-22 Thread Sébastien Delafond
Control: retitle -1 FTBFS in buster Control: tags -1 - sid + buster thanks In sid it builds fine during the 1st run, as shown here: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/mitmproxy.html The 2nd reproducible run fails because of the "date in the future" thing: since

Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet

2018-08-21 Thread Sébastien Delafond
On Aug/21, Chris Lamb wrote: > a) You will take the lead on stable/DSA. > b) I'll carry on with LTS, etc. Yes. --Seb

Bug#906236: openssh: CVE-2018-15473: delay bailout for invalid authenticating user until after the packet

2018-08-21 Thread Sébastien Delafond
On Aug/19, Chris Lamb wrote: > Would the security team be interested in one for stretch? If so, I can > return with a proposed debdiff. Sorry, missed your email about this. I'm actually done with the patch on my end. Cheers, --Seb

Bug#865505: php-horde-image 2.3.6-1+deb9u1 (CVE-2017-9773, CVE-2017-9774 & CVE-2017-14650)

2018-08-16 Thread Sébastien Delafond
On Jun/23, Chris Lamb wrote: > I've prepared an upload to fix the following: > > php-horde-image (2.3.6-1+deb9u1) stretch-security; urgency=high > > * CVE-2017-9773: [...] > > * CVE-2017-9774: [...] > > * CVE-2017-14650: [...] > > The full debdiff is attached. Please let me know if

Bug#903325: delayed/10

2018-08-03 Thread Sébastien Delafond
Hi, I have just uploaded blinker 1.4+dfsg1-0.2, fixing this FTBFS, to DELAYED/10. Don't hesitate to cancel or reschedule it if you need to. Cheers, --Seb

  1   2   3   >