Re: system upgrade by systemd

2015-08-26 Thread Michael Meskes
> Jup, sorry, that was a typo. It's called something like "Restart & > Install updates" There definitely was no such button and besides I shut the system down and started it again the next morning. > Strange - then the install-updates mode should not have been entered in > the first place. Let m

Re: system upgrade by systemd

2015-08-26 Thread Michael Meskes
> The GNOME story goes like this: when there are pending updates the > reboot / halt dialog contains a "install pending software updates" > checkbox, unchecked by default (as seen in attached screenshot). So either the update were done despite an unchecked box, or something changed it to be checke

Re: system upgrade by systemd

2015-08-26 Thread Michael Meskes
> Are you sure that you did not shutdown your computer from GNOME and did > not pay attention to the new checkbox allowing it to install upgrades > during shutdown/boot? > > I have seen it once already and I have always unchecked it. I may have missed the checkbox, no doubt about that, but I defi

Re: Security concerns with minified javascript code

2015-08-26 Thread Marco d'Itri
On Aug 26, Russ Allbery wrote: > Maybe there's some pragmatic approach that I haven't thought of yet that > will make this less painful. That's what I'm hoping for. Me too: I really care that Debian will continue to be relevant. -- ciao, Marco pgpMdNWptTf8g.pgp Description: PGP signature

Bug#797021: ITP: midicsv -- translate MIDI file to CSV

2015-08-26 Thread Kamal Mostafa
Package: wnpp Severity: wishlist Owner: Kamal Mostafa * Package name: midicsv Version : 1.1 Upstream Author : John Walker @ http://www.fourmilab.ch/ * URL : http://www.fourmilab.ch/webtools/midicsv/ * License : public-domain Programming Lang: C Description

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Josh Triplett
On Thu, Aug 27, 2015 at 12:30:42AM +0200, Julian Taylor wrote: > On 26.08.2015 21:08, Josh Triplett wrote: > > Andreas Barth wrote: > >> Specific issues: > >> - for i386, there is still sold new hardware with 32bit-only. Are > >> there open issues for i386 (apart from the 32bit-generic ones)? > >

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Julian Taylor
On 26.08.2015 21:08, Josh Triplett wrote: > Andreas Barth wrote: >> Specific issues: >> - for i386, there is still sold new hardware with 32bit-only. Are >> there open issues for i386 (apart from the 32bit-generic ones)? >> Discussion that we need to get rid of it one day should be started. >

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Ben Hutchings
On Wed, 2015-08-26 at 12:08 -0700, Josh Triplett wrote: > Andreas Barth wrote: > > Specific issues: > > - for i386, there is still sold new hardware with 32bit-only. Are > > there open issues for i386 (apart from the 32bit-generic ones)? > > Discussion that we need to get rid of it one day shou

Re: Replacing ldconfig maintscripts with declarative methods

2015-08-26 Thread Niels Thykier
On 2015-08-25 15:12, Ian Jackson wrote: > Niels Thykier writes ("Replacing ldconfig maintscripts with declarative > methods"): >> A possible solution is to replace these scripts with an >> "activate-no-await" trigger (again, no-await to avoid trigger cycles). >> I would need libc-bin to promote it

Re: Security concerns with minified javascript code

2015-08-26 Thread Eugene V. Lyubimkin
Hello list, On 26.08.2015 15:56, Philip Hands wrote: > Vincent Bernat writes: > >> [...] >> 3. ship a pre-compiled/minified version of the library with sources. >> >> I know this sucks, but if I have to pick my poison, I'll pick the last >> one. I have tried the second solution in the past, nob

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Josh Triplett
Andreas Barth wrote: > Specific issues: > - for i386, there is still sold new hardware with 32bit-only. Are > there open issues for i386 (apart from the 32bit-generic ones)? > Discussion that we need to get rid of it one day should be started. Brand-new 32-bit-only x86 hardware is currently be

Bug#797000: ITP: oxidized -- network device configuration backup tool

2015-08-26 Thread Jonas Genannt
Package: wnpp Severity: wishlist Owner: Jonas Genannt -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 * Package name: oxidized Version : 0.7.2 Upstream Author : Saku Ytti * URL : https://github.com/ytti/oxidized * License : Apache-2.0 Programming Lang: Ruby

Re: Bug#796973: ITP: pseudo -- advanced tool for simulating superuser privileges

2015-08-26 Thread Henrique de Moraes Holschuh
On Wed, Aug 26, 2015, at 08:35, Andrew Shadura wrote: > * Package name: pseudo > Version : 1.6.7. > Upstream Author : Yocto Project, Wind River Systems Inc. > * URL : > https://www.yoctoproject.org/tools-resources/projects/pseudo > * License : LGPL-2.1 > Progra

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 09:27 -0700, Russ Allbery  : >>> In the Debian context, the problem is hard. But if you allow network >>> access and execution of arbitrary code recovered from some random >>> registry, rebuilding the minified version from the unminified one is >>> quite trivial. > >>> I know how i

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Florian Weimer
* Andreas Barth: > * Florian Weimer (f...@deneb.enyo.de) [150823 17:02]: >> * Andreas Barth: >> >> > Specific issues: >> > - for i386, there is still sold new hardware with 32bit-only. Are >> > there open issues for i386 (apart from the 32bit-generic ones)? >> >> FWIW, for x32, the security te

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Ben Hutchings
On Wed, 2015-08-26 at 13:51 +0500, Andrey Rahmatullin wrote: > On Wed, Aug 26, 2015 at 09:38:04AM +0200, Andreas Barth wrote: > > > > Specific issues: > > > > - for i386, there is still sold new hardware with 32bit-only. Are > > > > there open issues for i386 (apart from the 32bit-generic ones)?

Re: Security concerns with minified javascript code

2015-08-26 Thread Russ Allbery
Ian Jackson writes: > Vincent Bernat writes ("Re: Security concerns with minified javascript code"): >> In the Debian context, the problem is hard. But if you allow network >> access and execution of arbitrary code recovered from some random >> registry, rebuilding the minified version from the u

Re: Security concerns with minified javascript code

2015-08-26 Thread Ian Jackson
Vincent Bernat writes ("Re: Security concerns with minified javascript code"): > In the Debian context, the problem is hard. But if you allow network > access and execution of arbitrary code recovered from some random > registry, rebuilding the minified version from the unminified one is > quite tr

Re: system upgrade by systemd

2015-08-26 Thread Matthias Klumpp
2015-08-26 15:17 GMT+02:00 Michael Biebl : > Am 26.08.2015 um 14:48 schrieb Matthias Klumpp: > > Actually, this query: > > > http://codesearch.debian.net/perpackage-results/trigger-offline-update%20-package%3Apackagekit%20-package%3Aaptdaemon/2/page_0 > > is more complete, and shows that likely gn

Re: system upgrade by systemd

2015-08-26 Thread Marc Haber
On Wed, 26 Aug 2015 13:26:13 +0200, Matthias Klumpp wrote: >1) This feature is not enabled by default. It only gets triggered if a >frontend tool makes use of it, and will not be activated automatically. So, >you will only see it when you use GNOME with GNOME-Software or any other >tool which trig

Re: system upgrade by systemd

2015-08-26 Thread Frederic Peters
Michael Meskes wrote: > > update, you will have chosen to do that by clicking the "Reboot and > > Restart" button. > > Eh? This neither makes sense nor is it true. A "Reboot and Restart" button > (if such a thing existed, could this be a typo?) would not give you any hint > whatsoever that the re

Re: system upgrade by systemd

2015-08-26 Thread Michael Biebl
Am 26.08.2015 um 14:48 schrieb Matthias Klumpp: > Actually, this query: > http://codesearch.debian.net/perpackage-results/trigger-offline-update%20-package%3Apackagekit%20-package%3Aaptdaemon/2/page_0 > is more complete, and shows that likely gnome-settings-daemon would trigger > this. Are you sur

Re: system upgrade by systemd

2015-08-26 Thread Matthias Klumpp
2015-08-26 14:40 GMT+02:00 Matthias Klumpp : > 2015-08-26 14:27 GMT+02:00 Michael Meskes : > >> On Wed, Aug 26, 2015 at 01:26:13PM +0200, Matthias Klumpp wrote: >> > 1) This feature is not enabled by default. It only gets triggered if a >> > frontend tool makes use of it, and will not be activated

Re: Security concerns with minified javascript code

2015-08-26 Thread Philip Hands
Vincent Bernat writes: > ❦ 26 août 2015 12:09 +0100, Philip Hands  : > >> I note that this page: >> >> https://wiki.debian.org/Javascript/Nodejs/Tasks/grunt >> >> was last touched in March, before the last thread in which you told us >> that packaging grunt is very hard: >> >> https://lists.

Re: system upgrade by systemd

2015-08-26 Thread Raphael Hertzog
On Wed, 26 Aug 2015, Michael Meskes wrote: > On Wed, Aug 26, 2015 at 07:39:38AM +0200, Vincent Bernat wrote: > > There doesn't seem to have a bug report for this. This would be a better > > place to discuss this issue. > > Please tell me which package is the one misbehaving and I gladly report it.

Re: system upgrade by systemd

2015-08-26 Thread Matthias Klumpp
2015-08-26 14:27 GMT+02:00 Michael Meskes : > On Wed, Aug 26, 2015 at 01:26:13PM +0200, Matthias Klumpp wrote: > > 1) This feature is not enabled by default. It only gets triggered if a > > frontend tool makes use of it, and will not be activated automatically. > So, > > you will only see it when

Re: system upgrade by systemd

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 14:17 +0200, Michael Meskes  : >> There doesn't seem to have a bug report for this. This would be a better >> place to discuss this issue. > > Please tell me which package is the one misbehaving and I gladly report it. > But so far I have yet to figure that our. I would have said

Re: system upgrade by systemd

2015-08-26 Thread Michael Meskes
On Wed, Aug 26, 2015 at 01:26:13PM +0200, Matthias Klumpp wrote: > 1) This feature is not enabled by default. It only gets triggered if a > frontend tool makes use of it, and will not be activated automatically. So, > you will only see it when you use GNOME with GNOME-Software or any other > tool w

Re: Security concerns with minified javascript code

2015-08-26 Thread Steve McIntyre
Craig Small wrote: >On Wed, Aug 26, 2015 at 12:28:22AM -0700, Vincent Cheng wrote: >> In that case, perhaps those who are most vocally in favour of >> enforcing build-time javascript minification would care to work on a >> debhelper addon to do so (similar to how dh-autoreconf makes dealing >That t

Re: system upgrade by systemd

2015-08-26 Thread Michael Meskes
On Wed, Aug 26, 2015 at 07:39:38AM +0200, Vincent Bernat wrote: > There doesn't seem to have a bug report for this. This would be a better > place to discuss this issue. Please tell me which package is the one misbehaving and I gladly report it. But so far I have yet to figure that our. Michael

Re: Security concerns with minified javascript code

2015-08-26 Thread Craig Small
On Wed, Aug 26, 2015 at 12:28:22AM -0700, Vincent Cheng wrote: > In that case, perhaps those who are most vocally in favour of > enforcing build-time javascript minification would care to work on a > debhelper addon to do so (similar to how dh-autoreconf makes dealing That to me seems the best way

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 13:01 +0100, Ian Jackson  : >> It's "unfair" to ask packages using JS stuff to be >> "perfect" right now while the difficulties are far greater. > > I'm sorry to say that the very fact that the difficulties are more > severe is an argument /against/ tolerating un-rebuilt minified j

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 12:09 +0100, Philip Hands  : > I note that this page: > > https://wiki.debian.org/Javascript/Nodejs/Tasks/grunt > > was last touched in March, before the last thread in which you told us > that packaging grunt is very hard: > > https://lists.debian.org/debian-devel/2015/04/msg0

Re: Security concerns with minified javascript code

2015-08-26 Thread Ian Jackson
Vincent Bernat writes ("Re: Security concerns with minified javascript code"): > My point is not that's a good idea. My point is that this has been > tolerated for years while there was an easy workaround solution (running > autoreconf). It was only tolerated because problems (that is, packages co

Re: git interface to snapshot.debian.org

2015-08-26 Thread Ian Jackson
Joachim Breitner writes ("Re: git interface to snapshot.debian.org"): > Am Dienstag, den 25.08.2015, 21:47 +0100 schrieb Ian Jackson: > > (Although if a .dsc migrates between suites, the git history > > is updated.) > > I don’t understand that. Is there really git history changed? Or just > branch

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 20:58 +1000, Riley Baird  : >> I would also like to stress that all this stuff is DFSG-compliant. > > Doesn't the DFSG require source code, as well as a free license? Yes and both of them are here. Only the build method is either unavailable, unspecified or needing network connec

Re: system upgrade by systemd

2015-08-26 Thread Matthias Klumpp
Calm down, people... A few more clarifications: 1) This feature is not enabled by default. It only gets triggered if a frontend tool makes use of it, and will not be activated automatically. So, you will only see it when you use GNOME with GNOME-Software or any other tool which triggers the funct

Bug#796973: ITP: pseudo -- advanced tool for simulating superuser privileges

2015-08-26 Thread Andrew Shadura
Package: wnpp Severity: wishlist Owner: Andrew Shadura * Package name: pseudo Version : 1.6.7. Upstream Author : Yocto Project, Wind River Systems Inc. * URL : https://www.yoctoproject.org/tools-resources/projects/pseudo * License : LGPL-2.1 Programming Lang:

Re: Security concerns with minified javascript code

2015-08-26 Thread Philip Hands
Vincent Bernat writes: > ❦ 25 août 2015 22:46 +0100, Steve McIntyre  : > >>>Notably, one of the tool is Grunt and its myriad of plugins. Even if >>>Grunt was in Debian, we would also need Gulp, then Broccoli, because in >>>Javascript, there is always someone thinking that it should be possible >

Bug#796969: ITP: hamradio-maintguide -- Debian Hamradio Maintainers Guide

2015-08-26 Thread Iain R. Learmonth
Package: wnpp Severity: wishlist Owner: "Iain R. Learmonth" * Package name: hamradio-maintguide Version : 0.1 Upstream Author : Iain R. Learmonth * License : BSD-2-clause maybe Programming Lang: Sphinx Description : Debian Hamradio Maintainers Guide The Debian Ha

Re: Security concerns with minified javascript code

2015-08-26 Thread Riley Baird
> Sure, you can proofread a 30k-line configure script without a > problem. So, the condition is now "must be generated from source only if > the generated from is hard-but-not-impossible to read". Several times over the last year I have modified the output form of autoconf directly when doing mino

Re: GoogleCode, gitorious and codehaus.org end of life, expected URL breakage ahead!

2015-08-26 Thread Lars Wirzenius
On Wed, Aug 26, 2015 at 12:10:18PM +0200, Simon Kainz wrote: > [ list of package names removed ] I believe Neil would like you to run the following command: dd-list $(cat codehaus.org.txt) and similarly for any other lists. This results in output listing the maintainers for each package, and

Re: GoogleCode, gitorious and codehaus.org end of life, expected URL breakage ahead!

2015-08-26 Thread Simon Kainz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Sorry, screwed the last file, here is it again, just in case... Simon Am 2015-08-26 um 11:19 schrieb Neil Williams: > On Wed, 26 Aug 2015 10:37:22 +0200 Simon Kainz > wrote: > >> -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 >> >> Hello, >>

Re: GoogleCode, gitorious and codehaus.org end of life, expected URL breakage ahead!

2015-08-26 Thread Simon Kainz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Am 2015-08-26 um 11:19 schrieb Neil Williams: > On Wed, 26 Aug 2015 10:37:22 +0200 Simon Kainz > wrote: > >> -BEGIN PGP SIGNED MESSAGE- Hash: SHA512 >> >> Hello, >> >> as was already announced here [1], and also discussed here [2], >>

Re: Squeeze non-LTS architectures moving to archive.debian.org

2015-08-26 Thread Tapani Palviainen
i want to get off this list! 26.8.2015, 12.40, Joerg Jaspert kirjoitti: Hi, due to serious disk space limitations on mirror hosts, the non-LTS architectures of the Squeeze release will get removed from the mirror network starting today. That is, only Squeeze i386/amd64 continue to be hosted on

Code review request: new sso.debian.org

2015-08-26 Thread Enrico Zini
Hello, we have an initial setup for the new sso.debian.org based on client certificates. Certificate generation is on sso.debian.org and contributors.debian.org and nm.debian.org already accept certificate authentication. I would like to have some code review and QA before announcing it widely.

Bug#796962: ITP: libsdsl -- succinct data structure library

2015-08-26 Thread Tomasz Buchert
Package: wnpp Severity: wishlist Owner: Tomasz Buchert * Package name: libsdsl Version : 2.0.3 Upstream Author : Simon Gog * URL : https://github.com/simongog/sdsl-lite * License : GPL-3+ Programming Lang: C++ Description : succinct data structure libra

Re: GoogleCode, gitorious and codehaus.org end of life, expected URL breakage ahead!

2015-08-26 Thread Neil Williams
On Wed, 26 Aug 2015 10:37:22 +0200 Simon Kainz wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > Hello, > > as was already announced here [1], and also discussed here [2], > > GoogleCode, gitorious.org and codehaus.org are in the process of > shutting down their services, or have

Re: system upgrade by systemd

2015-08-26 Thread Andreas Tscharner
On 26.08.2015 06:05, Russ Allbery wrote: Michael Meskes writes: PackageKit uses the very same resolver as apt itself does... A log file of what actually happened would be very helpful here, to determine the problem causing the package removal. Just try an update on a recently updated (Sund

GoogleCode, gitorious and codehaus.org end of life, expected URL breakage ahead!

2015-08-26 Thread Simon Kainz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Hello, as was already announced here [1], and also discussed here [2], GoogleCode, gitorious.org and codehaus.org are in the process of shutting down their services, or have already. To prevent bitrod/broken links, please take a look at [3], listi

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Andrey Rahmatullin
On Wed, Aug 26, 2015 at 09:38:04AM +0200, Andreas Barth wrote: > > > Specific issues: > > > - for i386, there is still sold new hardware with 32bit-only. Are > > > there open issues for i386 (apart from the 32bit-generic ones)? > > > > FWIW, for x32, the security team would prefer if support in

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Ben Hutchings
On Wed, 2015-08-26 at 09:38 +0200, Andreas Barth wrote: > * Florian Weimer (f...@deneb.enyo.de) [150823 17:02]: > > * Andreas Barth: > > > > > Specific issues: > > > - for i386, there is still sold new hardware with 32bit-only. Are > > > there open issues for i386 (apart from the 32bit-generic o

Re: Automated download/update of data files

2015-08-26 Thread Ole Streicher
Daniele Tricoli writes: > On Tuesday 25 August 2015 13:08:12 Ole Streicher wrote: >> This is probably the way to go. However, the original package does not >> update the data on a regular base. It checks whether the data are >> current when they are accessed and downloads a new version if the loca

Bug#796955: ITP: python-qwt -- Pure Python implementation of Qwt

2015-08-26 Thread Picca Frédéric-Emmanuel
Package: wnpp Severity: wishlist Owner: "Picca Frédéric-Emmanuel" * Package name: python-qwt Version : 6.1.2a3 Upstream Author : Pierre Raybaut * URL : https://github.com/PierreRaybaut/qwt * License : Expat Programming Lang: Python Description : Pure P

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Andreas Barth
* Russ Allbery (r...@debian.org) [150825 03:09]: > Andreas Barth writes: > > > - for i386, there is still sold new hardware with 32bit-only. Are > > there open issues for i386 (apart from the 32bit-generic ones)? > > Discussion that we need to get rid of it one day should be started. > > Can

Re: Minutes from the "32bit architectures in Debian"-bof

2015-08-26 Thread Andreas Barth
* Florian Weimer (f...@deneb.enyo.de) [150823 17:02]: > * Andreas Barth: > > > Specific issues: > > - for i386, there is still sold new hardware with 32bit-only. Are > > there open issues for i386 (apart from the 32bit-generic ones)? > > FWIW, for x32, the security team would prefer if support

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Cheng
On Wed, Aug 26, 2015 at 12:04 AM, Simon Josefsson wrote: > Vincent Bernat writes: > >> ❦ 25 août 2015 22:46 +0100, Steve McIntyre : >> Notably, one of the tool is Grunt and its myriad of plugins. Even if Grunt was in Debian, we would also need Gulp, then Broccoli, because in Javascr

Re: Security concerns with minified javascript code

2015-08-26 Thread Vincent Bernat
❦ 26 août 2015 09:04 +0200, Simon Josefsson  : Notably, one of the tool is Grunt and its myriad of plugins. Even if Grunt was in Debian, we would also need Gulp, then Broccoli, because in Javascript, there is always someone thinking that it should be possible to do better. We need

Re: Security concerns with minified javascript code

2015-08-26 Thread Simon Josefsson
Vincent Bernat writes: > ❦ 25 août 2015 22:46 +0100, Steve McIntyre  : > >>>Notably, one of the tool is Grunt and its myriad of plugins. Even if >>>Grunt was in Debian, we would also need Gulp, then Broccoli, because in >>>Javascript, there is always someone thinking that it should be possible >