I have been asked how Ubuntu relates to Debian, and how packages flow from one to the other. So here s my attempt at clarifying the whole picture.

Where do the packages come from? Most packages are created by Debian contributors and they are uploaded in Debian unstable (or Debian experimental). New packages are reviewed by the Debian ftpmasters before being accepted in the official archive. The packages are held in the NEW queue until the review is over, and the time spent there varies between a few hours and a few months (usually they are processed within one week or two). Ubuntu imports all the official Debian packages, but they also add some packages of their own. About 7% of the Ubuntu packages are third-party software that have been packaged for Ubuntu but not for Debian. What are the changes made by Ubuntu? From all the source packages coming from Debian, 17% have additional changes made by Ubuntu. Many of them are part of the main repository, which is actively maintained by Canonical and Ubuntu core developers. The universe repository is usually closer to the official Debian packages. Many of the changes made by Ubuntu are the results of the decisions taken during the Ubuntu Developer Summit in order to reach specific goals: provide a better user interface, offer faster boot times, become a better platform for third-party software developers, offer a good integration with their online services (Launchpad, Ubuntu One), etc. Other changes are simply the result of fixing bugs reported by Ubuntu users. Note that even non-modified source packages will result in different binary packages for Ubuntu. That s because Ubuntu has made changes to the build environment. They only support Intel-based computers with a 686-class (or newer) CPU, they enable some compiler options that Debian doesn t, etc. And all binary packages are modified by a program called pkgbinarymangler. Ubuntu s release cycle and the relation with Debian Ubuntu releases every 6 months (that s what time based releases is about). Debian has a very different schedule. How does Ubuntu manage to reuse Debian s work? Ubuntu imports packages from Debian unstable (even experimental sometimes) to get the newest packages. If the Ubuntu package already has Ubuntu-specific changes, they merge their changes in the updated Debian package. Otherwise the Debian package is simply grabbed and rebuilt in Ubuntu. This works well because Debian unstable is much more usable than the name suggests. And this process only goes on during the first 2 months of the cycle (until the Debian Import Freeze), so there s plenty of time afterward to fix the biggest problems. In the third and fourth month, it s still possible to pick updated packages from Debian but it must be requested by a developer, it won t be done automatically. At the end of the fourth month, the feature freeze is put in place. The 2 months left are dedicated to bug fixing and polishing the distribution. There are various sub-freezes that happen in this period, you can check the Natty release schedule as an example. Picking updated packages from Debian is now the exception, it will only be allowed if the update on the Debian side is a bug-fix only release. Credits: some figures taken from a talk of Lucas Nussbaum, they were collected based on the packages available in the Lucid Lynx release of Ubuntu. Click here to subscribe to my newsletter and get my monthly update on what s going on in Debian and Ubuntu.

15 comments Liked this article? Click here. My blog is Flattr-enabled.

Yesterday and today I attended Ruxcon the leading technical security conference in Australia [1]. The first lecture I attended was Breaking Linux Security Protections by Andrew Griffiths. This included a good overview of many current issues with Linux security. One thing that was particularly noteworthy was his mention of SE Linux policy, he cited the policy for the FTP server as an example of policy that can be regarded as too lax but also noted the fact that to get SE Linux used the policies had to be more liberal than we might desire. There is probably scope for someone to give a good lecture about how we are forced to make uncomfortable choices between making security features stronger and making them more usable.The next lecture I attended was Breaking Virtualisation by Endrazine. It makes me wonder how long it will be before someone cracks one of the major cloud hosting services such as EC2 it s not an appealing thought.Billy Rios gave a really interesting lecture titled Will it Blend? about blended exploits. The idea is to try and find a few programs which do things that are slightly undesired (arguably not even bugs) but which when combined can result in totally cracking a system. One example was a way of tricking IE into loading a DLL from the desktop and a way of tricking Safari into saving arbitrary files to the desktop, combine them and you can push a DLL to a victim and make them load it. Learning about these things can really change the way you think about misbehaving programs!Ben Nagy gave an interesting lecture about Prospecting for Rootite . His systematic way of finding test cases that cover a large portion of the code of a large application such as MS-Word seems quite effective. Once you have test cases that cover a lot of code then you can use fuzzing to find flaws.Edward Farrell gave an informative lecture about RFID Security , I didn t really learn that much though, he confirmed my suspicions that RFID implementations generally suck.Mark Goudie gave a very informative lecture titled We ve been Hacked! What Went Wrong and Why . Mark works for Verizon and often with the US Secret Service in investigating security breaches. He presented a lot of information that I have not seen before and made some good arguments in support of companies being more proactive in protecting their systems from attack.Stephen Glass and Mark Robert gave a lecture titled Security in Public Safety Radio Systems which mainly focussed on digital radios used by the Australian police. It would be good if the police got people like them to test out new kit before ordering it in bulk, it seems that they will be using defective radios for a long time (it s not easy or cheap to replace them once they are deployed).Edward Farrell gave an interesting lecture titled Hooray for Reading: The Kindle & You about hacking the Kindle. Unfortunately they haven t worked out how to get GUI code going on a hacked Kindle yet so there are some limitations as to what can be done.I think that the most interesting lecture of the conference was This Job Makes you Paranoid by Alex Tilley of the Australian Federal Police. He gave some interesting anecdotes about real cases to illustrate his points and he advocated the police position really well. I ve attended several lectures by employees of law enforcement agencies, but none of them demonstrated anywhere near the understanding of their audience that Alex did.The last lecture I attended was Virtualisation Security State of the Union by David Jorn of Red Hat. He gave an interesting summary of some of the issues including mentioning how SE Linux is being used for confining KVM virtual machines.Ruxcon was a great conference and I definitely recommend attending it. I have to note that even though there are police attending and lecturing it s not entirely a white-hat affair. One thing that I hope they do next year is to get a bigger venue. The foyer was rather crowded and because it had a hard floor was really noisy between lectures. Space and carpet are two really important things when you have lots of people in one room!

• [1] http://www.ruxcon.org.au/

I'm still running upgrade testing of the Lenny Gnome and KDE Desktop, but have not had time to spend on reporting the status. Here is a short update based on a test I ran 20101118. I still do not know what a correct migration should look like, so I report any differences between apt and aptitude and hope someone else can see if anything should be changed. This is for Gnome: Installed using apt-get, missing with aptitude

apache2.2-bin aptdaemon at-spi baobab binfmt-support browser-plugin-gnash cheese-common cli-common cpp-4.3 cups-pk-helper dmz-cursor-theme empathy empathy-common finger freedesktop-sound-theme freeglut3 gconf-defaults-service gdm-themes gedit-plugins geoclue geoclue-hostip geoclue-localnet geoclue-manual geoclue-yahoo gnash gnash-common gnome gnome-backgrounds gnome-cards-data gnome-codec-install gnome-core gnome-desktop-environment gnome-disk-utility gnome-screenshot gnome-search-tool gnome-session-canberra gnome-spell gnome-system-log gnome-themes-extras gnome-themes-more gnome-user-share gs-common gstreamer0.10-fluendo-mp3 gstreamer0.10-tools gtk2-engines gtk2-engines-pixbuf gtk2-engines-smooth hal-info hamster-applet libapache2-mod-dnssd libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libart2.0-cil libatspi1.0-0 libboost-date-time1.42.0 libboost-python1.42.0 libboost-thread1.42.0 libchamplain-0.4-0 libchamplain-gtk-0.4-0 libcheese-gtk18 libclutter-gtk-0.10-0 libcryptui0 libcupsys2 libdiscid0 libeel2-data libelf1 libepc-1.0-2 libepc-common libepc-ui-1.0-2 libfreerdp-plugins-standard libfreerdp0 libgail-common libgconf2.0-cil libgdata-common libgdata7 libgdl-1-common libgdu-gtk0 libgee2 libgeoclue0 libgexiv2-0 libgif4 libglade2.0-cil libglib2.0-cil libgmime2.4-cil libgnome-vfs2.0-cil libgnome2.24-cil libgnomepanel2.24-cil libgnomeprint2.2-data libgnomeprintui2.2-common libgnomevfs2-bin libgpod-common libgpod4 libgtk2.0-cil libgtkglext1 libgtksourceview-common libgtksourceview2.0-common libmono-addins-gui0.2-cil libmono-addins0.2-cil libmono-cairo2.0-cil libmono-corlib2.0-cil libmono-i18n-west2.0-cil libmono-posix2.0-cil libmono-security2.0-cil libmono-sharpzip2.84-cil libmono-system2.0-cil libmtp8 libmusicbrainz3-6 libndesk-dbus-glib1.0-cil libndesk-dbus1.0-cil libopal3.6.8 libpolkit-gtk-1-0 libpt-1.10.10-plugins-alsa libpt-1.10.10-plugins-v4l libpt2.6.7 libpython2.6 librpm1 librpmio1 libsdl1.2debian libservlet2.4-java libsrtp0 libssh-4 libtelepathy-farsight0 libtelepathy-glib0 libtidy-0.99-0 libxalan2-java libxerces2-java media-player-info mesa-utils mono-2.0-gac mono-gac mono-runtime nautilus-sendto nautilus-sendto-empathy openoffice.org-writer2latex openssl-blacklist p7zip p7zip-full pkg-config python-4suite-xml python-aptdaemon python-aptdaemon-gtk python-axiom python-beautifulsoup python-bugbuddy python-clientform python-coherence python-configobj python-crypto python-cupshelpers python-cupsutils python-eggtrayicon python-elementtree python-epsilon python-evolution python-feedparser python-gdata python-gdbm python-gst0.10 python-gtkglext1 python-gtkmozembed python-gtksourceview2 python-httplib2 python-louie python-mako python-markupsafe python-mechanize python-nevow python-notify python-opengl python-openssl python-pam python-pkg-resources python-pyasn1 python-pysqlite2 python-rdflib python-serial python-tagpy python-twisted-bin python-twisted-conch python-twisted-core python-twisted-web python-utidylib python-webkit python-xdg python-zope.interface remmina remmina-plugin-data remmina-plugin-rdp remmina-plugin-vnc rhythmbox-plugin-cdrecorder rhythmbox-plugins rpm-common rpm2cpio seahorse-plugins shotwell software-center svgalibg1 system-config-printer-udev telepathy-gabble telepathy-mission-control-5 telepathy-salut tomboy totem totem-coherence totem-mozilla totem-plugins transmission-common xdg-user-dirs xdg-user-dirs-gtk xserver-xephyr zip

Installed using apt-get, removed with aptitude

arj bluez-utils cheese dhcdbd djvulibre-desktop ekiga eog epiphany-extensions epiphany-gecko evolution-exchange fast-user-switch-applet file-roller gcalctool gconf-editor gdm gedit gedit-common gnome-app-install gnome-games gnome-games-data gnome-nettool gnome-system-tools gnome-themes gnome-utils gnome-vfs-obexftp gnome-volume-manager gnuchess gucharmap guile-1.8-libs hal libavahi-compat-libdnssd1 libavahi-core5 libavahi-ui0 libbind9-50 libbluetooth2 libcamel1.2-11 libcdio7 libcucul0 libcurl3 libdirectfb-1.0-0 libdmx1 libdvdread3 libedata-cal1.2-6 libedataserver1.2-9 libeel2-2.20 libepc-1.0-1 libepc-ui-1.0-1 libexchange-storage1.2-3 libfaad0 libgadu3 libgalago3 libgd2-noxpm libgda3-3 libgda3-common libggz2 libggzcore9 libggzmod4 libgksu1.2-0 libgksuui1.0-1 libgmyth0 libgnome-desktop-2 libgnome-pilot2 libgnomecups1.0-1 libgnomeprint2.2-0 libgnomeprintui2.2-0 libgpod3 libgraphviz4 libgtk-vnc-1.0-0 libgtkhtml2-0 libgtksourceview1.0-0 libgtksourceview2.0-0 libgucharmap6 libhesiod0 libicu38 libisccc50 libisccfg50 libiw29 libjaxp1.3-java-gcj libkpathsea4 liblircclient0 libltdl3 liblwres50 libmagick++10 libmagick10 libmalaga7 libmozjs1d libmpfr1ldbl libmtp7 libmysqlclient15off libnautilus-burn4 libneon27 libnm-glib0 libnm-util0 libopal-2.2 libosp5 libparted1.8-10 libpisock9 libpisync1 libpoppler-glib3 libpoppler3 libpt-1.10.10 libraw1394-8 libsdl1.2debian-alsa libsensors3 libsexy2 libsmbios2 libsoup2.2-8 libspeexdsp1 libssh2-1 libsuitesparse-3.1.0 libsvga1 libswfdec-0.6-90 libtalloc1 libtotem-plparser10 libtrackerclient0 libvoikko1 libxalan2-java-gcj libxerces2-java-gcj libxklavier12 libxtrap6 libxxf86misc1 libzephyr3 mysql-common rhythmbox seahorse sound-juicer swfdec-gnome system-config-printer totem-common totem-gstreamer transmission-gtk vinagre vino w3c-dtd-xhtml wodim

Installed using aptitude, missing with apt-get

gstreamer0.10-gnomevfs

Installed using aptitude, removed with apt-get

[nothing]

This is for KDE: Installed using apt-get, missing with aptitude

autopoint bomber bovo cantor cantor-backend-kalgebra cpp-4.3 dcoprss edict espeak espeak-data eyesapplet fifteenapplet finger gettext ghostscript-x git gnome-audio gnugo granatier gs-common gstreamer0.10-pulseaudio indi kaddressbook-plugins kalgebra kalzium-data kanjidic kapman kate-plugins kblocks kbreakout kbstate kde-icons-mono kdeaccessibility kdeaddons-kfile-plugins kdeadmin-kfile-plugins kdeartwork-misc kdeartwork-theme-window kdeedu kdeedu-data kdeedu-kvtml-data kdegames kdegames-card-data kdegames-mahjongg-data kdegraphics-kfile-plugins kdelirc kdemultimedia-kfile-plugins kdenetwork-kfile-plugins kdepim-kfile-plugins kdepim-kio-plugins kdessh kdetoys kdewebdev kdiamond kdnssd kfilereplace kfourinline kgeography-data kigo killbots kiriki klettres-data kmoon kmrml knewsticker-scripts kollision kpf krosspython ksirk ksmserver ksquares kstars-data ksudoku kubrick kweather libasound2-plugins libboost-python1.42.0 libcfitsio3 libconvert-binhex-perl libcrypt-ssleay-perl libdb4.6++ libdjvulibre-text libdotconf1.0 liberror-perl libespeak1 libfinance-quote-perl libgail-common libgsl0ldbl libhtml-parser-perl libhtml-tableextract-perl libhtml-tagset-perl libhtml-tree-perl libio-stringy-perl libkdeedu4 libkdegames5 libkiten4 libkpathsea5 libkrossui4 libmailtools-perl libmime-tools-perl libnews-nntpclient-perl libopenbabel3 libportaudio2 libpulse-browse0 libservlet2.4-java libspeechd2 libtiff-tools libtimedate-perl libunistring0 liburi-perl libwww-perl libxalan2-java libxerces2-java lirc luatex marble networkstatus noatun-plugins openoffice.org-writer2latex palapeli palapeli-data parley parley-data poster psutils pulseaudio pulseaudio-esound-compat pulseaudio-module-x11 pulseaudio-utils quanta-data rocs rsync speech-dispatcher step svgalibg1 texlive-binaries texlive-luatex ttf-sazanami-gothic

Installed using apt-get, removed with aptitude

amor artsbuilder atlantik atlantikdesigner blinken bluez-utils cvs dhcdbd djvulibre-desktop imlib-base imlib11 kalzium kanagram kandy kasteroids katomic kbackgammon kbattleship kblackbox kbounce kbruch kcron kdat kdemultimedia-kappfinder-data kdeprint kdict kdvi kedit keduca kenolaba kfax kfaxview kfouleggs kgeography kghostview kgoldrunner khangman khexedit kiconedit kig kimagemapeditor kitchensync kiten kjumpingcube klatin klettres klickety klines klinkstatus kmag kmahjongg kmailcvt kmenuedit kmid kmilo kmines kmousetool kmouth kmplot knetwalk kodo kolf kommander konquest kooka kpager kpat kpdf kpercentage kpilot kpoker kpovmodeler krec kregexpeditor kreversi ksame ksayit kshisen ksig ksim ksirc ksirtet ksmiletris ksnake ksokoban kspaceduel kstars ksvg ksysv kteatime ktip ktnef ktouch ktron kttsd ktuberling kturtle ktux kuickshow kverbos kview kviewshell kvoctrain kwifimanager kwin kwin4 kwordquiz kworldclock kxsldbg libakode2 libarts1-akode libarts1-audiofile libarts1-mpeglib libarts1-xine libavahi-compat-libdnssd1 libavahi-core5 libavc1394-0 libbind9-50 libbluetooth2 libboost-python1.34.1 libcucul0 libcurl3 libcvsservice0 libdirectfb-1.0-0 libdjvulibre21 libdvdread3 libfaad0 libfreebob0 libgd2-noxpm libgraphviz4 libgsmme1c2a libgtkhtml2-0 libicu38 libiec61883-0 libindex0 libisccc50 libisccfg50 libiw29 libjaxp1.3-java-gcj libk3b3 libkcal2b libkcddb1 libkdeedu3 libkdegames1 libkdepim1a libkgantt0 libkleopatra1 libkmime2 libkpathsea4 libkpimexchange1 libkpimidentities1 libkscan1 libksieve0 libktnef1 liblockdev1 libltdl3 liblwres50 libmagick10 libmimelib1c2a libmodplug0c2 libmozjs1d libmpcdec3 libmpfr1ldbl libneon27 libnm-util0 libopensync0 libpisock9 libpoppler-glib3 libpoppler-qt2 libpoppler3 libraw1394-8 librss1 libsensors3 libsmbios2 libssh2-1 libsuitesparse-3.1.0 libswfdec-0.6-90 libtalloc1 libxalan2-java-gcj libxerces2-java-gcj libxtrap6 lskat mpeglib network-manager-kde noatun pmount tex-common texlive-base texlive-common texlive-doc-base texlive-fonts-recommended tidy ttf-dustin ttf-kochi-gothic ttf-sjfonts

Installed using aptitude, missing with apt-get

dolphin kde-core kde-plasma-desktop kde-standard kde-window-manager kdeartwork kdebase kdebase-apps kdebase-workspace kdebase-workspace-bin kdebase-workspace-data kdeutils kscreensaver kscreensaver-xsavers libgle3 libkonq5 libkonq5-templates libnetpbm10 netpbm plasma-widget-folderview plasma-widget-networkmanagement xscreensaver-data-extra xscreensaver-gl xscreensaver-gl-extra xscreensaver-screensaver-bsod

Installed using aptitude, removed with apt-get

kdebase-bin konq-plugins konqueror

About six years ago, I spent a chunk of my very first salary on a portable music player, the iRiver H140, a relatively bulky and large hard-disk based player, with a capacity of 40G. Uniquely for music players before or since, the iRiver features both digital and analogue line ins and outs. It also has (more common) recording facilities and an FM tuner, the latter of which I used a great deal (and rules out just about all the iPods). This remarkable player has lasted nearly six years of moderate daily use. For the majority of that time, I've ran the rockbox open source firmware on the player, which has provided me with really wide codec support and excellent recording facilities. In the last month I finally had to replace the iRiver. I bought a Sansa Fuze player, featuring 8G of flash storage and a microsd expansion slot. The Fuze is also capable of running rockbox. This year, 32G microsd cards have arrived. Adding one of those brings the capacity of the new player right back up to 40G. For those who are curious: yes, a Sandisk 32G microsd does work in the Fuze, at least with rockbox, for playback. At the moment, rockbox cannot write to storage on the Fuze, so you need to either use the original firmware or an external reader/writer to manipulate the contents of the microsd. However, I am not sure how well the original firmware can handle the 32G. Whenever I boot it, I see a "refreshing your media" message which lasts longer than my patience. I will write an update once I've established further the degree of support. I kept a canonical copy of my music library on a desktop computer and used rsync to keep the iRiver up-to-date. I can use almost exactly the same procedure for the new player (with some small changes to cope with the split-storage) I now have a 40G player running rockbox exactly as I had before, albeit at a fraction of the size and weight (and cost: approximately half as expensive), and with a nicer display including colours, album art, etc. They both can even play doom (although the controls are even more awkward than iPhone Doom).

I'm planning on transcoding some of the Debconf 10 event videos in order to watch them on my phone (and other devices). Most likely to an MPEG container, H264 codec or similar. Subject to a license check, I could stick the results up somewhere for others if there is any interest. Let me know via comment or email.

Next article highlighting some new features which will come in phpMyAdmin 3.4 is about relations export. This feature is not much known anyway, so if you have not seen it in phpMyAdmin, just try it out on our demo server or configure phpMyAdmin configuration storage in your copy. In previous versions, it was possible to export database relational schema into PDF format. The 3.4 release comes with modular system for exporting schema adding SVG, Dia, EPS or Microsoft Visio. Especially SVG and EPS are useful for embedding schema into other documents. This feature was implemented by Muhammad Adnan during Google Summer of Code 2010.

Filed under: Phpmyadmin 0 comments Flattr this!

The bug webinterface of the Universal Debian Database currently knows about the following release critical bugs:

In Total:	707
Affecting Squeeze:	271
Squeeze only:	71
Remaining to be fixed in Squeeze:	200

Of these 200 bugs, the following tags are set:

Pending in Squeeze:	12
Patched in Squeeze:	36
Duplicates in Squeeze:	22
Can be fixed in a security Update:	17
Contrib or non-free in Squeeze:	5
Otherwise fixed in Squeeze:	27

Ignoring all the above (multiple tags possible), 123 bugs need to be fixed by Debian Contributors to get Debian 6.0 Squeeze released. However, with the view of the Release Managers, 157 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers.

About this time last year, I spent a while talking about how Barnes and Noble were failing in their GPL obligations. It took them about two months to release some source code that didn't actually correspond to the hardware - they finally provided it in March, more than three months after shipping the device.

The Nook Color is now shipping. Guess what Barnes and Noble aren't providing yet?

The flood of generic Chinese Android devices with no source code makes it very easy to think that GPL adherence is something that's only problematic with devices sourced from countries with poor records in IP enforcement. In reality, it's a problem everywhere. Barnes and Noble are a US company and the contractors for the Nook were based in Canada. They're aware enough to include the GPL notice in their documentation, but not concerned enough to make sure that they actually posses the source code that they're legally obliged to provide.

I'm glad to see that the Linux Foundation are providing resources to ensure compliance, but it's likely that this is going to continue being a problem until we start engaging in more visible efforts to educate companies about their legal obligations. The idea that a company like Barnes and Noble would ship copies of Windows without paying the appropriate license fees is pretty implausible, but they seem perfectly happy to engage in for-profit copyright violation if nobody's going to chase them down. It'll be interesting to see if this trend continues, or if we start making a sincere effort to remind vendors of their obligations.

In other GPL violation news - Fusion Garage have promised me that they'll provide the source code to their GPLed components on Monday. Given that the device has been end of lifed this is obviously pretty inept. Investors should realise that they're putting money into a company that has knowingly been engaging in criminal behaviour for over 6 months. We'll see how they manage compliance for their Android devices.

I got a fair bit of feedback from my latest post about the Boxee Box, none of it particularly favourable about the GMA500/Poulsbo chipset, so regretfully, I won't be buying a Boxee Box. Too bad, it looked cute, and was cheap. A David H rdeman dropped me an email, and brought to my attention the ASRock Core 100HT-BD I was nearly going to buy the wrong thing off Amazon (there's also an NVIDIA ION-based variant), but I found a non-BluRay variant on NewEgg for about $100 less than the BluRay version. It's certainly more expensive than something like a Boxee Box, but hey, if it's going to work... I think if I had the choice, I'd get an SSD for it, but I can see how this goes with a rotating disk. The current MythTV box has a rotating disk in it (just not for storage of recorded content) and it seems sufficiently quiet. The other nice thing about this box is it has VGA and HDMI, so I can totally try this thing out on the current TV before replacing it. Now the question is, do I place an order today...?

Most Debian packages are managed with a version control system (VCS) like git, subversion, bazaar or mercurial. The particularities of the 3.0 (quilt) source format are not without consequences in terms of integration with the VCS. I ll give you some tips to have a smoother experience. All the samples given in the article assume that you use git as version control system. 1. Add .pc to the VCS ignore list .pc is the directory used by quilt to store its internal data (list of applied patches, backup of modified files). It s also created by dpkg-source so that quilt knows that the patches are in debian/patches (and not in patches which is the default directory used by quilt). For that reason, the directory is kept even if you unapply all the patches. However you don t want to store this directory in your repository, so it s best to put it in the VCS ignore list. With git you simply do:

$ echo ".pc" >>.gitignore
$ git add .gitignore
$ git commit -m "Ignore quilt dir"

The .gitignore file is ignored by dpkg-source, so you re not adding any noise to the generated source package. 2. Unapply patches after the build If you store upstream sources with non-applied patches (most people do), and if you don t build packages in a temporary build directory, then you probably want to unapply the patches after the build so that your repository is again in a clean status. You can do this by adding unapply-patches to debian/source/local-options:

$ echo "unapply-patches" >>debian/source/local-options
$ git add debian/source/local-options
$ git commit -m "Unapply patches after build"

svn-buildpackage always builds in a temporary directory so the repository is left exactly like it was before the build, this option is thus useless. git-buildpackage can also be told to build in a temporary directory with --git-export-dir=../build-area/ (the directory ../build-area/ is the one used by svn-buildpackage, so this option makes git-buildpackage behave like svn-buildpackage in that respect). 3. Manage your quilt patches as a git branch Instead of using quilt to manage the Debian-specific patches, it s possible to use git itself. git-buildpackage comes with gbp-pq ( Git-BuildPackage Patch Queue ): it can export the quilt serie in a git branch that you can manipulate like you want. Each commit represents a patch, so you want to rebase that branch to edit intermediary commits. Check out the upstream documentation of this tool to learn how to work with it. There s an alternative tool as well: git-dpm. Its website explains the principle very well. It s a more complicated than gbp-pq but it has the advantage of keeping the history of all branches used to generate the quilt series of all Debian releases. You might want to read a review made by Sam Hartman, it explains the limits of this tool. 4. Document how to review the changes One of the main benefit of this new source format is that it s easy to review changes because upstream changes are kept as separate patches properly documented (ideally using the DEP-3 format). With the tools above, the commit message becomes the patch header. Thus it s important to write meaningful commit messages. This works well as long as your workflow considers the Debian patches as a branch that you rebase on top of the upstream sources at each release. Some maintainers don t like this workflow and prefer to have the Debian changes applied directly in the packaging branch. They switch to a new upstream version by merging it in their packaging branch. In that case, it s difficult to generate a quilt serie out of the VCS. Instead, you should instruct dpkg-source to store all the changes in a single patch (which is then similar to the good old .diff.gz) and document in the header of that patch how the changes can be better reviewed, for example in the VCS web interface. You do the former with the --single-debian-patch option and the latter by writing the header in debian/source/patch-header:

$ echo "single-debian-patch" >> debian/source/local-options
$ cat >debian/source/patch-header <<END
This patch contains all the Debian-specific
changes mixed together. To review them
separately, please inspect the VCS history
at http://git.debian.org/?=collab-maint/foo.git
<put details="details" here="here" more="more">
END

Subscribe to this blog by RSS, by email or on Facebook.

11 comments Liked this article? Click here. My blog is Flattr-enabled.

The Debian Release Team has made a status update on Debian 6.0, Squeeze . They are proud to report that Debian is moving towards the release like a glacier: inevitably and unstoppingly .

Squeeze is almost in its final state: testing of the installer and upgrades are welcome. Once the latest version of the Debian Installer is added, a deep freeze will begin, with minimal changes allowed while the remaining bugs are fixed. Your help is welcome in:

• processing installation/upgrade reports,
• translating of the debian-installer, (read latest translation status update)
• and fixing release-critical bugs.

There are two upcoming bug squashing parties you can join: Bern, Switzerland, November 27-28; and Boulogne-Billancourt, France,December 4-5.

I received a few emails from my blog post about my MythTV dilemma. Suggestions ranged from using VGA to DVI to HDMI adapters, to getting different TVs that still have VGA connectors, to getting an older NVIDIA card off eBay that has lower power requirements. Firstly, VGA is dead. It's time to make the move. I don't think VGA for a TV the size I'm looking at is ideal for HD anyway. I'm pretty much fixated on the Sony TV as well, because I want to get Google TV. So I need HDMI. Similarly, I suspect that the picture quality of something run through a VGA to HDMI conversion will be similarly shite, so I'm not too keen on that option, although it would tide me over initially, so I'll look into that further. Another suggestion was the fit-PC2, which was something I was already aware of, but I'd heard terrible things about the general Linux support for the graphics adapter. I did some more research into the Boxee Box, (it really is new, it's only been out for 6 days) and it appears to have the same video chipset as the fit-PC2, which seems rather unfortunate. But then, if the Boxee Box is running Linux, then they've obviously got a driver, so the question is how easy is it to transplant this driver from the Boxee distro to, say, Debian? I'm curious enough to place an order soon. Anyone got any interesting Poulsbo-on-Linux war stories they want to share? I know it makes Matthew Garrett sad.

I have finished the SCRAM implementation in GNU SASL. The remaining feature to be added were support for the enhanced SCRAM-SHA-1-PLUS variant instead of just the normal SCRAM-SHA-1 mechanism. The difference is that the latter supports channel bindings to TLS, which makes it possible to detect man-in-the-middle attacks even if TLS is not used with server authentication. In GnuTLS we recently added an API for applications to extract channel bindings, which you will need to use in order to use SCRAM-SHA-1-PLUS. I announced the experimental version 1.5.4 release together with a writeup on how to test it. With this, our support for SCRAM should be complete.

Org has a nice option which allows you to show week-end days in a different color in your agenda. That means that Saturday and Sunday (when I do not work) are fontified with org-agenda-date-weekend'. But there are other days I do not work, like my vacations or holidays. Therefore, I've wrote a patch to add org-agenda-day-face-function' which is optionally called to determine what should be the face used to fontify a day. This allows me to use the same face for holidays and for week-end days, like for last Thursday which was an holiday in France. That patch has been merged in Org last week.

Dead Lazyweb^*, Is anyone of you using FeedBurner for his blog? My new blog is Atom based, and FeedBurner would be a simple way of also offering RSS feeds. I don't think my blog is worth bothering with all the other 'features' of Feedburner, and I don't really want Google to track my subscribers ... And in fact, I'm not narcissistic enough to believe I have a single direct "subscriber", I belive that almost all my readers are using one or another planet ... that's why I also don't twitter - who'd read it? So: do you have experience here? If you use Feedburner, what benefits do you get? Drop me an email, erich () debian org. * Definition of Lazyweb

if I'm not mistaken, more & more people are trying to hunt down RC bugs nice! here are my contributions during the last weeks:

• #591133 src:linux86: "linux86: FTBFS: ncc: illegal label"
  grab patch from BTS and upload to DELAYED/2
• #592546 kernel-package: "kernel-package: does not create bootable image"
  lower severity
• #595397 libsys-sigaction-perl: "libsys-sigaction-perl: FTBFS on armel, unsupported"
  close after verification (pkg-perl)
• #598956 libwebkit-1.0-2: "On kfreebsd going into web pane segfaults Liferea."
  grab patch from BTS and uploaed to DELAYED/5
• #599693 nama: "nama: Startup fails because socket creation fails"
  upload fixed package prepared by bolangi (pkg-perl)
• #600585 vzctl: "vzctl: package fails to purge due to missing line continuation"
  apply patch from BTS (plus two other patches for two other bugs) and upload to DELAYED/7. later uploaded by maintainer
• #601116 liburi-perl: "liburi-perl: FTBFS in squeeze: test failed"
  upload to t-p-u and unstable (pkg-perl)
• #601978 gbonds: "gbonds: file conflict during upgrade from lenny"
  grab patch from BTS and upload to DELAYED/2
• #601979 libcherokee-server0-dev: "libcherokee-server0-dev: file conflict during upgrade from lenny"
  add Replaces and upload to DELAYED/2, later integrated into maintainer upload
• #601988 xfsprogs: "xfsprogs: file conflict when upgrading from lenny"
  add Replaces and upload to DELAYED/2, later fixed by maintainer upload
• #601990 libqdbm3++c2: "libqdbm3++c2: file conflict when upgrading from lenny"
  sponsor maintainer upload
• #601996 uim-applet-gnome: "uim-applet-gnome: file conflict when upgrading from lenny"
  grab patch from BTS and upload to DELAYED/2
• #602171 gdesklets: "gdesklets: won't start"
  propose a debdiff
• #602832 libsocket-getaddrinfo-perl: "libsocket-getaddrinfo-perl: 0.16-1 segfaults on lenny and squeeze"
  raise severity and provide some debug info (pkg-perl)
• #602872 wine: "wine: ftbfs on amd64, needs to build-depend on new ia32-libs-dev"
  upload NMU from mentors.d.n to DELAYED/7
• #602877 dvd+rw-tools: "dvd+rw-tools: apt dpendency problem"
  add a comment to the BTS, closed by maintainer afterwards

some remarks:

• although I was at the bug squashing party during the Paris Debian MiniConf I was more productive at home; I guess there was just to much other stuff to do (like going to talks and meet people) in Paris :)
• still no single complaint for my NMUs; but a few "thank you"s & some friendly requests to delay/cancel an NMU from active maintainers
• enrico sent some "should we remove this package from testing?" mails to several bugs today. IMO that's a great next step that will bring us closer to the release grazie!

Say hello to Isla Daisy Burton. Born at home (planned) on Thursday 4th November 2010 at 19:08, weighing 6 pounds 14.5 ounces. Both mother and baby are well. I'm now on leave until the end of December, so expect delayed responses to my personal email and vacation autoreplies to my Intel email.

I finally got around to clearing out my ~/Programming and publishing a number of the silly toy projects I've built up over the years that might be useful to someone, somewhere. A brief overview of what I've basically thrown over the wall to GitHub:

flickrest

A Python/Twisted library for the Flickr API. This was written for use in Postr, although I suspect now that I don't maintain Postr any more they have forked. Maybe now this is in Git we can merge any changes.

evo-known-contact

A small tool I wrote for someone years ago that takes an RFC2822-formatted email on stdin, extracts the sender, and sets the exit code depending on whether that email address is in the address book.

feednotify

Display notifications when a RSS feed is updated.

Zebu

A tool to manage Debian chroots using cowbuilder.

Tumblrss

Screen-scrape your Tumblr dashboard and generate a RSS feed. This has bitrotted but was very useful.

gupnp-scrobbler

Listen to announcements over UPnP of music being played and submit the tracks to Last.fm.

ephy-gupnp

Dynamically generate bookmarks from UPnP devices that expose a web interface. Probably doesn't work with recent Epiphany releases because I've switched to Chrome.

ephydeli

An action to add the current page to Delicious.com. Probably doesn't work with recent Epiphany releases because I've switched to Chrome and Pinboard.

eds-tools

Some tools I wrote when working on EDS such as a dummy addressbook backend and command-line access to the libebook API.

cdscrobbler

Submit the current CD (or an arbitrary MusicBrainz album ID) to Last.fm as if you'd just finished playing it.

Out of all of these hacks I only actively use flickrest and Zebu now, so I wouldn't be surprised if there is some serious bitrot in the others. Hopefully something here is useful to someone, somewhere though!

Seeing now that the situation regarding Free fonts is much better than in the past, I have started packaging some that are of high enough quality so that we can have it available on our systems (be it Debian or any of the good derivatives). In particular, I spent some time during the past few days packaging some that, I think, deserve to be mentioned:

• ParaType Sans: this typeface family consists of a set of proportional, sans-serif fonts that supply a lot of Cyrillic glyphs. Purpose: the intention of this font is that of supporting many of the smaller ethnic and cultural aspects present in Russia. It was even funded by the Russian Government: in particular, by the Federal Agency for Press and Mass Communications of the Russian Federation. Why you should care: for those (like me) that use a Latin-based alphabet, the fonts also have some nice attractives, like, besides the usual 4 shape/weight combinations (regular, italic, bold, bold italic), two other variants: PT Sans Narrow (with its respective bold) and PT Sans Caption (also with bold). On top of that, the fonts support ligatures (liga, dlig), fractions (frac), ordinals (ordn), and glyph composition (ccmp), among other OpenType features.
• Anonymous Pro: this typeface family consists of a set of fixed-width fonts with the usual 4 shape/weight combinations (regular, italic, bold, bold italic). Purpose: Anonymous Pro was made with people that stare at a computer screen, coding for long amounts of time, or people that use a terminal all the time. Apart from being scalable, it also features some pre-made bitmap versions at some sizes (10, 11, 12, and 13), so that they should look better than some automatically drawn font without proper TrueType hinting. My package still is not good enough, as I have not yet included explicit support for the bitmapped sizes via some fontconfig configuration, but I expect to fix those in two or three days. (This should just be a matter of including something like

  <edit name="embeddedbitmap" mode="assign">
      <bool>true</bool>
  </edit>
  

  in the configuration that I ship with the fonts).
• Cardo: this is produced by David Perry and it is a proportional, serif, old-style typeface similar to some highly regarded fonts like Bembo. It does not offer italic, or bold versions. Purpose: Cardo's target "audience" are scholars that need to type set Medieval texts, it has many glyphs, support for many opentype features and the author has told me that he may even provide some support for typesetting Mathematics (and this is a very big deal, since typesetting Mathematics is hard enough when you decide to change your typefaces). It works quite well with Jonathan Kew's XeTeX and you should just try it, especially if you are into serif fonts (like I am).
• Droid: this consists of three font families, with varying shapes and weights, in sans-serif, sans-serif monospaced, and serif families. It has received a lot of press, due to it being sponsored by Google and made by Ascender Corporation. Purpose: the Droid fonts were made for Google's Android platform and one of the main concerns was to be readable on devices with low resolution (like computer screens). It has a very wide coverage of glyphs (as one would expect from a font for phones) and have very high quality. A really nice donation to the world.
• Linux Libertine: this has to be one of the most beautiful fonts that I have see in a while. It has the basic four combinations of a serif font Purpose: to provide a beautiful, "organic" version of a typeface that can substitute Times/Times New Roman. It works well both with "regular" latex/pdflatex and with XeTeX (and, quite probably, with LuaTeX). It has quite a lot of OpenType features:

  rbrito:~$ otfinfo -f /usr/share/fonts/truetype/linux-libertine/LinLibertine_Re.ttf   wc -l
  25
  rbrito:~$
  

  OK, I can't be impartial with this font. It is beautiful. It is a pity that we are in a feature freeze and that a the new version won't probably be included in squeeze.
• Heuristica (" "): since Adobe has donated Utopia to the TeX Users's Group under a Free Software license, it was only a matter of time that people would tweak them and generate other versions. Then comes Andrey Panov's Heuristica, a modified version of the four basic typefaces that Adobe donated, in OpenType format (and, to boot, some nice scripts for fontforge). Purpose: Heuristica improves Utopia with the primary intent of adding Cyrillic symbols by Andrey V. Panov. Andrey has also incorporated Vietnamese glyphs made available by H n Th Th nh. Heuristica is a family that features regular and italic shapes, with both being present also in bold weight.

Well, that's it for now. Stay tuned for more to come.