Tobias Frost
did 12.0h (out of 10.5h assigned and 1.5h from previous period).
Evolution of the situation
In November, we have released 38 DLAs.
The LTS coordinators, Roberto and Santiago, delivered a talk at the Mini-DebConf event in Toulouse, France. The title of the talk was How LTS goes beyond LTS . The talk covered work done by the LTS Team during the past year. This included contributions related to individual packages in Debian (such as tomcat, jetty, radius, samba, apache2, ruby, and many others); improvements to tooling and documentation useful to the Debian project as a whole; and contributions to upstream work (apache2, freeimage, node-dompurify, samba, and more). Additionally, several contributors external to the LTS Team were highlighted for their contributions to LTS. Readers are encouraged to watch the video of the presentation for a more detailed review of various ways in which the LTS team has contributed more broadly to the Debian project and to the free software community during the past year.
We wish to specifically thank Salvatore (of the Debian Security Team) for swiftly handling during November the updates of needrestart and libmodule-scandeps-perl, both of which involved arbitrary code execution vulnerabilities. We are happy to see increased involvement in LTS work by contributors from outside the formal LTS Team.
The work of the LTS Team in November was otherwise unremarkable, encompassing the customary triage, development, testing, and release of numerous DLAs, along with some associated contributions to related packages in stable and unstable.
Thanks to our sponsors
Sponsors that joined recently are in bold.
Transition management, by Emilio Pozuelo Monfort
Emilio has been helping finish the mpi-defaults switch to mpich on 32-bit
architectures, and the openmpi transitions.
This involves filing bugs for the reverse dependencies, doing NMUs, and
requesting removals for outdated (Not Built from Source) binaries on 32-bit
architectures where openmpi is no longer available. Those transitions got
entangled with a few others, such as the petsc stack, and were blocking many
packages from migrating to testing. These transitions were completed in early
December.
cPython 3.12.7+ update uploads, by Stefano Rivera
Python 3.12 had failed to build on mips64el,
due to an obscure dh_strip failure. The mips64el porters never figured it out,
but the missing build on mips64el was blocking migration to Debian testing.
After waiting a month, enough changes had accumulated in the upstream 3.12
maintenance git branch that we could apply them in the hope of changing the
output enough to avoid breaking dh_strip. This worked.
Of course there were other things to deal with too. A test started failing due
to a Debian-specific patch we carry for python3.x-minimal, and it needed to be
reworked. And Stefano forgot to strip the trailing + from PY_VERSION, which
confuses some python
libraries. This always requires another patch when applying git updates from the
maintenance branch. Stefano added a build-time check to catch this mistake in
the future. Python 3.12.7 migrated.
Python 3.13 Transition, by Stefano Rivera and Colin Watson
During November the Python 3.13-add
transition
started. This is the first stage of supporting a new version of Python in Debian
archive (after preparatory work), adding it as a new supported but non-default
version. All packages with compiled Python extensions need to be re-built to add
support for the new version.
We have covered the lead-up to this transition in the past. Due to preparation,
many of the failures we hit were expected and we had patches waiting in the bug
tracker. These could be NMUed to get the transition moving. Others had been
known about but hadn t been worked on, yet.
Some other packages ran into new issues, as we got further into the transition
than we d been able to in preparation. The whole Debian Python team has been
helping with this work.
The rebuild stage of the 3.13-add transition is now over, but many packages
need work before
britney will let python3-defaults migrate to testing.
Limiting build concurrency based on available RAM, by Helmut Grohne
In recent years, the concurrency of CPUs has been increasing as has the demand
for RAM by linkers. What has not been increasing as quickly is the RAM supply in
typical machines. As a result, we more frequently run into situations where the
package builds exhaust memory when building at full concurrency. Helmut
initiated a
discussion about
generalizing an approach to this in Debian packages. Researching existing code
that limits concurrency as well as providing possible extensions to debhelper
and dpkg to provide concurrency limits based on available system RAM. Thus far
there is consensus on the need for a more general solution, but ideas are still
being collected for the precise solution.
MiniDebConf Toulouse at Capitole du Libre
The whole Freexian Collaborator team attended MiniDebConf
Toulouse, part of the Capitole du
Libre event. Several members of the team gave
talks:
Santiago spoke on Linux Live Patching in
Debian,
presenting an update on the idea since DebConf 24. This includes the
initial requirements for the livepatch package format, that would be used to
distribute the livepatches.
Stefano and Anupa worked as part of the video team, streaming and recording the
event s talks.
Miscellaneous contributions
Stefano looked into packaging the latest upstream python-falcon version in
Debian, in support of the Python 3.13 transition. This appeared to break
python-hug, which is sadly looking neglected upstream, and the best course of
action is probably its removal from Debian.
Stefano uploaded videos from various 2024 Debian events to PeerTube and
YouTube.
Stefano and Santiago visited the site for DebConf 2025 in Brest, after the
MiniDebConf in Toulouse, to meet with the local team and scout out the venue.
The on-going DebConf 25 organization work of last month also included
handling the logo and artwork call for
proposals.
Carles implemented multiple language support on
po-debconf-manager and
tested it using Portuguese-Brazilian during MiniDebConf Toulouse. The system was
also tested and improved by reviewing more than 20 translations to Catalan,
creating merge requests for those packages, and providing user support to new
users. Additionally, Carles implemented better status transitions, configuration
keys management and other small improvements.
Helmut sent 32 patches for cross build failures. The
wireplumber one was an interactive
collaboration with Dylan A ssi.
Helmut continued to monitor the /usr-move, sent a patch for lib64readline8
and continued several older patch conversations. lintian now reports some
aliasing issues in unstable.
Colin upgraded 42 Python packages to new upstream versions. Some were
complex: python-catalogue had some upstream version
confusion, pydantic and
rpds-py involved several Rust package upgrades as prerequisites, and
python-urllib3 involved first packaging python-quart-trio and then vendoring an
unpackaged test-dependency.
Colin contributed Incus support to needrestart upstream.
Lucas set up a machine to do a rebuild of all ruby reverse dependencies to
check what will be broken by adding ruby 3.3 as an alternative interpreter. The
tool used for this is
mass-rebuild and the initial
rebuilds have already started. The ruby interpreter maintainers are planning to
experiment with debusine next time.
Lucas is organizing a Debian Ruby
sprint towards the end of
January in Paris. The plan of the team is to finish any missing bits of Ruby 3.3
transition at the time, try to push Rails 7 transition and fix RC bugs affecting
the ruby ecosystem in Debian.
Anupa attended a Debian Publicity team meeting in-person during MiniDebCamp
Toulouse.
Anupa moderated and posted in the Debian Administrator group in LinkedIn.
Tobias Frost
did 10.5h (out of 12.0h assigned), thus carrying over 1.5h to the next month.
Evolution of the situation
In October, we have released 35 DLAs.
Some notable updates prepared in October include denial of service vulnerability fixes in nss, regression fixes in apache2, multiple fixes in php7.4, and new upstream releases of firefox-esr, openjdk-17, and opendk-11.
Additional contributions were made for the stable Debian 12 bookworm release by several LTS contributors. Arturo Borrero Gonzalez prepared a parallel update of nss, Bastien Roucari s prepared a parallel update of apache2, and Santiago Ruano Rinc n prepared updates of activemq for both LTS and Debian stable.
LTS contributor Bastien Roucari s undertook a code audit of the cacti package and in the process discovered three new issues in node-dompurity, which were reported upstream and resulted in the assignment of three new CVEs.
As always, the LTS team continues to work towards improving the overall sustainability of the free software base upon which Debian LTS is built. We thank our many committed sponsors for their ongoing support.
Thanks to our sponsors
Sponsors that joined recently are in bold.
rebootstrap, by Helmut Grohne
After significant changes earlier this year, the state of architecture cross bootstrap is normalizing again. More and more architectures manage to complete rebootstrap testing successfully again. Here are two examples of what kind of issues the bootstrap testing identifies.
At some point, libpng1.6 would fail to cross build on musl architectures whereas it would succeed on other ones failing to locate zlib. Adding --debug-find to the cmake invocation eventually revealed that it would fail to search in /usr/lib/<triplet>, which is the default library path. This turned out to be a bug in cmake assuming that all linux systems use glibc. libpng1.6 also gained a baseline violation for powerpc and ppc64 by enabling the use of AltiVec there.
The newt package would fail to cross build for many 32-bit architectures whereas it would succeed for armel and armhf due to -Wincompatible-pointer-types. It turns out that this flag was turned into -Werror and it was compiling with a warning earlier. The actual problem is a difference in signedness between wchar_t and FriBidChar (aka uint32_t) and actually affects native building on i386.
Miscellaneous contributions
Helmut sent 35 patches for cross build failures.
Stefano Rivera uploaded the Python 3.13.0 final release.
Stefano continued to rebuild Python packages with C extensions using Python 3.13, to catch compatibility issues before the 3.13-add transition starts.
Stefano uploaded new versions of a handful of Python packages, including: dh-python, objgraph, python-mitogen, python-truststore, and python-virtualenv.
Stefano packaged a new release of mkdocs-macros-plugin, which required packaging a new Python package for Debian, python-super-collections (now in NEW review).
Stefano helped the mini-DebConf Online Brazil get video infrastructure up and running for the event. Unfortunately, Debian s online-DebConf setup has bitrotted over the last couple of years, and it eventually required new temporary Jitsi and Jibri instances.
Colin Watson fixed a number of autopkgtest failures to get ansible back into testing.
Colin fixed an ssh client failure in certain cases when using GSS-API key exchange, and added an integration test to ensure this doesn t regress in future.
Colin worked on the Python 3.13 transition, fixing problems related to it in 15 packages. This included upstream work in a number of packages (postgresfixture, python-asyncssh, python-wadllib).
Colin upgraded 41 Python packages to new upstream versions.
Carles improved po-debconf-manager: now it can create merge requests to Salsa automatically (created 17, new batch coming this month), imported almost all the packages with debconf translation templates whose VCS is Salsa (currently 449 imported), added statistics per package and language, improved command line interface options. Performed user support fixing different issues. Also prepared an abstract for the talk at MiniDebConf Toulouse.
Santiago Ruano Rinc n continued the organization work for the DebConf 25 conference, to be held in Brest, France. Part of the work relates to the initial edits of the sponsoring brochure. Thanks to Benjamin Somers who finalized the French and English versions.
Rapha l forwarded a couple of zim and hamster bugs to the upstream developers, and tried to diagnose a delayed startup of gdm on his laptop (cf #1085633).
On behalf of the Debian Publicity Team, Anupa interviewed 7 women from the Debian community, old and new contributors. The interview was published in Bits from Debian.
Tobias Frost
did 17.0h (out of 7.5h assigned and 9.5h from previous period).
Evolution of the situation
In September, we have released 52 DLAs.
September marked the first full month of Debian 11 bullseye under the responsibility of the LTS Team and the team immediately got to work, publishing more than 4 dozen updates.
Some notable updates include ruby2.7 (denial-of-service, information leak, and remote code execution), git (various arbitrary code execution vulnerabilities), firefox-esr (multiple issues), gnutls28 (information disclosure), thunderbird (multiple issues), cacti (cross site scripting and SQL injection), redis (unauthorized access, denial of service, and remote code execution), mariadb-10.5 (arbitrary code execution), cups (arbitrary code execution).
Several LTS contributors have also contributed package updates which either resulted in a DSA (a Debian Security Announcement, which applies to Debian 12 bookworm) or in an upload that will be published at the next stable point release of Debian 12 bookworm. This list of packages includes cups, cups-filters, booth, nghttp2, puredata, python3.11, sqlite3, and wireshark. This sort of work, contributing fixes to newer Debian releases (and sometimes even to unstable), helps to ensure that upgrades from a release in the LTS phase of its lifecycle to a newer release do not expose users to vulnerabilities which have been closed in the older release.
Looking beyond Debian, LTS contributor Bastien Roucari s has worked with the upstream developers of apache2 to address regressions introduced upstream by some recent vulnerability fixes and he has also reached out to the community regarding a newly discovered security issue in the dompurify package. LTS contributor Santiago Ruano Rinc n has undertaken the work of triaging and reproducing nearly 4 dozen CVEs potentially affecting the freeimage package. The upstream development of freeimage appears to be dormant and some of the issues have languished for more than 5 years. It is unclear how much can be done without the aid of upstream, but we will do our best to provide as much help to the community as we can feasibly manage.
Finally, it is sometimes necessary to limit or discontinue support for certain packages. The transition of a release from being under the responsibility of the Debian Security Team to that of the LTS Team is an occasion where we assess any pending decisions in this area and formalize them. Please see the announcement for a complete list of packages which have been designated as unsupported.
Thanks to our sponsors
Sponsors that joined recently are in bold.
Pydantic v2, by Colin Watson
Pydantic is a useful library for validating data in Python using type hints: Freexian uses it in a number of projects, including Debusine. Its Debian packaging had been stalled at 1.10.17 in testing for some time, partly due to needing to make sure everything else could cope with the breaking changes introduced in 2.x, but mostly due to needing to sort out packaging of its new Rust dependencies. Several other people (notably Alexandre Detiste, Andreas Tille, Drew Parsons, and Timo R hling) had made some good progress on this, but nobody had quite got it over the line and it seemed a bit stuck.
Colin upgraded a few Rust libraries to new upstream versions, packaged rust-jiter, and chased various failures in other packages. This eventually allowed getting current versions of both pydantic-core and pydantic into testing. It should now be much easier for us to stay up to date routinely.
Reworking of glib2.0 for cross bootstrap, by Helmut Grohne
Simon McVittie (not affiliated with Freexian) earlier restructured the libglib2.0-dev such that it would absorb more functionality and in particular provide tools for working with .gir files. Those tools practically require being run for their host architecture (practically this means running under qemu-user) which is at odds with the requirements of architecture cross bootstrap. The qemu requirement was expressed in package dependencies and also made people unhappy attempting to use libglib2.0-dev for i386 on amd64 without resorting to qemu. The use of qemu in architecture bootstrap is particularly problematic as it tends to not be ready at the time bootstrapping is needed.
As a result, Simon proposed and implemented the introduction of a libgio-2.0-dev package providing a subset of libglib2.0-dev that does not require qemu. Packages should continue to use libglib2.0-dev in their Build-Depends unless involved in architecture bootstrap. Helmut reviewed and tested the implementation and integrated the necessary changes into rebootstrap. He also prepared a patch for libverto to use the new package and proposed adding forward compatibility to glib2.0.
Helmut continued working on adding cross-exe-wrapper to architecture-properties and implemented autopkgtests later improved by Simon. The cross-exe-wrapper package now provides a generic mechanism to a program on a different architecture by using qemu when needed only. For instance, a dependency on cross-exe-wrapper:i386 provides a i686-linux-gnu-cross-exe-wrapper program that can be used to wrap an ELF executable for the i386 architecture. When installed on amd64 or i386 it will skip installing or running qemu, but for other architectures qemu will be used automatically. This facility can be used to support cross building with targeted use of qemu in cases where running host code is unavoidable as is the case for GObject introspection.
This concludes the joint work with Simon and Niels Thykier on glib2.0 and architecture-properties resolving known architecture bootstrap regressions arising from the glib2.0 refactoring earlier this year.
Analyzing binary package metadata, by Helmut Grohne
As Guillem Jover (not affiliated with Freexian) continues to work on adding metadata tracking to dpkg, the question arises how this affects existing packages. The dedup.debian.net infrastructure provides an easy playground to answer such questions, so Helmut gathered file metadata from all binary packages in unstable and performed an explorative analysis. Some results include:
Guillem also performed a cursory analysis and reported other problem categories such as mismatching directory permissions for directories installed by multiple packages and thus gained a better understanding of what consistency checks dpkg can enforce.
Python archive rebuilds, by Stefano Rivera
Last month Stefano started to write some tooling to do large-scale rebuilds in debusine, starting with finding packages that had already started to fail to build from source (FTBFS) due to the removal of setup.py test. This month, Stefano did some more rebuilds, starting with experimental versions of dh-python.
During the Python 3.12 transition, we had added a dependency on python3-setuptools to dh-python, to ease the transition. Python 3.12 removed distutils from the stdlib, but many packages were expecting it to still be available. Setuptools contains a version of distutils, and dh-python was a convenient place to depend on setuptools for most package builds. This dependency was never meant to be permanent. A rebuild without it resulted in mass-filing about 340 bugs (and around 80 more by mistake).
A new feature in Python 3.12, was to have unittest s test runner exit with a non-zero return code, if no tests were run. We added this feature, to be able to detect tests that are not being discovered, by mistake. We are ignoring this failure, as we wouldn t want to suddenly cause hundreds of packages to fail to build, if they have no tests. Stefano did a rebuild to see how many packages were affected, and found that around 1000 were. The Debian Python community has not come to a conclusion on how to move forward with this.
As soon as Python 3.13 release candidate 2 was available, Stefano did a rebuild of the Python packages in the archive against it. This was a more complex rebuild than the others, as it had to be done in stages. Many packages need other Python packages at build time, typically to run tests. So transitions like this involve some manual bootstrapping, followed by several rounds of builds. Not all packages could be tested, as not all their dependencies support 3.13 yet. The result was around 100 bugs in packages that need work to support Python 3.13. Many other packages will need additional work to properly support Python 3.13, but being able to build (and run tests) is an important first step.
Miscellaneous contributions
Carles prepared the update of python-pyaarlo package to a new upstream release.
Carles worked on updating python-ring-doorbell to a new upstream release. Unfinished, pending to package a new dependency python3-firebase-messaging RFP #1082958 and its dependency python3-http-ece RFP #1083020.
Carles improved po-debconf-manager. Main new feature is that it can open Salsa merge requests. Aiming for a lightning talk in MiniDebConf Toulouse (November) to be functional end to end and get feedback from the wider public for this proof of concept.
Carles helped one translator to use po-debconf-manager (added compatibility for bullseye, fixed other issues) and reviewed 17 package templates.
Colin upgraded the OpenSSH packaging to 9.9p1.
Colin upgraded the various YubiHSM packages to new upstream versions, enabled more tests, fixed yubihsm-shell build failures on some 32-bit architectures, made yubihsm-shell build reproducibly, and fixed yubihsm-connector to apply udev rules to existing devices when the package is installed. As usual, bookworm-backports is up to date with all these changes.
Colin fixed quite a bit of fallout from setuptools 72.0.0 removing setup.py test, backported a large upstream patch set to make buildbot work with SQLAlchemy 2.0, and upgraded 25 other Python packages to new upstream versions.
Enrico worked with Jakob Haufe to get him up to speed for managing sso.debian.org
Rapha l did remove spam entries in the list of teams on tracker.debian.org (see #1080446), and he applied a few externalcontributions, fixing a rendering issue and replacing the DDPO link with a more useful alternative. He also gave feedback on a couple of mergerequests that required more work. As part of the analysis of the underlying problem, he suggested to the ftpmasters (via #1083068) to auto-reject packages having the too-many-contacts lintian error, and he raised the severity of #1076048 to serious to actually have that 4 year old bug fixed.
Rapha l uploaded zim and hamster-time-tracker to fix issues with Python 3.12 getting rid of setuptools. He also uploaded a new gnome-shell-extension-hamster to cope with the upcoming transition to GNOME 47.
Helmut sent seven patches and sponsored one upload for cross build failures.
Helmut uploaded a Nagios/Icinga plugin check-smart-attributes for monitoring the health of physical disks.
Helmut collaborated on sbuild reviewing and improving a MR for refactoring the unshare backend.
Helmut sent a patch fixing coinstallability of gcc-defaults.
Helmut continued to monitor the evolution of the /usr-move. With more and more key packages such as libvirt or fuse3 fixed. We re moving into the boring long-tail of the transition.
Helmut continued to update patches maintained in rebootstrap. Due to the work on glib2.0 above, rebootstrap moves a lot further, but still fails for any architecture.
Santiago reviewed some Merge Request in Salsa CI, such as: !478, proposed by Otto to extend the information about how to use additional runners in the pipeline and !518, proposed by Ahmed to add support for Ubuntu images, that will help to test how some debian packages, including the complex MariaDB are built on Ubuntu.
Santiago also prepared !545, which will make the reprotest job more consistent with the result seen on reproducible-builds.
Santiago worked on different tasks related to DebConf 25. Especially he drafted the fundraising brochure (which is almost ready).
Thorsten Alteholz uploaded package libcupsfilter to fix the autopkgtest and a dependency problem of this package. After package splix was abandoned by upstream and OpenPrinting.org adopted its maintenance, Thorsten uploaded their first release.
Anupa published posts on the Debian Administrators group in LinkedIn and moderated the group, one of the tasks of the Debian Publicity Team.
Anupa helped organize DebUtsav 2024. It had over 100 attendees with hand-on sessions on making initial contributions to Linux Kernel, Debian packaging, submitting documentation to Debian wiki and assisting Debian Installations.
Welcome to the September 2024 report from the Reproducible Builds project!
Our reports attempt to outline what we ve been up to over the past month, highlighting news items from elsewhere in tech where they are related. As ever, if you are interested in contributing to the project, please visit our Contribute page on our website.
Table of contents:
Binsider can perform static and dynamic analysis, inspect strings, examine linked libraries, and perform hexdumps, all within a user-friendly terminal user interface!
95% fixed by [merge request] !12680 when -fobject-determinism is enabled. []
The linked merge request has since been merged, and Rodrigo goes on to say that:
After that patch is merged, there are some rarer bugs in both interface file determinism (eg. #25170) and in object determinism (eg. #25269) that need to be taken care of, but the great majority of the work needed to get there should have been merged already. When merged, I think we should close this one in favour of the more specific determinism issues like the two linked above.
Fay Stegerman let everyone know that she started a thread on the Fediverse about the problems caused by unreproducible zlib/deflate compression in .zip and .apk files and later followed up with the results of her subsequent investigation.
Long-time developer kpcyrd wrote that there has been a recent public discussion on the Arch Linux GitLab [instance] about the challenges and possible opportunities for making the Linux kernel package reproducible , all relating to the CONFIG_MODULE_SIG flag. []
Bernhard M. Wiedemann followed-up to an in-person conversation at our recent Hamburg 2024 summit on the potential presence for Reproducible Builds in recognised standards. []
Fay Stegerman also wrote about her worry about the possible repercussions for RB tooling of Debian migrating from zlib to zlib-ng as reproducibility requires identical compressed data streams. []
Martin Monperrus wrote the list announcing the latest release of maven-lockfile that is designed aid building Maven projects with integrity . []
Lastly, Bernhard M. Wiedemann wrote about potential role of reproducible builds in combatting silent data corruption, as detailed in a recent Tweet and scholarly paper on faulty CPU cores. []
This is a report of Part 1 of my journey: building 100% bit-reproducible packages for every package that makes up [openSUSE s] minimalVM image. This target was chosen as the smallest useful result/artifact. The larger package-sets get, the more disk-space and build-power is required to build/verify all of them.
A hermetic build system manages its own build dependencies, isolated from the host file system, thereby securing the build process. Although, in recent years, new artifact-based build technologies like Bazel offer build hermeticity as a core functionality, no empirical study has evaluated how effectively these new build technologies achieve build hermeticity. This paper studies 2,439 non-hermetic build dependency packages of 70 Bazel-using open-source projects by analyzing 150 million Linux system file calls collected in their build processes. We found that none of the studied projects has a completely hermetic build process, largely due to the use of non-hermetic top-level toolchains. []
Distribution work
In Debian this month, 14 reviews of Debian packages were added, 12 were updated and 20 were removed, all adding to our knowledge about identified issues. A number of issue types were updated as well. [][]
In addition, Holger opened 4 bugs against the debrebuild component of the devscripts suite of tools. In particular:
#1081839: Fails with E: mmdebstrap failed to run error.
Last month, an issue was filed to update the Salsa CI pipeline (used by 1,000s of Debian packages) to no longer test for reproducibility with reprotest s build_path variation. Holger Levsen provided a rationale for this change in the issue, which has already been made to the tests being performed by tests.reproducible-builds.org. This month, this issue was closed by Santiago R. R., nicely explaining that build path variation is no longer the default, and, if desired, how developers may enable it again.
In openSUSE news, Bernhard M. Wiedemann published another report for that distribution.
diffoscopediffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb made the following changes, including preparing and uploading version 278 to Debian:
New features:
Add a helpful contextual message to the output if comparing Debian .orig tarballs within .dsc files without the ability to fuzzy-match away the leading directory. []
Bug fixes:
Drop removal of calculated os.path.basename from GNU readelf output. []
Correctly invert X% similar value and do not emit 100% similar . []
Misc:
Temporarily remove procyon-decompiler from Build-Depends as it was removed from testing (via #1057532). (#1082636)
Update copyright years. []
For trydiffoscope, the command-line client for the web-based version of diffoscope, Chris Lamb also:
Added an explicit python3-setuptools dependency. (#1080825)
Bumped the Standards-Version to 4.7.0. []
Other software development
disorderfs is our FUSE-based filesystem that deliberately introduces non-determinism into system calls to reliably flush out reproducibility issues. This month, version 0.5.11-4 was uploaded to Debian unstable by Holger Levsen making the following changes:
Replace build-dependency on the obsolete pkg-config package with one on pkgconf, following a Lintian check. []
Bump Standards-Version field to 4.7.0, with no related changes needed. []
In addition, reprotest is our tool for building the same source code twice in different environments and then checking the binaries produced by each build for any differences. This month, version 0.7.28 was uploaded to Debian unstable by Holger Levsen including a change by Jelle van der Waa to move away from the pipes Python module to shlex, as the former will be removed in Python version 3.13 [].
Android toolchain core count issue reported
Fay Stegerman reported an issue with the Android toolchain where a part of the build system generates a different classes.dex file (and thus a different .apk) depending on the number of cores available during the build, thereby breaking Reproducible Builds:
We ve rebuilt [tag v3.6.1] multiple times (each time in a fresh container): with 2, 4, 6, 8, and 16 cores available, respectively:
With 2 and 4 cores we always get an unsigned APK with SHA-256 14763d682c9286ef .
With 6, 8, and 16 cores we get an unsigned APK with SHA-256 35324ba4c492760 instead.
reproducibility settings [being] applied to some of Gradle s built-in tasks that should really be the default. Compatible with Java 8 and Gradle 8.3 or later.
Website updates
There were a rather substantial number of improvements made to our website this month, including:
Chris Lamb:
Attempt to use GitLab CI to artifact the website; hopefully useful for testing branches. []
Correct the linting rule whilst building the website. []
Make a number of small changes to Kees post written by Vagrant. [][][]
Jelle van der Waa completely modernised the System Images documentation, noting that a lot has changed since 2017(!); ext4, erofs and FAT filesystems can now be made reproducible . []
Developer RyanSquared replaced the continuous integration test link for Arch Linux on our Projects page with an external instance [][] as well as updated the documentation to reflect the dependencies required to build the website [].
Upstream patches
The Reproducible Builds project detects, dissects and attempts to fix as many currently-unreproducible packages as possible. We endeavour to send all of our patches upstream where appropriate. This month, we wrote a large number of such patches, including:
sphobjinv (duplicates fix from Debian bug #1082706)
Reproducibility testing framework
The Reproducible Builds project operates a comprehensive testing framework running primarily at tests.reproducible-builds.org in order to check packages and other artifacts for reproducibility. In September, a number of changes were made by Holger Levsen, including:
Upgrade the osuosl4 node to Debian trixie in anticipation of running debrebuild and rebuilderd there. [][][]
Temporarily mark the osuosl4 node as offline due to ongoing xfs_repair filesystem maintenance. [][]
Do not warn about (very old) broken nodes. []
Add the risc64 architecture to the multiarch version skew tests for Debian trixie and sid. [][][]
Mark the virt 32,64 b nodes as down. []
Misc changes:
Add support for powercycling OpenStack instances. []
Update the fail2ban to ban hosts for 4 weeks in total [][] and take care to never ban our own Jenkins instance. []
In addition, Vagrant Cascadian recorded a disk failure for the virt32b and virt64b nodes [], performed some maintenance of the cbxi4a node [][] and marked most armhf architecture systems as being back online.
Finally, If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:
Tobias Frost
did 2.5h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 9.5h to the next month.
Evolution of the situation
In August, we have released 1 DLAs.
During the month of August Debian 11 "bullseye" officially transitioned to the responsibility of the LTS team (on 2024-08-15). However, because the final point release (11.11) was not made until 2024-08-31, LTS contributors were prevented from uploading packages to bullseye until after the point release had been made. That said, the team was not at all idle, and was busy at work on a variety of tasks which impacted both LTS and the broader Debian community, as well as preparing uploads which will be released during the month of September.
Of particular note, LTS contributor Bastien Roucari s prepared updates of the putty and cacti packages for bookworm (12) and bullseye (12), which were accepted by the old-stable release managers for the August point releases. He also analysed several security regressions in the apache2 package. LTS contributor Emilio Pozuelo Monfort worked on the Rust toolchain in bookworm and bullseye, which will be needed to support the upcoming Firefox ESR and Thunderbird ESR releases from the Mozilla project. Additionally, LTS contributor Thorsten Alteholz prepared bookworm and bullseye updates of the cups package (12), which were accepted by the old-stable release managers for the August point releases.
LTS contributor Markus Koschany collaborated with Emmanuel Bourg, co-maintainer of the tomcat packages in Debian. Regressions in a proposed security fix necessitated the updating of the tomcat10 package in Debian to the latest upstream release.
LTS contributors Bastien and Santiago Ruano Rinc n collaborated with the upstream developers and the Debian maintainer (Bernhard Schmidt) of the FreeRADIUS project towards addressing the BlastRADIUS vulnerability in the bookworm and bullseye versions of the freeradius package. If you use FreeRADIUS in Debian bookworm or bullseye, we encourage you to test the packages following the instructions found in the call for testers to help identifying any possible regression that could be introduced with these updates.
Testing is an important part of the work the LTS Team does, and in that vein LTS contributor Sean Whitton worked on improving the documentation and tooling around creating test filesystems which can be used for testing a variety of package update scenarios.
Thanks to our sponsors
Sponsors that joined recently are in bold.
Debian Python 3 patch review, by Stefano Rivera
Last month, at DebConf, Stefano reviewed the current patch set of Debian s cPython packages with Matthias Klose, the primary maintainer until now. As a result of that review, Stefano re-reviewed the patchset, updating descriptions, etc. A few patches were able to be dropped, and a few others were forwarded upstream.
One finds all sorts of skeletons doing reviews like this. One of the patches had been inactive (fortunately, because it was buggy) since the day it was applied, 13 years ago. One is a cleanup that probably only fixes a bug on HPUX, and is a result of copying code from xfree86 into Python 25 years ago. It was fixed in xfree86 a year later. Others support just Debian-specific functionality and probably never seemed worth forwarding. Or good cleanup that only really applies to Debian.
A trivial new patch would allow Debian to multiarch co-install Python stable ABI dynamic extensions (like we can with regular dynamic extensions). Performance concerns are stalling it in review, at the moment.
DebConf 24 Organization, by Stefano Rivera
Stefano helped organize DebConf 24, which concluded in early August. The event is run by a large entirely volunteer team. The work involved in making this happen is far too varied to describe here. While Freexian provides funding for 20% of collaborator time to spend on Debian-related work, it only covers a small fraction of contributions to time-intensive tasks like this.
Since the end of the event, Stefano has been doing some work on the conference finances, and initiated the reimbursement process for travel bursaries.
Archive rebuilds on Debusine, by Stefano Rivera
The recent setuptools 73 upload to Debian unstable removed the test subcommand, breaking many packages that were using python3 setup.py test in their Debian packaging. Stefano did a partial archive-rebuild using debusine.debian.net to find the regressions and file bugs.
Debusine will be a powerful tool to do QA work like this for Debian in the future, but it doesn t have all the features needed to coordinate rebuild-testing, yet. They are planned to be fleshed out in the next year. In the meantime, Debusine has the building blocks to work through a queue of package building tasks and store the results, it just needs to be driven from outside the system.
So, Stefano started working on a set of tools using the Debusine client API to perform archive rebuilds, found and tagged existing bugs, and filed many more.
OpenSSL vs. cryptography, by Colin Watson
Colin facilitated a discussion between Debian s OpenSSL team and the upstream maintainers of Python cryptography about a new incompatibility between Debian s OpenSSL packaging and cryptography s handling of OpenSSL s legacy provider, which was causing a number of build and test failures. While the issue remains open, the Debian OpenSSL maintainers have effectively reverted the change now, so it s no longer a pressing problem.
/usr-move, by Helmut Grohne
There are less than 40 source packages left to move files to /usr, so what we re left with is the long tail of the transition. Rather than fix all of them, Helmut started a discussion on removing packages from unstable and filed a first batch. As libvirt is being restructured in experimental, we re handling the fallout in collaboration with its maintainer Andrea Bolognani. Since base-files validates the aliasing symlinks before upgrading, it was discovered that systemd has its own ideas with no solution as of yet. Helmut also proposed that dashchecks for ineffective diversions of /bin/sh and that lintianwarns about aliased files.
rebootstrap by Helmut Grohne
Bootstrapping Debian for a new or existing CPU architecture still is a quite manual process. The rebootstrap project attempts to automate part of the early stage, but it still is very sensitive to changes in unstable. We had a number of fairly intrusive changes this year already. August included a little more fallout from the earlier gcc-for-host work where the C++ include search path would end up being wrong in the generated cross toolchain. A number of packages such as util-linux (twice), libxml2, libcap-ng or systemd had their stage profiles broken. e2fsprogs gained a cycle with libarchive-dev due to having gained support for creating an ext4 filesystem from a tar archive. The restructuring of glib2.0 remains an unsolved problem for now, but libxt and cdebconf should be buildable without glib2.0.
Salsa CI, by Santiago Ruano Rinc n
Santiago completed the initial RISC-V support (!523) in the Salsa CI s pipeline. The main work started in July, but it was required to take into account some comments in the review (thanks to Ahmed!) and some final details in [!534]. riscv64 is the most recently supported port in Debian, which will be part of trixie. As its name suggests, the new build-riscv64 job makes it possible to test that a package successfully builds in the riscv64 architecture. The RISC-V runner (salsaci riscv64 runner 01) runs in a couple of machines generously provided by lab.rvperf.org. Debian Developers interested in running this job in their projects should enable the runner (salsaci riscv64 runner 01) in Settings / CI / Runners, and follow the instructions available at https://salsa.debian.org/salsa-ci-team/pipeline/#build-job-on-risc-v.
Santiago also took part in discussions about how to optimize the build jobs and reviewed !537 to make the build-source job to only satisfy the Build-Depends and Build-Conflicts fields by Andrea Pappacoda. Thanks a lot to him!
Miscellaneous contributions
Stefano submitted patches for BeautifulSoup to support the latest soupsieve and lxml.
Stefano uploaded pypy3 7.3.17, upgrading the cPython compatibility from 3.9 to 3.10. Then ran into a GCC-14-related regression, which had to be ignored for now as it s proving hard to fix.
Colin released libpipeline 1.5.8 and man-db 2.13.0; the latter included foundations allowing adding an autopkgtest for man-db.
Colin tracked down test failures in python-asyncssh and Ruby resulting from certain odd /etc/hosts configurations.
Carles upgraded the packages python-ring-doorbell and simplemonitor to new upstream versions.
Carles started discussions and implementation of a tool (still in early days) named po-debconf-manager : a way for translators and reviewers to collaborate using git as a backend instead of mailing list; and submit the translations using salsa MR. More information next month.
Carles (dog-fooding po-debconf-manager ) reviewed debconf templates translated by a collaborator.
Carles reviewed and submitted the translation of apt .
Helmut sent 19 patches for improving cross building.
Helmut implemented the cross-exe-wrapper proposed by Simon McVittie for use with glib2.0.
Helmut detailed what it takes to make Perl s ExtUtils::PkgConfig suitable for cross building.
Helmut made the deletion of the root password work in debvm in all situations and implemented a test case using expect.
Anupa attended Debian Publicity team meeting and is moderating and posting on Debian Administrators LinkedIn group.
Thorsten uploaded package gutenprint to fix a FTBFS with gcc14 and package ipp-usb to fix a /usr-merge issue.
Santiago updated bzip2 to fix a long-standing bug that requested to include a pkg-config file. An important impact of this change is that it makes it possible to use Rust bindings for libbz2 by Sequoia, an implementation of OpenPGP.
Evolution of the situation
In July, we have released 1 DLA.
August will be the month that Debian 11 makes the transition to LTS. Our
contributors have already been hard at work with preparatorty tasks and also
with making contributions to packages in Debian 11 in close collaboration with
the Debian security team and package maintainers. As a result, users and
sponsors should not observe any especially notable differences as the transition
occurs.
While only one DLA was released in July (as a result of the transitional state
of Debian 11 bullseye ), there were some notable highlights. LTS contributor
Guilhem Moulin prepared an update of libvirt for Debian 11 (in collaboration
with the Old-Stable Release Managers and the Debian Security Team) to fix a
number of outstanding CVEs which did not rise to the level of a DSA by the
Debian Security Team. The update prepared by Guilhem will be included in Debian
11 as part of the final point release at the end of August, one of the final
transition steps by the Release Managers as Debian 11 moves entirely to the LTS
Team s responsibility. Notable work was also undertaken by contributors Lee Garrett
(fixes on the ansible test suite and a bullseye update), Lucas Kanashiro (Rust toolchain, utilized by the clamav,
firefox-esr, and thunderbird packages), and Sylvain Beucler (fixes on the ruby2.5/2.7 test
suites and CI infrastructure), which will help improve the quality of updates produced during
the next LTS cycle.
June was the final month of LTS for Debian 10 (as announced on the
debian-lts-announce
mailing list). No additional Debian 10 security updates will be made available
on security.debian.org.
However, Freexian and its team of paid Debian contributors will continue
to maintain Debian 10 going forward for customers of the
Extended LTS offer. Subscribe right
away if you still have Debian 10 systems which must be kept secure (and which
cannot yet be upgraded).
Thanks to our sponsors
Sponsors that joined recently are in bold.
autopkgtest/Incus build streamlining, by Colin Watson
Colin contributed a change to allow maintaining Incus container and VM
images in parallel.
Both of these are useful (containers are faster, but some tests need
full machine isolation), and the build tools previously didn t handle
that very well.
This isn t yet in unstable, but once it is, keeping both flavours of
unstable images up to date will be a simple matter of running this
regularly:
Linux live-patching, by Santiago Ruano Rinc n
In collaboration with Emmanuel Arias, Santiago
continued the work on the support for applying security fixes to the
Linux kernel in Debian, without the need to reboot the machine.
As mentioned in the previous month report, kpatch
0.9.9-1
(and 0.9.9-2 afterwards) was uploaded to unstable in July, closing the
Intent to Salvage (ITS) bug.
With this upload, the remaining RC bugs were solved, and kpatch was able
to transition to Debian testing recently.
Kpatch is expected to be an important component in the live-patching
support, since it makes it easy to build a patch as a kernel module.
Emmanuel and Santiago continued to work on the design for Linux
live-patching and presented the current status in the DebConf24
presentation.
Python 3.13 Betas, by Stefano Rivera
As Python 3.13 is approaching the first
release, Stefano has been uploading
the beta releases to Debian unstable.
Most of these have uncovered small bugs that needed to be investigated
and fixed.
Stefano also took the time to review the current patch set against
cPython in Debian.
Python 3.13 isn t marked as a supported Python release in Debian s
Python tooling, yet, so nothing has been built against it, yet.
Now that the Python 3.12 transition has completed, the next task will be
to start trying to build Debian s Python module packages against Python
3.13, to estimate the work required to transition to 3.13 in unstable.
Miscellaneous contributions
Carles Pina updated the packages python-asyncclick, python-pyaarlo and
prepared updates for python-ring-doorbell and simplemonitor.
Carles Pina updated (reviewing or translating) Catalan translations
for adduser, apt-listchanges, debconf and shadow.
Colin merged OpenSSH 9.8, and prepared a corresponding release
note
for DSA support now being disabled.
This version included some substantial changes to split the server
into a listener binary and a per-session binary, and those required
some corresponding changes in the GSS-API key exchange patch.
Sorting out the details of this and getting it to work again took some
time.
Colin upgraded 11 Python packages to new upstream versions, and
modernized the build process and/or
added non-superficial autopkgtests to several more.
Rapha l Hertzog tweaked tracker.debian.org s debci task to work around
changes in the JSON output.
He also improved tracker.debian.org s ability to detect bounces due to
spam to avoid unsubscribing emails that are not broken, but that are
better than Debian at rejecting spam.
Helmut Grohne monitored the /usr-move transition with few incidents.
A notable one is that some systems have ended up with aliasing links
that don t match the ones installed by base-files which could lead
to an unpack error from dpkg.
This is now prevented by having base-files.preinst error out.
Helmut investigated toolchain bootstrap failures with gcc-14 in
rebootstrap but would only discover the cause in August.
Helmut sent a
MR
for the cross-exe-wrapper requested by Simon
McVittie for gobject-introspection.
It is a way of conditionally requesting qemu-user when emulation is
required for execution during cross compilation.
Helmut sent three patches for cross build failures.
Thorsten Alteholz uploaded packages lprint and magicfilter to fix
RC-bugs that appeared due to the introduction of gcc-14.
Santiago continued to work on activities related to the DebConf24
Content Team, including reviewing the schedule and handling updates on
it.
Santiago worked on preparations for the DebConf25, to be held in
Brest, France, next year. A video of the BoF presented during DebConf24
can be found here.
Stefano worked on preparations for DebConf24, and helped to run the event.
I m finishing typing up this blog entry hours before my last 13 hour leg back home, after I spent 2 weeks in Busan, South Korea for DebCamp24 and DebCamp24. I had a rough year and decided to take it easy this DebConf. So this is the first DebConf in a long time where I didn t give any talks. I mostly caught up on a bit of packaging, worked on DebConf video stuff, attended a few BoFs and talked to people. Overall it was a very good DebConf, which also turned out to be more productive than I expeced it would.
In the welcome session on the first day of DebConf, Nicolas Dandrimont mentioned that a benefit of DebConf is that it provides a sort of caffeine for your Debian motivation. I could certainly feel that affect swell as the days went past, and it s nice to be excited about some ideas again that would otherwise be fading.
Recovering DPL
It s a bit of a gear shift being DPL for 4 years, and DebConf Committee for nearly 5 years before that, and then being at DebConf while some issue arise (as it always does during a conference). At first I jump into high alert mode, but then I have to remind myself it s not your problem anymore and let others deal with it.
It was nice spending a little in-person time with Andreas Tille, our new DPL, we did some more handover and discussed some current issues. I still have a few dozen emails in my DPL inbox that I need to collate and forward to Andreas, I hope to finish all that up by the end of August.
During the Bits from the DPL talk, the usual question came up whether Andreas will consider running for DPL again, to which he just responded in a slide Maybe . I think it s a good idea for a DPL to do at least two terms if it all works out for everyone, since it takes a while to get up to speed on everything.
Also, having been DPL for four years, I have a lot to say about it, and I think there s a lot we can fix in the role, or at least discuss it. If I had the bandwidth for it I would have scheduled a BoF for it, but I ll very likely do that for the next DebConf instead!
Video team
I set up the standby loop for the video streaming setup. We call it loopy, it s a bunch of OBS scenes that provide announcements, shows sponsors, the schedule and some social content. I wrote about it back in 2020, but it s evolved quite a bit since then, so I m probably due to write another blog post with a bunch of updates on it. I hope to organise a video team sprint in Cape Town in the first half of next year, so I ll summarize everything before then.
It would ve been great if we could have some displays in social areas that could show talks, the loop and other content, but we were just too pressed for time for that. This year s DebConf had a very compressed timeline, and there was just too much that had to be done and that had to be figured out on the last minute. This put quite a lot of strain on the organisers, but I was glad to see how, for the most part, most attendees were very sympathetic to some rough edges (but I digress ).
I added more of the OBS machine setup to the videoteam s ansible repository, so as of now it just needs an ansible setup and the OBS data and it s good to go. The loopy data is already in the videoteam git repository, so I could probably just add a git pull and create some symlinks in ansible and then that machine can be installed from 0% to 100% by just installing via debian-installer with our ansible hooks.
This DebConf I volunteered quite a bit for actual video roles during the conference, something I didn t have much time for in recent DebConfs, and it s been fun, especially in a session or two where nearly none of the other volunteers showed up. Sometimes chaos is just fun :-)
Baekyongee is the university mascot, who s visible throughout the university. So of course we included this four legged whale creature on the loop too!
Packaging
I was hoping to do more packaging during DebCamp, but at least it was a non-zero amount:
Uploaded gdisk 1.0.10-2 to unstable (previously tested effects of adding dh-sequence-movetousr) (Closes: #1073679).
Worked a bit on bcachefs-tools (updating git to 1.9.4), but has a build failure that I need to look into (we might need a newer bindgen) update: I m probably going to ROM this package soon, it doesn t seem suitable for packaging in Debian.
Calamares: Tested a fix for encrypted installs, and uploaded it.
Calamares: Uploaded (3.3.8-1) to backports (at the time of writing it s still in backports-NEW).
Pixelorama 1.0 I did some initial packaging for Pixelorama back when we did the MiniDebConf Gaming Edition, but it had a few stoppers back then. Version 1.0 seems to fix all of that, but it depends on Godot 4.2 and we re still on the 3 series in Debian, so I ll upload this once Godot 4.2 hits at least experimental. Godot software/games is otherwise quite easy to run, it s basically just source code / data that is installed and then run via godot-runner (godot3-runner package in Debian).
BoFs
Python Team BoF
Link to the etherpad / pad archive link and video can be found on the talk page: https://debconf24.debconf.org/talks/31-python-bof/
The session ended up being extended to a second part, since all the issues didn t fit into the first session.
I was distracted by too many thing during the Python 3.12 transition (to the point where I thought that 3.11 was still new in Debian), so it was very useful listening to the retrospective of that transition.
There was a discussion whether Python 3.13 could still make it to testing in time for freeze, and it seems that there is consensus that it can, although, likely with new experimental features like disabling the global interpreter lock and the just in time compiler disabled.
I learned for the first time about the dead batteries project, PEP-0594, which removes ancient modules that have mostly been superseded, from the Python standard library.
There was some talk about the process for changing team policy, and a policy discussion on whether we should require autopkgtests as a SHOULD or a MUST for migration to testing. As with many things, the devil is in the details and in my opinion you could go either way and achieve a similar result (the original MUST proposal allowed exceptions which imho made it the same as the SHOULD proposal).
There s an idea to do some ongoing remote sprints, like having co-ordinated days for bug squashing / working on stuff together. This is a nice idea and probably a good way to energise the team and also to gain some interest from potential newcomers.
Louis-Philipe V ronneau was added as a new team admin and there was some discussion on various Sphinx issues and which Lintian tags might be needed for Python 3.13. If you want to know more, you probably have to watch the videos / read the notes :)
Debian.net BoF
Link to the etherpad / pad archive link can be found on the talk page: https://debconf24.debconf.org/talks/37-debiannet-team-bof
Debian Developers can set up services on subdomains on debian.net, but a big problem we ve had before was that developers were on their own for hosting those services. This meant that they either hosted it on their DSL/fiber connection at home, paid for the hosting themselves, or hosted it at different services which became an accounting nightmare to claim back the used funds. So, a few of us started the debian.net hosting project (sometimes we just call it debian.net, this is probably a bit of a bug) so that Debian has accounts with cloud providers, and as admins we can create instances there that gets billed directly to Debian.
We had an initial rush of services, but requests have slowed down since (not really a bad thing, we don t want lots of spurious requests). Last year we did a census, to check which of the instances were still used, whether they received system updates and to ask whether they are performing backups. It went well and some issues were found along the way, so we ll be doing that again.
We also gained two potential volunteers to help run things, which is great.
Debian Social BoF
Link to the etherpad / pad archive link can be found on the talk page: https://debconf24.debconf.org/talks/34-debiansocial-bof
We discussed the services we run, you can view the current state of things at: https://wiki.debian.org/Teams/DebianSocial
Pleroma has shown some cracks over the last year or so, and there are some forks that seem promising. At the same time, it might be worth while considering Mastodon too. So we ll do some comparison of features and maintenance and find a way forward. At the time when Pleroma was installed, it was way ahead in terms of moderation features.
Pixelfed is doing well and chugging along nicely, we should probably promote it more.
Peertube is working well, although we learned that we still don t have all the recent DebConf videos on there. A bunch of other issues should be fixed once we move it to a new machine that we plan to set up.
We re removing writefreely and plume. Nice concepts, but it didn t get much traction yet, and no one who signed up for these actually used it, which is fine, some experimentation with services is good and sometimes they prove to be very popular and other times not.
The WordPress multisite instance has some mild use, otherwise haven t had any issues.
Matrix ended up to be much, much bigger than we thought, both in usage and in its requirements. It s very stateful and remembers discussions for as long as you let it, so it s Postgres database is continuously expanding, this will also be a lot easier to manage once we have this on the new host.
Jitsi is also quite popular, but it could probably be on jitsi.debian.net instead (we created this on debian.social during the initial height of COVID-19 where we didn t have the debian.net hosting yet), although in practice it doesn t really matter where it lives.
Most of our current challenges will be solved by moving everything to a new big machine that has a few public IPs available for some VMs, so we ll be doing that shortly.
Debian Foundation Discussion BoF
This was some brainstorming about the future structure of Debian, and what steps might be needed to get there. It s way too big a problem to take on in a BoF, but we made some progress in figuring out some smaller pieces of the larger puzzle. The DPL is going to get in touch with some legal advisors and our trusted organisations so that we can aim to formalise our relationships a bit more by the time it s DebConf again.
I also introduced my intention to join the Debian Partners delegation. When I was DPL, I enjoyed talking with external organisations who wanted to help Debian, but helping external organisations help Debian turned out to be too much additional load on the usual DPL roles, so I m pursuing this with the Debian Partners team, more on that some other time.
This session wasn t recorded, but if you feel like you missed something, don t worry, all intentions will be communicated and discussed with project members before anything moves forward. There was a strong agreement in the room though that we should push forward on this, and not reach another DebConf where we didn t make progress on formalising Debian s structure more.
Social
Conference Dinner
Conference Dinner Photo from Santiago
The conference dinner took place in the university gymnasium. I hope not many people do sports there in the summer, because it got HOT. There was also some interesting observations on the thermodynamics of the attempted cooling solutions, which was amusing. On the plus side, the food was great, the company was good, and the speeches were kept to a minimum, so it was a great conference dinner, even though it was probably cut a bit short due to the heat.
Cheese and Wine
Cheese and Wine happened on 1 August, which happens to be the date I became a DD at DebConf17 in Montr al seven years before, so this was a nice accidental celebration of my Debiversary :)
Since I m running out of time, I ll add some more photos to this post some time after publishing it :P
Group Photo
As per DebConf tradition, Aigars took the group photo. You can find the high resolution version on Debian s GitLab instance.
Debian annual conference Debconf 24, Busan, South Korea Photography: Aigars Mahinovs aigarius@debian.org License: CC-BYv3+ or GPLv2+
Talking
Ah yes, talking to people is a big part of DebConf, but I didn t keep track of it very well.
I mostly listened to Alper a bit about his ideas for his talk about debian installer.
I talked to Rhonda a bit about ActivityPub and MQTT and whether they could be useful for publicising Debian activity.
Listened to Gunnar and Julian have a discussion about GPG and APT which was interesting.
We had the usual continuous keysigning party. Besides it s intended function, this is always a good ice breaker and a way to for shy people to meet other shy people.
and many other fly-by discussions.
Stuff that didn t happen this DebConf
loo.py A simple Python script that could eventually replace the obs-advanced-scene-switcher sequencer in OBS. It would also be extremely useful if we d ever replace OBS for loopy. I was hoping to have some time to hack on this, and try to recreate the current loopy in loo.py, but didn t have the time.
toetally This year videoteam had to scramble to get a bunch of resistors to assemble some tally light. Even when assembled, they were a bit troublesome. It would ve been nice to hack on toetally and get something ready for testing, but it mostly relies on having something like a rasbperry pi zero with an attached screen in order to work on further. I ll try to have something ready for the next mini conf though.
extrepo on debian live I think we should have extrepo installed by default on desktop systems, I meant to start a discussion on this, but perhaps it s just time I go ahead and do it and announce it.
Live stream to peertube server It would ve been nice to live stream DebConf to PeerTube, but the dependency tree to get this going got a bit too huge. Following our plans discussed in the Debian Social BoF, we should have this safely ready before the next MiniDebConf and should be able to test it there.
Desktop Egg there was this idea to get a stand-in theme for Debian testing/unstable until the artwork for the next release is finalized (Debian bug: #1038660), I have an idea that I meant to implement months ago, but too many things got in the way. It s based on Juliette Taka s Homeworld theme, and basically transforms the homeworld into an egg. Get it? Something that hasn t hatched yet? I also only recently noticed that we never used the actualhomeworld graphics (featuring the world image) in the final bullseye release. lol.
So, another DebConf and another new plush animal. Last but not least, thanks to PKNU for being such a generous and fantastic host to us! See you again at DebConf25 in Brest, France next year!
Welcome to the June 2024 report from the Reproducible Builds project!
In our reports, we outline what we ve been up to over the past month and highlight news items in software supply-chain security more broadly. As always, if you are interested in contributing to the project, please visit our Contribute page on our website.
Table of contents:
Next Reproducible Builds Summit dates announced
We are very pleased to announce the upcoming Reproducible Builds Summit, set to take place from September 17th 19th 2024 in Hamburg, Germany.
We are thrilled to host the seventh edition of this exciting event, following the success of previous summits in various iconic locations around the world, including Venice, Marrakesh, Paris, Berlin and Athens. Our summits are a unique gathering that brings together attendees from diverse projects, united by a shared vision of advancing the Reproducible Builds effort. During this enriching event, participants will have the opportunity to engage in discussions, establish connections and exchange ideas to drive progress in this vital field. Our aim is to create an inclusive space that fosters collaboration, innovation and problem-solving.
If you re interesting in joining us this year, please make sure to read the event page which has more details about the event and location. We are very much looking forward to seeing many readers of these reports there.
GNU Guix patch review session for reproducibility
Vagrant Cascadian will be holding a Reproducible Builds session as part of the monthly Guix patch review series on July 11th at 17:00 UTC.
These online events are intended to encourage everyone everyone becoming a patch reviewer and the goal of reviewing patches is to help Guix project accept contributions while maintaining our quality standards and learning how to do patch reviews together in a friendly hacking session.
New reproducibility-related academic papers
Multiple scholarly papers related to Reproducible Builds were published this month:
An Industry Interview Study of Software Signing for Supply Chain Security was published by Kelechi G. Kalu, Tanmay Singla, Chinenye Okafor, Santiago Torres-Arias and James C. Davis of Electrical and Computer Engineering department of Purdue University, Indiana, USA, and is concerned with:
To understand software signing in practice, we interviewed 18 high-ranking industry practitioners across 13 organizations. We provide possible impacts of experienced software supply chain failures, security standards, and regulations on software signing adoption. We also study the challenges that affect an effective software signing implementation.
Code signing enables software developers to digitally sign their code using cryptographic keys, thereby associating the code to their identity. This allows users to verify the authenticity and integrity of the software, ensuring it has not been tampered with. Next-generation software signing such as Sigstore and OpenPubKey simplify code signing by providing streamlined mechanisms to verify and link signer identities to the public key. However, their designs have vulnerabilities: reliance on an identity provider introduces a single point of failure, and the failure to follow the principle of least privilege on the client side increases security risks. We introduce Diverse Identity Verification (DiVerify) scheme, which strengthens the security guarantees of next-generation software signing by leveraging threshold identity validations and scope mechanisms.
[ ] resulted in an extension of GNU make which is called rmake, where diffoscope a tool for detecting differences between a large number of file types was integrated into the workflow of make. rmake was later used to answer the posed research questions for this thesis. We found that different build paths and offsets are a big problem as three out of three tested Free and Open Source Software projects all contained these variations. The results also showed that gcc s optimisation levels did not affect reproducibility, but link-time optimisation embeds a lot of unreproducible information in build artefacts. Lastly, the results showed that build paths, build ID s and randomness are the three most common groups of variations encountered in the wild and potential solutions for some variations were proposed.
The thesis serves as an introduction to the concept of reproducibility in software engineering, offering a comprehensive overview of formalizations using mathematical notations for key concepts and an empirical evaluation of several key tools. By exploring various case studies, methodologies and tools, the research aims to provide actionable insights for practitioners and researchers alike.
Development news
In Debian this month, 4 reviews of Debian packages were added, 11 were updated and 14 were removed this month adding to our knowledge about identified issues. Only one issue types was updated, though, explaining that we don t vary the build path anymore.
On our mailing list this month, Bernhard M. Wiedemann wrote that whilst he had previously collected issues that introduce non-determinism he has now moved on to discuss about mitigations , in the sense of how can we avoid whole categories of problem without patching an infinite number of individual packages . In addition, Janneke Nieuwenhuizen announced the release of two versions of GNU Mes. [][]
In openSUSE news, Bernhard M. Wiedemann published another report for that distribution.
In NixOS, with the 24.05 release out, it was again validated that our minimal ISO is reproducible by building it on a virtual machine with no access to the binary cache.
What s more, we continued to write patches in order to fix specific reproducibility issues, including Bernhard M. Wiedemann writing three patches (for qutebrowser, samba and systemd), Chris Lamb filing Debian bug #1074214 against the fastfetch package and Arnout Engelen proposing fixes to refind and for the Scala compiler [.
Lastly, diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues. This month, Chris Lamb uploaded two versions (270 and 271) to Debian, and made the following changes as well:
Drop Build-Depends on liblz4-tool in order to fix Debian bug #1072575. []
Update tests to support zipdetails version 4.004 that is shipped with Perl 5.40. []
Website updates
There were a number of improvements made to our website this month, including Akihiro Suda very helpfully making the <h4> elements more distinguishable from the <h3> level [][] as well as adding a guide for Dockerfile reproducibility []. In addition Fay Stegerman added two tools, apksigcopier and reproducible-apk-tools, to our Tools page.
Reproducibility testing framework
The Reproducible Builds project operates a comprehensive testing framework running primarily at tests.reproducible-builds.org in order to check packages and other artifacts for reproducibility. In June, a number of changes were made by Holger Levsen, including:
Marking the virt(32 64)c-armhf nodes as down. []
Granting a developer access to the osuosl4 node in order to debug a regression on the ppc64el architecture. []
Granting a developer access to the osuosl4 node. [][]
In addition, Mattia Rizzolo re-aligned the /etc/default/jenkins file with changes performed upstream [] and changed how configuration files are handled on the rb-mail1 host. [], whilst Vagrant Cascadian documented the failure of the virt32c and virt64c nodes after initial investigation [].
If you are interested in contributing to the Reproducible Builds project, please visit our Contribute page on our website. However, you can get in touch with us via:
Looking further afield to the broader Debian ecosystem, LTS contributor Bastien Roucari s also patched sendmail in Debian 12 (bookworm) and 11 (bullseye) in order to fix the previously mentioned SMTP smuggling vulnerability. Furthermore, LTS contributor Thorsten Alteholz provided fixes for the cups packages in Debian 12 (bookworm) and 11 (bullseye) in order to fix the aforementioned arbitrary remote code execution vulnerability.
Additionally, LTS contributor Ben Hutchings has commenced work on an updated backport of Linux kernel 6.1 to Debian 11 (bullseye), in preparation for bullseye transitioning to the responsibility of the LTS (and the associated closure of the bullseye-backports repository). LTS Lucas Kanashiro also began the preparatory work of backporting parts of the rust/cargo toolchain to Debian 11 (bullseye) in order to make future updates of the clamav virus scanner possible.
June was the final month of LTS for Debian 10 (as announced on the
debian-lts-announce
mailing list). No additional Debian 10 security updates will be made available
on security.debian.org.
However, Freexian and its team of paid Debian contributors will continue
to maintain Debian 10 going forward for the customers of the
Extended LTS offer. Subscribe right
away if you sill have Debian 10 which must be kept secure (and which
cannot yet be upgraded).
Thanks to our sponsors
Sponsors that joined recently are in bold.
YubiHSM packaging, by Colin Watson
Freexian is starting to use YubiHSM devices (hardware security modules)
as part of some projects, and we wanted to have the supporting software
directly in Debian rather than needing to use third-party repositories.
Since Yubico publish everything we need under free software licences,
Colin packaged yubihsm-connector, yubihsm-shell, and
python-yubihsm from
https://developers.yubico.com/, in
some cases based partly on the upstream packaging, and got them all into
Debian unstable.
Backports to bookworm will be forthcoming once they ve all reached
testing.
unschroot by Helmut Grohne
Following an in-person discussion at MiniDebConf Berlin, Helmut
attempted splitting the containment functionality of sbuild --chroot-mode=unshare into a dedicated tool interfacing with sbuild
as a variant of --chroot-mode=schroot providing a sufficiently
compatible
interface.
While this seemed technically promising initially, a discussion on
debian-devel
indicated a desire to rely on an existing container runtime such as
podman instead of using another Debian-specific tool with unclear long
term maintenance.
None of the existing container runtimes meet the specific needs of
sbuild, so further advancing this matter implies a compromise one way
or another.
Linux live-patching, by Santiago Ruano Rinc n
In collaboration with Emmanuel Arias, Santiago is
working on the development of linux live-patching for Debian.
For the moment, this is in an exploratory phase, that includes how to
handle the different patches that will need to be provided.
kpatch could help significantly
in this regard.
However, kpatch was removed from unstable because there are some RC bugs
affecting the version that was present in Debian unstable.
Santiago packaged the most recent upstream version
(0.9.9)
and filed an Intent to Salvage
bug.
Santiago is waiting for an ACK by the maintainer, and will upload to
unstable after July 10th, following the package salvaging rules.
While kpatch 0.9.9 fixes the main issues, it still needs some work to
properly support Debian and the Linux kernel versions packaged in our
distribution.
More on this in the report next month.
Salsa CI, by Santiago Ruano Rinc n
The work by Santiago in Salsa CI this month includes a merge
request
to ease testing how the production images are built from the changes
introduced by future merge requests.
By default, the pipelines triggered by a merge request build a subset of
the images built for production, to reduce the use of resources, and
because most of the time the subset of staging images is enough to test
the proposed modifications.
However, sometimes it is needed to test how the full set of production
images is built, and the above mentioned MR helps to do that.
The changes include documentation, so hopefully this will make it easier
to test future contributions.
Also, for being able to include support for RISC-V, Salsa CI needs to
replace
kaniko as
the tool used to build the images.
Santiago tested
buildah,
but there are some issues when pushing built images for non-default
platform architectures (i386, armhf, armel) to the container registry.
Santiago will continue to work on this to find a solution.
Miscellaneous contributions
Stefano Rivera prepared updates for a number of Python modules.
Stefano uploaded the latest point release of Python 3.12 and the
latest Python 3.13 beta.
Both uncovered upstream regressions that had to be addressed.
Stefano worked on preparations for DebConf 24.
Stefano helped SPI to reconcile their financial records for DebConf
23.
Colin did his usual routine work on the Python team, upgrading 36
packages to new upstream versions (including fixes for four CVEs in
python-aiohttp), fixing RC bugs in ipykernel, ipywidgets,
khard, and python-repoze.sphinx.autointerface, and packaging
zope.deferredimport which was needed for a new upstream version of
python-persistent.
Colin removed the user_readenv option from OpenSSH s PAM
configuration (#1018260), and
prepared a release note.
Thorsten Alteholz uploaded a new upstream version of cups.
Nicholas Skaggs updated xmacro to support reproducible builds
(#1014428),
DEP-3 and DEP-5 compatibility, along with utilizing hardening build
flags.
Helmut supported and uploaded package.
As a result of login having become non-essential, Helmut uploaded
debvm to unstable and stable and fixed a crossqa.debian.net worker.
Santiago worked on the Content Team activities for DebConf24.
Together with other DebConf25 team members, Santiago wrote a document
for the head of the venue to describe the project of the conference.
Tobias Frost
did 7.75h (out of 10.0h assigned and 2.0h from previous period), thus carrying over 4.25h to the next month.
Evolution of the situation
In May, we have released 20 DLAs.
Notable security updates in May included:
apache2: multiple vulnerabilities which may result in HTTP response splitting, denial of service, or authorization bypass (by Bastien Roucari s, in collaboration with apache2 maintainer Yadd)
bind9: two vulnerabilities, called KeyTrap and NSEC3, which may result in denial of service (by Santiago Ruano Rinc n)
python-pymysql: potential SQL injection attack (by Chris Lamb)
The aforementioned apache2 was prepared by its Debian maintainer Yadd. This update also involved work on the package test suite in buster, which contributor Bastien Roucari s then forwarded to the apache2 package in unstable. More importantly, a regression in fossil was reported, and Bastien prepared a fix for it. Bastien coordinated the upload of both packages to minimize the introduction of regressions.
Contributor Daniel Leidert also prepared an upload of runc to Debian 11 in order fix a number of CVEs still affecting that package. Finally, contributor Thorsten Alteholz prepared uploads for qtbase-opensource-src, libjwt, and libmicrohttpd in Debian 11. Note that Debian 11 will pass into the LTS phase of support in August and these updates will improve the state and long-term supportability of Debian 11.
Debian 10 is presently in its final month of LTS support (as announced on the
debian-lts-announce
mailing list, support will end on June 30th), after which no new
security updates will be made available on security.debian.org.
However, Freexian and its team of paid Debian contributors will continue
to maintain Debian 10 going forward for the customers of the
Extended LTS offer. Subscribe right
away if you sill have Debian 10 which must be kept secure (and which
cannot yet be upgraded).
Thanks to our sponsors
Sponsors that joined recently are in bold.
DebConf Bursary updates, by Utkarsh Gupta
Utkarsh is the bursaries team lead for DebConf 24. Bursary
requests are dispatched to a
team of volunteers to review. The results are collated, adjusted and merged to
produce priority lists of requests to fund. Utkarsh raised the team,
coordinated the review, and issued bursaries to attendees.
/usr-move, by Helmut Grohne
More and more, the /usr-move transition is being carried out by multiple
contributors and many performed around a hundred of the requested uploads. Of
these, Helmut contributed five patches and two uploads. As a result, there are
less than 350 packages left to be converted, and all of the non-trivial cases
have patches. We started with three times that number. Thanks to everyone
involved for supporting this effort.
For people interested in background information of this transition,
Helmut gave a presentation at MiniDebConf Berlin
2024
(slides).
sbuild, by Helmut Grohne
While unshare mode of sbuild has existed for quite a while, it is
now getting significant use in Debian, and new problems are popping up.
Helmut looked into an apparmor-related
failure and provided a diagnosis.
While relevant code would detect the chroot nature of a schroot
backend and skip apparmor tests, the unshare environment would be
just good enough to run and fail the test. As sbuild exposes fewer
special kernel filesystems, the tests will be skipped again.
Another problem popped up when gobject-introspection added a
dependency on the host architecture Python interpreter in a cross build
environment. sbuild would prefer installing (and failing) a host
architecture Python to installing the qemu alternative. Attempts to
fix this would result in systemd killing
sbuild. ischroot as used by
libc6.postinst would not classify the unshare environment as a
chroot. Therefore libc6.postinst would run telinit which would kill
the build process. This is a complex interaction problem that shall
eventually be solved by providing triggers from libc6 to be
implemented by affected init systems.
Salsa CI updates, by Santiago Ruano Rinc n
Several issues arose about Salsa CI last month, and it is probably worth
mentioning part of the challenges of defining its framework in YAML.
With the upcoming end-of-support of Debian 10 buster as LTS, armel was
removed from deb.debian.org, making the jobs that build images for
buster/armel to fail. While the removal of buster/armel from the
repositories is a natural change, it put some light on the flaws in
the Salsa CI design regarding the support of the different Debian
releases. Currently, the images are defined like these (from
.images-debian.yml):
Evidently, this increases duplication of the release support data, which
is of course not optimal and it is error prone when changing the data
about supported releases. A better approach would be to have two
different YAML lists, such as:
# releases that have partial support. E.g.: buster is transitioning to# Debian LTS, and buster armel is no longer found in deb.debian.org.old-releases: &old-releases - stretch - buster.currently-supported-releases: ¤tly-supported-releases - bullseye - bullseye-backports - bookworm - bookworm-backports - trixie - sid - experimental
that could be used in the matrix of the jobs that build all the images
available in the pipeline container registry.
However, due to limitations in
GitLab,
it is not possible to expand the variables or mapping values in a
parallel:matrix context. At least not in an elegant fashion.
This is the kind of issue that recently arose and that Santiago is
currently working to solve, in the simplest possible way.
Astute readers would notice that stretch is listed in the fully
supported releases. And there is no problem with stretch, because it is
built from archive.debian.org. Otto actually has tried to
fix
the broken image build job doing the same, but it is still incorrect,
because the security repository is not (yet) available in archive.debian.org.
Additionally, Santiago has also worked on other merge requests, such as:
Archiving DebConf Websites, by Stefano Rivera
DebConf, the annual Debian conference, has its own new website every
year. These are typically complex dynamic web applications (featuring
registration, call for papers, scheduling, etc.) Once the conference is
over, there is no need to keep maintaining these applications, so we
archive the sites off as static HTML, and serve them from Debian s
static CDN.
Stefano archived the websites for the last two DebConfs.
The schedule system behind DebConf 14
and 15 s websites was a derivative of
Canonical s summit
system. This was only used for a couple of years before migrating to
wafer, the current system. Archiving
summit content has been on the nice to have list for years, but nobody
has ever tackled it. The machine that served the sites went away a
couple of years ago. After much digging, a backup of the database was
found, and Stefano got this code running on an ancient Python 2.7.
Recently Stefano put this all together and hooked in an archive export
to finally get this content preserved.
Python 3.x and pypy3 security bug triage, by Stefano Rivera
Stefano Rivera triaged all the open security bugs against the Python 3.x
and PyPy3 packages for Debian s stable and LTS releases. Several had
been fixed but this wasn t recorded in the security tracker.
Linux livepatching support for Debian, by Santiago Ruano Rinc n
In collaboration with Emmanuel Arias, Santiago filed ITP bug
#1070494.
As stated in the bug, more than an Intent to Package, it is an Intent to
Design and Implement live patching support for the Linux kernel in
Debian. For now, Emmanuel and Santiago have done exploratory work and
they are working to understand the different possibilities to implement
livepatching. One possible direction is to rely on
kpatch, and the other is to
package the modules using regular packaging tools. Also, it is needed
to evaluate if it is possible to rely on distributing the modules via
packages, or instead as a service, as it is done by some commercial
distributions.
Miscellaneous contributions
Thorsten Alteholz uploaded cups-bjnp to improve packaging.
Colin Watson tracked down a baffling CI issue in openssh to unblock several merge requests, removed the user_readenv=1 option from its PAM configuration, and started on the first stage of his plan to split out GSS-API key exchange support to separate packages.
Colin did his usual routine work on the Python team, upgrading 26 packages to new upstream versions, and cherry-picking an upstream PR to fix a pytest 8 incompatibility in ipywidgets.
Colin NMUed a couple of packages to reduce the need for explicit overrides in Packages-arch-specific, and removed some other obsolete entries from there.
Emilio managed various library transitions, and helped finish a few of the remaining t64 transitions.
Helmut sent patches for 7 cross build failures, 6 other debian bugs and fixed an infrastructure problem in crossqa.debian.net.
Nicholas worked on a sponsored package upload, and discovered the blhc tool for diagnosing build hardening.
Stefano Rivera started and completed the re2 transition. The release team suggested moving to a virtual package scheme that includes the absl ABI (as re2 now depends on it). Adopted this.
Stefano continued to work on DebConf 24 planning.
Santiago continued to work on DebConf24 Content tasks as well as Debconf25 organisation.
Tobias Frost
did 10.0h (out of 12.0h assigned), thus carrying over 2.0h to the next month.
Utkarsh Gupta
did 3.25h (out of 28.5h assigned and 29.25h from previous period), thus carrying over 54.5h to the next month.
Evolution of the situation
In April, we have released 28 DLAs.
During the month of April, there was one particularly notable security update made in LTS. Guilhem Moulin prepared DLA-3782-1 for util-linux (part of the set of base packages and containing a number of important system utilities) in order to address a possible information disclosure vulnerability.
Additionally, several contributors prepared updates for oldstable (bullseye), stable (bookworm), and unstable (sid), including:
ruby-rack: prepared for oldstable, stable, and unstable by Adrian Bunk
wpa: prepared for oldstable, stable, and unstable by Bastien Roucari s
zookeeper: prepared for stable by Bastien Roucari s
libjson-smart: prepared for unstable by Bastien Roucari s
ansible: prepared for stable and unstable, including autopkgtest fixes to increase future supportability, by Lee Garrett
wordpress: prepared for oldstable and stable by Markus Koschany
emacs and org-mode: prepared for oldstable and stable by Sean Whitton
qtbase-opensource-src: prepared for oldstable and stable by Thorsten Alteholz
libjwt: prepared for oldstable by Thorsten Alteholz
libmicrohttpd: prepared for oldstable by Thorsten Alteholz
These fixes were in addition to corresponding updates in LTS.
Another item to highlight in this month s report is an update to the distro-info-data database by Stefano Rivera. This update ensures that Debian buster systems have the latest available information concerning the end-of-life dates and other related information for all releases of Debian and Ubuntu.
As announced on the debian-lts-announce
mailing list, it is worth to point out that we are getting close to
the end of support of Debian 10 as LTS. After June 30th, no new
security updates will be made available on security.debian.org.
However, Freexian and its team of paid Debian contributors will continue
to maintain Debian 10 going forward for the customers of the
Extended LTS offer. If you still have Debian 10
servers to keep secure, it s time to subscribe!
Thanks to our sponsors
Sponsors that joined recently are in bold.
Contributing to Debian
is part of Freexian s mission. This article
covers the latest achievements of Freexian and their collaborators. All of this
is made possible by organizations subscribing to our
Long Term Support contracts and
consulting services.
P.S. We ve completed over a year of writing these blogs. If you have any
suggestions on how to make them better or what you d like us to cover, or any
other opinions/reviews you might have, et al, please let us know by dropping
an email to us. We d be
happy to hear your thoughts. :)
Salsa CI updates & GSoC candidacy, by Santiago Ruano Rincon
In the context of Google Summer of Code (GSoC), Santiago continued the
mentoring work, following the applications of three of the candidates. This
work started in March, but
Aquila Macedo,
Ahmed Siam and
Piyush Raj continued in April to propose and
review MRs. For example,
Update CI pipeline to utilize specific blhc image per release
and Remove references to buster-backports
by Aquila, or the reviews the candidates made to
Document the structure of the different components of the pipeline
(see below).
Unfortunately, the Salsa CI project didn t get any slot from the GSoC program
in the end.
Along with the Salsa CI related work, Santiago improved the documentation of
Salsa CI, to make it easier for newcomers (as the GSoC candidates) or people
willing to fork the project to understand its internals. Documentation is an
aspect where a lot of improvements can be made.
OpenSSH option review, by Colin Watson
In light of last month s xz-utils backdoor,
Colin did an extensive
review of some
of the choices in Debian s OpenSSH packaging. Some work on this has already
been done
(removing uses of libsystemd
and reducing tcp-wrappers linkage); the next
step is likely to be to start work on the plan to split out GSS-API key
exchange again.
Miscellaneous contributions
Utkarsh Gupta started to put together and kickstart the bursary team ahead of
DebConf 24, to be held in Busan, South Korea.
Utkarsh Gupta reviewed some MRs and docs for the bursary team for the DC24 website.
Helmut Grohne sent patches for 19 cross build failures and submitted a gcc
patch removing LIMITS_H_TESTupstream.
Helmut sent 8 bug reports with 3 patches related to the /usr-move.
Helmut diagnosed why /dev/stdout is
not accessible in sbuild --mode=unshare.
Thorsten Alteholz uploaded foo2zjs and fixed two bugs, one related to
/usr-merge. Likewise the upload of cups-filters (from the 1.x branch) fixed
three bugs. In order to fix an RC bug in cpdb-backends-cups, which was
updated to the 2.x branch, the new package libcupsfilters has been
introduced. Last but not least an upload of hplip fixed one RC bug and an
upload of gutenprint fixed two of them. All of these RC bugs were more or
less related to the time_t transition.
Santiago continued to work in the DebConf organization tasks, including some
for the DebConf 24 Content Team, and looking to build a local community for
DebConf 25.
Stefano Rivera made a couple of uploads of dh-python to Debian, and a few
other general package update uploads.
Stefano did some winding up of DebConf 23 finances, including closing bursary
claims and recording the amounts spent on travel bursaries.
Stefano opened DebConf 24 registration, which always requires some
last-minute work on the website.
Contributing to Debian
is part of Freexian s mission. This article
covers the latest achievements of Freexian and their collaborators. All of this
is made possible by organizations subscribing to our
Long Term Support contracts and
consulting services.
P.S. We ve completed over a year of writing these blogs. If you have any
suggestions on how to make them better or what you d like us to cover, or any
other opinions/reviews you might have, et al, please let us know by dropping an
email to us. We d be
happy to hear your thoughts. :)
SSO Authentication for jitsi.debian.social, by Stefano Rivera
Debian.social s jitsi instance has been getting
some abuse by (non-Debian) people sharing sexually explicit content on the
service. After playing whack-a-mole with this for a month, and shutting the
instance off for another month, we opened it up again and the abuse immediately
re-started.
Stefano sat down and wrote an
SSO Implementation
that hooks into Jitsi s existing JWT SSO support. This requires everyone using
jitsi.debian.social to have a Salsa account.
With only a little bit of effort, we could change this in future, to only
require an account to open a room, and allow guests to join the call.
/usr-move, by Helmut Grohne
The biggest task this month was sending mitigation patches for all of the
/usr-move issues arising from package renames due to the 2038 transition. As a
result, we can now say that every affected package in unstable can either be
converted with dh-sequence-movetousr or has an open bug report. The package
set relevant to debootstrap except for the set that has to be uploaded
concurrently has been moved to /usr and is awaiting migration. The move of
coreutils happened to affect piuparts which hard codes the location of
/bin/sync and received multiple updates as a result.
Miscellaneous contributions
Stefano Rivera uploaded a stable release update to python3.11 for bookworm,
fixing a use-after-free crash.
Stefano uploaded a new version of python-html2text, and updated
python3-defaults to build with it.
In support of Python 3.12, Stefano dropped distutils as a Build-Dependency
from a few packages, and uploaded a complex set of patches to python-mitogen.
Stefano landed some merge requests to clean up dead code in dh-python,
removed the flit plugin, and uploaded it.
Stefano uploaded new upstream versions of twisted, hatchling,
python-flexmock, python-authlib, python mitogen, python-pipx, and xonsh.
Stefano requested removal of a few packages supporting the Opsis HDMI2USB
hardware that DebConf Video team used to use for HDMI capture, as they are
not being maintained upstream. They started to FTBFS, with recent sdcc
changes.
DebConf 24 is getting ready to open registration, Stefano spent some time
fixing bugs in the website, caused by infrastructure updates.
Stefano reviewed all the DebConf 23 travel reimbursements, filing requests
for more information from SPI where our records mismatched.
Roberto C. S nchez worked on facilitating the transfer of upstream
maintenance responsibility for the dormant Shorewall project to a new team
led by the current maintainer of the Shorewall packages in Debian.
Colin Watson fixed build failures in celery-haystack-ng, db1-compat,
jsonpickle, libsdl-perl, kali, knews, openssh-ssh1,
python-json-log-formatter, python-typing-extensions, trn4, vigor, and
wcwidth. Some of these were related to the 64-bit time_t transition, since
that involved enabling -Werror=implicit-function-declaration.
Colin fixed an
off-by-one error in neovim,
which was already causing a build failure in Ubuntu and would eventually have
caused a build failure in Debian with stricter toolchain settings.
Colin added an sshd@.service template to
openssh to help newer systemd versions make containers and VMs SSH-accessible
over AF_VSOCK sockets.
Following the xz-utils backdoor, Colin
spent some time testing and discussing OpenSSH upstream s proposed
inline systemd notification patch,
since the current implementation via libsystemd was part of the attack vector
used by that backdoor.
Utkarsh reviewed and sponsored some Go packages for Lena Voytek and Rajudev.
Utkarsh also helped Mitchell Dzurick with the adoption of pyparted package.
Helmut sent 10 patches for cross build failures.
Helmut partially fixed architecture cross bootstrap tooling to deal with
changes in linux-libc-dev and the recent gcc-for-host changes and also
fixed a 64bit-time_t FTBFS in libtextwrap.
Thorsten Alteholz uploaded several packages from debian-printing: cjet,
lprng, rlpr and epson-inkjet-printer-escpr were affected by the newly enabled
compiler switch -Werror=implicit-function-declaration. Besides fixing these
serious bugs, Thorsten also worked on other bugs and could fix one or the
other.
Carles updated simplemonitor and python-ring-doorbell packages with new
upstream versions.
Santiago also reviewed applications for the
improving Salsa CI in Debian
GSoC 2024 project. We received applications from four very talented
candidates. The selection process is currently ongoing. A huge thanks to all
of them!
As part of the DebConf 24 organization, Santiago has taken part in the
Content team discussions.
Like each month, have a look at the work funded by Freexian s Debian LTS offering.
I m finishing typing up this blog entry hours before my last 13 hour leg back home, after I spent 2 weeks in 
Conference Dinner Photo from Santiago
