• as you might have read in the ftp-master sprint report, we have a new ftp-master: congrats Ansgar! (delegation update pending, but no suspense here)
• we have a new front-desk member (delegation pending + suspense)
• we have a new debian policy team (delegation pending + suspense)
• the tech-ctte is in the process of selecting a new candidate to fill the vacant seat. I've nominated a couple of candidates myself, and I'm now waiting for tech-ctte recommendations as per Constitution 6.2. On related news, the tech-ctte has now dealt with the conflict on Python interpreter maintenership, which was also the longest standing issue brought before them. Having invested quite some energy in that issue myself, I'm delighted to see it finally addressed.

echo 'DEBSIGN_KEYID=0x0123ABCD' >> ~/.devscripts

[DEFAULT]
builder = debuild -i -I -k1234ABCD
...

self.assoc_data.update(dict([tuple(ad.strip().split("=")) for ad in data[header_len:].split(",") if ad.find("=") > -1]))

Related articles

• Verifying NTP Reserved Mode Denial of Service Vulnerability (gursevkalra.blogspot.com)
• Time precision between NTP and GPS source (stackoverflow.com)

• Require that Secure Boot be disabled
  
  Not ideal. The UI for doing this is going to vary significantly between machines, making it difficult to document. It also means that the security benefits of Secure Boot are lost.
  
  
• Require that the machine be placed in Setup Mode
  
  Clearing the enrolled Platform Key results in the system transitioning into Setup Mode, and from then on new keys can be enrolled into the key database until a new Platform Key is enrolled. Distributions could ship an unsigned bootloader that then writes the distribution keys into the database - James Bottomley has an example here. This means that the distribution can still benefit from Secure Boot, but otherwise has the same downside that the UI for doing this will vary between machines.
  
  
• Ship with a signed bootloader that can add keys to its own database
  
  This is more interesting. Suse's bootloader design involves the bootloader having its own key database, distinct from those provided by the UEFI specification. The bootloader will execute any second stage bootloaders signed with a key in that database. Since the bootloader is in charge of its own key enrolment, the bootloader is free to impose its own policy - including enrolling new keys off a filesystem.

• Seine-Eure marathon, the flattest marathon in France, on October 21st. This marathon is the one where I set the record which I just broke in June, in Caen. So, the goal is easy to find : break it again. My target time is around 3h37. Not so ambitious in apparence, with a current record at 3h38'45". However, I can't afford the highly meticulous preparation I did in April-May-June, so I try to stay with an achievable target.
• The Le Raid Le Puy-Firminy 70km night run on November 24th. Here, I'll just try to go faster than 9h15 which I achieved last year, trying to have a better race management and avoid cramps. Of course, meteorological conditions will be the key, here, as it can be as low as -15 C in that part of France, in November..:-)

1. Machine A is our main virtualization machine and hosts several virtual machines. (VMs)
2. Each VM has its own VNC port assigned. (usually the port range goes from 5900 to 5910 or even more if the hosted VMs are more than 10)
3. We ll be using libvirt, thus virsh.

sudo virsh
virsh # list
Id   Name   Status
----------------------------------------------------
5    foo    running
6    bar    running
7    foobar running
virsh # vncdisplay foobar
:3

ssh -f -N -L 5910:localhost:5903 user@machine-A.com

1. -N tells SSH to not execute any command after logging in.
2. -f tells SSH to hide into the background just before the command gets executed.
3. -L enables the port forwarding between the local (client) host and the host on the remote side.

Protocol: VNC - Virtual Network Computing
Server: localhost - 127.0.0.1
Port: 5910

1. Machine A is our main virtualization machine and hosts several virtual machines. (VMs)
2. Each VM has its own VNC port assigned. (usually the port range goes from 5900 to 5910 or even more if the hosted VMs are more than 10)
3. We ll be using libvirt, thus virsh.

sudo virsh
virsh # list
Id   Name   Status
----------------------------------------------------
5    foo    running
6    bar    running
7    foobar running
virsh # vncdisplay foobar
:3

ssh -f -N -L 5910:localhost:5903 user@machine-A.com

1. -N tells SSH to not execute any command after logging in.
2. -f tells SSH to hide into the background just before the command gets executed.
3. -L enables the port forwarding between the local (client) host and the host on the remote side.

Protocol: VNC - Virtual Network Computing
Server: localhost - 127.0.0.1
Port: 5910

#if [ "$list" ] && ! $in_submenu; then
#echo "submenu \"Previous Linux versions\" "
#in_submenu=:
#fi

#if $in_submenu; then
# echo " "
#fi

ssize_t
sock_fd_write(int sock, void *buf, ssize_t buflen, int fd)
 
    ssize_t     size;
    struct msghdr   msg;
    struct iovec    iov;
    union  
        struct cmsghdr  cmsghdr;
        char        control[CMSG_SPACE(sizeof (int))];
      cmsgu;
    struct cmsghdr  *cmsg;
    iov.iov_base = buf;
    iov.iov_len = buflen;
    msg.msg_name = NULL;
    msg.msg_namelen = 0;
    msg.msg_iov = &iov;
    msg.msg_iovlen = 1;
    if (fd != -1)  
        msg.msg_control = cmsgu.control;
        msg.msg_controllen = sizeof(cmsgu.control);
        cmsg = CMSG_FIRSTHDR(&msg);
        cmsg->cmsg_len = CMSG_LEN(sizeof (int));
        cmsg->cmsg_level = SOL_SOCKET;
        cmsg->cmsg_type = SCM_RIGHTS;
        printf ("passing fd %d\n", fd);
        *((int *) CMSG_DATA(cmsg)) = fd;
      else  
        msg.msg_control = NULL;
        msg.msg_controllen = 0;
        printf ("not passing fd\n");
     
    size = sendmsg(sock, &msg, 0);
    if (size < 0)
        perror ("sendmsg");
    return size;
 

ssize_t
sock_fd_read(int sock, void *buf, ssize_t bufsize, int *fd)
 
    ssize_t     size;
    if (fd)  
        struct msghdr   msg;
        struct iovec    iov;
        union  
            struct cmsghdr  cmsghdr;
            char        control[CMSG_SPACE(sizeof (int))];
          cmsgu;
        struct cmsghdr  *cmsg;
        iov.iov_base = buf;
        iov.iov_len = bufsize;
        msg.msg_name = NULL;
        msg.msg_namelen = 0;
        msg.msg_iov = &iov;
        msg.msg_iovlen = 1;
        msg.msg_control = cmsgu.control;
        msg.msg_controllen = sizeof(cmsgu.control);
        size = recvmsg (sock, &msg, 0);
        if (size < 0)  
            perror ("recvmsg");
            exit(1);
         
        cmsg = CMSG_FIRSTHDR(&msg);
        if (cmsg && cmsg->cmsg_len == CMSG_LEN(sizeof(int)))  
            if (cmsg->cmsg_level != SOL_SOCKET)  
                fprintf (stderr, "invalid cmsg_level %d\n",
                     cmsg->cmsg_level);
                exit(1);
             
            if (cmsg->cmsg_type != SCM_RIGHTS)  
                fprintf (stderr, "invalid cmsg_type %d\n",
                     cmsg->cmsg_type);
                exit(1);
             
            *fd = *((int *) CMSG_DATA(cmsg));
            printf ("received fd %d\n", *fd);
          else
            *fd = -1;
      else  
        size = read (sock, buf, bufsize);
        if (size < 0)  
            perror("read");
            exit(1);
         
     
    return size;
 

void
child(int sock)
 
    int fd;
    char    buf[16];
    ssize_t size;
    sleep(1);
    for (;;)  
        size = sock_fd_read(sock, buf, sizeof(buf), &fd);
        if (size <= 0)
            break;
        printf ("read %d\n", size);
        if (fd != -1)  
            write(fd, "hello, world\n", 13);
            close(fd);
         
     
 
void
parent(int sock)
 
    ssize_t size;
    int i;
    int fd;
    fd = 1;
    size = sock_fd_write(sock, "1", 1, 1);
    printf ("wrote %d\n", size);
 
int
main(int argc, char **argv)
 
    int sv[2];
    int pid;
    if (socketpair(AF_LOCAL, SOCK_STREAM, 0, sv) < 0)  
        perror("socketpair");
        exit(1);
     
    switch ((pid = fork()))  
    case 0:
        close(sv[0]);
        child(sv[1]);
        break;
    case -1:
        perror("fork");
        exit(1);
    default:
        close(sv[1]);
        parent(sv[0]);
        break;
     
    return 0;
 

void
parent(int sock)
 
    ssize_t size;
    int i;
    int fd;
    fd = 1;
    size = sock_fd_write(sock, "1", 1, -1);
    printf ("wrote %d without fd\n", size);
    size = sock_fd_write(sock, "1", 1, 1);
    printf ("wrote %d with fd\n", size);
    size = sock_fd_write(sock, "1", 1, -1);
    printf ("wrote %d without fd\n", size);
 

void
child(int sock)
 
    int fd;
    char    buf[16];
    ssize_t size;
    sleep(1);
    size = sock_fd_read(sock, buf, sizeof(buf), NULL);
    if (size <= 0)
        return;
    printf ("read %d\n", size);
    size = sock_fd_read(sock, buf, sizeof(buf), &fd);
    if (size <= 0)
        return;
    printf ("read %d\n", size);
    if (fd != -1)  
        write(fd, "hello, world\n", 13);
        close(fd);
     
 
void
parent(int sock)
 
    ssize_t size;
    int i;
    int fd;
    fd = 1;
    size = sock_fd_write(sock, "1", 1, 1);
    printf ("wrote %d without fd\n", size);
    size = sock_fd_write(sock, "1", 1, 2);
    printf ("wrote %d with fd\n", size);
 

void
parent(int sock)
 
    ssize_t size;
    int i;
    int fd;
    fd = 1;
    size = sock_fd_write(sock, "1", 1, -1);
    printf ("wrote %d without fd\n", size);
    size = sock_fd_write(sock, NULL, 0, 1);
    printf ("wrote %d with fd\n", size);
    size = sock_fd_write(sock, "1", 1, -1);
    printf ("wrote %d without fd\n", size);
 

1. read and recvmsg don t merge data across a file descriptor message boundary.
2. failing to accept an fd in the receiver results in the fd being closed by the kernel.
3. a file descriptor must be accompanied by some data.

static void
child(int sock)
 
    uint8_t xreq[1024];
    uint8_t xnop[4];
    uint8_t req;
    int i, reqlen;
    ssize_t size, fdsize;
    int fd = -1, *fdp;
    int j;
    sleep (1);
    for (j = 0;; j++)  
        size = sock_fd_read(sock, xreq, sizeof (xreq), NULL);
        printf ("got %d\n", size);
        if (size == 0)
            break;
        i = 0;
        while (i < size)  
            req = xreq[i];
            reqlen = xreq[i+1];
            i += reqlen;
            switch (req)  
            case 0:
                break;
            case 1:
                if (i != size)  
                    fprintf (stderr, "Got fd req, but not at end of input %d < %d\n",
                         i, size);
                 
                fdsize = sock_fd_read(sock, xnop, sizeof (xnop), &fd);
                if (fd == -1)  
                    fprintf (stderr, "no fd received\n");
                  else  
                    FILE    *f = fdopen (fd, "w");
                    fprintf(f, "hello %d\n", j);
                    fflush(f);
                    fclose(f);
                    close(fd);
                    fd = -1;
                 
                break;
            case 2:
                fprintf (stderr, "Unexpected FD passing req\n");
                break;
             
         
     
 
int
tmp_file(int j)  
    char    name[64];
    sprintf (name, "tmp-file-%d", j);
    return creat(name, 0666);
 
static void
parent(int sock)
 
    uint8_t xreq[32];
    uint8_t xnop[4];
    int i, j;
    int fd;
    for (j = 0; j < 4; j++)  
        /* Write a bunch of regular requests */
        for (i = 0; i < 8; i++)  
            xreq[0] = 0;
            xreq[1] = sizeof (xreq);
            sock_fd_write(sock, xreq, sizeof (xreq), -1);
         
        /* Write our 'pass an fd' request with a 'useless' FD to block the receiver */
        xreq[0] = 1;
        xreq[1] = sizeof(xreq);
        sock_fd_write(sock, xreq, sizeof (xreq), 1);
        /* Pass an fd */
        xnop[0] = 2;
        xnop[1] = sizeof (xnop);
        fd = tmp_file(j);
        sock_fd_write(sock, xnop, sizeof (xnop), fd);
        close(fd);
     
 

1. First I noticed that it would not accept my passphrase for my encrypted partition during early boot this turned out to be already reported as #619711 but was no longer getting any attention from the package maintainer. After some IRC discussion with Julien Cristau, we prodded Michael Prokop who had apparently already offered to take care of this issue. I tested his updated package and the result got quickly uploaded.
2. I had weird networking problems that turned out to be related to the lack of the loopback network (i.e. on localhost). This was the result of a broken /etc/network/interfaces: it had been incorrectly modified by NetworkManager. I reported this in #688355. This issue affects people with IPv6 enabled networks.

4 comments Liked this article? Click here. My blog is Flattr-enabled.

• TPCI200, the bridge between PCI and IndustryPack.
• The IndustryPack bus.
• IPOCTAL-232, an IndustryPack module with eight RS-232 serial ports.

$ qemu -device tpci200 -device ipoctal

$ qemu -device tpci200 -device ipoctal,serial0=pty

• if Michael receives at least 5 Debian-tagged donations for the cause he has chosen to support (Autism Research Trust - donate), he'll do his marathon day wearing a Debian t-shirt (which apparently is also the first Free Software t-shirt he has ever owned). I've already donated, so that makes only 4 donations to go to add some Debian promotion salt to an Ubuntu marathon . To "tag" your donation as originating from the Debian community, just leave a message containing the word "debian" at the end of the donation process. The work Michael will be doing tomorrow is not entirely Debian-specific, but Michael is Canonical's responsible for relationship with upstream. I've worked with him in the past on a range of topics, and I can testify that part of his work is generally useful to Debian.

• for every 5 Debian-tagged donations to Nick's cause (WaterAid - donate), Nick will write a manpage for a Debian package that is in dire need of one. As above, just mention "debian" in your post-donation message to tag your donation as originating from the Debian community.

• for every Debian-tagged donation to Daniel's cause (Oxfam - donate), Daniel will (triage and) forward a patch from Ubuntu to the Debian BTS.