Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In November, 15 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 0.0h (out of 14.0h assigned), thus carrying over 14.0h to the next month.
• Anton Gladky did 6.0h (out of 15.0h assigned), thus carrying over 9.0h to the next month.
• Ben Hutchings did 9.0h (out of 24.0h assigned), thus carrying over 15.0h to the next month.
• Chris Lamb did 18.0h (out of 18.0h assigned).
• Dominik George did 10.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 14.0h to the next month.
• Emilio Pozuelo Monfort did 0.0h (out of 38.0h assigned and 19.5h from previous period), thus carrying over 57.5h to the next month.
• Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
• Helmut Grohne did 17.5h (out of 20.0h assigned).
• Markus Koschany did 40.0h (out of 40.0h assigned).
• Ola Lundqvist did 7.5h (out of 11.0h assigned and 5.0h from previous period), thus carrying over 8.5h to the next month.
• Roberto C. S nchez did 20.25h (out of 0.75h assigned and 31.25h from previous period), thus carrying over 11.75h to the next month.
• Stefano Rivera did 2.5h (out of 0h assigned and 17.0h from previous period), thus carrying over 14.5h to the next month.
• Sylvain Beucler did 35.5h (out of 23.0h assigned and 34.5h from previous period), thus carrying over 22.0h to the next month.
• Thorsten Alteholz did 14.0h (out of 14.0h assigned).
• Utkarsh Gupta did 41.0h (out of 32.5h assigned and 25.0h from previous period), thus carrying over 16.5h to the next month.

Evolution of the situation In November, we released 43 DLAs, fixing 183 CVEs. We currently have 63 packages in dla-needed.txt that are waiting for updates, which is 19 fewer than the previous month. We re excited to announce that two Debian Developers Tobias Frost and Guilhem Moulin, have completed the on-boarding process and will begin contributing to LTS as of December 2022. Welcome aboard!

Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 87 months)
  • GitHub (for 78 months)
  • Civil Infrastructure Platform (CIP) (for 55 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 98 months)
  • Linode (for 92 months)
  • Babiel GmbH (for 81 months)
  • Plat Home (for 81 months)
  • University of Oxford (for 37 months)
  • Deveryware (for 24 months)
  • VyOS Inc (for 19 months)
  • EDF SA (for 8 months)
• Silver sponsors:
  • Domeneshop AS (for 102 months)
  • Nantes M tropole (for 96 months)
  • Univention GmbH (for 88 months)
  • Universit Jean Monnet de St Etienne (for 88 months)
  • Ribbon Communications, Inc. (for 82 months)
  • Exonet B.V. (for 72 months)
  • Leibniz Rechenzentrum (for 66 months)
  • CINECA (for 55 months)
  • Minist re de l Europe et des Affaires trang res (for 49 months)
  • Cloudways Ltd (for 39 months)
  • Dinahosting SL (for 37 months)
  • Bauer Xcel Media Deutschland KG (for 31 months)
  • Platform.sh (for 31 months)
  • MOXA INC. (for 25 months)
  • sipgate GmbH (for 22 months)
  • OVH US LLC (for 20 months)
  • Tilburg University (for 20 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 12 months)
  • Soliton Systems K.K. (for 9 months)
• Bronze sponsors:
  • Evolix (for 103 months)
  • Seznam.cz, a.s. (for 103 months)
  • Intevation GmbH (for 100 months)
  • Linuxhotel GmbH (for 100 months)
  • Daevel SARL (for 98 months)
  • Bitfolk LTD (for 97 months)
  • Megaspace Internet Services GmbH (for 97 months)
  • Greenbone Networks GmbH (for 96 months)
  • NUMLOG (for 96 months)
  • WinGo AG (for 96 months)
  • Ecole Centrale de Nantes - LHEEA (for 92 months)
  • Entr ouvert (for 87 months)
  • Adfinis AG (for 84 months)
  • GNI MEDIA (for 79 months)
  • Laboratoire LEGI - UMR 5519 / CNRS (for 79 months)
  • Tesorion (for 79 months)
  • Bearstech (for 70 months)
  • LiHAS (for 70 months)
  • Catalyst IT Ltd (for 65 months)
  • Supagro (for 60 months)
  • Demarcq SAS (for 59 months)
  • Universit Grenoble Alpes (for 45 months)
  • TouchWeb SAS (for 37 months)
  • SPiN AG (for 34 months)
  • CoreFiling (for 29 months)
  • Institut des sciences cognitives Marc Jeannerod (for 24 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 21 months)
  • Tem Innovations GmbH (for 16 months)
  • WordFinder.pro (for 15 months)
  • CNRS DT INSU R sif (for 14 months)
  • Alter Way (for 7 months)

FTP master This month I accepted 292 and rejected 43 packages. The overall number of packages that got accepted was 295. Debian LTS This was my hundred-first month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 14h. During that time I uploaded:

• [DLA 3200-1] graphicsmagick security update for one CVE
• [DLA 3201-1] ntfs-3g security update for one CVE
• [inetutils]found unfixed CVE in latest DLA

I also started to work on ring, but this seems to be a pile of work. Not least because at the moment the package does not migrate to testing. Further I started to investigate what packages are really affected by CVE-2018-17942. It looks like some upstreams and their corresponding maintainers did not care about that CVE in the embedded gnulib. Last but not least I did some days of frontdesk duties. Debian ELTS This month was the fifty second ELTS month. During my allocated time I uploaded:

• [ELA-736-1] ntfs-3g security update of Jessie and Stretch for one CVE
• [ELA-745-1] snapd security update of Jessie for two CVEs
• [ELA-746-1] inetutils security update of Jessie for two CVEs

Last but not least I did some days of frontdesk duties. Debian Mobcom This month I uploaded improved packages of:

• libsmpp34
• osmo-libasn1c
• osmo-mgw
• osmo-bsc

Other stuff This month I uploaded improved packages of:

• gnupg-pkcs11-scd

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In October, 15 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 14.0h (out of 2.0h assigned and 12.0h from previous period).
• Anton Gladky did 20.0h (out of 19.0h assigned and 1.0h from previous period).
• Ben Hutchings did 9.0h (out of 0h assigned and 9.0h from previous period).
• Chris Lamb did 18.0h (out of 18.0h assigned).
• Dominik George did 0.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 24.0h to the next month.
• Emilio Pozuelo Monfort did 40.5h (out of 58.0h assigned and 2.0h from previous period), thus carrying over 19.5h to the next month.
• Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
• Helmut Grohne did 15.0h (out of 15.0h assigned).
• Markus Koschany did 40.0h (out of 40.0h assigned).
• Ola Lundqvist did 7.0h (out of 12.0h assigned), thus carrying over 5.0h to the next month.
• Roberto C. S nchez did 0.75h (out of 1.0h assigned and 31.0h from previous period), thus carrying over 31.25h to the next month.
• Stefano Rivera did 12.5h (out of 9.0h assigned and 26.0h from previous period), thus carrying over 22.5h to the next month.
• Sylvain Beucler did 25.5h (out of 31.5h assigned and 28.5h from previous period), thus carrying over 34.5h to the next month.
• Thorsten Alteholz did 14.0h (out of 14.0h assigned).
• Utkarsh Gupta did 35.0h (out of 38.0h assigned and 22.0h from previous period), thus carrying over 25.0h to the next month.

Evolution of the situation In October, we have released 42 DLAs, closing 106 CVEs. At the moment we have 82 packages in dla-needed.txt, waiting for update. We are continuously working on updating our infrastructure, trying to document all of our changes in the git-repo. Most of packages there are having continuous integration (CI) pipelines.

Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 86 months)
  • GitHub (for 77 months)
  • Civil Infrastructure Platform (CIP) (for 54 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 97 months)
  • Linode (for 91 months)
  • Babiel GmbH (for 80 months)
  • Plat Home (for 80 months)
  • University of Oxford (for 36 months)
  • Deveryware (for 23 months)
  • VyOS Inc (for 18 months)
  • EDF SA (for 7 months)
• Silver sponsors:
  • Domeneshop AS (for 101 months)
  • Nantes M tropole (for 95 months)
  • Univention GmbH (for 87 months)
  • Universit Jean Monnet de St Etienne (for 87 months)
  • Ribbon Communications, Inc. (for 81 months)
  • Exonet B.V. (for 71 months)
  • Leibniz Rechenzentrum (for 65 months)
  • CINECA (for 54 months)
  • Minist re de l Europe et des Affaires trang res (for 48 months)
  • Cloudways Ltd (for 38 months)
  • Dinahosting SL (for 36 months)
  • Bauer Xcel Media Deutschland KG (for 30 months)
  • Platform.sh (for 30 months)
  • Moxa Intelligence Co., Ltd. (for 24 months)
  • sipgate GmbH (for 21 months)
  • OVH US LLC (for 19 months)
  • Tilburg University (for 19 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 11 months)
  • Soliton Systems K.K. (for 8 months)
• Bronze sponsors:
  • Evolix (for 102 months)
  • Seznam.cz, a.s. (for 102 months)
  • Intevation GmbH (for 99 months)
  • Linuxhotel GmbH (for 99 months)
  • Daevel SARL (for 97 months)
  • Bitfolk LTD (for 96 months)
  • Megaspace Internet Services GmbH (for 96 months)
  • Greenbone Networks GmbH (for 95 months)
  • NUMLOG (for 95 months)
  • WinGo AG (for 95 months)
  • Ecole Centrale de Nantes - LHEEA (for 91 months)
  • Entr ouvert (for 86 months)
  • Adfinis AG (for 83 months)
  • GNI MEDIA (for 78 months)
  • Laboratoire LEGI - UMR 5519 / CNRS (for 78 months)
  • Tesorion (for 78 months)
  • Bearstech (for 69 months)
  • LiHAS (for 69 months)
  • Catalyst IT Ltd (for 64 months)
  • Supagro (for 59 months)
  • Demarcq SAS (for 58 months)
  • Universit Grenoble Alpes (for 44 months)
  • TouchWeb SAS (for 36 months)
  • SPiN AG (for 33 months)
  • CoreFiling (for 28 months)
  • Institut des sciences cognitives Marc Jeannerod (for 23 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 20 months)
  • Tem Innovations GmbH (for 15 months)
  • WordFinder.pro (for 14 months)
  • CNRS DT INSU R sif (for 13 months)
  • Alter Way (for 6 months)

FTP master This month I accepted 484 and rejected 55 packages. The overall number of packages that got accepted was 492. Debian LTS This was my hundredth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. Woohoo, There is a party. (yes I am old). Unfortunately there are already 101 completed month listed in the debian-lts-announce archive, so I seem to have counted wrong once. *sigh*, yes I am old. This month my all in all workload has been 14h. During that time I uploaded:

• [DLA 3168-1] openvswitch security update for one CVE
• [DLA 3167-1] ncurses security update for one CVE
• [#1020596] bullseye-pu: mod-wsgi/4.7.1-3+deb11u1 upload
• [graphicsmagick] debdiff for Bullseye sent to security team (update as DLA or via PU?)
• [graphicsmagick] prepared upload for Buster
• [libvncserver] debdiff for Buster and Bullseye sent to maintainer (no upload yet :-()

I also started to work on virglrenderer. Last but not least I took care of NEW packages on security-master. Debian ELTS This month was the fifty first ELTS month. During my allocated time I uploaded:

• [ELA-719-1] graphicsmagick security update of Jessie and Stretch for one CVE
• [ELA-720-1] bluez security update of Jessie and Stretch for three CVEs
• marked two CVEs of curl as not-affected for Jessie and Stretch
• checked that all patches for dpdk need to be backported, unfortunately that was beyond my capabilities

I also started to work on snapd. Last but not least I finally managed to become familiar with the git workflow and imported several packages to the salsa repository. Debian Astro This month I uploaded new upstream versions or improved packaging of:

• nautic

I also uploaded a new package pysqm. This software supports the Sky Quality Meters made by Unihedron. I was kindly given an SQM-LU for USB and SQM-LE with network adapter. I plan to put a working Python3 version of the old PySQM software into Debian, package the UDM (Unihedron Device Manager) and finally check the support within Indi. Debian IoT This month I uploaded new upstream versions or improved packaging of:

• pywws

Debian Mobcom This month I finished the transition of the Osmocom packages, except
osmo-mgw and osmo-msc seem to have problems. I have no idea how I can solve this, so help is appreciated. Other stuff This month I uploaded new packages:

• nuspell
• hcloud-cli

FTP master This month I accepted 226 and rejected 33 packages. The overall number of packages that got accepted was 232. All in all I addressed about 60 RM-bugs and either simply removed the package or added a moreinfo tag. In total I spent 5 hours for this task. Anyway, I have to repeat my comment from last month: please have a look at the removal page and check whether the created dak command is really what you wanted. It would also help if you check the reverse dependencies and write a comment whether they are important or can be ignored or also file a new bug for them. Each removal must have one bug! Debian LTS This was my ninety-ninth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 14h. During that time I uploaded:

• [DLA 3111-1] mod-wsgi security update for one CVE
• [#1020596] bullseye-pu: mod-wsgi/4.7.1-3+deb11u1
• [DLA 3119-1] expat security update for one CVE
• [DLA 3125-1] libvncserver security update for two CVEs
• [DLA 3126-1] libsndfile security update for one CVE
• [DLA 3127-1] libhttp-daemon-perl security update for one CVE
• [DLA 3130-1] tinyxml security update for one CVE

I also started to work on frr. Last but not least I did some days of frontdesk duties and took care of issues on security-master. Debian ELTS This month was the fiftieth ELTS month. During my allocated time I uploaded:

• [ELA-685-1] ntfs-3g security update of Stretch for eight CVE
• [ELA-686-1] expat security update of Jessie and Stretch for one CVE
• [ELA-690-1] libvncserver security update of Stretch for one CVE

Last but not least I did some days of frontdesk duties. Debian Printing This month I uploaded new upstream versions or improved packaging of:

• cups-filters

Debian IoT This month I uploaded new upstream versions or improved packaging of:

• libmatthew-java

Debian Mobcom This month I started another upload session for new upstrea versions:

• libosmocore
• libgsm

Other stuff This month I uploaded new packages:

• meep
• meep-mpi-default
• meep-openmpi

FTP master This month I accepted 375 and rejected 25 packages. The overall number of packages that got accepted was 386. I also had a closer look at the RM-bugs. All in all I addressed about 90 of them and either simply removed the package or added a moreinfo tag. In total I spent 13 hours for this task. Anyway, if you want to have your RM-bug processed in a timely manner, please have a look at the removal page and check whether the created dak command is really what you wanted. It would also help if you check the reverse dependencies and write a comment whether they are important or can be ignored or also file a new bug for them. Each removal must have one bug! Debian LTS This was my ninety-eighth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 30.00h. As I started to become a Freexian collaborator in this month, I only worked 17h on the LTS project. During that time I uploaded:

• [#1010380] buster-pu: flac/1.3.2-3+deb10u2, upload
• [#1009076] buster-pu: minidlna/1.2.1+dfsg-2+deb10u3, upload
• [#1009251] buster-pu: fribidi/1.0.5-3.1+deb10u2, upload
• [#1008578] buster-pu: golang-github-russellhaering-goxmldsig/0.0~git20170911.b7efc62-1+deb10u1, upload
• [#1016391] bullseye-pu: libhttp-daemon-perl/6.12-1+deb11u1, upload
• [DLA 3088-1] net-snmp security update for six CVEs
• [unstable] mod-wsgi for one CVE

I also started to work on upx-ucl. Debian ELTS This month was the forty-ninth ELTS month. During my allocated time I uploaded:

• [ELA-655-1] libhttp-daemon-perl security update of Jessie and Stretch for one CVE
• [ELA-659-1] mod-wsgi security update of Stretch for one CVE
• [ELA-667-1] gst-plugins-good1.0 security update of Jessie and Stretch for seven CVEs
• [ELA-668-1] net-snmp security update of Jessie and Stretch for six CVEs

Debian Printing This month I uploaded new upstream versions or improved packaging of:

• cups-bjnp
• dymo-cups-driver
• hplip
• gutenprint

Debian Astro This month I uploaded new upstream versions or improved packaging of:

• planetary-system-stacker
• openvlbi
• libsbig
• indi-sbig

Like each month, have a look at the work funded by Freexian s Debian LTS offering. Debian project funding No any major updates on running projects.
Two 1, 2 projects are in the pipeline now.
Tryton project is in a review phase. Gradle projects is still fighting in work. In July, we put aside 2389 EUR to fund Debian projects. We re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article. Debian LTS contributors In July, 14 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 0.00h (out of 14.00h assigned, thus carrying over 14.00h to the next month).
• Andreas R nnquist did 0.00h (out of 0.00h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
• Anton Gladky did 23.00h (out of 25.00h assigned, thus carrying over 2.00h to the next month).
• Ben Hutchings did 3.00h (out of 24.00h assigned, thus carrying over 21.00h to the next month).
• Dominik George did 0.00h (out of 0.00h assigned and 22.17h from previous period, thus carrying over 22.17h to the next month).
• Emilio Pozuelo Monfort did 72.00h (out of 35.75h assigned).
• Enrico Zini did 0.00h (out of 0.00h assigned and 8.00h from previous period, thus carrying over 8.00h to the next month).
• Markus Koschany did 35.75h (out of 35.75h assigned).
• Ola Lundqvist did 8.00h (out of 0.00h assigned and 12.00h from previous period, thus carrying over 4.00h to the next month).
• Roberto C. S nchez did 14.25h (out of 29.25h assigned and 2.75h from previous period, thus carrying over 17.75h to the next month).
• Stefano Rivera did 8.00h (out of 6.25h assigned and 20.75h from previous period, thus carrying over 19.00h to the next month).
• Sylvain Beucler did 3.50h (out of 35.75h assigned, thus carrying over 32.25h to the next month).
• Thorsten Alteholz did 20.00h (out of 35.75h assigned).
• Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 35.75 available hours, thus carrying them over to the next month).

Evolution of the situation In July, we have released 3 DLAs. July was the period, when the Debian Stretch had already ELTS status, but Debian Buster was still in the hands of security team. Many member of LTS used this time to update internal infrastructure, documentation and some internal tickets. Now we are ready to take the next release in our hands: Buster! Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 83 months)
  • GitHub (for 74 months)
  • Civil Infrastructure Platform (CIP) (for 51 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 94 months)
  • Linode (for 88 months)
  • Babiel GmbH (for 78 months)
  • Plat Home (for 77 months)
  • University of Oxford (for 33 months)
  • Deveryware (for 20 months)
  • VyOS Inc (for 15 months)
  • EDF SA (for 4 months)
• Silver sponsors:
  • Domeneshop AS (for 99 months)
  • The Positive Internet Company (for 99 months)
  • Nantes M tropole (for 93 months)
  • Universit Jean Monnet de St Etienne (for 85 months)
  • Univention GmbH (for 84 months)
  • Ribbon Communications, Inc. (for 78 months)
  • Exonet B.V. (for 68 months)
  • Leibniz Rechenzentrum (for 62 months)
  • CINECA (for 52 months)
  • Minist re de l Europe et des Affaires trang res (for 46 months)
  • Cloudways Ltd (for 35 months)
  • Dinahosting SL (for 33 months)
  • Bauer Xcel Media Deutschland KG (for 27 months)
  • Platform.sh (for 27 months)
  • Moxa Intelligence Co., Ltd. (for 21 months)
  • sipgate GmbH (for 18 months)
  • Tilburg University (for 17 months)
  • OVH US LLC (for 16 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 8 months)
  • Soliton Systems K.K. (for 5 months)
• Bronze sponsors:
  • Evolix (for 99 months)
  • Seznam.cz, a.s. (for 99 months)
  • Intevation GmbH (for 96 months)
  • Linuxhotel GmbH (for 96 months)
  • Daevel SARL (for 95 months)
  • Bitfolk LTD (for 93 months)
  • Greenbone Networks GmbH (for 93 months)
  • Megaspace Internet Services GmbH (for 93 months)
  • NUMLOG (for 93 months)
  • WinGo AG (for 92 months)
  • Ecole Centrale de Nantes LHEEA (for 88 months)
  • Entr ouvert (for 83 months)
  • Adfinis AG (for 81 months)
  • GNI MEDIA (for 75 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 75 months)
  • Tesorion (for 75 months)
  • Bearstech (for 67 months)
  • LiHAS (for 67 months)
  • Catalyst IT Ltd (for 61 months)
  • Supagro (for 57 months)
  • Demarcq SAS (for 55 months)
  • Universit Grenoble Alpes (for 41 months)
  • TouchWeb SAS (for 33 months)
  • SPiN AG (for 30 months)
  • CoreFiling (for 26 months)
  • Institut des sciences cognitives Marc Jeannerod (for 20 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 17 months)
  • Tem Innovations GmbH (for 12 months)
  • WordFinder.pro (for 11 months)
  • CNRS DT INSU R sif (for 10 months)
  • Alter Way (for 3 months)

FTP master This month I accepted 420 and rejected 44 packages. The overall number of packages that got accepted was 422. I am sad to write the following lines, but unfortunately there are people who rather take advantage of others instead of doing a proper maintenance of their packages. So, in order to find time slots for as much packages in NEW as possible, I no longer write a debian/copyright for others. I know it is a boring task to collect the copyright information, but our policy still requires this. Of course nobody is perfect and certainly one or the other license or copyright holder can be overlooked. Luckily most of the contributors maintain their debian/copyright very thouroughly with a terrific result. On the other hand some contributors upload only some crap and demand that I exactly list what is missing. I am no longer willing to do this. I am going to stop processing after I found a few missing things and reject the package. When I see repeatedly uploads containing only improvements with things I pointed out, I will process this package only after all others from NEW are done. Debian LTS This was my ninety-seventh month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 35.75h. Unfortunately Stretch LTS has moved to Stretch ELTS and Buster LTS was not yet opened in July. So I think this is the first month I did not work all assigned hours. Besides things on security-master, I only worked 20h on moving the LTS documentation to their new destination. At the moment the documentation is spread over several locations. As searching over all those locations is not possible, it shall be collected at one place. Debian ELTS This month was the forty-eighth ELTS month. During my allocated time I uploaded:

• [ELA-643-1] for ncurses (5.9+20140913-1+deb8u4, 6.0+20161126-1+deb9u3)
• [ELA-655-1] for libhttp-daemon-perl (6.01-1+deb8u1, 6.01-1+deb9u1)
• [6.14-1.1] upload to unstable
• [#1016391] bullseye-pu: libhttp-daemon-perl/6.12-1+deb11u1

I also started to work on mod-wsgi and my patch was already approved by the maintainer. Now I am waiting for the security team to decide whether it will be uploaded as DSA or via PU. Last but not least I did some days of frontdesk duties. Other stuff This month I uploaded new upstream versions or improved packaging of:

• meep
• meep-openmpi
• meep-mpi-default
• glewlwyd
• entropybroker

Like each month, have a look at the work funded by Freexian s Debian LTS offering. Debian project funding No any major updates on running projects.
Two 1, 2 projects are in the pipeline now.
Tryton project is in a review phase. Gradle projects is still fighting in work. In June, we put aside 2254 EUR to fund Debian projects. We re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article. Debian LTS contributors In June, 15 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 14.00h (out of 14.00h assigned).
• Andreas R nnquist did 14.50h (out of 14.50h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
• Anton Gladky did 16.00h (out of 16.00h assigned).
• Ben Hutchings did 16.00h (out of 0.00h assigned and 16.00h from previous period).
• Chris Lamb did 18.00h (out of 18.00h assigned).
• Dominik George did 1.83h (out of 6.00h assigned and 18.00h from previous period, thus carrying over 22.17h to the next month).
• Emilio Pozuelo Monfort did 30.25h (out of 9.25h assigned and 21.00h from previous period).
• Enrico Zini did 8.00h (out of 9.50h assigned and 6.50h from previous period, thus carrying over 8.00h to the next month).
• Markus Koschany did 30.25h (out of 30.25h assigned).
• Ola Lundqvist did nothing (out of 12.00 available hours, thus carrying them over to the next month).
• Roberto C. S nchez did 27.50h (out of 11.75h assigned and 18.50h from previous period, thus carrying over 2.75h to the next month).
• Stefano Rivera did 8.00h (out of 30.25h assigned, thus carrying over 20.75h to the next month).
• Sylvain Beucler did 30.25h (out of 13.75h assigned and 16.50h from previous period).
• Thorsten Alteholz did 30.25h (out of 30.25h assigned).
• Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 30.25 available hours, thus carrying them over to the next month).

Evolution of the situation In June we released 27 DLAs.

This is a special month, where we have two releases (stretch and jessie) as ELTS and NO release as LTS. Buster is still handled by the security team and will probably be given in LTS hands at the beginning of the August. During this month we are updating the infrastructure, documentation and improve our internal processes to switch to a new release.
Many developers have just returned back from Debconf22, hold in Prizren, Kosovo! Many (E)LTS members could meet face-to-face and discuss some technical and social topics! Also LTS BoF took place, where the project was introduced (link to video).

Thanks to our sponsors Sponsors that joined recently are in bold. We are pleased to welcome Alter Way where their support of Debian is publicly acknowledged at the higher level, see this French quote of Alterway s CEO.

• Platinum sponsors:
  • TOSHIBA (for 82 months)
  • GitHub (for 73 months)
  • Civil Infrastructure Platform (CIP) (for 50 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 93 months)
  • Linode (for 87 months)
  • Babiel GmbH (for 76 months)
  • Plat Home (for 76 months)
  • University of Oxford (for 32 months)
  • Deveryware (for 19 months)
  • VyOS Inc (for 14 months)
  • EDF SA (for 3 months)
• Silver sponsors:
  • Domeneshop AS (for 98 months)
  • The Positive Internet Company (for 98 months)
  • Nantes M tropole (for 92 months)
  • Univention GmbH (for 83 months)
  • Universit Jean Monnet de St Etienne (for 83 months)
  • Ribbon Communications, Inc. (for 77 months)
  • Exonet B.V. (for 67 months)
  • Leibniz Rechenzentrum (for 61 months)
  • CINECA (for 50 months)
  • Minist re de l Europe et des Affaires trang res (for 45 months)
  • Cloudways Ltd (for 34 months)
  • Dinahosting SL (for 32 months)
  • Bauer Xcel Media Deutschland KG (for 26 months)
  • Platform.sh (for 26 months)
  • Moxa Intelligence Co., Ltd. (for 20 months)
  • sipgate GmbH (for 17 months)
  • Tilburg University (for 16 months)
  • OVH US LLC (for 15 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 7 months)
  • Soliton Systems K.K. (for 4 months)
• Bronze sponsors:
  • Evolix (for 98 months)
  • Seznam.cz, a.s. (for 98 months)
  • Intevation GmbH (for 95 months)
  • Linuxhotel GmbH (for 95 months)
  • Daevel SARL (for 94 months)
  • Bitfolk LTD (for 92 months)
  • Megaspace Internet Services GmbH (for 92 months)
  • NUMLOG (for 92 months)
  • Greenbone Networks GmbH (for 91 months)
  • WinGo AG (for 91 months)
  • Ecole Centrale de Nantes LHEEA (for 87 months)
  • Entr ouvert (for 82 months)
  • Adfinis AG (for 80 months)
  • GNI MEDIA (for 74 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 74 months)
  • Tesorion (for 74 months)
  • Bearstech (for 66 months)
  • LiHAS (for 65 months)
  • Catalyst IT Ltd (for 60 months)
  • Supagro (for 55 months)
  • Demarcq SAS (for 54 months)
  • Universit Grenoble Alpes (for 40 months)
  • TouchWeb SAS (for 32 months)
  • SPiN AG (for 29 months)
  • CoreFiling (for 24 months)
  • Institut des sciences cognitives Marc Jeannerod (for 19 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 16 months)
  • Tem Innovations GmbH (for 11 months)
  • WordFinder.pro (for 10 months)
  • CNRS DT INSU R sif (for 9 months)
  • Alter Way

FTP master This month I accepted 305 and rejected 59 packages. The overall number of packages that got accepted was 310. From time to time I am also looking at the list of packages to be removed. If you would like to make life easier for the people who remove packages, please make sure that the resulting dak command really makes sense. If this command consists of garbage, please adapt the Subject: of your bug report accordingly. Also it does not make sense to file bugs to remove packages from NEW. Please don t hesitate to close such bugs again Debian LTS This was my ninety-sixth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 30.25h. During that time I did LTS and normal security uploads of:

• [DLA 3058-1] libsndfile security update for two CVEs
• [DLA 3060-1] blender security update for three CVEs
• [#1008577] bullseye-pu: golang-github-russellhaering-goxmldsig/1.1.0-1+deb11u1 package has been accepted
• [#1009077] bullseye-pu: minidlna/1.3.0+dfsg-2+deb11u1 package has been accepted
• upload of blender to buster-security, no DSA yet
• upload of blender to bullseye-security, no DSA yet, this upload seems to have failed

I have to admit that I totally ignored the EOL of Stretch LTS, so my upload of ncurses needs to go to Stretch ELTS now. This month I also moved/refactored the current LTS documentation to a new repository and started to move the LTS Wiki as well. I also continued to work on security support for golang packages. Last but not least I did some days of frontdesk duties and took care of issues on security-master. At this point I also need to mention my first business trip . I drove the short distance between Chemnitz and Freiberg and met Anton to have a face to face talk about LTS/ELTS. It was a great pleasure and definitely more fun than a meeting on IRC. Debian ELTS This month was the forty-seventh ELTS month. During my allocated time I uploaded:

• ELS-629-1 for libsndfile

Due to the delay of my ncurses upload to Stretch LTS, the ELTS upload got delayed as well. Now I will do both uploads to ELTS in July. Last but not least I did some days of frontdesk duties. Debian Printing This month I uploaded new upstream versions or improved packaging of:

• pappl
• ipp-usb

Debian Astro As there has been a new indi release arriving in Debian, I uploaded new upstream versions of most of the indi-3rdparty packages. Don t hesitate to tell me whether you really use one of them :-). Other stuff This month I uploaded new upstream versions or improved packaging of:

• pipexec
• chktex
• gnupg-pkcs11-scd
• libctl

Like each month, have a look at the work funded by Freexian s Debian LTS offering. Debian project funding Two [1, 2] projects are in the pipeline now. Tryton project is in a final phase. Gradle projects is fighting with technical difficulties. In May, we put aside 2233 EUR to fund Debian projects. We re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article. Debian LTS contributors In May, 14 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 14.0h (out of 14h assigned).
• Andreas R nnquist did 14.5h (out of 25.0h assigned), thus carrying over 10.5h to June.
• Anton Gladky did 19h (out of 19h assigned).
• Ben Hutchings did 8h (out of 11h assigned and 13h from April), thus carrying over 16h to June.
• Chris Lamb did 18h (out of 18h assigned).
• Dominik George did 2h (out of 20.0h assigned), thus carrying over 18h to June.
• Enrico Zini did 9.5h (out of 16.0h assigned), thus carrying over 6.5h to June.
• Emilio Pozuelo Monfort did 28h (out of 13.75h assigned and 35.25h from April), thus carrying over 21h to June.
• Markus Koschany did 40h (out of 40h assigned).
• Roberto C. S nchez did 13.5h (out of 32h assigned), thus carrying over 18.5h to June.
• Sylvain Beucler did 23.5h (out of 20h assigned and 20h from April), thus carrying over 16.5h to June.
• Stefano Rivera did 5h in April and 14h in May (out of 17.5h assigned), thus anticipating 1.5h for June.
• Thorsten Alteholz did 40h (out of 40h assigned).
• Utkarsh Gupta did 35h (out of 19h assigned and 30h from April), thus carrying over 14h to June.

Evolution of the situation In May we released 49 DLAs. The security tracker currently lists 71 packages with a known CVE and the dla-needed.txt file has 65 packages needing an update. The number of paid contributors increased significantly, we are pleased to welcome our latest team members: Andreas R nnquist, Dominik George, Enrico Zini and Stefano Rivera. It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org. We are preparing to overtake Debian 10 Buster for the next two years and to make this process as smooth as possible. But Freexian and its team of paid Debian contributors will continue to maintain Debian 9 going forward for the customers of the Extended LTS offer. If you have Debian 9 servers to keep secure, it s time to subscribe! You might not have noticed, but Freexian formalized a mission statement where we explain that our purpose is to help improve Debian. For this, we want to fund work time for the Debian developers that recently joined Freexian as collaborators. The Extended LTS and the PHP LTS offers are built following a model that will help us to achieve this if we manage to have enough customers for those offers. So consider subscribing: you help your organization but you also help Debian! Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 81 months)
  • GitHub (for 72 months)
  • Civil Infrastructure Platform (CIP) (for 49 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 92 months)
  • Linode (for 86 months)
  • Babiel GmbH (for 75 months)
  • Plat Home (for 75 months)
  • University of Oxford (for 31 months)
  • Deveryware (for 18 months)
  • VyOS Inc (for 13 months)
  • EDF SA
• Silver sponsors:
  • The Positive Internet Company (for 97 months)
  • Domeneshop AS (for 96 months)
  • Nantes M tropole (for 90 months)
  • Univention GmbH (for 82 months)
  • Universit Jean Monnet de St Etienne (for 82 months)
  • Ribbon Communications, Inc. (for 76 months)
  • Exonet B.V. (for 66 months)
  • Leibniz Rechenzentrum (for 60 months)
  • CINECA (for 49 months)
  • Minist re de l Europe et des Affaires trang res (for 43 months)
  • Cloudways Ltd (for 33 months)
  • Dinahosting SL (for 31 months)
  • Bauer Xcel Media Deutschland KG (for 25 months)
  • Platform.sh (for 25 months)
  • Moxa Intelligence Co., Ltd. (for 19 months)
  • sipgate GmbH (for 16 months)
  • OVH US LLC (for 14 months)
  • Tilburg University (for 14 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 6 months)
  • Telecats BV (for 4 months)
  • Soliton Systems K.K. (for 3 months)
• Bronze sponsors:
  • Evolix (for 97 months)
  • Seznam.cz, a.s. (for 97 months)
  • Intevation GmbH (for 94 months)
  • Linuxhotel GmbH (for 94 months)
  • Daevel SARL (for 92 months)
  • Bitfolk LTD (for 91 months)
  • Megaspace Internet Services GmbH (for 91 months)
  • Greenbone Networks GmbH (for 90 months)
  • NUMLOG (for 90 months)
  • WinGo AG (for 90 months)
  • Ecole Centrale de Nantes LHEEA (for 86 months)
  • Entr ouvert (for 81 months)
  • Adfinis AG (for 78 months)
  • GNI MEDIA (for 73 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 73 months)
  • Tesorion (for 73 months)
  • Bearstech (for 64 months)
  • LiHAS (for 64 months)
  • People Doc (for 61 months)
  • Catalyst IT Ltd (for 59 months)
  • Supagro (for 54 months)
  • Demarcq SAS (for 53 months)
  • Universit Grenoble Alpes (for 39 months)
  • TouchWeb SAS (for 31 months)
  • SPiN AG (for 28 months)
  • CoreFiling (for 23 months)
  • Institut des sciences cognitives Marc Jeannerod (for 18 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 15 months)
  • Tem Innovations GmbH (for 10 months)
  • WordFinder.pro (for 9 months)
  • CNRS DT INSU R sif (for 8 months)
  • Alter Way

FTP master This month I accepted 288 and rejected 45 packages. The overall number of packages that got accepted was 290. Debian LTS This was my ninety-fifth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

• [DLA 3029-1] cups security update for one embargoed CVE
• [DLA 3028-1] atftp security update for one CVE
• [DLA 3030-1] zipios++ security update for one CVE
• [DSA-5149-1] cups security update in Buster and Bullseye
• [#1008577] bullseye-pu: golang-github-russellhaering-goxmldsig/1.1.0-1+deb11u1 debdiff was approved and package uploaded
• [#1009077] bullseye-pu: minidlna/1.3.0+dfsg-2+deb11u1 debdiff was approved and package uploaded
• [#1009250] bullseye-pu: fribidi/1.0.8-2+deb11u1 debdiff was approved and package uploaded

Further I continued working on libvirt and started to work on blender and ncurses. I also continued to work on security support for golang packages. Last but not least I did some days of frontdesk duties and took care of issues on security-master. Debian ELTS This month was the forty-seventh ELTS month. During my allocated time I uploaded:

• ELS-618-1 for openldap

I also moved/refactored the current ELTS documentation to a new repository. Further I started to work on blender and ncurses in ELTS as well as in LTS. Last but not least I did some days of frontdesk duties. Debian Printing This month I uploaded new upstream versions or improved packaging of:

• ipp-usb
• cups
• hplip
• pappl

The reason for the new upstream version of ipp-usb was a strange bug. Some HP printers claim to have fax support but fail to respond to corresponding IPP queries. I understand that nowadays sending a fax is no longer a main theme for quality assurance. But if one tries to advertise as much features as possible, all these features should basically work and not prevent the things a printer should normally do. The reason for the new upstream version of cups was a security issue. You now should have the latest version of cups installed (there have been updates in other Debian releases as well). Debian Astro This month I uploaded new upstream versions or improved packaging of:

• openvlbi
• libinovasdk
• libricohcamerasdk
• indi-pentax
• indi-inovaplx

Other stuff This month I uploaded new packages:

• golang-github-muka-go-bluetooth

Like each month, have a look at the work funded by Freexian s Debian LTS offering. Debian project funding Two projects are currently in the pipeline: Gradle enterprise and Tryton update. Progress is quite slow on the Gradle one, there are technical difficulties. The tryton one was stalled because the developer had not enough time but seems to progress smoothly in the last weeks. In April, we put aside 2635 EUR to fund Debian projects. We re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article. Debian LTS contributors In April, 11 contributors have been paid to work on Debian LTS, their reports are available:

• Abhijith PA did 14h out of 14h assigned
• Anton Gladky did 20h out of 20h assigned
• Ben Hutchings did 11h out of 16h assigned and 8h from March, thus carrying over 13h to May
• Chris Lamb did 18h out of 18h assigned
• Emilio Pozuelo Monfort did 18h (out of 53.25h assigned), thus carrying over 35.25h to May
• Jeremiah Foster did 9.5h out of 13.5h assigned, thus carrying over 4h to May
• Markus Koschany did 40 out of 40h assigned
• Roberto C. S nchez did 18h carried out from March
• Sylvain Beucler did 20h out of 14.5h assigned and 25.5h from March, thus carrying over 20h to May
• Thorsten Alteholz did 40h out of 40h assigned
• Utkarsh Gupta did 23.25h out of 51.5h assigned and 1.75h from March, thus carrying over 30h to May

Evolution of the situation In April we released 30 DLAs and we were glad to welcome a new customer with Alter Way. The security tracker currently lists 72 packages with a known CVE and the dla-needed.txt file has 71 packages needing an update. It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org. But Freexian and its team of paid Debian contributors will continue to maintain Debian 9 going forward for the customers of the Extended LTS offer. If you have Debian 9 servers to keep secure, it s time to subscribe! You might not have noticed, but Freexian formalized a mission statement where we explain that our purpose is to help improve Debian. For this, we want to fund work time for the Debian developers that recently joined Freexian as collaborators. The Extended LTS and the PHP LTS offers are built following a model that will help us to achieve this if we manage to have enough customers for those offers. So consider subscribing: you help your organization but you also help Debian! Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 80 months)
  • GitHub (for 71 months)
  • Civil Infrastructure Platform (CIP) (for 48 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 91 months)
  • Linode (for 85 months)
  • Babiel GmbH (for 75 months)
  • Plat Home (for 74 months)
  • University of Oxford (for 30 months)
  • Deveryware (for 17 months)
  • VyOS Inc (for 12 months)
  • EDF SA
• Silver sponsors:
  • The Positive Internet Company (for 97 months)
  • Domeneshop AS (for 96 months)
  • Nantes M tropole (for 90 months)
  • Universit Jean Monnet de St Etienne (for 82 months)
  • Univention GmbH (for 81 months)
  • Ribbon Communications, Inc. (for 75 months)
  • Exonet B.V. (for 65 months)
  • Leibniz Rechenzentrum (for 59 months)
  • CINECA (for 49 months)
  • Minist re de l Europe et des Affaires trang res (for 43 months)
  • Cloudways Ltd (for 32 months)
  • Dinahosting SL (for 30 months)
  • Bauer Xcel Media Deutschland KG (for 24 months)
  • Platform.sh (for 24 months)
  • Moxa Intelligence Co., Ltd. (for 18 months)
  • sipgate GmbH (for 15 months)
  • Tilburg University (for 14 months)
  • OVH US LLC (for 13 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 5 months)
  • Telecats BV (for 3 months)
  • Soliton Systems K.K.
• Bronze sponsors:
  • Evolix (for 96 months)
  • Seznam.cz, a.s. (for 96 months)
  • Intevation GmbH (for 93 months)
  • Linuxhotel GmbH (for 93 months)
  • Daevel SARL (for 92 months)
  • Bitfolk LTD (for 91 months)
  • Megaspace Internet Services GmbH (for 91 months)
  • Greenbone Networks GmbH (for 90 months)
  • NUMLOG (for 90 months)
  • WinGo AG (for 89 months)
  • Ecole Centrale de Nantes LHEEA (for 85 months)
  • Entr ouvert (for 80 months)
  • Adfinis AG (for 78 months)
  • GNI MEDIA (for 72 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 72 months)
  • Tesorion (for 72 months)
  • Bearstech (for 64 months)
  • LiHAS (for 64 months)
  • People Doc (for 60 months)
  • Catalyst IT Ltd (for 58 months)
  • Supagro (for 54 months)
  • Demarcq SAS (for 52 months)
  • Universit Grenoble Alpes (for 38 months)
  • TouchWeb SAS (for 30 months)
  • SPiN AG (for 27 months)
  • CoreFiling (for 23 months)
  • Institut des sciences cognitives Marc Jeannerod (for 17 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 14 months)
  • Tem Innovations GmbH (for 9 months)
  • WordFinder.pro (for 8 months)
  • CNRS DT INSU R sif (for 7 months)
  • Alter Way

FTP master This month I accepted 186 and rejected 26 packages. The overall number of packages that got accepted was 188. Debian LTS This was my ninety-fourth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

• [DLA 2973-1] minidlna security update for one CVE
• [DLA 2974-1] fribidi security update for three CVEs
• [DLA 2988-1] tinyxml security update for one CVE
• [DLA 2987-1] libarchive security update for three CVEs
• [#1009076] buster-pu: minidlna/1.2.1+dfsg-2+deb10u3
• [#1009077] bullseye-pu: minidlna/1.3.0+dfsg-2+deb11u1
• [#1009251] buster-pu: fribidi/1.0.5-3.1+deb10u2
• [#1009250] bullseye-pu: fribidi/1.0.8-2+deb11u1
• [#1010380] buster-pu: flac/1.3.2-3+deb10u2

Further I worked on libvirt, the dependency problems in unstable have been resolved and fixing in other releases can continue. I also continued to work on security support for golang packages. Last but not least I did some days of frontdesk duties. Debian ELTS This month was the forty-siyth ELTS month. During my allocated time I uploaded:

• ELA-591-1 for minidlna
• ELA-592-1 for fribidi
• ELA-602-1 for tinyxml
• ELS-603-1 for libarchive

Last but not least I did some days of frontdesk duties. Debian Printing This month I uploaded new upstream versions or improved packaging of:

• hplip
• cups-filters

As I already became the maintainer of usb-modeswitch I also adopted usb-modeswitch-data Debian Astro Unfortunately I didn t do anything for this group, but in May I will upload a new version of openvlbi and several indi-3rdparty packages. Other stuff Last but not least I uploaded several new upstream version of golang packages but not before checking with ratt that all dependencies still work.

Every month we review the work funded by Freexian s Debian LTS offering. Please find the report for March below. Debian project funding

• There was no new activity in Debian project funding in the two existing projects. However, there was a survey run with hundreds of Debian Developers and Debian contributors. The survey results are being collated and we will use the anonymized data to further develop the Freexian project funding initiative.
• We are preparing to more broadly announce additional support for Debian 8 Jessie and Debian 9 Stretch. Now, Debian 8 can be supported until June 2025 and Debian 9 until June 2027. More information on ELTS support is available.
• In March 2250 was put aside to fund Debian projects.

Learn more about the rationale behind this initiative in this article. Debian LTS contributors In March, 11 contributors were paid to work on Debian LTS, their reports are available below. If you re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Rapha l if you are if you are interested in participating.

• Abhijith PA did 12.0h out of 12h assigned.
• Anton Gladky did 20h out of 20h assigned.
• Ben Hutchings did 16h out of 24h assigned.
• Chris Lamb did 18h out of 18h assigned.
• Emilio Pozuelo Monfort did 59.5h out of 59.5h assigned.
• Jeremiah Foster did 13.5 out of 20h assigned.
• Markus Koschany did 40h out of 40h assigned.
• Roberto C. S nchez did 14h out of 32h assigned, carrying over 18h
• Sylvain Beucler did 14.5h out of 40h assigned, carrying over 25.5h
• Thorsten Alteholz did 40h out of 40h assigned.
• Utkarsh Gupta did 57.75h out of 59.5h assigned, carrying over 1.75 hours.

Evolution of the situation In March we released 42 DLAs. The security tracker currently lists 81 packages with a known CVE and the dla-needed.txt file has 52 packages needing an update. We re glad to welcome a few new sponsors such as lectricit de France (Gold sponsor), Telecats BV and Soliton Systems. Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 79 months)
  • GitHub (for 70 months)
  • Civil Infrastructure Platform (CIP) (for 47 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 90 months)
  • Linode (for 84 months)
  • Babiel GmbH (for 73 months)
  • Plat Home (for 73 months)
  • University of Oxford (for 29 months)
  • Deveryware (for 16 months)
  • VyOS Inc (for 11 months)
  • EDF SA
• Silver sponsors:
  • Domeneshop AS (for 95 months)
  • The Positive Internet Company (for 95 months)
  • Nantes M tropole (for 89 months)
  • Univention GmbH (for 80 months)
  • Universit Jean Monnet de St Etienne (for 80 months)
  • Ribbon Communications, Inc. (for 74 months)
  • Exonet B.V. (for 64 months)
  • Leibniz Rechenzentrum (for 58 months)
  • CINECA (for 47 months)
  • Minist re de l Europe et des Affaires trang res (for 42 months)
  • Cloudways Ltd (for 31 months)
  • Dinahosting SL (for 29 months)
  • Bauer Xcel Media Deutschland KG (for 23 months)
  • Platform.sh (for 23 months)
  • Moxa Intelligence Co., Ltd. (for 17 months)
  • sipgate GmbH (for 14 months)
  • Tilburg University (for 13 months)
  • OVH US LLC (for 12 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 4 months)
  • Telecats BV
  • Soliton Systems K.K.
• Bronze sponsors:
  • Evolix (for 95 months)
  • Seznam.cz, a.s. (for 95 months)
  • Intevation GmbH (for 92 months)
  • Linuxhotel GmbH (for 92 months)
  • Daevel SARL (for 91 months)
  • Bitfolk LTD (for 89 months)
  • Megaspace Internet Services GmbH (for 89 months)
  • NUMLOG (for 89 months)
  • Greenbone Networks GmbH (for 88 months)
  • WinGo AG (for 88 months)
  • Ecole Centrale de Nantes LHEEA (for 84 months)
  • Entr ouvert (for 79 months)
  • Adfinis AG (for 77 months)
  • GNI MEDIA (for 71 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 71 months)
  • Tesorion (for 71 months)
  • Bearstech (for 63 months)
  • LiHAS (for 62 months)
  • People Doc (for 59 months)
  • Catalyst IT Ltd (for 57 months)
  • Supagro (for 52 months)
  • Demarcq SAS (for 51 months)
  • Universit Grenoble Alpes (for 37 months)
  • TouchWeb SAS (for 29 months)
  • SPiN AG (for 26 months)
  • CoreFiling (for 22 months)
  • Institut des sciences cognitives Marc Jeannerod (for 16 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 13 months)
  • Tem Innovations GmbH (for 8 months)
  • WordFinder.pro (for 7 months)
  • CNRS DT INSU R sif (for 6 months)

FTP master This month I accepted 332 and rejected 15 packages. This ratio gives a reason to hope. The overall number of packages that got accepted was 342. Debian LTS This was my ninety-third month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

• [DLA 2932-1] tiff security update for three CVEs
• [DLA 2931-1] cyrus-sasl2 security for one CVE
• [DLA 2966-1] libgc security update for one CVE
• [#1006493] bullseye-pu: htmldoc debdiff was approved and package uploaded
• [#1006493] buster-pu: htmldoc debdiff was approved and package uploaded
• [#1007938] buster-pu: cups/2.2.10-6+deb10u5
• [#1007938] buster-pu: cups debdiff was approved and package uploaded
• [#1008577] bullseye-pu: golang-github-russellhaering-goxmldsig/1.1.0-1+deb11u1
• [#1008578] buster-pu: golang-github-russellhaering-goxmldsig/0.0~git20170911.b7efc62-1+deb10u1
• [unstable] minidlna security update for one CVE

All my PU bugs for Buster and Bullseye, that accumulated over the last months, were part of the latest point release. So new ones have to be created now :-). I also continued to work on security support for golang packages. As a result #1008577 and #1008578 were the first real tests with a simple package. Debian ELTS This month was the forty-fifth ELTS month. During my allocated time I uploaded:

• ELA-573-1 for cyrus-sasl2
• ELA-589-1 for libgc

Unfortunately uploads have to be done for younger releases first, so I had to withhold some uploads for ELTS. Hopefully they can be done in April. Probably this policy needs to be reconsidered. Last but not least I did some days of frontdesk duties. Debian Printing This month I uploaded new upstream versions or improved packaging of:

• cups
• ipp-usb
• gutenprint
• foomatic-db
• cups-filters
• ippsample
• epson-inkjet-printer-escpr
• brlaser

In order to make the Debian Edu team happy, I uploaded a new version of cups-filters with an adapted Apparmor-file to Unstable and Bullseye. Debian Astro This month I uploaded new upstream versions or improved packaging of:

• openvlbi
• astap-cli
• astap

Other stuff This month I uploaded new upstream versions or improved packaging of:

• meep
• meep-mpi-default
• meep-openmpi
• nuspell
• pyicloud
• libsomocore
• osmo-trx
• libosmo-abis
• osmo-ggsn
• osmo-pcu
• osmo-sgsn
• osmo-msc
• openbsc
• osmo-hlr
• osmo-bts
• libosmo-netif
• libosmo-sccp
• osmo-mgw
• osmo-iuh

In order to avoid an AUTORM of some Osmocom packages, I also had to NMU:

• dahdi-linux

Every month we review the work funded by Freexian s Debian LTS offering. Please find the report for February below. Debian project funding

• In February Rapha l and the LTS worked on a survey of Debian developers meant to solicit ideas for improvements in the Debian project at large. You can see the results of the initial discussion here in the list of ideas of which there are already over 30.
• The full survey is due to be emailed to Debian Developers shortly.
• In February 2250 was put aside to fund Debian projects.

Debian LTS contributors In February, 12 contributors were paid to work on Debian LTS, their reports are available below. If you re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Rapha l if you are if you are interested in participating.

• Abhijith PA did 10h out of 10h available.
• Anton Gladky did 20h out of 20h available.
• Ben Hutchings did 16h out of 16h available.
• Chris Lamb did 18h out of 18h available.
• Emilio Pozuelo Monfort did 42.75h out of 42.75h available.
• Jeremiah Foster worked 20 hours out of 20 available on LTS administration and 2.9 hours on funded projects.
• Markus Koschany did 30h (out of 40h available), thus carrying over 10h to March.
• Roberto C. S nchez did 12h out of 12h available.
• Sylvain Beucler did 13h (out of 40h available), thus carrying over 27h to March.
• Thorsten Alteholz did 40h out of 40h available.
• Utkarsh Gupta did 15.75h (out of 42.75h available), thus carrying over 27h to March.

Evolution of the situation In February we released 24 DLAs. The security tracker currently lists 61 packages with a known CVE and the dla-needed.txt file has 26 packages needing an update. You can find out more about the Debian LTS project via the following video:

Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 78 months)
  • GitHub (for 68 months)
  • Civil Infrastructure Platform (CIP) (for 46 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 89 months)
  • Linode (for 83 months)
  • Babiel GmbH (for 72 months)
  • Plat Home (for 71 months)
  • University of Oxford (for 28 months)
  • Deveryware (for 15 months)
  • VyOS Inc (for 10 months)
• Silver sponsors:
  • The Positive Internet Company (for 94 months)
  • Domeneshop AS (for 93 months)
  • Nantes M tropole (for 87 months)
  • Univention GmbH (for 79 months)
  • Universit Jean Monnet de St Etienne (for 79 months)
  • Ribbon Communications, Inc. (for 73 months)
  • Exonet B.V. (for 63 months)
  • Leibniz Rechenzentrum (for 57 months)
  • CINECA (for 46 months)
  • Minist re de l Europe et des Affaires trang res (for 40 months)
  • Cloudways Ltd (for 29 months)
  • Dinahosting SL (for 27 months)
  • Platform.sh (for 22 months)
  • Bauer Xcel Media Deutschland KG (for 21 months)
  • Moxa Intelligence Co., Ltd. (for 16 months)
  • sipgate GmbH (for 13 months)
  • OVH US LLC (for 11 months)
  • Tilburg University (for 11 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH
  • Telecats BV
  • Soliton Systems K.K.
• Bronze sponsors:
  • Evolix (for 94 months)
  • Seznam.cz, a.s. (for 94 months)
  • Linuxhotel GmbH (for 91 months)
  • Intevation GmbH (for 90 months)
  • Daevel SARL (for 89 months)
  • Bitfolk LTD (for 88 months)
  • Megaspace Internet Services GmbH (for 88 months)
  • Greenbone Networks GmbH (for 87 months)
  • NUMLOG (for 87 months)
  • WinGo AG (for 86 months)
  • Ecole Centrale de Nantes LHEEA (for 83 months)
  • Entr ouvert (for 78 months)
  • Adfinis AG (for 75 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 70 months)
  • Tesorion (for 70 months)
  • GNI MEDIA (for 69 months)
  • Bearstech (for 61 months)
  • LiHAS (for 61 months)
  • People Doc (for 57 months)
  • Catalyst IT Ltd (for 56 months)
  • Supagro (for 51 months)
  • Demarcq SAS (for 50 months)
  • Universit Grenoble Alpes (for 36 months)
  • TouchWeb SAS (for 28 months)
  • SPiN AG (for 24 months)
  • CoreFiling (for 20 months)
  • Institut des sciences cognitives Marc Jeannerod (for 15 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 11 months)
  • Tem Innovations GmbH (for 6 months)
  • WordFinder.pro (for 6 months)
  • CNRS DT INSU R sif (for 4 months)

FTP master This month I accepted 484 and rejected 73 packages. The overall number of packages that got accepted was 495. The overall number of rejected packages was 76, which is about 15% of the uploads to NEW. While most of the maintainers do a great job when creating their debian/copyright, others are a bit lax. Unfortunately those people seem to be more enthusiastic when fighting for changes in NEW processing or even removing NEW. One argument in discussions about NEW is that the copyright verification of packages can be done by the community after accepting the packages in the archive.
Last month I did not get any hint that such checks have been done by anybody. As the past already showed several times, this community based checks simply do not exist. So in the end poorly maintained copyright information will rot in the archive and I am not sure that this really corresponds with the Debian Social Contract. Debian LTS This was my ninety-second month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

• [DLA 2928-1] htmldoc security update for three CVEs
• [#1004049] buster-pu: zziplib debdiff was approved and package uploaded
• [#1004050] bullseye-pu: zziplib debdiff was approved and package uploaded
• [#1004055] buster-pu: debdiff was approved and package uploaded
• [#1006493] bullseye-pu: htmldoc/1.9.11-4+deb11u2
• [#1006494] buster-pu: htmldoc/1.9.3-1+deb10u3
• [#1006550] buster-pu: tiff/4.1.0+git191117-2~deb10u4
• [#1006551] bullseye-pu: tiff/4.2.0-1+deb11u1

Unfortunately salsa went down at the end of the month, so several planned uploads did not happen and have to be delayed to March. I also continued to work on security support for golang packages. Further I worked on packages in NEW on security-master and injected missing sources. Last but not least I did some days of frontdesk duties. Debian ELTS This month was the forty-fourth ELTS month. During my allocated time I uploaded:

• ELA-567-1 for apache2
• ELA-567-2 for apache2
• ELA-568-1 for ksh
• ELA-569-1 for tiff
• ELA-570-1 for htmldoc

Further I worked on cyrus-sasl but did not do an upload yet. Last but not least I did some days of frontdesk duties. Debian Printing As announced last month I uploaded a new version of cups. Altogether I uploaded new upstream versions or improved packaging of:

• cups
• cups-filters

Debian Astro This month I uploaded new upstream versions or improved packaging of:

• openvlbi

Other stuff This month I uploaded new upstream versions or improved packaging of:

• duktape
• meep
• bitshuffle
• several golang packages

Every month we review the work funded by Freexian s Debian LTS offering. Please find the report for January below. Debian project funding

• In January we saw a new funded project proposed. The project is meant to bring in a number of changes to the Tryton modules and packages in Debian. Tryton, a full featured, entirely open source business software platform, is supported by its own foundation. You can track the current status of all our funded projects at its dedicated web page.
• Folks continue to add to the Grow Your Ideas project page, that s great.
• In January 2550 was put aside to fund Debian projects.

We continue to looking forward to hearing about Debian project proposals from various Debian stakeholders. This month has seen work on a survey that will go out to Debian Developers to gather feedback on what they think should be the priorities for funding in the project. Learn more about the rationale behind this initiative in this article. Debian LTS contributors In January, 13 contributors were paid to work on Debian LTS, their reports are available below. If you re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Rapha l.

• Abhijith Pa worked 5 hours out of 5 available.
• Anton Gladky worked 12 hours out of 12 available.
• Ben Hutchings worked 16 hours out of 24 available and carried over 8 for February.
• Chris Lamb worked 18 hours out of 18 available.
• Emilio Pozuelo Monfort worked 55 hours out of 58.25 available and carried over 3.25 for February
• Jeremiah Foster worked 20 hours out of 20 available on LTS administration and 8.3 hours on funded projects.
• Lee Garrett didn t spend any hours in January and carries over 39.25 hours to February
• Markus Koschany worked 34 hours out of 40 available and carried over 6 for February.
• Ola Lundqvist reported via email that they didn t spend any hours in January and carries over 11 from December for a total of 12 hours for February.
• Roberto C. Sanchez worked 9 hours out of 32 available and carried over 23 for February
• Sylvain Beucler worked 22 hours out of 40 available and carried over 14 for February
• Thorsten Alteholz worked 40 hours out of 40 available.
• Utkarsh Gupta worked 58.25 hours out of 58.25 available.

Evolution of the situation In January we released 34 DLAs. The security tracker currently lists 39 packages with a known CVE and the dla-needed.txt file has 20 packages still needing an update. Thanks to our sponsors Sponsors that joined recently are in bold.

• Platinum sponsors:
  • TOSHIBA (for 77 months)
  • GitHub (for 68 months)
  • Civil Infrastructure Platform (CIP) (for 45 months)
• Gold sponsors:
  • Roche Diagnostics International AG (for 88 months)
  • Linode (for 82 months)
  • Babiel GmbH (for 71 months)
  • Plat Home (for 71 months)
  • University of Oxford (for 27 months)
  • Deveryware (for 14 months)
  • VyOS Inc (for 9 months)
• Silver sponsors:
  • The Positive Internet Company (for 93 months)
  • Domeneshop AS (for 92 months)
  • Nantes M tropole (for 86 months)
  • Univention GmbH (for 78 months)
  • Universit Jean Monnet de St Etienne (for 78 months)
  • Ribbon Communications, Inc. (for 72 months)
  • Exonet B.V. (for 62 months)
  • Leibniz Rechenzentrum (for 56 months)
  • CINECA (for 45 months)
  • Minist re de l Europe et des Affaires trang res (for 39 months)
  • Cloudways Ltd (for 29 months)
  • Dinahosting SL (for 27 months)
  • Bauer Xcel Media Deutschland KG (for 21 months)
  • Platform.sh (for 21 months)
  • Moxa Intelligence Co., Ltd. (for 15 months)
  • sipgate GmbH (for 12 months)
  • OVH US LLC (for 10 months)
  • Tilburg University (for 10 months)
  • GSI Helmholtzzentrum f r Schwerionenforschung GmbH
  • Telecats BV
• Bronze sponsors:
  • Evolix (for 93 months)
  • Seznam.cz, a.s. (for 93 months)
  • Intevation GmbH (for 90 months)
  • Linuxhotel GmbH (for 90 months)
  • Daevel SARL (for 88 months)
  • Bitfolk LTD (for 87 months)
  • Megaspace Internet Services GmbH (for 87 months)
  • Greenbone Networks GmbH (for 86 months)
  • NUMLOG (for 86 months)
  • WinGo AG (for 86 months)
  • Ecole Centrale de Nantes LHEEA (for 82 months)
  • Entr ouvert (for 77 months)
  • Adfinis AG (for 74 months)
  • GNI MEDIA (for 69 months)
  • Laboratoire LEGI UMR 5519 / CNRS (for 69 months)
  • Tesorion (for 69 months)
  • Bearstech (for 60 months)
  • LiHAS (for 60 months)
  • People Doc (for 57 months)
  • Catalyst IT Ltd (for 55 months)
  • Supagro (for 50 months)
  • Demarcq SAS (for 49 months)
  • Universit Grenoble Alpes (for 35 months)
  • TouchWeb SAS (for 27 months)
  • SPiN AG (for 24 months)
  • CoreFiling (for 19 months)
  • Institut des sciences cognitives Marc Jeannerod (for 14 months)
  • Observatoire des Sciences de l Univers de Grenoble (for 11 months)
  • Tem Innovations GmbH (for 6 months)
  • WordFinder.pro (for 5 months)
  • CNRS DT INSU R sif (for 4 months)

FTP master This month I accepted 342 and rejected 57 packages. The overall number of packages that got accepted was 366. Lately I was asked: Is it ftpmaster s opinion and policy that there is no difference in NEW queue review process between bin and src? This is a yes/no-question and in this generality the answer is clearly: Every package in NEW needs a full review. Of course there are circumstances with exceptions. For example after an upload of -1, which would get a full review, the upload of -2 afterwards, introducing a new binary package, would get a much faster review. In this case it would make sense to ping on IRC and draw attention to this. Nevertheless the evaluation of a light review might differ between the maintainer and the person doing the review. Debian LTS This was my ninety-first month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian. This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

• [DLA 2882-1] sphinxsearch security update for one CVE
• [DLA 2890-1] libspf2 security update for two CVEs
• [DLA 2897-1] apr security update for one CVE
• [DLA 2900-1] lrzsz security update for one CVE
• [DLA 2901-1] libxfont security update for one CVE
• [DLA 2902-1] graphicsmagick security update for one CVE
• [#1004049] buster-pu: package zziplib/0.13.62-3.2+deb10u1
• [#1004050] bullseye-pu: package zziplib/0.13.62-3.3+deb11u1
• [#1004055] buster-pu: package raptor2/2.0.14-1.1~deb10u2

I also started to work on security support for golang packages. Though this sounds like an easy task, the devel is in the details.
As CVEs need to be fixed in unstable first, at the moment it looks like this is the most time consuming task. I will report later on my journey to fix open CVEs in golang-github-russellhaering-goxmldsig Further I worked on packages in NEW on security-master and injected missing sources. Last but not least I did some days of frontdesk duties and attended an LTS meeting on IRC. Debian ELTS This month was the forty-third ELTS month. During my allocated time I uploaded:

• ELA-544-1 for libspf2
• ELA-549-1 for apr
• ELA-552-1 for lrzsz
• ELA-553-1 for libxfont

Further I worked on an update for apache2 Last but not least I did some days of frontdesk duties. Debian Printing I was finally able to upload a new version of hplip and Ubuntu is now able to build new snaps for their next release.
Altogether I uploaded new upstream versions or improved packaging of:

• pappl
• rasterview
• cjet
• epson-inkjet-printer-escpr
• cups-filters
• lprint
• hplip

Now the dashboard looks rather good and my next task for February is an update of cups. Debian Astro As there was a release of version 1.9.4 of INDI and indi-3rdparty, I also uploaded the new version of all INDI drivers and releated libs from indi-3rdparty. Other stuff This month I uploaded lots of new upstream releases of golang packages.