Search Results: "Ben Hutchings"

Freexian Collaborators: Monthly report about Debian Long Term Support, September 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In September, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 7.0h (out of 0.0h assigned and 14.0h from previous period), thus carrying over 7.0h to the next month.

Adrian Bunk did 51.75h (out of 9.25h assigned and 55.5h from previous period), thus carrying over 13.0h to the next month.

Arturo Borrero Gonzalez did 10.0h (out of 0.0h assigned and 10.0h from previous period).

Bastien Roucari s did 20.0h (out of 20.0h assigned).

Ben Hutchings did 20.0h (out of 12.0h assigned and 12.0h from previous period), thus carrying over 4.0h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 23.0h (out of 26.0h assigned), thus carrying over 3.0h to the next month.

Emilio Pozuelo Monfort did 23.5h (out of 22.25h assigned and 37.75h from previous period), thus carrying over 36.5h to the next month.

Guilhem Moulin did 22.25h (out of 20.0h assigned and 2.5h from previous period), thus carrying over 0.25h to the next month.

Lucas Kanashiro did 10.0h (out of 5.0h assigned and 15.0h from previous period), thus carrying over 10.0h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 6.5h (out of 14.5h assigned and 9.5h from previous period), thus carrying over 17.5h to the next month.

Roberto C. S nchez did 24.75h (out of 21.0h assigned and 3.75h from previous period).

Santiago Ruano Rinc n did 19.0h (out of 19.0h assigned).

Sean Whitton did 0.75h (out of 4.0h assigned and 2.0h from previous period), thus carrying over 5.25h to the next month.

Sylvain Beucler did 16.0h (out of 42.0h assigned and 18.0h from previous period), thus carrying over 44.0h to the next month.

Thorsten Alteholz did 11.0h (out of 11.0h assigned).

Tobias Frost did 17.0h (out of 7.5h assigned and 9.5h from previous period).

Evolution of the situation In September, we have released 52 DLAs. September marked the first full month of Debian 11 bullseye under the responsibility of the LTS Team and the team immediately got to work, publishing more than 4 dozen updates. Some notable updates include ruby2.7 (denial-of-service, information leak, and remote code execution), git (various arbitrary code execution vulnerabilities), firefox-esr (multiple issues), gnutls28 (information disclosure), thunderbird (multiple issues), cacti (cross site scripting and SQL injection), redis (unauthorized access, denial of service, and remote code execution), mariadb-10.5 (arbitrary code execution), cups (arbitrary code execution). Several LTS contributors have also contributed package updates which either resulted in a DSA (a Debian Security Announcement, which applies to Debian 12 bookworm) or in an upload that will be published at the next stable point release of Debian 12 bookworm. This list of packages includes cups, cups-filters, booth, nghttp2, puredata, python3.11, sqlite3, and wireshark. This sort of work, contributing fixes to newer Debian releases (and sometimes even to unstable), helps to ensure that upgrades from a release in the LTS phase of its lifecycle to a newer release do not expose users to vulnerabilities which have been closed in the older release. Looking beyond Debian, LTS contributor Bastien Roucari s has worked with the upstream developers of apache2 to address regressions introduced upstream by some recent vulnerability fixes and he has also reached out to the community regarding a newly discovered security issue in the dompurify package. LTS contributor Santiago Ruano Rinc n has undertaken the work of triaging and reproducing nearly 4 dozen CVEs potentially affecting the freeimage package. The upstream development of freeimage appears to be dormant and some of the issues have languished for more than 5 years. It is unclear how much can be done without the aid of upstream, but we will do our best to provide as much help to the community as we can feasibly manage. Finally, it is sometimes necessary to limit or discontinue support for certain packages. The transition of a release from being under the responsibility of the Debian Security Team to that of the LTS Team is an occasion where we assess any pending decisions in this area and formalize them. Please see the announcement for a complete list of packages which have been designated as unsupported.

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 108 months)

Civil Infrastructure Platform (CIP) (for 76 months)

VyOS Inc (for 40 months)

Gold sponsors:

Roche Diagnostics International AG (for 118 months)

Akamai - Linode (for 112 months)

Babiel GmbH (for 102 months)

Plat Home (for 101 months)

CINECA (for 76 months)

University of Oxford (for 58 months)

Deveryware (for 45 months)

EDF SA (for 30 months)

Dataport A R (for 5 months)

CERN (for 3 months)

Silver sponsors:

Domeneshop AS (for 123 months)

Nantes M tropole (for 117 months)

Univention GmbH (for 109 months)

Universit Jean Monnet de St Etienne (for 109 months)

Ribbon Communications, Inc. (for 103 months)

Exonet B.V. (for 92 months)

Leibniz Rechenzentrum (for 87 months)

Minist re de l Europe et des Affaires trang res (for 70 months)

Cloudways by DigitalOcean (for 60 months)

Dinahosting SL (for 58 months)

Bauer Xcel Media Deutschland KG (for 52 months)

Platform.sh SAS (for 52 months)

Moxa Inc. (for 46 months)

sipgate GmbH (for 44 months)

OVH US LLC (for 42 months)

Tilburg University (for 42 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 33 months)

Soliton Systems K.K. (for 30 months)

THINline s.r.o. (for 6 months)

Copenhagen Airports A/S

Bronze sponsors:

Evolix (for 123 months)

Seznam.cz, a.s. (for 123 months)

Intevation GmbH (for 120 months)

Linuxhotel GmbH (for 120 months)

Daevel SARL (for 119 months)

Bitfolk LTD (for 118 months)

Megaspace Internet Services GmbH (for 118 months)

Greenbone AG (for 117 months)

NUMLOG (for 117 months)

WinGo AG (for 116 months)

Entr ouvert (for 107 months)

Adfinis AG (for 105 months)

Tesorion (for 100 months)

GNI MEDIA (for 99 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 99 months)

Bearstech (for 91 months)

LiHAS (for 91 months)

Catalyst IT Ltd (for 86 months)

Supagro (for 81 months)

Demarcq SAS (for 80 months)

Universit Grenoble Alpes (for 66 months)

TouchWeb SAS (for 58 months)

SPiN AG (for 55 months)

CoreFiling (for 51 months)

Institut des sciences cognitives Marc Jeannerod (for 46 months)

Observatoire des Sciences de l Univers de Grenoble (for 42 months)

Tem Innovations GmbH (for 37 months)

WordFinder.pro (for 36 months)

CNRS DT INSU R sif (for 35 months)

Alter Way (for 28 months)

Institut Camille Jordan (for 18 months)

SOBIS Software GmbH (for 3 months)

Ben Hutchings: FOSS activity in September 2024

I continued to attend and soemtimes chair Debian kernel team meetings
For the Debian firmware-nonfree package:
- I opened the MRs:
  - !105: nvidia-graphics: Add versioned Breaks on initramfs-tools to avoid bug #1076539
  - !107: Update to 20240909; improve orig tarball generation
- I reviewed the MRs:
  - !79: Improve maintainer scripts of firmware-nonfree
  - !102: Backport firmware-nonfree 20240709-2~bpo12+1 to Bookworm (merged)
  - !103: Add missing symlinks for tas2563 and tas2781 (merged)
  - !106: Update to 20240811 (merged)
- I merged my own MRs:
  - !104: Update to linux-support-6.10.6
  - !105: nvidia-graphics: Add versioned Breaks on initramfs-tools to avoid bug #1076539
- I uploaded:
  - version 20240709-2 to unstable
  - version 20240709-2~bpo12+1 to bookworm-backports
- I respnded to bug reports:
  - #1080492: firmware-nonfree: [i915] With 20240709-2, the external monitors randomly blank for 2-3 seconds (regression) (closed)
For the kernel-team repository:
- I reviewed and merged the MR !5: git-format-patch-for-debian: Support for sourcehut
- I deleted some obsolete text from the kernel upload checklist
For the Debian linux package:
- I announced the end of i386 kernel packages
- I opened or updated the MRs:
- I reviewed the MRs:
  - !675: [arm64] drivers/usb/host: Enable USB_XHCI_PCI_RENESAS as module (Closes: #1032671)
  - !1732: [x86] linux-cpupower: Add intel-speed-select command (rebased and merged)
  - !1038: debian/rules.real: export LANG = C.UTF-8 for sphinx (closed)
  - !1041: Add -b flag to genorig.py (closed)
  - !1065: Enable UBSAN_BOUNDS and UBSAN_SHIFT (closed)
  - !1166: [amd64] Enable CRYPTO_DEV_IAA_CRYPTO (merged)
  - !1169: [arm64] Add additional kernel with 64k page size
  - !1172: debian/config: add DAMON support for debian kernel (merged)
  - !1177: powerpc: Explicitly disable CRASH_DUMP on 32-bit (merged)
  - !1178: mm: set CONFIG_ZONE_DEVICE=y on most 64-bit architectures, not only amd64 (merged)
  - !1185: riscv64: fix module duplication detected by kernel-wedge starting with version 2.106 (merged)
  - !1186: [arm64] udeb: fix duplicated modules (merged)
  - !1192: [loong64] enable LBT, KVM and para-virt support (merged)
  - !1193: [arm64] Update rk3588 platform support (merged)
  - !1195: [arm64] enable Qualcomm X Elite support (merged)
  - !1196: [arm64] include modules for Rockchip RK3588 (closed)
  - !1198: Revert Make linux-libc-dev provide all cross packages (merged)
  - !1204: [arm64] Enable drivers for K3-AM642 SoC on SolidRun HummingBoard-T
  - !1207: [rt] Update to 6.11-rc5-rt5 (merged)
  - !1208: Support some Wi-Fi 7 devices (merged)
  - !1211: Set CONFIG_I2C=y on alpha and sparc64 (closed)
  - !1214: [loong64] Enable USB EHCI and OHCI host support (merged)
- I merged my own MRs:
  - !741: Fix most reproducibility issues
  - !1182: [x86] ACPI: Enable ACPI_EC_DEBUGFS as module (Closes: #980555)
  - !1188: [arm64] udeb: fix duplicated modules
  - !1199: [i386] Stop building kernel packages
  - !1200: Backport CI support to bullseye
  - !1209: Build fixes for rtla
  - !1215: d/rules.real: Try harder to set the locale to C.UTF-8
  - !1218: Clean up udeb configuration
- I uploaded:
  - linux-6.1 versions 6.1.106-3~deb11u1, 6.1.106-3~deb11u2, and 6.1.106-3~deb11u3 to bullseye-security
  - linux version 6.11-1~exp1 to experimental
- I updated the bullseye-security branch to upstream version 5.10.226
- I responded to bug reports:
- I sent patches upstream:
  - wifi: iwlegacy: Fix field-spanning write warning in il_enqueue_hcmd() which is meant to fix bug #1062421
  - tools/rtla: Fix installation from out-of-tree build
- I sent a new response to Proposal: Switch to linear git history
For the Debian nfs-utils package:
- I reviewed the MRs:
  - !8: Fixes for bugs #849942 and #849608 (closed)
  - !32: d/control: nfs-common: Move python3 to Recommends (merged)
- I closed my own old bug report #711021: mount.nfs timeout for GETPORT is much too short
For diffoscope:
- I commented on issue #100: Excessive memory use when comparing Linux Debian .dbg packages to report that the issue still exists, and to provide a reproducer
- I commented on issue #342: Gets killed trying to diff very large (~5GB) images which seems like a duplicate of #100
- I opened the MR !145: Draft: Reduce memory usage by revert to using popen() for diff input and output which fixes #100 but needs work to avoid regressions for other cases
For the Debian nss-wrapper package, I opened MR !4: Replace wrap-and-sort autopkgtest with a CI job
For the Debian pam-wrapper package, I opened MR !4: Replace wrap-and-sort autopkgtest with a CI job
For initramfs-tools:
- I opened the MR !136: Fix copy_file again; expand documentation and add tests
- I reviewed the MRs:
- I responded to bug report #1082647: copy_exec: [regression] ignores trailing slash, installs file as directory name (pending)
For debian-kernel-handbook:
- I reviwed the MRs:
  - !7: Add disabling SECURITY_LOCKDOWN_LSM to chapter-common-tasks
  - !8: Disable dwarf toolchain default to really disable debug info (merged)
I responded (belatedly) to Debian tech-ctte bug #1065416: linux-libc-dev claims to provide linux-libc-dev-ARCH-cross, but it doesn t do that completely

Freexian Collaborators: Monthly report about Debian Long Term Support, August 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In August, 16 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 44.5h (out of 46.5h assigned and 53.5h from previous period), thus carrying over 55.5h to the next month.

Bastien Roucari s did 20.0h (out of 20.0h assigned).

Ben Hutchings did 9.0h (out of 0.0h assigned and 21.0h from previous period), thus carrying over 12.0h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 12.0h (out of 7.0h assigned and 5.0h from previous period).

Emilio Pozuelo Monfort did 22.25h (out of 6.5h assigned and 53.5h from previous period), thus carrying over 37.75h to the next month.

Guilhem Moulin did 17.5h (out of 8.75h assigned and 11.25h from previous period), thus carrying over 2.5h to the next month.

Lee Garrett did 11.5h (out of 58.0h assigned and 2.0h from previous period), thus carrying over 48.5h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 14.5h (out of 4.0h assigned and 20.0h from previous period), thus carrying over 9.5h to the next month.

Roberto C. S nchez did 8.25h (out of 5.0h assigned and 7.0h from previous period), thus carrying over 3.75h to the next month.

Santiago Ruano Rinc n did 21.5h (out of 11.5h assigned and 10.0h from previous period).

Sean Whitton did 4.0h (out of 2.25h assigned and 3.75h from previous period), thus carrying over 2.0h to the next month.

Sylvain Beucler did 42.0h (out of 46.0h assigned and 14.0h from previous period), thus carrying over 18.0h to the next month.

Thorsten Alteholz did 11.0h (out of 11.0h assigned).

Tobias Frost did 2.5h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 9.5h to the next month.

Evolution of the situation In August, we have released 1 DLAs. During the month of August Debian 11 "bullseye" officially transitioned to the responsibility of the LTS team (on 2024-08-15). However, because the final point release (11.11) was not made until 2024-08-31, LTS contributors were prevented from uploading packages to bullseye until after the point release had been made. That said, the team was not at all idle, and was busy at work on a variety of tasks which impacted both LTS and the broader Debian community, as well as preparing uploads which will be released during the month of September. Of particular note, LTS contributor Bastien Roucari s prepared updates of the putty and cacti packages for bookworm (1 2) and bullseye (1 2), which were accepted by the old-stable release managers for the August point releases. He also analysed several security regressions in the apache2 package. LTS contributor Emilio Pozuelo Monfort worked on the Rust toolchain in bookworm and bullseye, which will be needed to support the upcoming Firefox ESR and Thunderbird ESR releases from the Mozilla project. Additionally, LTS contributor Thorsten Alteholz prepared bookworm and bullseye updates of the cups package (1 2), which were accepted by the old-stable release managers for the August point releases. LTS contributor Markus Koschany collaborated with Emmanuel Bourg, co-maintainer of the tomcat packages in Debian. Regressions in a proposed security fix necessitated the updating of the tomcat10 package in Debian to the latest upstream release. LTS contributors Bastien and Santiago Ruano Rinc n collaborated with the upstream developers and the Debian maintainer (Bernhard Schmidt) of the FreeRADIUS project towards addressing the BlastRADIUS vulnerability in the bookworm and bullseye versions of the freeradius package. If you use FreeRADIUS in Debian bookworm or bullseye, we encourage you to test the packages following the instructions found in the call for testers to help identifying any possible regression that could be introduced with these updates. Testing is an important part of the work the LTS Team does, and in that vein LTS contributor Sean Whitton worked on improving the documentation and tooling around creating test filesystems which can be used for testing a variety of package update scenarios.

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 107 months)

Civil Infrastructure Platform (CIP) (for 75 months)

VyOS Inc (for 39 months)

Gold sponsors:

Roche Diagnostics International AG (for 117 months)

Akamai - Linode (for 111 months)

Babiel GmbH (for 101 months)

Plat Home (for 100 months)

CINECA (for 75 months)

University of Oxford (for 57 months)

Deveryware (for 44 months)

EDF SA (for 29 months)

Dataport A R (for 4 months)

Silver sponsors:

Domeneshop AS (for 122 months)

Nantes M tropole (for 116 months)

Univention GmbH (for 108 months)

Universit Jean Monnet de St Etienne (for 108 months)

Ribbon Communications, Inc. (for 102 months)

Exonet B.V. (for 91 months)

Leibniz Rechenzentrum (for 86 months)

Minist re de l Europe et des Affaires trang res (for 69 months)

Cloudways by DigitalOcean (for 59 months)

Dinahosting SL (for 57 months)

Bauer Xcel Media Deutschland KG (for 51 months)

Platform.sh SAS (for 51 months)

Moxa Inc. (for 45 months)

sipgate GmbH (for 43 months)

OVH US LLC (for 41 months)

Tilburg University (for 41 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 32 months)

Soliton Systems K.K. (for 29 months)

THINline s.r.o. (for 5 months)

Bronze sponsors:

Evolix (for 122 months)

Seznam.cz, a.s. (for 122 months)

Intevation GmbH (for 119 months)

Linuxhotel GmbH (for 119 months)

Daevel SARL (for 118 months)

Bitfolk LTD (for 117 months)

Megaspace Internet Services GmbH (for 117 months)

Greenbone AG (for 116 months)

NUMLOG (for 116 months)

WinGo AG (for 115 months)

Entr ouvert (for 106 months)

Adfinis AG (for 104 months)

Tesorion (for 99 months)

GNI MEDIA (for 98 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 98 months)

Bearstech (for 90 months)

LiHAS (for 90 months)

Catalyst IT Ltd (for 85 months)

Supagro (for 80 months)

Demarcq SAS (for 79 months)

Universit Grenoble Alpes (for 65 months)

TouchWeb SAS (for 57 months)

SPiN AG (for 54 months)

CoreFiling (for 50 months)

Institut des sciences cognitives Marc Jeannerod (for 45 months)

Observatoire des Sciences de l Univers de Grenoble (for 41 months)

Tem Innovations GmbH (for 36 months)

WordFinder.pro (for 35 months)

CNRS DT INSU R sif (for 34 months)

Alter Way (for 27 months)

Institut Camille Jordan (for 17 months)

SOBIS Software GmbH

Ben Hutchings: FOSS activity in August 2024

For the Debian firmware-nonfree package:
- I opened the MR:
  - !104: Update to linux-support-6.10.6
- I reviewed the MRs:
  - !102: Backport firmware-nonfree 20240709-2~bpo12+1 to Bookworm
- I responded to a query about backporting.
For the Debian linux package:
- I opened or updated the MRs:
- I reviewed the MRs:
- I merged my own MRs:
  - !1161: Fix and clean up Build-Depends
  - !1164: d/config: Fix broken configs that were being resolved differently by kconfig
  - !1175: Fix perf build failure on many architectures
- I uploaded:
  - linux version 6.11~rc4-1~exp1 to experimental.
  - linux version 6.11~rc5-1~exp1 to experimental.
  - linux version 6.10.6-1~bpo12+1 to bookworm-backports.
- Upstream, I commented on additional backports required to address CVE-2024-26621 and CVE-2024-42258.
- I responded to bug reports:
  - #1072004: linux: regression in the 9p protocol in 6.8 breaks autopkgtest qemu jobs (affecting debci)
- Upstream, I submitted the patch aacraid: Fix double-free on probe failure which should fix part of bug #1075855.
- Upstream, I pointed out that the fix in !1175 is needed in Linux 6.11.
- I updated the bullseye-security branch to upstream version 5.10.224, but didn t make a new upload.
- I updated the bullseye-security-6.1 branch, merging changes from version 6.1.106-3.
For initramfs-tools:
- I opened and later merged the MRs:
- I reviewed the MRs:
  - !128: Put compressed kernel modules and firmware in an uncompressed cpio
- I uploaded:
  - version 0.144 to Debian unstable.
  - version 0.145 to Debian unstable.
  - version 0.142+deb12u1 to Debian bookworm.
- I responded to Debian bug reports:
For the Debian iproute package, I reverted the recent removal of the /usr/sbin/ip symlink and uploaded version 6.10.0-2.
For kernel-wedge:
- I fixed a bug in duplicate detection that linux !1176 had revealed.
- I added support for packages installing modules under /usr/lib/modules, and a test case for this.
- I uploaded version 2.106 to Debian unstable, including the above and some other bug fixes.
For the Debian sgt-puzzles package, I responded to and wrote a patch for bug #1079717: sgt-puzzles: [Mozaic] crashes when copying the game.

Ben Hutchings: FOSS activity in July 2024

I continued participating in Debian kernel team meetings.
For the Debian linux package:
- I investigated a regression for nftables introduced in my final upload of linux to buster-security, and passed on the information to the Freexian ELTS team.
- I uploaded:
  - linux version 6.1.94-1~bpo11+1 to bullseye-backports.
  - linux version 6.8.12-1~bpo12+1 to bookworm-backports.
  - linux version 6.9.7-1~bpo12+1 to bookworm-backports.
  - linux version 6.10-1~exp1 to experimental.
  - linux version 6.1.99-1~bpo11+1 to bullseye-backports (but it was never accepted).
  - linux version 6.10.1-1~exp1 to experimental.
  - linux version 6.9.10-1~bpo12+1 to bookworm-backports.
- I opened or updated MRs:
- I reviewed MRs:
- I merged my own MRs:
  - !1110: d/l/p/debian_linux/firmware.py: Handle RawFile fields
  - !1112: Update d/l/p/debian_linux/firmware.py for current WHENCE format
  - !1119: Update d/b/test-patches to work with current package
  - !1126: [alpha] scsi: Disable SCSI_IMM (fixes FTBFS)
- To support Debian ELTS, I created branches of the Linux 5.10 and 6.1 packaging with backports of the change to use an ephemeral module signing key.
- I answered a query about use of the linux-image-*-unsigned packages.
- I responded to bug reports:
- Upstream, I commented on how to detect 32-bit architectures in order to fix CVE-2024-42258.
- Upstream, I submitted the patch xhci-pci: Make xhci-pci-renesas a proper modular driver which is a prerequisite for merging MR !675.
- I asked the Debian Super-H porters whether the sh7785lcr kernel flavour was useful.
In dput-ng, I merged my own MR !36: rsync, scp: Fix username lookup.
In devscripts, I updated and merged my own MR !292: uscan: Allow compression of VCS exports to be disabled. This can make uscan a lot faster for packages that use a VCS as upstream and exclude some files from it.
For the Debian firmware-nonfree package:
- I opened MRs:
  - !98: Include or exclude most unpackaged firmware
  - !101: Update to 20240709 and remove some file exclusions
- I reviewed MRs:
  - !97: misc-nonfree: Add firmware for Gen10 Arm Mali GPUs (merged)
  - !99: ti: Include tas2563 and tas2781 DSP firmware (merged)
  - !100: d/copyright: reenable firmware for Qualcomm qcm2290 and qrb4210 (closed)
- I merged my own MRs:
  - !96: Update to 20240610
  - !98: Include or exclude most unpackaged firmware
  - !101: Update to 20240709 and remove some file exclusions
- I uploaded versions 20240610-1 and 20240709-1 to unstable.
- I responded to bug reports:
  - #1076500: firmware-brcm80211: Contains .txt files with a space
In the kernel-team repository:
- I reviewed MRs:
  - !2: Check for the kconfig in /lib/modules/ too (closed)
  - !4: process.py: friendlier error on missing featureset source (merged)
- I deleted the obsolete script that !2 would have updated.
For the Debian wireless-regdb package:
- I reviewed MRs:
  - !4: merge stretch-elts 2022.04.08-1~deb9u1 upload (closed)
  - !5: Upload For LTS (buster) (merged)
For the Debian nfs-utils package:
- I opened MR !31: Fixes for handling of state files in /var/lib/nfs in response to bug #1074359: nfs-kernel-server: Updating package unexports all filesystems, and later merged it.
- I reviewed and merged MR !15: A couple more DEP8 tests.
For the Debian klibc package:
- I reviewed MRs:
  - !12: d/i/h/klibc-utils: Fix compatibility issue with busybox and improve verbose debug output. (closed)
  - !13: d/i/h/klibc-utils: Pass --update=none instead of -n to cp (closed)
For the Debian ktls-utils package:
- I updated to upstream version 0.11 and uploaded version 0.11-1 to unstable.
For the Debian initramfs-tools package:
- I uploaded version 0.143.1 to unstable, with no changes from version 0.143. One of the changes in 0.143 happened to fix the newly reported #1076539: plymouth: Updating plymouth fails with No space left on device (and its many duplicates).
- I reviewed MRs:
- I responded to bug reports:
I reported Debian bugs:
For the Debian a56 package, which is a build-dependency of firmware-free, I made an NMU fixing a build failure with gcc-14 and many compiler warnings. These changes were included in version 1.3+dfsg-11.

Freexian Collaborators: Monthly report about Debian Long Term Support, June 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In June, 18 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 47.0h (out of 74.25h assigned and 11.75h from previous period), thus carrying over 39.0h to the next month.

Arturo Borrero Gonzalez did 6.0h (out of 6.0h assigned).

Bastien Roucari s did 20.0h (out of 20.0h assigned).

Ben Hutchings did 15.5h (out of 16.0h assigned and 8.0h from previous period), thus carrying over 8.5h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 4.0h (out of 8.0h assigned and 2.0h from previous period), thus carrying over 6.0h to the next month.

Emilio Pozuelo Monfort did 23.25h (out of 49.5h assigned and 10.5h from previous period), thus carrying over 36.75h to the next month.

Guilhem Moulin did 4.5h (out of 13.0h assigned and 7.0h from previous period), thus carrying over 15.5h to the next month.

Lee Garrett did 17.0h (out of 25.0h assigned and 35.0h from previous period), thus carrying over 43.0h to the next month.

Lucas Kanashiro did 5.0h (out of 10.0h assigned and 10.0h from previous period), thus carrying over 15.0h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 10.0h (out of 6.5h assigned and 17.5h from previous period), thus carrying over 14.0h to the next month.

Roberto C. S nchez did 5.25h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 6.75h to the next month.

Santiago Ruano Rinc n did 22.5h (out of 14.5h assigned and 8.0h from previous period).

Sean Whitton did 6.5h (out of 6.0h assigned and 0.5h from previous period).

Stefano Rivera did 0.5h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 9.5h to the next month.

Sylvain Beucler did 9.0h (out of 24.5h assigned and 35.5h from previous period), thus carrying over 51.0h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Evolution of the situation In June, we have released 31 DLAs. Notable security updates in June included:

git: multiple vulnerabilities, which may result in privilege escalation, denial of service, and arbitrary code execution

sendmail: SMTP smuggling allowed remote attackers bypass SPF protection checks

cups: arbitrary remote code execution

Looking further afield to the broader Debian ecosystem, LTS contributor Bastien Roucari s also patched sendmail in Debian 12 (bookworm) and 11 (bullseye) in order to fix the previously mentioned SMTP smuggling vulnerability. Furthermore, LTS contributor Thorsten Alteholz provided fixes for the cups packages in Debian 12 (bookworm) and 11 (bullseye) in order to fix the aforementioned arbitrary remote code execution vulnerability. Additionally, LTS contributor Ben Hutchings has commenced work on an updated backport of Linux kernel 6.1 to Debian 11 (bullseye), in preparation for bullseye transitioning to the responsibility of the LTS (and the associated closure of the bullseye-backports repository). LTS Lucas Kanashiro also began the preparatory work of backporting parts of the rust/cargo toolchain to Debian 11 (bullseye) in order to make future updates of the clamav virus scanner possible. June was the final month of LTS for Debian 10 (as announced on the debian-lts-announce mailing list). No additional Debian 10 security updates will be made available on security.debian.org. However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for the customers of the Extended LTS offer. Subscribe right away if you sill have Debian 10 which must be kept secure (and which cannot yet be upgraded).

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 105 months)

Civil Infrastructure Platform (CIP) (for 73 months)

VyOS Inc (for 37 months)

Gold sponsors:

Roche Diagnostics International AG (for 115 months)

Linode (for 109 months)

Babiel GmbH (for 99 months)

Plat Home (for 98 months)

CINECA (for 73 months)

University of Oxford (for 55 months)

Deveryware (for 42 months)

EDF SA (for 27 months)

Dataport A R

Silver sponsors:

Domeneshop AS (for 120 months)

Nantes M tropole (for 114 months)

Univention GmbH (for 106 months)

Universit Jean Monnet de St Etienne (for 106 months)

Ribbon Communications, Inc. (for 100 months)

Exonet B.V. (for 90 months)

Leibniz Rechenzentrum (for 84 months)

Minist re de l Europe et des Affaires trang res (for 68 months)

Cloudways by DigitalOcean (for 57 months)

Dinahosting SL (for 55 months)

Bauer Xcel Media Deutschland KG (for 49 months)

Platform.sh SAS (for 49 months)

Moxa Inc. (for 43 months)

sipgate GmbH (for 41 months)

OVH US LLC (for 39 months)

Tilburg University (for 39 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 30 months)

Soliton Systems K.K. (for 27 months)

THINline s.r.o. (for 3 months)

Bronze sponsors:

Evolix (for 120 months)

Seznam.cz, a.s. (for 120 months)

Intevation GmbH (for 117 months)

Linuxhotel GmbH (for 117 months)

Daevel SARL (for 116 months)

Bitfolk LTD (for 115 months)

Megaspace Internet Services GmbH (for 115 months)

Greenbone AG (for 114 months)

NUMLOG (for 114 months)

WinGo AG (for 113 months)

Ecole Centrale de Nantes - LHEEA (for 109 months)

Entr ouvert (for 104 months)

Adfinis AG (for 102 months)

Tesorion (for 97 months)

GNI MEDIA (for 96 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 96 months)

Bearstech (for 88 months)

LiHAS (for 88 months)

Catalyst IT Ltd (for 83 months)

Supagro (for 78 months)

Demarcq SAS (for 77 months)

Universit Grenoble Alpes (for 63 months)

TouchWeb SAS (for 55 months)

SPiN AG (for 52 months)

CoreFiling (for 48 months)

Institut des sciences cognitives Marc Jeannerod (for 43 months)

Observatoire des Sciences de l Univers de Grenoble (for 39 months)

Tem Innovations GmbH (for 34 months)

WordFinder.pro (for 33 months)

CNRS DT INSU R sif (for 32 months)

Alter Way (for 25 months)

Institut Camille Jordan (for 15 months)

Ben Hutchings: FOSS activity in June 2024

I continued participating in Debian kernel team meetings.
For initramfs-tools:
- I reviewed several more merge requests and merged some of them.
- I released version 0.143 and uploaded it to Debian experimental.
For the Debian firmware-free package:
- I responded to an update on the bug report firmware-linux-free uses prebuilt blobs instead of building from source and the accompanying merge request Build some firmware files from source .
- I split off the new issue into a separate bug report firmware-free: Incomplete source for carl9170-1.fw , and merged the MR.
- I made some other necessary changes to the package and uploaded version 20240610-1 to unstable.
For the Debian linux package:
- I responded to the following bug reports:
  - linux: ext4 corruption with symlinks I bisected this and (re-)reported it upstream. I tested the upstream fix for this, but it hasn t yet been applied.
- I answered questions about its required build environment.
- I uploaded:
  - linux version 6.9.2-1~exp1 to experimental.
  - linux version 4.19.316-1 to buster-security, for which I issued DLA 3840-1.
  - linux-5.10 version 5.10.218-1~deb10u1 to buster-security, for which I issued DLA 3843-1.
- I issued DLA 3841-1 and DLA 3842-1 for the earlier uploads of linux-5.10 that I had failed to announce.
- I reviewed and merged the following merge requests:
  - Update to 6.9.x
  - [arm64] Disable RELR
- I opened merge requests:
  - d/l/p/debian_linux/firmware.py: Handle RawFile fields
- I started a backport of Linux 6.1 to bullseye, for when bullseye enters LTS and bullseye-backports is closed.
For the Debian linux-base package:
- Following discussion on a systemd merge request and in a kernel team meeting, I added the linux-sysctl-defaults package to provide a default sysctl configuration independent of which init system or kernel packages are used. I also requested that procps Depend on or Recommend it.
- I updated the debian/copyright file and fixed most of the open bugs.
- I uploaded version 4.10 and version 4.10.1 to unstable.
For the Debian firmware-nonfree package:
- I finished reviewing and merged Diederik de Haas s major (non-upstream) update to firmware-nonfree.
- I uploaded version 20230625-3~exp1 to experimental, but it was auto-rejected. I fixed a lintian override to satisfy the older lintian version on ftp-master, then uploaded version 20230625-3~exp2.
- I merged my changes to support and use wildcards in file lists.
- Diederik s changes included package splits that could cause file loss in conjunction with the /usr-move in this release cycle. I applied Helmut Grohne s fix from the above bug report, then uploaded version 20230625-3~exp3 to unstable.
- I prepared an update to the latest upstream version.

Ben Hutchings: FOSS activity in May 2024

For the Debian kernel security tracker:
- I implemented some static checks in CI.
- I continued work on automated handling of kernel CVEs, but it is still not quite ready to merge.
- I implemented improved reporting on top of those changes.
For the Debian linux package:
- I reviewed and merged the following merge requests:
- I reviewed but did not merge:
  - Enable UBSAN_BOUNDS and UBSAN_SHIFT
- I responded to the following bug reports:
- I opened my own merge requests:
- I uploaded:
  - linux-5.10 version 5.10.216-1~deb10u1 to buster-security.
  - linux version 6.1.90-1~bpo11+1 to bullseye-backports.
  - linux version 6.7.12-1~bpo12+1 to bookworm-backports.
  - linux version 6.8.9-1 to unstable.
I attended the mini-DebConf in Berlin and very much enjoyed it. Thanks to all the organisers, volunteers and presenters.
I supported Salvatore Bonaccorso s proposal of regular kernel team meetings, and attended the first one.
I answered Andreas Tille s questions about the kernel team.
I uploaded ktls-utils version 0.10-1 to unstable.
I uploaded wireless-regdb version 2024.05.08-1 to unstable.
I reviewed all open merge requests for initramfs-tools, and merged most of them.
For the Debian firmware-nonfree package:
- I started reviewing Diederik de Haas s major (non-upstream) update to firmware-nonfree.
- I opened a merge request intended to simplify future work: Add support for and start using wildcards in package file lists.
I uploaded iw version 6.9-1 to unstable.

Ben Hutchings: FOSS activity in April 2024

I answered a query about the continued need for an executable stack on Linux/m68k.
I reported and fixed some regressions on the Linux 4.19-stable branch.
I proposed a fix for the regression of rsync and scp support in dput-ng.
I updated the linux (4.19) package for Debian 10 buster to upstream version 4.19.311, but didn t make an upload this month.
I started work on more automated handling of kernel CVEs for Debian.

Freexian Collaborators: Monthly report about Debian Long Term Support, May 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In May, 17 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 34.25h (out of 24.0h assigned and 22.0h from previous period), thus carrying over 11.75h to the next month.

Bastien Roucari s did 20.0h (out of 20.0h assigned).

Ben Hutchings did 16.0h (out of 24.0h assigned), thus carrying over 8.0h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 8.0h (out of 10.0h assigned), thus carrying over 2.0h to the next month.

Emilio Pozuelo Monfort did 35.5h (out of 46.0h assigned), thus carrying over 10.5h to the next month.

Guilhem Moulin did 13.0h (out of 14.75h assigned and 5.25h from previous period), thus carrying over 7.0h to the next month.

Lee Garrett did 11.0h (out of 37.25h assigned and 8.75h from previous period), thus carrying over 35.0h to the next month.

Lucas Kanashiro did 10.0h (out of 20.0h assigned), thus carrying over 10.0h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 6.5h (out of 22.5h assigned and 1.5h from previous period), thus carrying over 17.5h to the next month.

Roberto C. S nchez did 7.75h (out of 11.0h assigned and 1.0h from previous period), thus carrying over 4.25h to the next month.

Santiago Ruano Rinc n did 8.0h (out of 16.0h assigned), thus carrying over 8.0h to the next month.

Sean Whitton did 5.5h (out of 5.5h assigned and 0.5h from previous period), thus carrying over 0.5h to the next month.

Sylvain Beucler did 10.5h (out of 0.75h assigned and 45.25h from previous period), thus carrying over 35.5h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Tobias Frost did 7.75h (out of 10.0h assigned and 2.0h from previous period), thus carrying over 4.25h to the next month.

Evolution of the situation In May, we have released 20 DLAs. Notable security updates in May included:

apache2: multiple vulnerabilities which may result in HTTP response splitting, denial of service, or authorization bypass (by Bastien Roucari s, in collaboration with apache2 maintainer Yadd)

bind9: two vulnerabilities, called KeyTrap and NSEC3, which may result in denial of service (by Santiago Ruano Rinc n)

python-pymysql: potential SQL injection attack (by Chris Lamb)

The aforementioned apache2 was prepared by its Debian maintainer Yadd. This update also involved work on the package test suite in buster, which contributor Bastien Roucari s then forwarded to the apache2 package in unstable. More importantly, a regression in fossil was reported, and Bastien prepared a fix for it. Bastien coordinated the upload of both packages to minimize the introduction of regressions. Contributor Daniel Leidert also prepared an upload of runc to Debian 11 in order fix a number of CVEs still affecting that package. Finally, contributor Thorsten Alteholz prepared uploads for qtbase-opensource-src, libjwt, and libmicrohttpd in Debian 11. Note that Debian 11 will pass into the LTS phase of support in August and these updates will improve the state and long-term supportability of Debian 11. Debian 10 is presently in its final month of LTS support (as announced on the debian-lts-announce mailing list, support will end on June 30th), after which no new security updates will be made available on security.debian.org. However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for the customers of the Extended LTS offer. Subscribe right away if you sill have Debian 10 which must be kept secure (and which cannot yet be upgraded).

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 105 months)

Civil Infrastructure Platform (CIP) (for 73 months)

VyOS Inc (for 37 months)

Gold sponsors:

Roche Diagnostics International AG (for 116 months)

Linode (for 110 months)

Babiel GmbH (for 99 months)

Plat Home (for 99 months)

CINECA (for 73 months)

University of Oxford (for 55 months)

Deveryware (for 42 months)

EDF SA (for 26 months)

CERN

Silver sponsors:

Domeneshop AS (for 120 months)

Nantes M tropole (for 115 months)

Univention GmbH (for 106 months)

Universit Jean Monnet de St Etienne (for 106 months)

Ribbon Communications, Inc. (for 100 months)

Exonet B.V. (for 90 months)

Leibniz Rechenzentrum (for 84 months)

Minist re de l Europe et des Affaires trang res (for 67 months)

Cloudways by DigitalOcean (for 57 months)

Dinahosting SL (for 55 months)

Bauer Xcel Media Deutschland KG (for 49 months)

Platform.sh SAS (for 49 months)

Moxa Inc. (for 43 months)

sipgate GmbH (for 40 months)

OVH US LLC (for 38 months)

Tilburg University (for 38 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 30 months)

Soliton Systems K.K. (for 27 months)

THINline s.r.o.

Bronze sponsors:

Evolix (for 121 months)

Seznam.cz, a.s. (for 121 months)

Intevation GmbH (for 118 months)

Linuxhotel GmbH (for 118 months)

Daevel SARL (for 116 months)

Bitfolk LTD (for 115 months)

Megaspace Internet Services GmbH (for 115 months)

NUMLOG (for 115 months)

Greenbone AG (for 114 months)

WinGo AG (for 114 months)

Ecole Centrale de Nantes - LHEEA (for 110 months)

Entr ouvert (for 105 months)

Adfinis AG (for 102 months)

GNI MEDIA (for 97 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 97 months)

Tesorion (for 97 months)

Bearstech (for 88 months)

LiHAS (for 88 months)

Catalyst IT Ltd (for 83 months)

Supagro (for 78 months)

Demarcq SAS (for 77 months)

Universit Grenoble Alpes (for 63 months)

TouchWeb SAS (for 55 months)

SPiN AG (for 52 months)

CoreFiling (for 47 months)

Institut des sciences cognitives Marc Jeannerod (for 42 months)

Observatoire des Sciences de l Univers de Grenoble (for 39 months)

Tem Innovations GmbH (for 34 months)

WordFinder.pro (for 33 months)

CNRS DT INSU R sif (for 32 months)

Alter Way (for 25 months)

Institut Camille Jordan (for 14 months)

Freexian Collaborators: Monthly report about Debian Long Term Support, April 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In April, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.5h (out of 0.0h assigned and 14.0h from previous period), thus carrying over 13.5h to the next month.

Adrian Bunk did 35.75h (out of 17.25h assigned and 40.5h from previous period), thus carrying over 22.0h to the next month.

Bastien Roucari s did 25.0h (out of 25.0h assigned).

Ben Hutchings did 24.0h (out of 9.0h assigned and 15.0h from previous period).

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 10.0h (out of 10.0h assigned).

Emilio Pozuelo Monfort did 46.0h (out of 12.0h assigned and 34.0h from previous period).

Guilhem Moulin did 14.75h (out of 20.0h assigned), thus carrying over 5.25h to the next month.

Lee Garrett did 51.25h (out of 0.0h assigned and 60.0h from previous period), thus carrying over 8.75h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 22.5h (out of 19.5h assigned and 4.5h from previous period), thus carrying over 1.5h to the next month.

Roberto C. S nchez did 11.0h (out of 9.25h assigned and 2.75h from previous period), thus carrying over 1.0h to the next month.

Santiago Ruano Rinc n did 20.0h (out of 20.0h assigned).

Sean Whitton did 9.5h (out of 4.5h assigned and 5.5h from previous period), thus carrying over 0.5h to the next month.

Stefano Rivera did 1.5h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 8.5h to the next month.

Sylvain Beucler did 12.5h (out of 22.75h assigned and 35.0h from previous period), thus carrying over 45.25h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Tobias Frost did 10.0h (out of 12.0h assigned), thus carrying over 2.0h to the next month.

Utkarsh Gupta did 3.25h (out of 28.5h assigned and 29.25h from previous period), thus carrying over 54.5h to the next month.

Evolution of the situation In April, we have released 28 DLAs. During the month of April, there was one particularly notable security update made in LTS. Guilhem Moulin prepared DLA-3782-1 for util-linux (part of the set of base packages and containing a number of important system utilities) in order to address a possible information disclosure vulnerability. Additionally, several contributors prepared updates for oldstable (bullseye), stable (bookworm), and unstable (sid), including:

ruby-rack: prepared for oldstable, stable, and unstable by Adrian Bunk

wpa: prepared for oldstable, stable, and unstable by Bastien Roucari s

zookeeper: prepared for stable by Bastien Roucari s

libjson-smart: prepared for unstable by Bastien Roucari s

ansible: prepared for stable and unstable, including autopkgtest fixes to increase future supportability, by Lee Garrett

wordpress: prepared for oldstable and stable by Markus Koschany

emacs and org-mode: prepared for oldstable and stable by Sean Whitton

qtbase-opensource-src: prepared for oldstable and stable by Thorsten Alteholz

libjwt: prepared for oldstable by Thorsten Alteholz

libmicrohttpd: prepared for oldstable by Thorsten Alteholz

These fixes were in addition to corresponding updates in LTS. Another item to highlight in this month s report is an update to the distro-info-data database by Stefano Rivera. This update ensures that Debian buster systems have the latest available information concerning the end-of-life dates and other related information for all releases of Debian and Ubuntu. As announced on the debian-lts-announce mailing list, it is worth to point out that we are getting close to the end of support of Debian 10 as LTS. After June 30th, no new security updates will be made available on security.debian.org. However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for the customers of the Extended LTS offer. If you still have Debian 10 servers to keep secure, it s time to subscribe!

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 104 months)

Civil Infrastructure Platform (CIP) (for 72 months)

Gold sponsors:

Roche Diagnostics International AG (for 115 months)

Linode (for 109 months)

Babiel GmbH (for 98 months)

Plat Home (for 98 months)

CINECA (for 72 months)

University of Oxford (for 54 months)

Deveryware (for 41 months)

VyOS Inc (for 36 months)

EDF SA (for 25 months)

Silver sponsors:

Domeneshop AS (for 119 months)

Nantes M tropole (for 114 months)

Univention GmbH (for 105 months)

Universit Jean Monnet de St Etienne (for 105 months)

Ribbon Communications, Inc. (for 99 months)

Exonet B.V. (for 89 months)

Leibniz Rechenzentrum (for 83 months)

Minist re de l Europe et des Affaires trang res (for 67 months)

Cloudways by DigitalOcean (for 56 months)

Dinahosting SL (for 54 months)

Bauer Xcel Media Deutschland KG (for 48 months)

Platform.sh SAS (for 48 months)

Moxa Inc. (for 42 months)

sipgate GmbH (for 39 months)

OVH US LLC (for 37 months)

Tilburg University (for 37 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 29 months)

Soliton Systems K.K. (for 26 months)

THINline s.r.o.

Bronze sponsors:

Evolix (for 120 months)

Seznam.cz, a.s. (for 120 months)

Intevation GmbH (for 117 months)

Linuxhotel GmbH (for 117 months)

Daevel SARL (for 115 months)

Bitfolk LTD (for 114 months)

Megaspace Internet Services GmbH (for 114 months)

NUMLOG (for 114 months)

Greenbone AG (for 113 months)

WinGo AG (for 113 months)

Ecole Centrale de Nantes - LHEEA (for 109 months)

Entr ouvert (for 104 months)

Adfinis AG (for 102 months)

GNI MEDIA (for 96 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 96 months)

Tesorion (for 96 months)

Bearstech (for 87 months)

LiHAS (for 87 months)

Catalyst IT Ltd (for 82 months)

Supagro (for 77 months)

Demarcq SAS (for 76 months)

Universit Grenoble Alpes (for 62 months)

TouchWeb SAS (for 54 months)

SPiN AG (for 51 months)

CoreFiling (for 46 months)

Institut des sciences cognitives Marc Jeannerod (for 41 months)

Observatoire des Sciences de l Univers de Grenoble (for 38 months)

Tem Innovations GmbH (for 33 months)

WordFinder.pro (for 32 months)

CNRS DT INSU R sif (for 31 months)

Alter Way (for 24 months)

Institut Camille Jordan (for 13 months)

Freexian Collaborators: Monthly report about Debian Long Term Support, March 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In March, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 10.0h assigned and 4.0h from previous period), thus carrying over 14.0h to the next month.

Adrian Bunk did 59.5h (out of 47.5h assigned and 52.5h from previous period), thus carrying over 40.5h to the next month.

Bastien Roucari s did 22.0h (out of 20.0h assigned and 2.0h from previous period).

Ben Hutchings did 9.0h (out of 2.0h assigned and 22.0h from previous period), thus carrying over 15.0h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 12.0h (out of 12.0h assigned).

Emilio Pozuelo Monfort did 0.0h (out of 3.0h assigned and 57.0h from previous period), thus carrying over 60.0h to the next month.

Guilhem Moulin did 22.5h (out of 7.25h assigned and 15.25h from previous period).

Holger Levsen did 0.0h (out of 0.5h assigned and 11.5h from previous period), thus carrying over 12.0h to the next month.

Lee Garrett did 0.0h (out of 0.0h assigned and 60.0h from previous period), thus carrying over 60.0h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Ola Lundqvist did 19.5h (out of 24.0h assigned), thus carrying over 4.5h to the next month.

Roberto C. S nchez did 9.25h (out of 3.5h assigned and 8.5h from previous period), thus carrying over 2.75h to the next month.

Santiago Ruano Rinc n did 19.0h (out of 16.5h assigned and 2.5h from previous period).

Sean Whitton did 4.5h (out of 4.5h assigned and 1.5h from previous period), thus carrying over 1.5h to the next month.

Sylvain Beucler did 25.0h (out of 24.5h assigned and 35.5h from previous period), thus carrying over 35.0h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Tobias Frost did 12.0h (out of 12.0h assigned).

Utkarsh Gupta did 19.5h (out of 0.0h assigned and 48.75h from previous period), thus carrying over 29.25h to the next month.

Evolution of the situation In March, we have released 31 DLAs. Adrian Bunk was responsible for updating gtkwave not only in LTS, but also in unstable, stable, and old-stable as well. This update involved an upload of a new upstream release of gtkwave to each target suite to address 82 separate CVEs. Guilhem Moulin prepared an update of libvirt which was particularly notable, as it fixed multiple vulnerabilities which would lead to denial of service or information disclosure. In addition to the normal security updates, multiple LTS contributors worked at getting various packages updated in more recent Debian releases, including gross for bullseye/bookworm (by Adrian Bunk), imlib2 for bullseye, jetty9 and tomcat9/10 for bullseye/bookworm (by Markus Koschany), samba for bullseye, py7zr for bullseye (by Santiago Ruano Rinc n), cacti for bullseye/bookwork (by Sylvain Beucler), and libmicrohttpd for bullseye (by Thorsten Alteholz). Additionally, Sylvain actively coordinated with cacti upstream concerning an incomplete fix for CVE-2024-29894.

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 103 months)

Civil Infrastructure Platform (CIP) (for 71 months)

Gold sponsors:

Roche Diagnostics International AG (for 114 months)

Linode (for 108 months)

Babiel GmbH (for 97 months)

Plat Home (for 97 months)

CINECA (for 71 months)

University of Oxford (for 53 months)

Deveryware (for 40 months)

VyOS Inc (for 35 months)

EDF SA (for 24 months)

Silver sponsors:

Domeneshop AS (for 118 months)

Nantes M tropole (for 112 months)

Univention GmbH (for 104 months)

Universit Jean Monnet de St Etienne (for 104 months)

Ribbon Communications, Inc. (for 98 months)

Exonet B.V. (for 88 months)

Leibniz Rechenzentrum (for 82 months)

Minist re de l Europe et des Affaires trang res (for 65 months)

Cloudways by DigitalOcean (for 55 months)

Dinahosting SL (for 53 months)

Bauer Xcel Media Deutschland KG (for 47 months)

Platform.sh SAS (for 47 months)

Moxa Inc. (for 41 months)

sipgate GmbH (for 38 months)

OVH US LLC (for 36 months)

Tilburg University (for 36 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 28 months)

Soliton Systems K.K. (for 25 months)

THINline s.r.o.

Bronze sponsors:

Evolix (for 119 months)

Seznam.cz, a.s. (for 119 months)

Intevation GmbH (for 116 months)

Linuxhotel GmbH (for 116 months)

Daevel SARL (for 114 months)

Bitfolk LTD (for 113 months)

Megaspace Internet Services GmbH (for 113 months)

Greenbone AG (for 112 months)

NUMLOG (for 112 months)

WinGo AG (for 112 months)

Ecole Centrale de Nantes - LHEEA (for 108 months)

Entr ouvert (for 103 months)

Adfinis AG (for 100 months)

GNI MEDIA (for 95 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 95 months)

Tesorion (for 95 months)

Bearstech (for 86 months)

LiHAS (for 86 months)

Catalyst IT Ltd (for 81 months)

Supagro (for 76 months)

Demarcq SAS (for 75 months)

Universit Grenoble Alpes (for 61 months)

TouchWeb SAS (for 53 months)

SPiN AG (for 50 months)

CoreFiling (for 45 months)

Institut des sciences cognitives Marc Jeannerod (for 40 months)

Observatoire des Sciences de l Univers de Grenoble (for 37 months)

Tem Innovations GmbH (for 32 months)

WordFinder.pro (for 31 months)

CNRS DT INSU R sif (for 30 months)

Alter Way (for 23 months)

Institut Camille Jordan (for 12 months)

Ben Hutchings: FOSS activity in March 2024

I updated the Linux (4.19) package for buster to upstream version 4.19.311, but I did not make an upload this month.
I triaged recent CVE IDs assigned for kernel security issues, and queried some duplicate and trivial issues, which have now been rejected.
I reviewed and applied a fix for klibc s inet_pton() function. I then added some test cases for it, and made further fixes.

Ben Hutchings: FOSS activity in March 2024

I updated the Linux (4.19) package for buster to upstream version 4.19.311, but I did not make an upload this month.
I triaged recent CVE IDs assigned for kernel security issues, and queried some duplicate and trivial issues, which have now been rejected.
I reviewed and applied a fix for klibc s inet_pton() function. I then added some test cases for it, and made further fixes.

Freexian Collaborators: Monthly report about Debian Long Term Support, February 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In February, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 14.0h assigned), thus carrying over 4.0h to the next month.

Adrian Bunk did 13.5h (out of 24.25h assigned and 41.75h from previous period), thus carrying over 52.5h to the next month.

Bastien Roucari s did 20.0h (out of 20.0h assigned).

Ben Hutchings did 2.0h (out of 14.5h assigned and 9.5h from previous period), thus carrying over 22.0h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 10.0h (out of 10.0h assigned).

Emilio Pozuelo Monfort did 3.0h (out of 28.25h assigned and 31.75h from previous period), thus carrying over 57.0h to the next month.

Guilhem Moulin did 7.25h (out of 4.75h assigned and 15.25h from previous period), thus carrying over 12.75h to the next month.

Holger Levsen did 0.5h (out of 3.5h assigned and 8.5h from previous period), thus carrying over 11.5h to the next month.

Lee Garrett did 0.0h (out of 18.25h assigned and 41.75h from previous period), thus carrying over 60.0h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Roberto C. S nchez did 3.5h (out of 8.75h assigned and 3.25h from previous period), thus carrying over 8.5h to the next month.

Santiago Ruano Rinc n did 13.5h (out of 13.5h assigned and 2.5h from previous period), thus carrying over 2.5h to the next month.

Sean Whitton did 4.5h (out of 0.5h assigned and 5.5h from previous period), thus carrying over 1.5h to the next month.

Sylvain Beucler did 24.5h (out of 27.75h assigned and 32.25h from previous period), thus carrying over 35.5h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Tobias Frost did 12.0h (out of 12.0h assigned).

Utkarsh Gupta did 11.25h (out of 26.75h assigned and 33.25h from previous period), thus carrying over 48.75 to the next month.

Evolution of the situation In February, we have released 17 DLAs. The number of DLAs published during February was a bit lower than usual, as there was much work going on in the area of triaging CVEs (a number of which turned out to not affect Debia buster, and others which ended up being duplicates, or otherwise determined to be invalid). Of the packages which did receive updates, notable were sudo (to fix a privilege management issue), and iwd and wpa (both of which suffered from authentication bypass vulnerabilities). While this has already been already announced in the Freexian blog, we would like to mention here the start of the Long Term Support project for Samba 4.17. You can find all the important details in that post, but we would like to highlight that it is thanks to our LTS sponsors that we are able to fund the work from our partner, Catalyst, towards improving the security support of Samba in Debian 12 (Bookworm).

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 102 months)

Civil Infrastructure Platform (CIP) (for 70 months)

Gold sponsors:

Roche Diagnostics International AG (for 113 months)

Linode (for 107 months)

Babiel GmbH (for 96 months)

Plat Home (for 96 months)

CINECA (for 70 months)

University of Oxford (for 52 months)

Deveryware (for 39 months)

VyOS Inc (for 34 months)

EDF SA (for 23 months)

Silver sponsors:

Domeneshop AS (for 117 months)

Nantes M tropole (for 112 months)

Univention GmbH (for 103 months)

Universit Jean Monnet de St Etienne (for 103 months)

Ribbon Communications, Inc. (for 97 months)

Exonet B.V. (for 87 months)

Leibniz Rechenzentrum (for 81 months)

Minist re de l Europe et des Affaires trang res (for 64 months)

Cloudways by DigitalOcean (for 54 months)

Dinahosting SL (for 52 months)

Bauer Xcel Media Deutschland KG (for 46 months)

Platform.sh SAS (for 46 months)

Moxa Inc. (for 40 months)

sipgate GmbH (for 37 months)

OVH US LLC (for 35 months)

Tilburg University (for 35 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 27 months)

Soliton Systems K.K. (for 24 months)

Bronze sponsors:

Evolix (for 118 months)

Seznam.cz, a.s. (for 118 months)

Intevation GmbH (for 115 months)

Linuxhotel GmbH (for 115 months)

Daevel SARL (for 113 months)

Bitfolk LTD (for 112 months)

Megaspace Internet Services GmbH (for 112 months)

NUMLOG (for 112 months)

Greenbone AG (for 111 months)

WinGo AG (for 111 months)

Ecole Centrale de Nantes - LHEEA (for 107 months)

Entr ouvert (for 102 months)

Adfinis AG (for 99 months)

GNI MEDIA (for 94 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 94 months)

Tesorion (for 94 months)

Bearstech (for 85 months)

LiHAS (for 85 months)

Catalyst IT Ltd (for 80 months)

Supagro (for 75 months)

Demarcq SAS (for 74 months)

Universit Grenoble Alpes (for 60 months)

TouchWeb SAS (for 52 months)

SPiN AG (for 49 months)

CoreFiling (for 44 months)

Institut des sciences cognitives Marc Jeannerod (for 39 months)

Observatoire des Sciences de l Univers de Grenoble (for 36 months)

Tem Innovations GmbH (for 31 months)

WordFinder.pro (for 30 months)

CNRS DT INSU R sif (for 29 months)

Alter Way (for 22 months)

Institut Camille Jordan (for 11 months)

Ben Hutchings: FOSS activity in February 2024

I updated the Linux kernel packages in various Debian suites:
- buster: Updated linux-5.10 to the latest security update for bullseye, and uploaded it, but it still needs to be approved.
- bullseye-backports: Updated linux (6.1) to the latest security update from bullseye, and uploaded it.
- bookworm-backports: Updated linux to the current version in testing, and uploaded it.
I reported a regression in documentation builds in the Linux 5.10 stable branch.

Ben Hutchings: Converted from Pyblosxom to Jekyll

I ve been using Pyblosxom here for nearly 17 years, but have become increasingly dissatisfied with having to write HTML instead of Markdown. Today I looked at upgrading my web server and discovered that Pyblosxom was removed from Debian after Debian 10, presumably because it wasn t updated for Python 3. I keep hearing about Jekyll as a static site generator for blogs, so I finally investigated how to use that and how to convert my existing entries. Fortunately it supports both HTML and Markdown (and probably other) input formats, so this was mostly a matter of converting metadata. I have my own crappy script for drafting, publishing, and listing blog entries, which also needed a bit of work to update, but that is now done. If all has gone to plan, you should be seeing just one new entry in the feed but all permalinks to older entries still working.

Freexian Collaborators: Monthly report about Debian Long Term Support, January 2024 (by Roberto C. S nchez)

Like each month, have a look at the work funded by Freexian s Debian LTS offering.

Debian LTS contributors In January, 16 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 7.0h assigned and 7.0h from previous period).

Bastien Roucari s did 22.0h (out of 16.0h assigned and 6.0h from previous period).

Ben Hutchings did 14.5h (out of 8.0h assigned and 16.0h from previous period), thus carrying over 9.5h to the next month.

Chris Lamb did 18.0h (out of 18.0h assigned).

Daniel Leidert did 10.0h (out of 10.0h assigned).

Emilio Pozuelo Monfort did 10.0h (out of 14.75h assigned and 27.0h from previous period), thus carrying over 31.75h to the next month.

Guilhem Moulin did 9.75h (out of 25.0h assigned), thus carrying over 15.25h to the next month.

Holger Levsen did 3.5h (out of 12.0h assigned), thus carrying over 8.5h to the next month.

Markus Koschany did 40.0h (out of 40.0h assigned).

Roberto C. S nchez did 8.75h (out of 9.5h assigned and 2.5h from previous period), thus carrying over 3.25h to the next month.

Santiago Ruano Rinc n did 13.5h (out of 8.25h assigned and 7.75h from previous period), thus carrying over 2.5h to the next month.

Sean Whitton did 0.5h (out of 0.25h assigned and 5.75h from previous period), thus carrying over 5.5h to the next month.

Sylvain Beucler did 9.5h (out of 23.25h assigned and 18.5h from previous period), thus carrying over 32.25h to the next month.

Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Tobias Frost did 12.0h (out of 10.25h assigned and 1.75h from previous period).

Utkarsh Gupta did 8.5h (out of 35.75h assigned), thus carrying over 24.75h to the next month.

Evolution of the situation In January, we have released 25 DLAs. A variety of particularly notable packages were updated during January. Among those updates were the Linux kernel (both versions 5.10 and 4.19), mariadb-10.3, openjdk-11, firefox-esr, and thunderbird. In addition to the many other LTS package updates which were released in January, LTS contributors continue their efforts to make impactful contributions both within the Debian community.

Thanks to our sponsors Sponsors that joined recently are in bold.

Platinum sponsors:

TOSHIBA (for 101 months)

Civil Infrastructure Platform (CIP) (for 69 months)

Gold sponsors:

Roche Diagnostics International AG (for 112 months)

Linode (for 106 months)

Babiel GmbH (for 95 months)

Plat Home (for 95 months)

CINECA (for 69 months)

University of Oxford (for 51 months)

Deveryware (for 38 months)

VyOS Inc (for 33 months)

EDF SA (for 22 months)

Silver sponsors:

Domeneshop AS (for 116 months)

Nantes M tropole (for 110 months)

Univention GmbH (for 102 months)

Universit Jean Monnet de St Etienne (for 102 months)

Ribbon Communications, Inc. (for 96 months)

Exonet B.V. (for 86 months)

Leibniz Rechenzentrum (for 80 months)

Minist re de l Europe et des Affaires trang res (for 63 months)

Cloudways by DigitalOcean (for 53 months)

Dinahosting SL (for 51 months)

Bauer Xcel Media Deutschland KG (for 45 months)

Platform.sh SAS (for 45 months)

Moxa Inc. (for 39 months)

sipgate GmbH (for 36 months)

OVH US LLC (for 34 months)

Tilburg University (for 34 months)

GSI Helmholtzzentrum f r Schwerionenforschung GmbH (for 26 months)

Soliton Systems K.K. (for 23 months)

Bronze sponsors:

Evolix (for 117 months)

Seznam.cz, a.s. (for 117 months)

Intevation GmbH (for 114 months)

Linuxhotel GmbH (for 114 months)

Daevel SARL (for 112 months)

Bitfolk LTD (for 111 months)

Megaspace Internet Services GmbH (for 111 months)

Greenbone AG (for 110 months)

NUMLOG (for 110 months)

WinGo AG (for 110 months)

Ecole Centrale de Nantes - LHEEA (for 106 months)

Entr ouvert (for 101 months)

Adfinis AG (for 98 months)

GNI MEDIA (for 93 months)

Laboratoire LEGI - UMR 5519 / CNRS (for 93 months)

Tesorion (for 93 months)

Bearstech (for 84 months)

LiHAS (for 84 months)

Catalyst IT Ltd (for 79 months)

Supagro (for 74 months)

Demarcq SAS (for 73 months)

Universit Grenoble Alpes (for 59 months)

TouchWeb SAS (for 51 months)

SPiN AG (for 48 months)

CoreFiling (for 43 months)

Institut des sciences cognitives Marc Jeannerod (for 38 months)

Observatoire des Sciences de l Univers de Grenoble (for 35 months)

Tem Innovations GmbH (for 30 months)

WordFinder.pro (for 29 months)

CNRS DT INSU R sif (for 28 months)

Alter Way (for 21 months)

Institut Camille Jordan (for 10 months)

Ben Hutchings: FOSS activity in January 2024

I fixed a bug in my merge request adding the rsync method to dput-ng. (This has now been merged and included in the dput 1.38 release.)
I updated the Linux kernel packages in various Debian suites:
- buster: Updated linux (4.19) to upstream version 4.19.304, uploaded it, and issued DLA-3710-1.
- buster: Updated linux-5.10 to the latest security update for bullseye, uploaded it, and issued DLA-3711-1.
- bullseye-backports: Updated linux to the latest security update for bookworm, and uploaded it.
- bookworm-backports: Updated linux to the latest version in sid, but didn't upload it as that version is not yet in testing.
I uploaded kernel-wedge to bookworm-backports as it will be needed by later updates to the linux backport.
I reviewed the enablement of bcachefs in Debian.
I updated the Debian kernel upload checklist in line with recent changes to kernel ABI handling.
I reviewed (again) Bastian's proposal to change the use of Git branches for the Debian kernel package.
I discussed the support status of armel in the Debian kernel package.

Ben Hutchings: FOSS activity in December 2023

I made a merge request to get rid of the manual split between old and current changelogs in the Debian linux source package. As there wasn't agreement on this I've since closed it.
I updated the linux (4.19) package for buster to upstream version 4.19.302, but didn't upload it.
I reported a bug in libnfsidmap packages involving aliased file locations that can (in principle) result in file loss on upgrade.