Debian LTS April marked the 24th month I contributed to Debian LTS under the Freexian umbrella. I had 8 hours allocated plus 4 hours left from March which I used by:

• releasing DLA-881-1 for ejabberd. The actual package was prepared by Philipp Huebner fixing two CVEs
• preparing and releasing DLA-896-1 for icedove. This update involved the debranding of Icedove back to Thunderbird fixing 17 CVEs
• preparing and releasing DLA-895-1 of openoffice.org-dictionaries so the provided dictionaries stay installable with the new thunderbird package
• preparing and releasing DLA-903-1 of hunspell-en-us so the provided dictionary stays intallable with the new thunderbird package
• preparing and releasing DLA-904-1 of uzbek-wordlist so the provided dictionaries stay installable with the new thunderbird package
• handling the communication with credativ regarding XSA-212
• triaging of several QEMU/KVM CVEs
• backporting large amounts of the cirrus_vga driver to Wheezy's qemu-kvm to fix 3 cirrus_vga related CVEs. The DLA is not released yet since I'm awaiting some more feedback about the test packages. Give them a try!
• Looking into the 9pfs related CVEs in qemu-kvm. Work will be resumed in May.

Other Debian stuff

• organized the 10th installment of the Debian Groupware Meeting. A more detailed report on this is pending.
• uploaded osinfo-db 0.20170225-2 to unstable which builds now reproducibly (thanks Chris Lamb) and has support added for the Stretch RC3 installer
• uploaded libvirt 1.2.9-9+deb8u4 to jessie which now works with newer QEMU (thanks Hilko Bengen)
• uploaded libvirt 3.0.0-4 to unstable unbreaking it for architectures that don't support probing CPU definitions in QEMU (like mips) and unbreaking the use of qemu-bridge-helper with apparmor so gnome-boxes works apparmored now too
• uploaded python-vobject 0.9.4.1-1 to experimental. The package was prepared by Jelmer Vernoo . I made some minor cleaups and added a autopkgtest.
• uploaded hunspell-en-us, uzbek-wordlist, openoffice.org-dictionaries to jessie-security to not conflict with the new thunderbird package (see above)
• sponsored the upload of icedove 1:45.8.0-3~deb8u1 to jessie-security.
• sponsored the upload of python-selenium 2.53.2+dfsg1-2 to experimental

git-buildpackage Released versions 0.8.14 and 0.8.15. Notable changes besides bug fixes:

• gbp buildpackage will now default to --merge-mode=replace for 3.0 (quilt) packages to avoid merges where no merge is necessary.
• gbp buildpackage --git-export=WC now implies --git-ignore-new --git-ignore-branch to make it simpler to use
• gbp buildpackge now has a "sloppy" mode to create a upstream tarball that uses the debian branch as base. This can help to test build from a patched tree. The main reason was to give people a way to not care about 3.0 (quilt) intrinsics when getting started with packaging.
• gbp clone now supports vcsgit: and github: pseudo URLs:

  $ gbp clone vcsgit:libvirt
  gbp:info: Cloning from 'https://anonscm.debian.org/git/pkg-libvirt/libvirt.git'
   
  $ gbp clone github:agx/libvirt-debian
  gbp:info: Cloning from 'https://github.com/agx/libvirt-debian.git'
   
  

The versions are also available on pypi.

What happened in the reproducible builds effort this week: Toolchain fixes

• St phane Glondu uploaded dh-ocaml/1.0.10 which now generates *.info with a deterministic order. Original patch by Chris Lamb. St phane also uploaded ocaml/4.02.3-1 to experimental which enables ocamldoc to build reproducible manpages using a patch by Valentin Lorentz.
• Paul Gevers uploaded pasdoc/0.14.0-1 with upstream changes which should make the generated documentation reproducible by default.
• Osamu Aoki uploaded debiandoc-sgml/1.2.31-1 adding spport for a DEBIANDOC_DATE environment variable to override the content of the <date> tag.
• Dmitry Shachnev uploaded sphinx/1.3.1-4 which fixes many reproducibility issues and add support for SOURCE_DATE_EPOCH.

Valentin Lorentz sent a patch for ispell to initialize memory structures before dumping their content. In our experimental repository, qt4-x11 has been rebased on the latest version (Dhole), as was doxygen (akira). Packages fixed The following packages became reproducible due to changes in their build dependencies: backup-manager, cheese, coinor-csdp, coinor-dylp, ebook-speaker, freefem, indent, libjbcrypt-java, qtquick1-opensource-src, ruby-coffee-script, ruby-distribution, schroot, twittering-mode. The following packages became reproducible after getting fixed:

• abook/0.6.0~pre2-5 by Denis Briand.
• ada-reference-manual/1:2012.2-6 by Nicolas Boulenguez.
• aegisub/3.2.2+dfsg-1 uploaded by Sebastian Reichel, original patch by Juan Picca.
• casablanca/2.5.0-1 uploaded by Gianfranco Costamagna, fix by Mattia Rizzolo.
• dpatch/2.0.37 by Gergely Nagy.
• ganeti/2.14.1-1~exp1 by Apollon Oikonomopoulos.
• gperf/3.0.4-2 by Hilko Bengen, report by akira.
• htdig/1:3.2.0b6-14 uploaded by Ralf Treinen, original patch by Chris Lamb.
• icedove/38.1.0-1 uploaded by Christoph Goehre, report by Lunar.
• kamailio/4.3.1-2 by Victor Seva.
• leveldb/1.18-3 uploaded by Laszlo Boszormenyi, original patch by Reiner Herrmann.
• librostlab-blast/1.0.1-5 uploaded by Andreas Tille, original patch by Chris Lamb.
• linux-tools/4.1.4-1 by Ben Hutchings.
• nitpic/0.1-16 uploaded by Ralf Treinen, patches by Chris Lamb (#777492) and akira (#793708).
• openscad/2015.03-1+dfsg-1 uploaded by Christian M. Ams ss, fixed upstream.
• pciutils/1:3.3.1-1 uploaded by Anibal Monsalve Salazar, origial patch by Reiner Herrmann.
• pyepr/0.9.3-1 uploaded by Antonio Valentino, original patch by Juan Picca.
• pytables/3.2.1-1 by Antonio Valentino.
• python-xlib/0.14+20091101-3 by Andrew Shadura, report by akira.
• rrdtool/1.5.4-3 by Jean-Michel Vourg re.
• sgmltools-lite/3.0.3.0.cvs.20010909-18 uploaded by Ralf Treinen, patches by Chris Lamb (#777011) and akira (#793720).
• uhd/3.8.5-2 by A. Maitland Bottoms.
• xfireworks/1.3-10 uploaded by Yukiharu YABUKI, original patch by Chris Lamb.

Some uploads fixed some reproducibility issues but not all of them:

• ben/0.7.1 uploaded by Mehdi Dogguy, original patch by Reiner Herrmann.
• debiandoc-sgml-doc/1.1.24 uploaded by Osamu Aoki, initial patch by Dhole.
• ifrench-gut/1:1.0-31 uploaded by Lionel Elie Mamane, original patch by Valentin Lorentz.
• qdjango/0.6.0-1 uploaded by Jeremy Lain , fixed upstream, original patch by akira.
• spectacle/0.25-1 assembled by Philippe Coval, original patch by Chris Lamb.

Patches submitted which have not made their way to the archive yet:

• #795203 on xlsx2csv by Dhole: set PODDATE to the date of the latest debian/changelog entry.
• #795392 on blkreplay by Dhole: tell pod2man to use the date of the latest debian/changelog entry.
• #795394 on libitpp by Dhole: use SOURCE_DATE_EPOCH as source for the manpage date instead of the currentdate.
• #795395 on adblock-plus by Dhole: set TZ to UTC when using zip.
• #795438 on wims-extra by Chris Lamb: ask grep to cope with non-UTF8 files.
• #795441 on aprx by Chris Lamb: use SOURCE_DATE_EPOCH as source for the manpage date instead of the currentdate.
• #795462 on ogre-1.9 by Chris Lamb: removes timestamps from the documentation system.
• #795484 on ruby-rmagick by Chris Lamb: patch the bindings to allow the PRNG seed to be set, and set it to a fixed value when generating examples.
• #795562 on htp by Chris Lamb: export TZ=UTC in debian/rules.

akira found another embedded code copy of texi2html in maxima. reproducible.debian.net Work on testing several architectures has continued. (Mattia/h01ger) Package reviews 29 reviews have been removed, 187 added and 34 updated this week. 172 new FTBFS reports were filled, 137 solely by Chris West (Faux). josch spent time investigating the issue with fonts in PDF files. Chris Lamb documented the issue affecting documentation generated by ocamldoc. Misc. Lunar presented a general Reproducible builds HOWTO talk at the Chaos Communication Camp 2015 in Germany on August 13th. Recordings are already available, as well as slides and script. h01ger and Lunar also used CCCamp15 as an opportunity to have discussions with members of several different projects about reproducible builds. Good news should be coming soon.

Slighthly delayed, but here are the stats for week 5 of the DUCK challenge:

• Emmanuel Bourg uploaded gant
• Marco d'Itri uploaded libsystemd-dummy
• Christoph Egger uploaded sbcl
• Sandro Tosi uploaded basemap
• Hilko Bengen uploaded libbde
• Bas Couwenberg uploaded gpx2shp
• Michael Stapelberg uploaded dh-make-golang
• Jackson Doak uploaded pyicu
• Peter Pentchev uploaded stdsyslog
• Gianfranco Costamagna uploaded cld2

So we had 10 packages fixed and uploaded by 10 different uploaders. A big "Thank You" to you!! Since the start of this challenge, a total of 59 packages, were fixed. Here is a quick overview:

	Week 1	Week 2	Week 3	Week 4	Week 5	Week 6	Week 7
# Packages	10	15	10	14	10	-	-
Total	10	25	35	49	59	-	-

The list of the fixed and updated packages is availabe here. I will try to update this ~daily. If I missed one of your uploads, please drop me a line. Only 2 more weeks to DebConf15 so please get involved: The DUCK Challenge is running until end of DebConf15! Pevious articles are here: Week 1, Week 2, Week 3, Week 4.