Freexian Collaborators: Debian Contributions: Updates about DebConf Video Team Sprint, rebootstrap, SBOM tooling in Debian and more! (by Anupa Ann Joseph)
Debian Contributions: 2025-11
Contributing to Debian
is part of Freexian s mission. This article
covers the latest achievements of Freexian and their collaborators. All of this
is made possible by organizations subscribing to our
Long Term Support contracts and
consulting services.
DebConf Video Team Sprint
The DebConf Video Team records, streams, and publishes talks from DebConf and
many miniDebConfs. A lot of the infrastructure development happens during setup
for these events, but we also try to organize a sprint once a year to work on
infrastructure, when there isn t a DebConf about to happen. Stefano attended the
sprint in Herefordshire this year and
wrote up a report.
rebootstrap, by Helmut Grohne
A number of jobs were stuck in architecture-specific failures. gcc-15 and
dpkg still disagree about whether PIE is enabled occasionally and big endian
mipsen needed fixes in systemd. Beyond this regular uploads of libxml2 and
gcc-15 required fixes and rebasing of pending patches.
Earlier, Loongson used rebootstrap to create the initial package set for
loong64 and Miao Wang now submitted their changes. Therefore, there is now
initial support for suites other than unstable and use with derivatives.
Building the support for Software Bill Of Materials tooling in Debian, by Santiago Ruano Rinc n
Vendors of Debian-based products may/should be paying attention to the evolution
of different jurisdictions (such as the CRA
or updates on CISA s Minimum Elements for a Software Bill of Materials)
that require to make available Software Bill of Materials (SBOM) of their
products. It is important then to have tools in Debian to make it easier to
produce such SBOMs.
In this context, Santiago continued the work on packaging libraries related to
SBOMs. This includes the packaging of the SPDX python library (python-spdx-tools),
and its dependencies rdflib
and mkdocs-include-markdown-plugin.
System Package Data Exchange (SPDX), defined by ISO/IEC 5962:2021, is an open
standard capable of representing systems with software components as SBOMs and
other data and security references. SPDX and CycloneDX (whose python library
python3-cyclonedx-lib was
packaged by prior efforts this year),
encompass the two main SBOM standards available today.
Miscellaneous contributions
- Carles improved po-debconf-manager:
added checking status of bug reports automatically via
python-debianbts;
changed some command line options naming or output based on user feedback;
finished refactoring user interaction to rich; codebase is now flake8-compliant;
added type safety with mypy.
- Carles, using
po-debconf-manager, created 19 bug reports for translations
where the merge requests were pending; reviewed and created merge requests for
4 packages.
- Carles planned a second version of the tool that detects packages that
Recommends or Suggests packages which are not in Debian. He is taking ideas from
dumat.
- Carles submitted a pull request
to
python-unidiff2 (adapted from the
original pull request to
python-unidiff). He also started preparing a qnetload
update.
- Stefano did miscellaneous python package updates:
mkdocs-macros-plugin,
python-confuse, python-pip, python-mitogen.
- Stefano reviewed a beets upload for a new maintainer who
is taking it over.
- Stefano handled some debian.net infrastructure requests.
- Stefano updated debian.social
infrastructure for the trixie point release.
- The update broke jitsi.debian.social, Stefano put some time into debugging it
and eventually enlisted upstream assistance,
who solved the problem!
- Stefano worked on some patches for Python that help Debian:
- Stefano spun up a website for hamburg2026.mini.debconf.org.
- Rapha l reviewed a merge request
updating tracker.debian.org to rely on bootstrap
version 5.
- Emilio coordinated various transitions.
- Helmut sent patches for 26 cross build failures.
- Helmut officially handed over the cleanup of the /usr-move transition.
- Helmut monitored the transition moving
libcrypt-dev out of build-essential
and bumped the remaining bugs to rc-severity in coordination with the release team.
- Helmut updated the Build-Profiles patch for debian-policy
incorporating feedback from Sean Whitton with a lot of help from
Nattie Mayer-Hutchings and Freexian colleagues.
- Helmut discovered that the way
mmdebstrap deals with start-stop-daemon may
result in broken output and sent a patch.
- As a result of
armel being removed from sid , but not from forky , the
multiarch hinter broke. Helmut fixed it.
- Helmut uploaded debvm
accepting a patch from Luca Boccassi to fix it for newer
systemd.
- Colin began preparing for the second stage of the
OpenSSH GSS-API key exchange package split.
- Colin caught and fixed a devscripts regression
due to it breaking part of Debusine.
- Colin packaged django-pgtransaction
and backported it to trixie , since it looks useful for Debusine.
- Thorsten uploaded the packages
lprng, cpdb-backend-cups, cpdb-libs and
ippsample to fix some RC bugs as well as other bugs that accumulated over time.
He also uploaded cups-filters to all Debian releases to fix three CVEs.
rebootstrap, by Helmut Grohne
A number of jobs were stuck in architecture-specific failures. gcc-15 and
dpkg still disagree about whether PIE is enabled occasionally and big endian
mipsen needed fixes in systemd. Beyond this regular uploads of libxml2 and
gcc-15 required fixes and rebasing of pending patches.
Earlier, Loongson used rebootstrap to create the initial package set for
loong64 and Miao Wang now submitted their changes. Therefore, there is now
initial support for suites other than unstable and use with derivatives.
Building the support for Software Bill Of Materials tooling in Debian, by Santiago Ruano Rinc n
Vendors of Debian-based products may/should be paying attention to the evolution
of different jurisdictions (such as the CRA
or updates on CISA s Minimum Elements for a Software Bill of Materials)
that require to make available Software Bill of Materials (SBOM) of their
products. It is important then to have tools in Debian to make it easier to
produce such SBOMs.
In this context, Santiago continued the work on packaging libraries related to
SBOMs. This includes the packaging of the SPDX python library (python-spdx-tools),
and its dependencies rdflib
and mkdocs-include-markdown-plugin.
System Package Data Exchange (SPDX), defined by ISO/IEC 5962:2021, is an open
standard capable of representing systems with software components as SBOMs and
other data and security references. SPDX and CycloneDX (whose python library
python3-cyclonedx-lib was
packaged by prior efforts this year),
encompass the two main SBOM standards available today.
Miscellaneous contributions
- Carles improved po-debconf-manager:
added checking status of bug reports automatically via
python-debianbts;
changed some command line options naming or output based on user feedback;
finished refactoring user interaction to rich; codebase is now flake8-compliant;
added type safety with mypy.
- Carles, using
po-debconf-manager, created 19 bug reports for translations
where the merge requests were pending; reviewed and created merge requests for
4 packages.
- Carles planned a second version of the tool that detects packages that
Recommends or Suggests packages which are not in Debian. He is taking ideas from
dumat.
- Carles submitted a pull request
to
python-unidiff2 (adapted from the
original pull request to
python-unidiff). He also started preparing a qnetload
update.
- Stefano did miscellaneous python package updates:
mkdocs-macros-plugin,
python-confuse, python-pip, python-mitogen.
- Stefano reviewed a beets upload for a new maintainer who
is taking it over.
- Stefano handled some debian.net infrastructure requests.
- Stefano updated debian.social
infrastructure for the trixie point release.
- The update broke jitsi.debian.social, Stefano put some time into debugging it
and eventually enlisted upstream assistance,
who solved the problem!
- Stefano worked on some patches for Python that help Debian:
- Stefano spun up a website for hamburg2026.mini.debconf.org.
- Rapha l reviewed a merge request
updating tracker.debian.org to rely on bootstrap
version 5.
- Emilio coordinated various transitions.
- Helmut sent patches for 26 cross build failures.
- Helmut officially handed over the cleanup of the /usr-move transition.
- Helmut monitored the transition moving
libcrypt-dev out of build-essential
and bumped the remaining bugs to rc-severity in coordination with the release team.
- Helmut updated the Build-Profiles patch for debian-policy
incorporating feedback from Sean Whitton with a lot of help from
Nattie Mayer-Hutchings and Freexian colleagues.
- Helmut discovered that the way
mmdebstrap deals with start-stop-daemon may
result in broken output and sent a patch.
- As a result of
armel being removed from sid , but not from forky , the
multiarch hinter broke. Helmut fixed it.
- Helmut uploaded debvm
accepting a patch from Luca Boccassi to fix it for newer
systemd.
- Colin began preparing for the second stage of the
OpenSSH GSS-API key exchange package split.
- Colin caught and fixed a devscripts regression
due to it breaking part of Debusine.
- Colin packaged django-pgtransaction
and backported it to trixie , since it looks useful for Debusine.
- Thorsten uploaded the packages
lprng, cpdb-backend-cups, cpdb-libs and
ippsample to fix some RC bugs as well as other bugs that accumulated over time.
He also uploaded cups-filters to all Debian releases to fix three CVEs.
Miscellaneous contributions
- Carles improved po-debconf-manager:
added checking status of bug reports automatically via
python-debianbts;
changed some command line options naming or output based on user feedback;
finished refactoring user interaction to rich; codebase is now flake8-compliant;
added type safety with mypy.
- Carles, using
po-debconf-manager, created 19 bug reports for translations
where the merge requests were pending; reviewed and created merge requests for
4 packages.
- Carles planned a second version of the tool that detects packages that
Recommends or Suggests packages which are not in Debian. He is taking ideas from
dumat.
- Carles submitted a pull request
to
python-unidiff2 (adapted from the
original pull request to
python-unidiff). He also started preparing a qnetload
update.
- Stefano did miscellaneous python package updates:
mkdocs-macros-plugin,
python-confuse, python-pip, python-mitogen.
- Stefano reviewed a beets upload for a new maintainer who
is taking it over.
- Stefano handled some debian.net infrastructure requests.
- Stefano updated debian.social
infrastructure for the trixie point release.
- The update broke jitsi.debian.social, Stefano put some time into debugging it
and eventually enlisted upstream assistance,
who solved the problem!
- Stefano worked on some patches for Python that help Debian:
- Stefano spun up a website for hamburg2026.mini.debconf.org.
- Rapha l reviewed a merge request
updating tracker.debian.org to rely on bootstrap
version 5.
- Emilio coordinated various transitions.
- Helmut sent patches for 26 cross build failures.
- Helmut officially handed over the cleanup of the /usr-move transition.
- Helmut monitored the transition moving
libcrypt-dev out of build-essential
and bumped the remaining bugs to rc-severity in coordination with the release team.
- Helmut updated the Build-Profiles patch for debian-policy
incorporating feedback from Sean Whitton with a lot of help from
Nattie Mayer-Hutchings and Freexian colleagues.
- Helmut discovered that the way
mmdebstrap deals with start-stop-daemon may
result in broken output and sent a patch.
- As a result of
armel being removed from sid , but not from forky , the
multiarch hinter broke. Helmut fixed it.
- Helmut uploaded debvm
accepting a patch from Luca Boccassi to fix it for newer
systemd.
- Colin began preparing for the second stage of the
OpenSSH GSS-API key exchange package split.
- Colin caught and fixed a devscripts regression
due to it breaking part of Debusine.
- Colin packaged django-pgtransaction
and backported it to trixie , since it looks useful for Debusine.
- Thorsten uploaded the packages
lprng, cpdb-backend-cups, cpdb-libs and
ippsample to fix some RC bugs as well as other bugs that accumulated over time.
He also uploaded cups-filters to all Debian releases to fix three CVEs.
python-debianbts;
changed some command line options naming or output based on user feedback;
finished refactoring user interaction to rich; codebase is now flake8-compliant;
added type safety with mypy.po-debconf-manager, created 19 bug reports for translations
where the merge requests were pending; reviewed and created merge requests for
4 packages.python-unidiff2 (adapted from the
original pull request to
python-unidiff). He also started preparing a qnetload
update.mkdocs-macros-plugin,
python-confuse, python-pip, python-mitogen.version 5.
libcrypt-dev out of build-essential
and bumped the remaining bugs to rc-severity in coordination with the release team.mmdebstrap deals with start-stop-daemon may
result in broken output and sent a patch.armel being removed from sid , but not from forky , the
multiarch hinter broke. Helmut fixed it.systemd.lprng, cpdb-backend-cups, cpdb-libs and
ippsample to fix some RC bugs as well as other bugs that accumulated over time.
He also uploaded cups-filters to all Debian releases to fix three CVEs.
DebConf26 is already in the air in Argentina. Organizing DebConf26 give us the
opportunity to talk about Debian in our country again. This is not the first
time that Debian has come here, previously Argentina has hosted DebConf 8 in Mar
del Plata.
In August, Nattie Mayer-Hutchings and Stefano Rivera from DebConf Committee
visited the venue where the next DebConf will take place. They came to Argentina
in order to see what it is like to travel from Buenos Aires to Santa Fe (the
venue of the next DebConf). In addition, they were able to observe the layout
and size of the classrooms and halls, as well as the infrastructure available at
the venue, which will be useful for the Video Team.
But before going to Santa Fe, on the August 27th, we organized a meetup in
Buenos Aires at
On August 28th, we had the opportunity to get to know the Venue. We walked around
the city and, obviously, sampled some of the beers from Santa Fe.
On August 29th we met with representatives of the University and local government
who were all very supportive. We are very grateful to them for opening
their doors to DebConf.
In the afternoon we met some of the local free software community at an event we
held in ATE
Thanks to Debian Argentina, and all the people who will make DebConf26
possible.
Thanks to Nattie Mayer-Hutchings and Stefano Rivera for reviewing an earlier
version of this article.
On 26th and 27th April we held a Debian bug-squashing party near
Leuven, Belgium. Several longstanding and new Debian contributors
gathered to work through some of the highest priority bugs affecting
the upcoming release of Debian 13 trixie .
We were hosted by the
The image here comes from an example of building
Official logo of DebConf23
Suresh and me celebrating Onam in Kochi.
Four Points Hotel by Sheraton was the venue of DebConf23. Photo credits: Bilal
Photo of the pool. Photo credits: Andreas Tille.
View from the hotel window.
This place served as lunch and dinner place and later as hacklab during debconf. Photo credits: Bilal
Picture of the awesome swag bag given at DebConf23. Photo credits: Ravi Dwivedi
My presentation photo. Photo credits: Valessio
Selfie with Anisa and Kristi. Photo credits: Anisa.
Me helping with the Cheese and Wine Party.
This picture was taken when there were few people in my room for the party.
Sadhya Thali: A vegetarian meal served on banana leaf. Payasam and rasam were especially yummy! Photo credits: Ravi Dwivedi.
Sadhya thali being served at debconf23. Photo credits: Bilal
Group photo of our daytrip. Photo credits: Radhika Jhalani
A selfie in memory of Abraham.
Thanks to Niibe Yutaka (the person towards your right hand) from Japan (FSIJ), who gave me a wonderful Japanese gift during debconf23: A folder to keep pages with ancient Japanese manga characters printed on it. I realized I immediately needed that :)
This is the Japanese gift I received.
Bits from the DPL. Photo credits: Bilal
Kristi on GNOME community. Photo credits: Ravi Dwivedi.
Abhas' talk on home automation. Photo credits: Ravi Dwivedi.
I was roaming around with a QR code on my T-shirt for downloading Prav.
Me in mundu. Picture credits: Abhijith PA
From left: Nilesh, Saswata, me, Sahil. Photo credits: Sahil.
Ruchika (taking the selfie) and from left to right: Yash,
Joost and me going to Delhi. Photo credits: Ravi.















Who are you?
My name is Francesca and I'm totally flattered by your intro. The fearless warrior part may be a bit exaggerated, though.
What have you done and what are you currently working on in FLOSS world?
I've been a Debian contributor since late 2009. My journey in Debian has touched several non-coding areas: from translation to publicity, from videoteam to www. I've been one of the www.debian.org webmasters for a while, a press officer for the Project as well as an editor for DPN. I've dabbled a bit in font packaging, and nowadays I'm mostly working as a Front Desk member.
Setup of your main machine?
Wow, that's an intimate question! Lenovo Thinkpad, Debian testing.
Describe your current most memorable situation as FLOSS member?
Oh, there are a few. One awesome, tiring and very satisfying moment was during the release of Squeeze: I was member of the publicity and the www teams at the time, and we had to pull a 10 hours of team work to put everything in place. It was terrible and exciting at the same time. I shudder to think at the amount of work required from ftpmaster and release team during the release. Another awesome moment was my first Debconf: I was so overwhelmed by the sense of belonging in finally meeting all these people I've been worked remotely for so long, and embarassed by my poor English skills, and overall happy for just being there... If you are a Debian contributor I really encourage you to participate to Debian events, be they small and local or as big as DebConf: it really is like finally meeting family.
Some memorable moments from Debian conferences?
During DC11, the late nights with the "corridor cabal" in the hotel, chatting about everything. A group expedition to watch shooting stars in the middle of nowhere, during DC13. And a very memorable videoteam session: it was my first time directing and everything that could go wrong, went wrong (including the speaker deciding to take a walk outside the room, to demonstrate something, out of the cameras range). It was a disaster, but also fun: at the end of it, all the video crew was literally in stitches. But there are many awesome moments, almost too many to recall. Each conference is precious on that regard: for me the socializing part is extremely important, it's what cements relationships and help remote work go smoothly, and gives you motivation to volunteer in tasks that sometimes are not exactly fun.
You are known as Front Desk member for DebConf's - what work does it occupy and why do you enjoy doing it?
I'm not really a member of the team: just one of Nattie's minions!
You had been also part of DebConf Video team - care to share insights
into video team work and benefits it provides to Debian Project?
The video team work is extremely important: it makes possible for people not attending to follow the conference, providing both live streaming and recording of all talks. I may be biased, but I think that DebConf video coverage and the high quality of the final recordings are unrivaled among FLOSS conferences - especially since it's all volunteer work and most of us aren't professional in the field. During the conference we take shifts in filming the various talks - for each talk we need approximately 4 volunteers: two camera operators, a sound mixer and the director. After the recording, comes the boring part: reviewing, cutting and sometimes editing the videos. It's a long process and during the conference, you can sometimes spot the videoteam members doing it at night in the hacklab, exhausted after a full day of filming. And then, the videos are finally ready to be uploaded, for your viewing pleasure. During the last years this process has become faster thanks to the commitment of many volunteers, so that now you have to wait only few days, sometimes a week, after the end of the conference to be able to watch the videos. I personally love to contribute to the videoteam: you get to play with all that awesome gear and you actually make a difference for all the people who cannot attend in person.
You are also non-packaging Debian Developer - how does that feel like?
Feels awesome! The mere fact that the Debian Project decided - in 2009 via a GR - to recognize the many volunteers who contribute without doing packaging work is a great show of inclusiveness, in my opinion. In a big project like Debian just packaging software is not enough: the final result relies heavily on translators, sysadmins, webmasters, publicity people, event organizers and volunteers, graphic artists, etc. It's only fair that these contributions are deemed as valuable as the packaging, and to give an official status to those people. I was one of the firsts non-uploading DD, four years ago, and for a long time it was just really an handful of us. In the last year I've seen many others applying for the role and that makes me really happy: it means that finally the contributors have realized that they deserve to be an official part of Debian and to have "citizenship rights" in the project.
You were the leading energy on Debian's diversity statement - what gave
you the energy to drive into it?
It seemed the logical conclusion of the extremely important work that Debian Women had done in the past. When I first joined Debian, in 2009, as a contributor, I was really surprised to find a friendly community and to not be discriminated on account of my gender or my lack of coding skills. I may have been just lucky, landing in particularly friendly teams, but my impression is that the project has been slowly but unequivocally changed by the work of Debian Women, who raised first the need for inclusiveness and the awareness about the gender problem in Debian. I don't remember exactly how I stumbled upon the fact that Debian didn't have a Diversity Statement, but at first I was very surprised by it. I asked zack (Stefano Zacchiroli), who was DPL at the time, and he encouraged me to start a public discussion about it, sending out a draft - and helped me all the way along the process. It took some back and forth in the debian-project mailing list, but the only thing needed was actually just someone to start the process and try to poke the discussion when it stalled - the main blocker was actually about the wording of the statement. I learned a great deal from that experience, and I think it changed completely my approach in things like online discussions and general communication within the project. At the end of the day, what I took from that is a deep respect for who participated and the realization that constructive criticism does require certainly a lot of work for all parts involved, but can happen. As for the statement in itself: these things are as good as you keep them alive with best practices, but I think that are better stated explicitly rather than being left unsaid.
You are involved also with another Front Desk, the Debian's one which is involved with Debian's New Members process - what are tasks of that FD
and how rewarding is the work on it?
The Debian Front Desk is the team that runs the New Members process: we receive the applications, we assign the applicant a manager, and we verify the final report. In the last years the workflow has been simplified a lot by the re-design of the nm.debian.org website, but it's important to keep things running smoothly so that applicants don't have too lenghty processes or to wait too much before being assigned a manager. I've been doing it for a less more than a month, but it's really satisfying to usher people toward DDship! So this is how I feel everytime I send a report over to DAM for an applicant to be accepted as new Debian Developer:
How do you see future of Debian development?
Difficult to say. What I can say is that I'm pretty sure that, whatever the technical direction we'll take, Debian will remain focused on excellence and freedom.
What are your future plans in Debian, what would you like to work on?
Definetely bug wrangling: it's one of the thing I do best and I've not had a chance to do that extensively for Debian yet.
Why should developers and users join Debian community? What makes Debian a great and happy place?
We are awesome, that's why. We are strongly committed to our Social Contract and to users freedom, we are steadily improving our communication style and trying to be as inclusive as possible. Most of the people I know in Debian are perfectionists and outright brilliant in what they do. Joining Debian means working hard on something you believe, identifying with a whole project, meeting lots of wonderful people and learning new things. It ca be at times frustrating and exhausting, but it's totally worth it.
You have been involved in Mozilla as part of OPW - care to share
insights into Mozilla, what have you done and compare it to Debian?
That has been a very good experience: it meant have the chance to peek into another community, learn about their tools and workflow and contribute in different ways. I was an intern for the Firefox QA team and their work span from setting up specific test and automated checks on the three version of Firefox (Stable, Aurora, Nightly) to general bug triaging. My main job was bug wrangling and I loved the fact that I was a sort of intermediary between developers and users, someone who spoke both languages and could help them work together. As for the comparison, Mozilla is surely more diverse than Debian: both in contributors and users. I'm not only talking demographic, here, but also what tools and systems are used, what kind of skills people have, etc. That meant reach some compromises with myself over little things: like having to install a proprietary tool used for the team meetings (and getting crazy in order to make it work with Debian) or communicating more on IRC than on mailing lists. But those are pretty much the challenges you have to face whenever you go out of your comfort zone .
You are also volunteer of the Organization for Transformative Works -
what is it, what work do you do and care to share some interesting stuff?

