diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues.

• comparators.xml:
  • Fix EPUB "missing file" tests; they ship a META-INF/container.xml file. [ ]
  • Misc style fixups. [ ]
• APK files can also be identified as "DOS/MBR boot sector". (#868486)
• comparators.sqlite: Simplify file detection by rewriting manual recognizes call with a Sqlite3Database.RE_FILE_TYPE definition. [ ]
• comparators.directory:
  • Revert the removal of a try-except. (#868534)
  • Tidy module. [ ]

strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build.

• Add missing File::Temp imports in the JAR and PNG handlers. This appears to have been exposed by lazily-loading handlers in #867982. (#868077)

buildinfo.debian.net is my experiment into how to process, store and distribute .buildinfo files after the Debian archive software has processed them.

• Avoid a race condition between check-and-creation of Buildinfo instances. [ ]

• obs-studio: Remove annoying "click wrapper" on first startup. (#867756)
• vim: Syntax highlighting for debian/copyright files. (#869965)
• moin: Incorrect timezone offset applied due to "84600" typo. (#868463)
• ssss: Add a simple autopkgtest. (#869645)
• dch: Please bump $latest_bpo_dist to current stable release. (#867662)
• python-kaitaistruct: Remove Markdown and homepage references from package long descriptions. (#869265)
• album-data: Correct invalid Vcs-Git URI. (#869822)
• pytest-sourceorder: Update Homepage field. (#869125)

• "Frontdesk" duties, triaging CVEs, etc.
• Issued DLA 1014-1 for libclamunrar, a library to add unrar support to the Clam anti-virus software to fix an arbitrary code execution vulnerability.
• Issued DLA 1015-1 for the libgcrypt11 crypto library to fix a "sliding windows" information leak.
• Issued DLA 1016-1 for radare2 (a reverse-engineering framework) to prevent a remote denial-of-service attack.
• Issued DLA 1017-1 to fix a heap-based buffer over-read in the mpg123 audio library.
• Issued DLA 1018-1 for the sqlite3 database engine to prevent a vulnerability that could be exploited via a specially-crafted database file.
• Issued DLA 1019-1 to patch a cross-site scripting (XSS) exploit in phpldapadmin, a web-based interface for administering LDAP servers.
• Issued DLA 1024-1 to prevent an information leak in nginx via a specially-crafted HTTP range.
• Issued DLA 1028-1 for apache2 to prevent the leakage of potentially confidential information via providing Authorization Digest headers.
• Issued DLA 1033-1 for the memcached in-memory object caching server to prevent a remote denial-of-service attack.

• redis:
  • 4:4.0.0-1 Upload new major upstream release to unstable.
  • 4:4.0.0-2 Make /usr/bin/redis-server in the primary package a symlink to /usr/bin/redis-check-rdb in the redis-tools package to prevent duplicate debug symbols that result in a package file collision. (#868551)
  • 4:4.0.0-3 Add -latomic to LDFLAGS to avoid a FTBFS on the mips & mipsel architectures.
  • 4:4.0.1-1 New upstream version. Install 00-RELEASENOTES as the upstream changelog.
  • 4:4.0.1-2 Skip non-deterministic tests that rely on timing. (#857855)
• python-django:
  • 1:1.11.3-1 New upstream bugfix release. Check DEB_BUILD_PROFILES consistently, not DEB_BUILD_OPTIONS.
• bfs:
  • 1.0.2-2 & 1.0.2-3 Use help2man to generate a manpage.
  • 1.0.2-4 Set hardening=+all for bindnow, etc.
  • 1.0.2-5 & 1.0.2-6 Don't use upstream's release target as it overrides our CFLAGS & install RELEASES.md as the upstream changelog.
  • 1.1-1 New upstream release.
• libfiu:
  • 0.95-4 Apply patch from Steve Langasek to fix autopkgtests. (#869709)
• python-daiquiri:
  • 1.0.1-1 Initial upload. (ITP)
  • 1.1.0-1 New upstream release.
  • 1.1.0-2 Tidy package long description.
  • 1.2.1-1 New upstream release.

• ITP: python-daiquiri Python library to easily setup basic logging functionality. (#867322)
• twittering-mode: Correct incorrect time formatting due to "84600" typo. (#868479)