Posted on

My Debian Activities in February 2022

FTP master

This month I accepted 484 and rejected 73 packages. The overall number of packages that got accepted was 495.

The overall number of rejected packages was 76, which is about 15% of the uploads to NEW. While most of the maintainers do a great job when creating their debian/copyright, others are a bit lax. Unfortunately those people seem to be more enthusiastic when fighting for changes in NEW processing or even removing NEW.

One argument in discussions about NEW is that the copyright verification of packages can be done by the community after accepting the packages in the archive.
Last month I did not get any hint that such checks have been done by anybody. As the past already showed several times, this community based checks simply do not exist.

So in the end poorly maintained copyright information will rot in the archive and I am not sure that this really corresponds with the Debian Social Contract.

Debian LTS

This was my ninety-second month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

  • [DLA 2928-1] htmldoc security update for three CVEs
  • [#1004049] buster-pu: zziplib debdiff was approved and package uploaded
  • [#1004050] bullseye-pu: zziplib debdiff was approved and package uploaded
  • [#1004055] buster-pu: debdiff was approved and package uploaded
  • [#1006493] bullseye-pu: htmldoc/1.9.11-4+deb11u2
  • [#1006494] buster-pu: htmldoc/1.9.3-1+deb10u3
  • [#1006550] buster-pu: tiff/4.1.0+git191117-2~deb10u4
  • [#1006551] bullseye-pu: tiff/4.2.0-1+deb11u1

Unfortunately salsa went down at the end of the month, so several planned uploads did not happen and have to be delayed to March.

I also continued to work on security support for golang packages. Further I worked on packages in NEW on security-master and injected missing sources. Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the forty-fourth ELTS month.

During my allocated time I uploaded:

  • ELA-567-1 for apache2
  • ELA-567-2 for apache2
  • ELA-568-1 for ksh
  • ELA-569-1 for tiff
  • ELA-570-1 for htmldoc

Further I worked on cyrus-sasl but did not do an upload yet.

Last but not least I did some days of frontdesk duties.

Debian Printing

As announced last month I uploaded a new version of cups.

Altogether I uploaded new upstream versions or improved packaging of:

Debian Astro

This month I uploaded new upstream versions or improved packaging of:

Other stuff

This month I uploaded new upstream versions or improved packaging of:

Posted on

My Debian Activities in January 2022

FTP master

This month I accepted 342 and rejected 57 packages. The overall number of packages that got accepted was 366.

Lately I was asked: Is it ftpmaster’s opinion and policy that there is no difference in NEW queue review process between bin and src?

This is a yes/no-question and in this generality the answer is clearly: Every package in NEW needs a full review.

Of course there are circumstances with exceptions. For example after an upload of -1, which would get a full review, the upload of -2 afterwards, introducing a new binary package, would get a much faster review. In this case it would make sense to ping on IRC and draw attention to this. Nevertheless the evaluation of a “light review” might differ between the maintainer and the person doing the review.

Debian LTS

This was my ninety-first month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

  • [DLA 2882-1] sphinxsearch security update for one CVE
  • [DLA 2890-1] libspf2 security update for two CVEs
  • [DLA 2897-1] apr security update for one CVE
  • [DLA 2900-1] lrzsz security update for one CVE
  • [DLA 2901-1] libxfont security update for one CVE
  • [DLA 2902-1] graphicsmagick security update for one CVE
  • [#1004049] buster-pu: package zziplib/0.13.62-3.2+deb10u1
  • [#1004050] bullseye-pu: package zziplib/0.13.62-3.3+deb11u1
  • [#1004055] buster-pu: package raptor2/2.0.14-1.1~deb10u2

I also started to work on security support for golang packages. Though this sounds like an easy task, the devel is in the details.
As CVEs need to be fixed in unstable first, at the moment it looks like this is the most time consuming task. I will report later on my journey to fix open CVEs in golang-github-russellhaering-goxmldsig

Further I worked on packages in NEW on security-master and injected missing sources.

Last but not least I did some days of frontdesk duties and attended an LTS meeting on IRC.

Debian ELTS

This month was the forty-third ELTS month.

During my allocated time I uploaded:

  • ELA-544-1 for libspf2
  • ELA-549-1 for apr
  • ELA-552-1 for lrzsz
  • ELA-553-1 for libxfont

Further I worked on an update for apache2

Last but not least I did some days of frontdesk duties.

Debian Printing

I was finally able to upload a new version of hplip and Ubuntu is now able to build new snaps for their next release.
Altogether I uploaded new upstream versions or improved packaging of:

Now the dashboard looks rather good and my next task for February is an update of cups.

Debian Astro

As there was a release of version 1.9.4 of INDI and indi-3rdparty, I also uploaded the new version of all INDI drivers and releated libs from indi-3rdparty.

Other stuff

This month I uploaded lots of new upstream releases of golang packages.

Posted on

My Debian Activities in December 2021

FTP master

This month I accepted 412 and rejected 44 packages. The overall number of packages that got accepted was 423.

Debian LTS

This was my ninetieth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

  • [DLA 2846-1] raptor2 security update for one CVE
  • [DLA 2845-1] libsamplerate security update for one CVE
  • [DLA 2859-1] zziplib security update for one CVE
  • [DLA 2858-1] libzip security update for one CVE
  • [DLA 2869-1] xorg-server security update for three CVEs
  • [#1002912] for graphicsmagick in Buster
  • [debdiff] for sphinxearch/buster to maintainer and sec team
  • [debdiff] for zziplib/buster to maintainer
  • [debdiff] for zziplib/bullseye to maintainer
  • [debdiff] for raptor2/bullseye to maintainer

I also started to work on libarchive

Further I worked on packages in NEW on security-master. In order to faster process such packages, I added a notification when work arrived there.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the forty-second ELTS month.

During my allocated time I uploaded:

  • ELA-527-1 for libsamplerate
  • ELA-528-1 for raptor2
  • ELA-529-1 for ufraw
  • ELA-532-1 for zziplib
  • ELA-534-1 for xorg-server

Last but not least I did some days of frontdesk duties.

Debian Astro

Related to my previous article about fun with telescopes I uploaded new versions or did source uploads for:

Besides the indi-stuff I also uploaded

Other stuff

I celebrated christmas :-).

Posted on

Fun with Telescopes

Recently I purchased a small telescope to look at solar spots. When choosing a mount, I checked whether it can be controlled with OSS.

In this context INDI is mentioned everywhere and my desired mount was supported. indi and kstars are already part of Debian, so “apt install”, selecting my mount, …. oh, wait, the menu shows it, but I can not select it.

Ok, that was the time when I learned about the difference of indi and indi-3rdparty. The indi package just contains a few drivers and others are available from a different repository. This split has been done either due to different release cycles of the driver, a different OSS license of it, or just due to binary blobs without source being part of some drivers.

Fine, there are already packages of the 3rdparty-repository available from an Ubuntu PPA, so it should be no problem to add them do Debian as well.

Some manufacturers freely distribute at least the specification of their API so that others are able to write the corresponding software. Some manufacturers even write their own driver. Examples are:

  • Skywatcher (mounts who can be controlled by the Skywatcher Protocol)
  • Shelyak to control some spectrographs
  • Radio Astronomy Supplies’ SpectraCyber hydrogen line spectrometer
  • Vixen, for controlling Vixen Starbook and Vixen Starbook Ten
  • Starlight Express, SX CCDs, SX wheel and SX Active Optics

A minor part actually does not have binary blobs but distributes the sources of their software. Unfortunately they have licenses that are not compatible with DFSG and those packages still need to go to non-free. Examples are:

  • Finger Lakes Instrumentation (FLI), L.L.C.
  • Lunatico Astronomia
  • Astrojolo
  • Astromechanics

But there also seem to exist lots of manufacturers of astronomically accessories, especially cameras, that just distribute some binary blobs to talk to their hardware. This is sad, but at the moment it is just the way it is and such package need to go to non-free.

Luckily their blobs are accompanied with corresponding licenses. At least those manufacturers understand how software licenses work and packaging their SDK is just straight forward. Examples are:

  • SBIG Astronomical Instruments
  • Moravian Instruments Inc.
  • Player One Astronomy

However, when looking at the license information of some Ubuntu packages, several of them were distributed under a CC license. This is not a common license for software, so I wanted to get a confirmation whether these information are correct.

Unfortunately most of such manufacturers don’t want to disclose their licenses. For whatever reason they distribute their tarballs without any hint and emails to their support channels are just ignored. Examples of such bad behaviour are:

  • Altaircam
  • QSI (was bought by Atik)
  • Atik
  • Touptek
  • QHY

However the best answer comes from the Levenhuk support. My question about the license of their SDK was answered by:

I am afraid we cannot disclose any further information except the software file that is available on our website.

So strictly speaking nobody is allowed to use their software. I wonder whether such competence also becomes visible in their products. I will never really know as there are more than enough OSS friendly manufacturers available.

Anyway, most of the indi-3rdparty drivers are now available and I got lots of suggestions about hardware I need to buy in the future :-).

Posted on

My Debian Activities in November 2021

FTP master

This month I accepted 564 and rejected 93 packages. The overall number of packages that got accepted was 591.

Debian LTS

This was my eighty-ninth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 40h. During that time I did LTS and normal security uploads of:

  • [DLA 2820-1] atftp security update for two CVEs
  • [DLA 2821-1] axis security update for one CVE
  • [DLA 2822-1] netkit-rsh security update for two CVEs
  • [DLA 2825-1] libmodbus security update for two CVEs
  • [#1000408] for libmodbus in Buster
  • [#1000485] for btrbk in Bullseye
  • [#1000486] for btrbk in Buster

I also started to work on pgbouncer to get an update for each release and had to process packages from NEW on security-master.

Further I worked on a script to automatically publish DLAs on the Debian website, that are posted to debian-lts-announce. The script can be found on salsa. It only publishes stuff from people on a whitelist. At the moment it is running on a computer at home. You might run your own copy, or just send me an email to be put on the whitelist as well.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the forty-first ELTS month.

During my allocated time I uploaded:

  • ELA-517-1 for atftp
  • ELA-519-1 for qtbase-opensource-src
  • ELA-520-1 for libsdl1.2
  • ELA-521-1 for libmodbus

Last but not least I did some days of frontdesk duties.

Debian Printing

Unfortunately I did not do as much as I wanted this month. At least I looked at some old bugs and uploaded new upstream versions of …

I hope this will improve in December again. New versions of cups and hplip are on my TODO-list.

Debian Astro

This month I uploaded new versions of …

Other stuff

I improved packaging or fixed bugs of:

Posted on

My Debian Activities in October 2021

FTP master

This month I accepted 341 and rejected 46 packages. The rejection is as high as last month. I hope everybody is aware that pressing just one key when accepting a package is much faster than writing an explanation why a package has to be rejected. Anyway, the overall number of packages that got accepted was 355.

Debian LTS

This was my eighty-eighth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 28.5h. During that time I did LTS and normal security uploads of:

  • [DLA 2788-1] strongswan security update for one CVE
  • [DLA 2789-1] squashfs-tools security update for one CVE
  • [DLA 2792-1] faad2 security update for seven CVEs
  • [DLA 2796-1] jbig2dec security update for two CVEs
  • [DLA 2800-1] cups security update for one CVE
  • [#998042] for jbig2dec in Buster

I also continued to work on exiv2.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the fortieth ELTS month.

During my allocated time I uploaded:

  • ELA-494-1 for curl
  • ELA-497-1 for squashfs-tools
  • ELA-498-1 for openssl
  • ELA-501-1 for faad2
  • ELA-504-1 for jbig2dec
  • ELA-508-1 for cups

Last but not least I did some days of frontdesk duties.

Debian Printing

I improved packaging or fixed bugs or uploaded a new version of:

Last but not least I looked at some old bugs and checked whether they could be closed.

Debian Astro

Though being a silent member of Debian Astro for a long time, I am now going to be more active now. Most of the time I will be focused on packages for telescope control, but of course I won’t stay away from other topics.

So I uploaded:

If you know of other missing packages, don’t hesitate to tell me!

Other stuff

On my neverending golang challenge I again uploaded some packages either for NEW or as source upload.

I uploaded new upstream versions of:

I improved packaging or fixed bugs of:

Posted on

My Debian Activities in September 2021

FTP master

This month I accepted 224 and rejected 47 packages. This is almost thrice the rejects of last month. Please, be more careful and check your package twice before uploading. The overall number of packages that got accepted was 233.

Debian LTS

This was my eighty-seventh month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 24.75h. During that time I did LTS and normal security uploads of:

  • [DLA 2755-1] btrbk security update for one CVE
  • [DLA 2762-1] grilo security update for one CVE
  • [DLA 2766-1] openssl security update for one CVE
  • [DLA 2774-1] openssl1.0 security update for one CVE
  • [DLA 2773-1] curl security update for two CVEs

I also started to work on exiv2 and faad2.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the thirty-ninth ELTS month.

Unfortunately during my allocated time I could not process any upload. I worked on openssl, curl and squashfs-tools but for one reason or another the prepared packages didn’t pass all tests. In order to avoid regressions, I postponed the uploads (meanwhile an ELA for curl was published …).

Last but not least I did some days of frontdesk duties.

Other stuff

On my neverending golang challenge I again uploaded some packages either for NEW or as source upload.

As Odyx took a break from all Debian activities, I volunteered to take care of the printing packages. Please be merciful when somethings breaks after I did an upload. My first printing upload was hplip

Posted on

My Debian Activities in August 2021

FTP master

Yeah, Bullseye is released, thanks a lot to everybody involved!

This month I accepted 242 and rejected 18 packages. The overall number of packages that got accepted was 253.

Debian LTS

This was my eighty-sixth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 23.75h. During that time I did LTS and normal security uploads of:

  • [DLA 2738-1] c-ares security update for one CVE
  • [DLA 2746-1] scrollz security update for one CVE
  • [DLA 2747-1] ircii security update for one CVE
  • [DLA 2748-1] tnef security update for one CVE
  • [DLA 2749-1] gthumb security update for one CVE
  • [DLA 2752-1] squashfs-tools security update for one CVE
  • buster-pu for gthumb #993228
  • prepared debdiffs for squashfs-tools in Buster and Bullseye, which will result in DSA 4967
  • prepared debdiffs for btrbk in Buster and Bullseye

I also started to work on openssl, grilo and had to process packages from NEW on security-master.

As the CVE of btrbk was later marked as no-dsa, an upload to stable and oldstable is needed now.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the thirty-eighth ELTS month.

During my allocated time I uploaded:

  • ELA-474-1 for c-ares
  • ELA-480-1 for squashfs-tools

I also started to work on openssl.

Last but not least I did some days of frontdesk duties.

Other stuff

This month I uploaded new upstream versions of:

On my neverending golang challenge I again uploaded some packages either for NEW or as source upload.

Posted on

My Debian Activities in July 2021

FTP master

This month I accepted 13 and rejected 2 packages. The overall number of packages that got accepted was 13.

As the Release Team prefers not to have any new package upload to unstable, the numbers are this low. I am afraid there is some discussion needed after the release of Bullseye …

Debian LTS

This was my eighty-fifth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been 30h. During that time I did LTS and normal security uploads of:

  • [DLA 2720-1] aspell security update for two CVEs
  • [DLA 2722-1] libsndfile security update for one CVE
  • [DLA 2723-1] linuxptp security update for one CVE
  • prepared aspell update in Buster, which resulted in DSA 4948-1

I also made further progress on gpac and started to test the package now.

Last but not least I did some days of frontdesk duties. I am not sure whether it is just me, but I got the impression that nowadays lots of CVEs can be marked as not-affected in the corresponding Stretch-version. Most of the remaining CVEs only have a small security impact (if at all) and can be marked as no-dsa. So the number of packages that really need an update decreases steadily. Does that mean that all issues in older versions are fixed now? Or are people more focused on new features in software as it is easier to find issues in more or less unexplored code?

Debian ELTS

This month was the thirty-seventh ELTS month.

During my allocated time I uploaded:

  • ELA-461-1 for jasper
  • ELA-462-1 for aspell
  • ELA-464-1 for libsndfile

Last but not least I did some days of frontdesk duties. In ELTS the decreasing number of uploads, as mentioned above, seems to be even more clearly.

Other stuff

I played a bit with RISC-V and looked after some packages that did not build on that architecture. Generally this looks like fun but building packages with qemu dampens the mood a bit. So if anybody knows some hardware that runs Debian, that is available now and that does not cost more than my car, I would be happy to get some pointer.

This month I uploaded new upstream versions of:

to experimental.

I improved packaging and fixed bugs in:

On my neverending golang challenge I again uploaded some packages either for NEW or as source upload.

Posted on

My Debian Activities in June 2021

FTP master

This month I accepted 105 and rejected 6 packages. The overall number of packages that got accepted was 111.

Debian LTS

This was my eighty-fourth month that I did some work for the Debian LTS initiative, started by Raphael Hertzog at Freexian.

This month my all in all workload has been almost 30h. During that time I did LTS and normal security uploads of:

  • [DLA 2691-1] libgcrypt20 security update for one CVE
  • [DLA 2692-1] bluez security update for two CVEs
  • [DLA 2694-1] tiff security update for two CVEs
  • [DLA 2697-1] fluidsynth security update for one CVE
  • [DLA 2698-1] node-bl security update for one CVE
  • [DLA 2699-1] ipmitool security update for one CVE
  • PU bug #989815 ring/buster for one CVE

I also made further progress on gpac.

Last but not least I did some days of frontdesk duties.

Debian ELTS

This month was the thirty-sixth ELTS month.

During my allocated time I uploaded:

  • ELA-444-1 for libgcrypt20
  • ELA-445-1 for bluez
  • ELA-447-1 for tiff
  • ELA-450-1 for fluidsynth

Last but not least I did some days of frontdesk duties.

Other stuff

On my neverending golang challenge I again uploaded lots of packages either for NEW or as source upload.