--- /dev/null
+Title: Free software activity in May 2025
+Slug: activity-2025-05
+Date: 2025-06-08 01:20:02 +01:00
+Category: columbiform
+Tags: activity, columbiform, freexian, man-db, openssh, planet-debian, planet-ubuntu
+Summary: Debian work as we reached the hard freeze for trixie.
+Mastodon-ID: 114644888745955985
+
+My Debian contributions this month were all
+[sponsored](https://www.freexian.com/about/debian-contributions/) by
+Freexian. Things were a bit quieter than usual, as for the most part I was
+sticking to things that seemed urgent for the upcoming trixie release.
+
+You can also support my work directly via
+[Liberapay](https://liberapay.com/cjwatson) or [GitHub
+Sponsors](https://github.com/sponsors/cjwatson).
+
+## OpenSSH
+
+After my appeal for help [last month]({filename}/activity-2025-04.md) to
+debug [intermittent `sshd` crashes](https://bugs.debian.org/1103418), Michel
+Casabona helped me put together an environment where I could reproduce it,
+which allowed me to track it down to a [root
+cause](https://bugzilla.mindrot.org/show_bug.cgi?id=3822) and fix it. (I
+also found a [misuse of
+`strlcpy`](https://bugzilla.mindrot.org/show_bug.cgi?id=3819) affecting at
+least glibc-based systems in passing, though I think that was unrelated.)
+
+I worked with Daniel Kahn Gillmor to fix a [regression in `ssh-agent` socket
+handling](https://bugs.debian.org/1103522).
+
+I fixed a [reproducibility bug depending on whether `passwd` is installed on
+the build system](https://bugs.debian.org/1104992), which would have
+affected security updates during the lifetime of trixie.
+
+I [backported](https://bugs.debian.org/1105036) openssh 1:10.0p1-5 to
+bookworm-backports.
+
+I issued bookworm and
+[bullseye](https://lists.debian.org/debian-lts-announce/2025/05/msg00008.html)
+updates for [CVE-2025-32728](https://bugs.debian.org/1102603).
+
+## groff
+
+I backported a fix for [incorrect output when formatting multiple documents
+as PDF/PostScript at once](https://bugs.debian.org/1104609).
+
+## debmirror
+
+I added a [simple
+autopkgtest](https://salsa.debian.org/debian/debmirror/-/commit/c122f7ff32c4ae24a729a6ecf42d15c9ac05eb5c).
+
+## Python team
+
+I upgraded these packages to new upstream versions:
+
+* automat
+* celery
+* flufl.i18n
+* flufl.lock
+* frozenlist
+* python-charset-normalizer
+* python-evalidate (including pointing out an [upstream release handling
+ issue](https://github.com/yaroslaff/evalidate/issues/15))
+* python-pythonjsonlogger
+* python-setproctitle
+* python-telethon
+* python-typing-inspection
+* python-webargs
+* pyzmq
+* trove-classifiers (including a [small upstream
+ cleanup](https://github.com/pypa/trove-classifiers/pull/212))
+* uncertainties
+* zope.testrunner
+
+In bookworm-backports, I updated these packages:
+
+* python-django to 3:4.2.21-1 (issuing
+ [BSA-124](https://backports.debian.org/news/BSA-124_Security_Update_for_python-django/))
+* python-django-pgtrigger to 4.14.0-1
+
+I fixed problems building these packages reproducibly:
+
+* celery ([contributed
+ upstream](https://github.com/celery/celery/pull/9687))
+* python-setproctitle
+* uncertainties ([contributed
+ upstream](https://github.com/lmfit/uncertainties/pull/312), after some
+ discussion)
+
+I backported fixes for some security vulnerabilities to unstable (since
+we're in freeze now so it's not always appropriate to upgrade to new
+upstream versions):
+
+* django-select2: [CVE-2025-48383](https://bugs.debian.org/1106747)
+* python-tornado: [CVE-2025-47287](https://bugs.debian.org/1105886)
+
+I fixed various other build/test failures:
+
+* [fail2ban](https://salsa.debian.org/python-team/packages/fail2ban/-/merge_requests/17)
+ (also reviewing and merging [fix sshd 10.0 log
+ identifier](https://salsa.debian.org/python-team/packages/fail2ban/-/merge_requests/15)
+ and [remove runtime calls to
+ distutils](https://salsa.debian.org/python-team/packages/fail2ban/-/merge_requests/16))
+* [karabo-bridge](https://bugs.debian.org/1103147) ([contributed
+ upstream](https://github.com/European-XFEL/karabo-bridge-py/pull/71))
+* [kegtron-ble](https://bugs.debian.org/1104837)
+* [python-click-option-group](https://bugs.debian.org/1091947) (NMU)
+* [python-holidays](https://bugs.debian.org/1104508)
+* [python-mastodon](https://bugs.debian.org/1103591)
+* [python-mechanize](https://bugs.debian.org/1106440) ([contributed
+ upstream](https://github.com/python-mechanize/mechanize/pull/102))
+* [thermobeacon-ble](https://salsa.debian.org/python-team/packages/thermobeacon-ble/-/commit/c1bc246f0a04018483074cbdca1501088165dc07)
+
+I added non-superficial autopkgtests to these packages:
+
+* [karabo-bridge](https://bugs.debian.org/1035163)
+* [python-lazy-model](https://salsa.debian.org/python-team/packages/python-lazy-model/-/compare/debian%2F0.3.0-1...debian%2F0.3.0-2?from_project_id=93488)
+
+I packaged [python-django-hashids](https://bugs.debian.org/1103977) and
+[python-django-pgbulk](https://bugs.debian.org/1103880), needed for new
+upstream versions of python-django-pgtrigger.
+
+I
+[ported](https://code.launchpad.net/~cjwatson/storm/py314-beta/+merge/485763)
+storm to Python 3.14.
+
+## Science team
+
+I fixed a [build failure](https://bugs.debian.org/1103232) in
+apertium-oci-fra.
~cjwatson / blog.git / commitdiff