--- /dev/null
+Title: Free software activity in April 2025
+Slug: activity-2025-04
+Date: 2025-05-04 16:38:13 +01:00
+Category: columbiform
+Tags: activity, columbiform, freexian, man-db, openssh, planet-debian, planet-ubuntu
+Summary: OpenSSH 10.0 (and a request for help), dput-ng, and more.
+Mastodon-ID: 114450324476636098
+
+About 90% of my Debian contributions this month were
+[sponsored](https://www.freexian.com/about/debian-contributions/) by
+Freexian.
+
+You can also support my work directly via
+[Liberapay](https://liberapay.com/cjwatson).
+
+## Request for OpenSSH debugging help
+
+Following the OpenSSH work described below, I have an [open
+report](https://bugs.debian.org/1103418) about the `sshd` server sometimes
+crashing when clients try to connect to it. I can't reproduce this myself,
+and arm's-length debugging is very difficult, but three different users have
+reported it. For the time being I can't pass it upstream, as it's entirely
+possible it's due to a Debian patch.
+
+Is there anyone reading this who can reproduce this bug and is capable of
+doing some independent debugging work, most likely involving bisecting
+changes to OpenSSH? I'd suggest first seeing whether a build of the
+unmodified upstream 10.0p2 release exhibits the same bug. If it does, then
+bisect between 9.9p2 and 10.0p2; if not, then bisect the list of Debian
+patches. This would be extremely helpful, since at the moment it's a bit
+like trying to look for a needle in a haystack from the next field over by
+sending instructions to somebody with a magnifying glass.
+
+## OpenSSH
+
+I upgraded the Debian packaging to [OpenSSH
+10.0p1](https://www.openssh.com/releasenotes.html#10.0p2) (now [designated
+10.0p2](https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html)
+by upstream due to a mistake in the release process, but they're the same
+thing), fixing [CVE-2025-32728](https://bugs.debian.org/1102603). This also
+involved a [diffoscope bug report](https://bugs.debian.org/1102658) due to
+the version number change.
+
+I enabled the new `--with-linux-memlock-onfault` configure option to protect
+`sshd` against being swapped out, but this turned out to cause test failures
+on riscv64, so I disabled it again there. Debugging this took some time
+since I needed to do it under emulation, and in the process of setting up a
+testbed I [added riscv64 support to
+vmdb2](https://gitlab.com/larswirzenius/vmdb2/-/merge_requests/154).
+
+In [coordination](https://bugs.debian.org/1102643) with the wtmpdb
+maintainer, I enabled the new Y2038-safe native wtmpdb support in OpenSSH,
+so `wtmpdb last` now reports the correct tty.
+
+I fixed a couple of packaging bugs:
+
+* [Please stop writing /var/log/btmp](https://bugs.debian.org/1072184)
+* [Restore sshd\_config(5) documentation about
+ rdomain](https://bugs.debian.org/1095686)
+
+I reviewed and merged several packaging contributions from others:
+
+* [ssh-agent: Improve systemd user service socket
+ activation](https://bugs.debian.org/1103037) (Daniel Kahn Gillmor)
+* [Switch from adduser to
+ sysusers.d](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/30)
+ (Luca Boccassi)
+* [Add sshd-keygen
+ service](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/31)
+ (Luca Boccassi)
+
+## dput-ng
+
+Since we [added `dput-ng` integration to
+Debusine](https://salsa.debian.org/freexian-team/debusine/-/issues/713)
+recently, I wanted to make sure that it was in good condition in trixie, so
+I fixed [dput-ng: will FTBFS during trixie support
+period](https://bugs.debian.org/1078613). Previously a similar bug had been
+fixed by just using different Ubuntu release names in tests; this time I
+made the tests independent of the current supported release data returned by
+`distro_info`, so this shouldn't come up again.
+
+We also ran into [dput-ng: --override doesn't override profile
+parameters](https://bugs.debian.org/983160), which needed somewhat more
+extensive changes since it turned out that that option had never worked. I
+fixed this after some discussion with Paul Tagliamonte to make sure I
+understood the background properly.
+
+## man-db
+
+I released [man-db
+2.13.1](https://gitlab.com/man-db/man-db/-/releases/2.13.1). This just
+included various small fixes and a number of translation updates, but I
+wanted to get it into trixie in order to include a contribution to [increase
+the `MAX_NAME` constant](https://gitlab.com/man-db/man-db/-/issues/48),
+since that was now causing problems for some pathological cases of manual
+pages in the wild that documented a very large number of terms.
+
+## debmirror
+
+I fixed one security bug: [debmirror prints credentials with
+--progress](https://bugs.debian.org/1104091).
+
+## Python team
+
+I upgraded these packages to new upstream versions:
+
+* celery
+* django-modeltranslation (maintained by Freexian)
+* django-phonenumber-field
+* djangorestframework
+* kombu
+* orderly-set
+* pox
+* pydantic-extra-types
+* [python-cmarkgfm](https://bugs.debian.org/1072833) (fixing
+ [CVE-2022-39209](https://security-tracker.debian.org/tracker/CVE-2022-39209),
+ [CVE-2023-22483](https://security-tracker.debian.org/tracker/CVE-2023-22483),
+ [CVE-2023-22484](https://security-tracker.debian.org/tracker/CVE-2023-22484),
+ [CVE-2023-22485](https://security-tracker.debian.org/tracker/CVE-2023-22485),
+ [CVE-2023-22486](https://security-tracker.debian.org/tracker/CVE-2023-22486),
+ [CVE-2023-24824](https://security-tracker.debian.org/tracker/CVE-2023-24824),
+ [CVE-2023-26485](https://security-tracker.debian.org/tracker/CVE-2023-26485),
+ and
+ [CVE-2023-37463](https://security-tracker.debian.org/tracker/CVE-2023-37463))
+* python-django-crispy-forms
+* python-django-extensions (fixing incompatibilities with Python 3.12:
+ [#1040091](https://bugs.debian.org/1040091),
+ [#1040119](https://bugs.debian.org/1040119))
+* python-django-pgtrigger
+* python-django-test-migrations
+* python-holidays
+* python-legacy-cgi
+* python-pydash
+* python-redis (4.3.4 to 5.2.1; needed some autopkgtest adjustments)
+* python-tblib
+* python-typing-extensions
+* trove-classifiers
+* xonsh
+
+In bookworm-backports, I updated these packages:
+
+* python-django to 3:4.2.20-1 (issuing
+ [BSA-123](https://backports.debian.org/news/BSA-123_Security_Update_for_python-django/))
+* python-django-pgtrigger to 4.13.3
+
+I dropped a stale build-dependency from
+[python-aiohttp-security](https://bugs.debian.org/1102526) that kept it out
+of testing (though unfortunately too late for the trixie freeze).
+
+I fixed or helped to fix various other build/test failures:
+
+* [bleak-retry-connector](https://bugs.debian.org/1102380)
+* [billiard](https://bugs.debian.org/1101621) ([contributed
+ upstream](https://github.com/celery/billiard/pull/423))
+* [cairosvg](https://bugs.debian.org/1103184)
+* [errbot](https://bugs.debian.org/1103066) ([contributed
+ upstream](https://github.com/errbotio/errbot/pull/1724))
+* [haversine](https://bugs.debian.org/1103116)
+* [json-tricks](https://bugs.debian.org/1104240)
+* [jsonpickle](https://bugs.debian.org/1103146) ([contributed
+ upstream](https://github.com/jsonpickle/jsonpickle/pull/560))
+* [lazygal](https://salsa.debian.org/python-team/packages/lazygal/-/commit/ea71ae96f4a48dd390f0e2b514234ce864ba430f)
+* [mypy](https://bugs.debian.org/1101856)
+* [pydantic](https://bugs.debian.org/1102283)
+* [pydantic-core](https://bugs.debian.org/1101417)
+* [pydantic-settings](https://bugs.debian.org/1101859)
+* [pympress](https://bugs.debian.org/1103197) ([contributed
+ upstream](https://github.com/Cimbali/pympress/pull/333))
+* [pysequoia](https://bugs.debian.org/1101861)
+* [pysodium](https://bugs.debian.org/1103103) ([contributed
+ upstream](https://github.com/stef/pysodium/pull/117))
+* [python-decorator](https://salsa.debian.org/python-team/packages/python-decorator/-/commit/e9d3b610e7cc7e3766ea0be2b21b3489dc11d9d9)
+* [python-djvulibre](https://bugs.debian.org/1103593) ([contributed
+ upstream](https://github.com/FriedrichFroebel/python-djvulibre/pull/25))
+* [python-msgspec](https://bugs.debian.org/1103362)
+* [python-momepy](https://bugs.debian.org/1103140) ([contributed
+ upstream](https://github.com/pysal/momepy/pull/698))
+* [python-tz](https://bugs.debian.org/1103581)
+* [storm](https://bugs.debian.org/1103501)
+* [supysonic](https://bugs.debian.org/1103208)
+* [uvloop](https://bugs.debian.org/1101258) ([contributed
+ upstream](https://github.com/MagicStack/uvloop/pull/662))
+
+I packaged [python-typing-inspection](https://bugs.debian.org/1102391),
+needed for a new upstream version of pydantic.
+
+I
+[documented](https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/57)
+the `architecture` field in `debian/tests/autopkgtest-pkg-pybuild.conf`
+files.
+
+I fixed other odds and ends of bugs:
+
+* [python-pydash: please make the build
+ reproducible](https://bugs.debian.org/1087330)
+* [thunarx-python: fails to allow plugins to
+ run](https://bugs.debian.org/1092859) / [thunarx-python: fails to discover
+ SONAME of libpython, tries to load
+ /usr/lib/MULTIARCH/lib.so.1.0](https://bugs.debian.org/1103704)
+* [ttconv: package installs superfluous files under
+ /usr/lib/python3/dist-packages](https://bugs.debian.org/1086561)
+
+## Science team
+
+I fixed various build/test failures:
+
+* [python-vispy](https://bugs.debian.org/1102477) (also fixing [unhandled
+ failures to build documentation can
+ occur](https://bugs.debian.org/1064607) while I was there)
+* [skimage](https://bugs.debian.org/1103004)
~cjwatson / blog.git / commitdiff