--- /dev/null
+Title: Free software activity in February 2026
+Slug: activity-2026-02
+Date: 2026-03-09 12:22:42 +00:00
+Category: columbiform
+Tags: activity, columbiform, freexian, planet-debian
+Summary: Even more pkg_resources wrangling, minor OpenSSH security updates, and a BTS mail-handling tweak.
+Mastodon-ID: 116199195033759285
+
+My Debian contributions this month were all [sponsored](https://www.freexian.com/about/debian-contributions/) by Freexian.
+
+You can also support my work directly via [Liberapay](https://liberapay.com/cjwatson) or [GitHub Sponsors](https://github.com/sponsors/cjwatson).
+
+## OpenSSH
+
+* [openssh: Please remove/replace usage of dh\_movetousr](https://bugs.debian.org/1122765)
+
+I released bookworm and trixie fixes for [CVE-2025-61984](https://bugs.debian.org/1117529) and [CVE-2025-61985](https://bugs.debian.org/1117530), both allowing code execution via `ProxyCommand` in some cases. The trixie update also included a fix for [openssh-server: refuses further connections after having handled PerSourceMaxStartups connections](https://bugs.debian.org/1080350).
+
+## bugs.debian.org administration
+
+Gioele Barabucci [reported](https://bugs.debian.org/1126848) that some messages to the bug tracking system generated by the `bts` command were being discarded. While the regression here was on the client side, I found and fixed a typo in our SpamAssassin configuration that was failing to apply a bonus specifically to `forwarded` commands, mitigating the problem.
+
+## Python packaging
+
+New upstream versions:
+
+* aiosmtplib
+* bitstruct
+* diff-cover
+* django-q
+* isort
+* multipart
+* poetry ([adding support for Dulwich >= 0.25](https://bugs.debian.org/1127062))
+* poetry-core
+* pydantic-settings
+* python-build
+* python-certifi
+* python-datamodel-code-generator
+* python-flatdict
+* python-holidays
+* python-maggma
+* python-pytokens
+* python-scruffy
+* python-urllib3 (fixing [CVE-2025-66471](https://bugs.debian.org/1122029) and a [chunked decoding bug](https://bugs.debian.org/1122743))
+* responses
+* yarsync
+* zope.component
+* zope.deferredimport
+
+Porting away from the [deprecated](https://github.com/pypa/setuptools/issues/3085) (and now removed from upstream setuptools) `pkg_resources`:
+
+* [genshi](https://bugs.debian.org/1083413) ([contributed upstream](https://github.com/edgewall/genshi/pull/97))
+* [germinate](https://bugs.debian.org/1083414)
+* [mopidy](https://bugs.debian.org/1083483)
+* [nose2](https://bugs.debian.org/1083509)
+* [pokrok](https://bugs.debian.org/1083553) ([contributed upstream](https://github.com/jdidion/pokrok/pull/5))
+* [pylama](https://bugs.debian.org/1125854)
+* [python-flask-seeder](https://bugs.debian.org/1125850)
+* [python-maggma](https://bugs.debian.org/1125819) ([contributed upstream](https://github.com/materialsproject/maggma/pull/1067))
+* [python-pybadges](https://bugs.debian.org/1125851)
+* [python-scruffy](https://bugs.debian.org/1083705) ([contributed upstream](https://github.com/snare/scruffy/pull/33))
+* [thumbor](https://bugs.debian.org/1125840) ([contributed upstream](https://github.com/thumbor/thumbor/pull/1789))
+* [zope.deprecation](https://bugs.debian.org/1084009) ([contributed upstream](https://github.com/zopefoundation/zope.deprecation/pull/27) a while ago, but there hasn't been an upstream release yet)
+
+Other build/test failures:
+
+* [flask-dance: FTBFS: No module named 'pkg\_resources'](https://bugs.debian.org/1129112) (actually fixed by adding a missing dependency to python3-sphinxcontrib.seqdiag)
+* [paramiko: autopkgtest regression on i386](https://bugs.debian.org/1127663) ([contributed upstream](https://github.com/paramiko/paramiko/pull/2577))
+* [poetry: autopkgtest regression on i386](https://bugs.debian.org/1128776)
+* [python-argh](https://bugs.debian.org/1123190)
+* [python-django-celery-beat: FTBFS: FAILED t/unit/test\_models.py::HumanReadableTestCase::test\_long\_name](https://bugs.debian.org/1127525)
+* [python-maturin: rust-itertools update](https://bugs.debian.org/1126157)
+* [python-msrest: FTBFS: FAILED tests/asynctests/test\_async\_client.py::TestServiceClient::test\_client\_send](https://bugs.debian.org/1127528) ([contributed upstream](https://github.com/Azure/msrest-for-python/pull/268), though not very successfully)
+* [python-typing-inspect](https://bugs.debian.org/1123326)
+
+Other bugs:
+
+* [python-datamodel-code-generator: Depends: python3-isort (< 8) but 8.0.0-1 is to be installed](https://bugs.debian.org/1129211) ([contributed upstream](https://github.com/koxudaxi/datamodel-code-generator/pull/3011))
+* [python-typeguard: Mark python3-typeguard Multi-Arch: foreign](https://bugs.debian.org/1125025)
+* [wheel: Mark python3-wheel Multi-Arch: foreign](https://bugs.debian.org/1124771)
+* [zope.deferredimport: Please make the build reproducible](https://bugs.debian.org/1123664) ([contributed upstream](https://github.com/zopefoundation/zope.deferredimport/pull/19), with a [follow-up fix](https://github.com/zopefoundation/zope.deferredimport/pull/22))
+
+I added a [manual page symlink](https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/83) to make the documentation for `Testsuite: autopkgtest-pkg-pybuild` easier to find.
+
+I backported python-pytest-unmagic and a more recent version of pytest-django to trixie.
+
+## Rust packaging
+
+* [librust-pyo3-ffi-dev: Cannot be installed for foreign architectures](https://bugs.debian.org/1124553)
+
+I also packaged rust-garde and rust-garde-derive, which are part of the pile of work needed to get the ruff packaging back in shape (which is a project I haven't decided if I'm going to take on for real, but I thought I'd at least chip away at a bit of it).
+
+## Other bits and pieces
+
+* [arch-test: Remove build dependency on binutils-mips64el-linux-gnuabi64](https://bugs.debian.org/1126132) (NMU)
+
+## Code reviews
+
+* [debconf: Add BMP version of debian-logo](https://salsa.debian.org/pkg-debconf/debconf/-/merge_requests/23) (merged and uploaded)
+* [openssh: Reorder pam\_selinux(7) usage](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/20) (merged and uploaded)
+* [openssh-client: use sysusers.d, drop superflous dependencies](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/37) (merged and uploaded)
+* [openssh: Stop deleting system user on remove/purge](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/38) (merged and uploaded)
+* [openssh: Do not link against libcrypt on GNU/Hurd](https://bugs.debian.org/1128399) (merged and uploaded)
+* [partman-prep: Align PReP descriptions with other partition types](https://salsa.debian.org/installer-team/partman-prep/-/merge_requests/2) (merged)
+* [python-better-exceptions](https://bugs.debian.org/1124754) (sponsored upload for Seyed Mohamad Amin Modaresi)
~cjwatson / blog.git / commitdiff