From: Colin Watson Date: Sun, 4 May 2025 15:43:31 +0000 (+0100) Subject: Free software activity in April 2025 X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~cjwatson/git?a=commitdiff_plain;h=c5527cae19d576d8239a171bc597da9bd27d1544;p=blog.git Free software activity in April 2025 --- diff --git a/content/activity-2025-04.md b/content/activity-2025-04.md new file mode 100644 index 00000000..d0985beb --- /dev/null +++ b/content/activity-2025-04.md @@ -0,0 +1,211 @@ +Title: Free software activity in April 2025 +Slug: activity-2025-04 +Date: 2025-05-04 16:38:13 +01:00 +Category: columbiform +Tags: activity, columbiform, freexian, man-db, openssh, planet-debian, planet-ubuntu +Summary: OpenSSH 10.0 (and a request for help), dput-ng, and more. +Mastodon-ID: 114450324476636098 + +About 90% of my Debian contributions this month were +[sponsored](https://www.freexian.com/about/debian-contributions/) by +Freexian. + +You can also support my work directly via +[Liberapay](https://liberapay.com/cjwatson). + +## Request for OpenSSH debugging help + +Following the OpenSSH work described below, I have an [open +report](https://bugs.debian.org/1103418) about the `sshd` server sometimes +crashing when clients try to connect to it. I can't reproduce this myself, +and arm's-length debugging is very difficult, but three different users have +reported it. For the time being I can't pass it upstream, as it's entirely +possible it's due to a Debian patch. + +Is there anyone reading this who can reproduce this bug and is capable of +doing some independent debugging work, most likely involving bisecting +changes to OpenSSH? I'd suggest first seeing whether a build of the +unmodified upstream 10.0p2 release exhibits the same bug. If it does, then +bisect between 9.9p2 and 10.0p2; if not, then bisect the list of Debian +patches. This would be extremely helpful, since at the moment it's a bit +like trying to look for a needle in a haystack from the next field over by +sending instructions to somebody with a magnifying glass. + +## OpenSSH + +I upgraded the Debian packaging to [OpenSSH +10.0p1](https://www.openssh.com/releasenotes.html#10.0p2) (now [designated +10.0p2](https://lists.mindrot.org/pipermail/openssh-unix-announce/2025-April/000163.html) +by upstream due to a mistake in the release process, but they're the same +thing), fixing [CVE-2025-32728](https://bugs.debian.org/1102603). This also +involved a [diffoscope bug report](https://bugs.debian.org/1102658) due to +the version number change. + +I enabled the new `--with-linux-memlock-onfault` configure option to protect +`sshd` against being swapped out, but this turned out to cause test failures +on riscv64, so I disabled it again there. Debugging this took some time +since I needed to do it under emulation, and in the process of setting up a +testbed I [added riscv64 support to +vmdb2](https://gitlab.com/larswirzenius/vmdb2/-/merge_requests/154). + +In [coordination](https://bugs.debian.org/1102643) with the wtmpdb +maintainer, I enabled the new Y2038-safe native wtmpdb support in OpenSSH, +so `wtmpdb last` now reports the correct tty. + +I fixed a couple of packaging bugs: + +* [Please stop writing /var/log/btmp](https://bugs.debian.org/1072184) +* [Restore sshd\_config(5) documentation about + rdomain](https://bugs.debian.org/1095686) + +I reviewed and merged several packaging contributions from others: + +* [ssh-agent: Improve systemd user service socket + activation](https://bugs.debian.org/1103037) (Daniel Kahn Gillmor) +* [Switch from adduser to + sysusers.d](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/30) + (Luca Boccassi) +* [Add sshd-keygen + service](https://salsa.debian.org/ssh-team/openssh/-/merge_requests/31) + (Luca Boccassi) + +## dput-ng + +Since we [added `dput-ng` integration to +Debusine](https://salsa.debian.org/freexian-team/debusine/-/issues/713) +recently, I wanted to make sure that it was in good condition in trixie, so +I fixed [dput-ng: will FTBFS during trixie support +period](https://bugs.debian.org/1078613). Previously a similar bug had been +fixed by just using different Ubuntu release names in tests; this time I +made the tests independent of the current supported release data returned by +`distro_info`, so this shouldn't come up again. + +We also ran into [dput-ng: --override doesn't override profile +parameters](https://bugs.debian.org/983160), which needed somewhat more +extensive changes since it turned out that that option had never worked. I +fixed this after some discussion with Paul Tagliamonte to make sure I +understood the background properly. + +## man-db + +I released [man-db +2.13.1](https://gitlab.com/man-db/man-db/-/releases/2.13.1). This just +included various small fixes and a number of translation updates, but I +wanted to get it into trixie in order to include a contribution to [increase +the `MAX_NAME` constant](https://gitlab.com/man-db/man-db/-/issues/48), +since that was now causing problems for some pathological cases of manual +pages in the wild that documented a very large number of terms. + +## debmirror + +I fixed one security bug: [debmirror prints credentials with +--progress](https://bugs.debian.org/1104091). + +## Python team + +I upgraded these packages to new upstream versions: + +* celery +* django-modeltranslation (maintained by Freexian) +* django-phonenumber-field +* djangorestframework +* kombu +* orderly-set +* pox +* pydantic-extra-types +* [python-cmarkgfm](https://bugs.debian.org/1072833) (fixing + [CVE-2022-39209](https://security-tracker.debian.org/tracker/CVE-2022-39209), + [CVE-2023-22483](https://security-tracker.debian.org/tracker/CVE-2023-22483), + [CVE-2023-22484](https://security-tracker.debian.org/tracker/CVE-2023-22484), + [CVE-2023-22485](https://security-tracker.debian.org/tracker/CVE-2023-22485), + [CVE-2023-22486](https://security-tracker.debian.org/tracker/CVE-2023-22486), + [CVE-2023-24824](https://security-tracker.debian.org/tracker/CVE-2023-24824), + [CVE-2023-26485](https://security-tracker.debian.org/tracker/CVE-2023-26485), + and + [CVE-2023-37463](https://security-tracker.debian.org/tracker/CVE-2023-37463)) +* python-django-crispy-forms +* python-django-extensions (fixing incompatibilities with Python 3.12: + [#1040091](https://bugs.debian.org/1040091), + [#1040119](https://bugs.debian.org/1040119)) +* python-django-pgtrigger +* python-django-test-migrations +* python-holidays +* python-legacy-cgi +* python-pydash +* python-redis (4.3.4 to 5.2.1; needed some autopkgtest adjustments) +* python-tblib +* python-typing-extensions +* trove-classifiers +* xonsh + +In bookworm-backports, I updated these packages: + +* python-django to 3:4.2.20-1 (issuing + [BSA-123](https://backports.debian.org/news/BSA-123_Security_Update_for_python-django/)) +* python-django-pgtrigger to 4.13.3 + +I dropped a stale build-dependency from +[python-aiohttp-security](https://bugs.debian.org/1102526) that kept it out +of testing (though unfortunately too late for the trixie freeze). + +I fixed or helped to fix various other build/test failures: + +* [bleak-retry-connector](https://bugs.debian.org/1102380) +* [billiard](https://bugs.debian.org/1101621) ([contributed + upstream](https://github.com/celery/billiard/pull/423)) +* [cairosvg](https://bugs.debian.org/1103184) +* [errbot](https://bugs.debian.org/1103066) ([contributed + upstream](https://github.com/errbotio/errbot/pull/1724)) +* [haversine](https://bugs.debian.org/1103116) +* [json-tricks](https://bugs.debian.org/1104240) +* [jsonpickle](https://bugs.debian.org/1103146) ([contributed + upstream](https://github.com/jsonpickle/jsonpickle/pull/560)) +* [lazygal](https://salsa.debian.org/python-team/packages/lazygal/-/commit/ea71ae96f4a48dd390f0e2b514234ce864ba430f) +* [mypy](https://bugs.debian.org/1101856) +* [pydantic](https://bugs.debian.org/1102283) +* [pydantic-core](https://bugs.debian.org/1101417) +* [pydantic-settings](https://bugs.debian.org/1101859) +* [pympress](https://bugs.debian.org/1103197) ([contributed + upstream](https://github.com/Cimbali/pympress/pull/333)) +* [pysequoia](https://bugs.debian.org/1101861) +* [pysodium](https://bugs.debian.org/1103103) ([contributed + upstream](https://github.com/stef/pysodium/pull/117)) +* [python-decorator](https://salsa.debian.org/python-team/packages/python-decorator/-/commit/e9d3b610e7cc7e3766ea0be2b21b3489dc11d9d9) +* [python-djvulibre](https://bugs.debian.org/1103593) ([contributed + upstream](https://github.com/FriedrichFroebel/python-djvulibre/pull/25)) +* [python-msgspec](https://bugs.debian.org/1103362) +* [python-momepy](https://bugs.debian.org/1103140) ([contributed + upstream](https://github.com/pysal/momepy/pull/698)) +* [python-tz](https://bugs.debian.org/1103581) +* [storm](https://bugs.debian.org/1103501) +* [supysonic](https://bugs.debian.org/1103208) +* [uvloop](https://bugs.debian.org/1101258) ([contributed + upstream](https://github.com/MagicStack/uvloop/pull/662)) + +I packaged [python-typing-inspection](https://bugs.debian.org/1102391), +needed for a new upstream version of pydantic. + +I +[documented](https://salsa.debian.org/python-team/tools/dh-python/-/merge_requests/57) +the `architecture` field in `debian/tests/autopkgtest-pkg-pybuild.conf` +files. + +I fixed other odds and ends of bugs: + +* [python-pydash: please make the build + reproducible](https://bugs.debian.org/1087330) +* [thunarx-python: fails to allow plugins to + run](https://bugs.debian.org/1092859) / [thunarx-python: fails to discover + SONAME of libpython, tries to load + /usr/lib/MULTIARCH/lib.so.1.0](https://bugs.debian.org/1103704) +* [ttconv: package installs superfluous files under + /usr/lib/python3/dist-packages](https://bugs.debian.org/1086561) + +## Science team + +I fixed various build/test failures: + +* [python-vispy](https://bugs.debian.org/1102477) (also fixing [unhandled + failures to build documentation can + occur](https://bugs.debian.org/1064607) while I was there) +* [skimage](https://bugs.debian.org/1103004) diff --git a/posted_on_Mastodon.txt b/posted_on_Mastodon.txt index 5ed3d713..717dd771 100644 --- a/posted_on_Mastodon.txt +++ b/posted_on_Mastodon.txt @@ -12,6 +12,7 @@ activity-2024-12.html activity-2025-01.html activity-2025-02.html activity-2025-03.html +activity-2025-04.html apt-resolver-bugs.html automatic-installability-checking.html binfmt-support-2.2.0.html