From: Colin Watson Date: Sun, 2 Mar 2025 13:53:32 +0000 (+0000) Subject: Free software activity in February 2025 X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~cjwatson/git?a=commitdiff_plain;h=d18f0e95d2dbb2d2daef2b1df97acb9bfe462db1;p=blog.git Free software activity in February 2025 --- diff --git a/content/activity-2025-02.md b/content/activity-2025-02.md new file mode 100644 index 00000000..f1f871b3 --- /dev/null +++ b/content/activity-2025-02.md @@ -0,0 +1,218 @@ +Title: Free software activity in February 2025 +Slug: activity-2025-02 +Date: 2025-03-02 13:49:47 +00:00 +Category: columbiform +Tags: activity, columbiform, freexian, planet-debian, planet-ubuntu +Summary: OpenSSH security fixes; Python team upstream reporting. +Mastodon-ID: 114093163952364984 + +Most of my Debian contributions this month were +[sponsored](https://www.freexian.com/about/debian-contributions/) by +Freexian. + +You can also support my work directly via +[Liberapay](https://liberapay.com/cjwatson). + +## OpenSSH + +OpenSSH upstream released +[9.9p2](https://www.openssh.com/releasenotes.html#9.9p2) with fixes for +CVE-2025-26465 and CVE-2025-26466. I got a heads-up on this in advance from +the Debian security team, and prepared updates for all of testing/unstable, +bookworm (Debian 12), bullseye (Debian 11), buster (Debian 10, LTS), and +stretch (Debian 9, ELTS). jessie (Debian 8) is also still in ELTS for a few +more months, but wasn't affected by either vulnerability. + +Although I'm not particularly active in the Perl team, I fixed a +[libnet-ssleay-perl build failure](https://bugs.debian.org/1096245) because +it was blocking openssl from migrating to testing, which in turn was +blocking the above openssh fixes. + +I also sent a minor [`sshd -T` +fix](https://bugzilla.mindrot.org/show_bug.cgi?id=3788) upstream, simplified +a number of autopkgtests using the newish [`Restrictions: +needs-sudo`](https://bugs.debian.org/906424) facility, and prepared for +[removing the obsolete `slogin` symlink](https://bugs.debian.org/1098760). + +## PuTTY + +I upgraded to the [new upstream version +0.83](https://www.chiark.greenend.org.uk/~sgtatham/putty/). + +## GCC 15 build failures + +I fixed build failures with [GCC +15](https://gcc.gnu.org/gcc-15/porting_to.html) in a few packages: + +* [icoutils](https://bugs.debian.org/1096829) ([contributed + upstream](https://savannah.nongnu.org/bugs/index.php?66812)) +* [kali](https://bugs.debian.org/1096891) +* [parted](https://bugs.debian.org/1097550) +* [python-setproctitle](https://bugs.debian.org/1097681) +* [vigor](https://bugs.debian.org/1098064) + +## Python team + +A lot of my Python team work is driven by its [maintainer +dashboard](https://udd.debian.org/dmd/?email1=team%2Bpython%40tracker.debian.org&nosponsor1=on&email2=&email3=&packages=&ignpackages=&format=html&onlytesting=on). +Now that we've finished the transition to Python 3.13 as the default +version, and inspired by a recent [debian-devel thread started by +Santiago](https://lists.debian.org/debian-devel/2025/02/msg00134.html), I +thought it might be worth spending a bit of time on the "uscan error" +section. [`uscan`](https://wiki.debian.org/debian/watch) is typically +scraping upstream web sites to figure out whether new versions are +available, and so it's easy for its configuration to become outdated or +broken. Most of this work is pretty boring, but it can often reveal +situations where we didn't even realize that a Debian package was out of +date. I fixed these packages: + +* cssutils (this in particular was very out of date due to a new and active + upstream maintainer since 2021) +* django-assets +* django-celery-email +* django-sass +* django-yarnpkg +* json-tricks +* mercurial-extension-utils +* pydbus +* pydispatcher +* pylint-celery +* pyspread +* pytest-pretty +* python-apptools +* python-django-libsass ([contributed a packaging fix + upstream](https://github.com/torchbox/django-libsass/pull/59) in passing) +* python-django-postgres-extra +* python-django-waffle +* python-ephemeral-port-reserve +* python-ifaddr +* python-log-symbols +* python-msrest +* python-msrestazure +* python-netdisco +* python-pathtools +* python-user-agents +* sinntp +* wchartype + +I upgraded these packages to new upstream versions: + +* cssutils ([contributed a packaging tweak + upstream](https://github.com/jaraco/cssutils/pull/62)) +* django-iconify +* django-sass +* domdf-python-tools +* extra-data (fixing a [numpy 2.0 failure](https://bugs.debian.org/1095343)) +* flufl.i18n +* json-tricks +* jsonpickle +* mercurial-extension-utils +* mod-wsgi +* nbconvert +* orderly-set +* pydispatcher ([contributed a Python 3.12 fix + upstream](https://github.com/mcfletch/pydispatcher/pull/9)) +* pylint +* pytest-rerunfailures +* python-asyncssh +* python-box ([contributed a packaging fix + upstream](https://github.com/cdgriffith/Box/pull/290)) +* python-charset-normalizer +* python-django-constance +* python-django-guid +* python-django-pgtrigger +* python-django-waffle +* python-djangorestframework-simplejwt +* python-formencode +* python-holidays ([contributed a test fix + upstream](https://github.com/vacanza/holidays/pull/2273)) +* python-legacy-cgi +* python-marshmallow-polyfield (fixing a [test + failure](https://bugs.debian.org/1098600)) +* python-model-bakery +* python-mrcz (fixing a [numpy 2.0 + failure](https://bugs.debian.org/1095373)) +* python-netdisco +* python-npe2 +* python-persistent +* python-pkginfo (fixing a [test failure](https://bugs.debian.org/1098603)) +* python-proto-plus +* python-requests-ntlm +* python-roman +* python-semantic-release +* python-setproctitle +* python-stdlib-list +* python-trustme +* python-typeguard (fixing a [test + failure](https://bugs.debian.org/1098615)) +* python-tzlocal +* pyzmq +* setuptools-scm +* sqlfluff +* stravalib +* tomopy +* trove-classifiers +* xhtml2pdf (fixing [CVE-2024-25885](https://bugs.debian.org/1084986)) +* xonsh +* zodbpickle +* zope.deprecation +* zope.testrunner + +In bookworm-backports, I updated python-django to 3:4.2.18-1 (issuing +[BSA-121](https://backports.debian.org/news/BSA-121_Security_Update_for_python-django/)) +and added new backports of python-django-dynamic-fixture and +python-django-pgtrigger, all of which are dependencies of +[debusine](https://freexian-team.pages.debian.net/debusine/). + +I went through all the build failures related to python-click 8.2.0 (which +was confusingly [tagged but not fully released +upstream](https://github.com/pallets/click/pull/2844) and posted an +[analysis](https://bugs.debian.org/1098507#17). + +I fixed or helped to fix various other build/test failures: + +* [cython](https://bugs.debian.org/1095084) +* [dask](https://bugs.debian.org/1095019) +* [deepdish](https://bugs.debian.org/1095339) +* [hickle](https://bugs.debian.org/1094905) ([contributed + upstream](https://github.com/telegraphic/hickle/pull/186)) +* [mdp](https://bugs.debian.org/1095356) ([contributed + upstream](https://github.com/mdp-toolkit/mdp-toolkit/pull/105)) +* [mypy](https://bugs.debian.org/1098578) +* [pillow](https://bugs.debian.org/1094040) +* [pynput](https://bugs.debian.org/1098590) +* [python-fonticon-fontawesome6](https://bugs.debian.org/1094085) +* [python-persistent](https://bugs.debian.org/1098602) ([contributed + upstream](https://github.com/zopefoundation/persistent/pull/214)) +* [python-srsly](https://bugs.debian.org/1056874) + +I [dropped support for the old `setup.py ftest` +command](https://github.com/zopefoundation/zope.testrunner/pull/192) from +zope.testrunner upstream. + +I fixed various odds and ends of bugs: + +* [django-memoize: autopkgtest must be marked + superficial](https://bugs.debian.org/974455) +* [extra-data: extra-data: please add autopkgtests (to add coverage for + python3-numpy)](https://bugs.debian.org/1035135) +* [fpylll: missing dependency on numpy abi](https://bugs.debian.org/1094910) +* [python-box: autopkgtest must be marked + superficial](https://bugs.debian.org/974492) +* [python-hdmedians: missing dependency on numpy + abi](https://bugs.debian.org/1095284) +* [python-legacy-cgi: missing requirement: + openstack-pkg-tools](https://bugs.debian.org/1094317) +* [python-tzlocal: doesn't run any tests during the build or as + autopkgtest](https://bugs.debian.org/1063372) +* [requests: will FTBFS during trixie support + period](https://bugs.debian.org/1091503) ([contributed supporting fix + upstream](https://github.com/psf/requests/pull/6897)) +* [setuptools-scm: project was renamed from `setuptools_scm` to + `setuptools-scm`](https://bugs.debian.org/1096004) + +## Installer team + +Following up on [last month]({filename}/activity-2025-01.md), I merged and +uploaded [Helmut's `/usr`-move +fix](https://salsa.debian.org/installer-team/debian-installer-utils/-/merge_requests/11). diff --git a/posted_on_Mastodon.txt b/posted_on_Mastodon.txt index e6a6d0c4..68e798ef 100644 --- a/posted_on_Mastodon.txt +++ b/posted_on_Mastodon.txt @@ -10,6 +10,7 @@ activity-2024-10.html activity-2024-11.html activity-2024-12.html activity-2025-01.html +activity-2025-02.html apt-resolver-bugs.html automatic-installability-checking.html binfmt-support-2.2.0.html