Planet-Debian on Freexian

Debian Contributions: Go default compatibility, Trimming build-essential, Python upstream engagement and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Mon, 15 Jun 2026 00:00:00 +0000

Debian Contributions: 2026-05

Contributing to Debian is part of Freexian’s mission. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our Long Term Support contracts and consulting services.

Go default compatibility, by Helmut Grohne

At the MiniDebConf Hamburg, Andrew Lee had prepared a talk on how Debian accidentally chooses Go compatibility. Helmut joined Tobias Quathammer and Andrew Lee in looking into the problem. Go has a compatibility system where modules declare a desired Go version to be compatible with. This influences various features such as whether RSA keys smaller than 1024 bits are accepted. Unfortunately, Debian’s way of building Go packages is unique in setting GO111MODULE=off, which practically implies a very old compatibility version that enables a number of insecure settings. Most Linux distributions use the default GO111MODULE=on and therefore consult a go.mod file that often declares a sensible version. While doing so is the way for Debian longer term, getting there involves major changes so we also sought a more short term workaround. We developed a patch to the Go compiler that would enable it to pick up a compatibility version from the environment. Tobias uploaded it to unstable. The next step is communicating the declared compatibility version from go.mod to the compiler via the new variable. Then, rebuilding the archive resolves the immediate symptoms. This does not save us from having to perform the larger transition to GO111MODULE=on, but this shortcut can be backported to trixie.

Trimming build-essential, by Helmut Grohne

One of the harder problems of the architecture cross bootstrap is correctly expressing the Build-Depends of glib during the toolchain bootstrap. It implicitly depends on build-essential, which happens to depend on libc6-dev. This poses a cycle. It applies even for cross building, because it is interpreted for the host architecture and that there is no way of satisfying this dependency during the toolchain bootstrap.

Given discussions at MiniDebConf Hamburg with Jochen Sprickerhof and others, a seemingly stupid idea evolved: Let’s delete build-essential. What looks insane on the surface might deserve a second look. Given how we moved away from C, C++ and autotools, what is in build-essential no longer is required by much of the archive. With the rise of debputy, debian/rules no longer has to be a makefile. While the task would be huge, those packages relevant to architecture bootstrap could explicitly support building without the implied dependency making their dependencies explicit. In a number of cases, this amounts to issuing a dependency on g++-for-host. This dependency requires the use of architecture-prefixed tools. Therefore, Helmut wrote a debhelper change that makes it always pass build tools to various build systems. This also enables more packages to honour environment variables such as CC and CXX.

Python upstream engagement, by Stefano Rivera

Stefano attended PyCon US (at personal expense) to improve upstream relations and ensure Debian’s voice is heard where it needs to be. On Friday there was a packaging summit (notes) with good discussion on the future of the wheel format, and some discussion of the new abi3t shared library format for free-threaded python.

In preparation for the event, Stefano did a complete review of the current patch stack.

Stefano’s primary goal was to get some of Debian’s patches merged during the sprints, and results were mixed. Some trivial patches (e.g. GH-150098, made progress and merged, but the most consequential patch Debian is carrying is still blocked. Stefano will continue to try to drive progress on this.

Miscellaneous contributions

Carles worked on po-debconf-manager: Reviewed Catalan translations for 6 packages, submitted 10 packages to maintainers, and removed 3 packages from po-debconf-manager.
Carles worked on check-relations: Continued improving the backend, including importing source package build dependencies to better support analysis of Debian blends. Added support for ignoring packages using regular expressions and source package names in response to user feedback. Used the tool to report 5 new bugs and followed up on previously reported issues.
Helmut sent a cross build patch on behalf of a customer.
Helmut uploaded debvm and guess_concurrency both featuring improved reproducibility and documentation.
Helmut continued maintaining rebootstrap and made it correctly handle binNMUs of gcc-defaults. Additionally, he poked at existing gcc patches giving answers, rebasing or closing them.
Helmut supported the video team in Hamburg mixing audio.
Helmut continued to report undeclared file conflicts of various kinds and corresponded with maintainers about them.
Antonio attended a debate during the Brazil Internet Forum about the impacts of the child protection regulation (ECA Digital) on free software operating systems.
Antonio worked on Debian CI to improve the system transparency for users. This included listing any pending jobs explicitly in the job lists for each package/architecture/suite page, as well as adding a queue status page that users can check for an estimate of test latency.
Antonio worked on several Debian CI maintenance tasks, including but not limited to some monitoring improvements, replacing usage of fonts-font-awesome with fonts-fork-awesome, and adding the ability in debci to configure a global notice (which is being used in Debian CI to point to the system status pages).
Antonio started doing some tests related to the change of default Debian CI backend from lxc to incus-lxc. This helped identify an omission in the creation of incus-lxc images. It was missing dpkg-dev, which caused a few packages that assumed its presence to fail. In the end, the incus-lxc backend will be fixed to include dpkg-dev by default in the image, but that uncovered an undeclared dependency in gem2deb (Ruby packaging helper) and in ruby-byebug, both already fixed in unstable.
Stefano did some minimal work on debian-reimbursements to get it working with current versions of django-allauth.
May included the discovery of several high-severity Linux kernel root exploits. Stefano updated kernels and rebooted debian.social infrastructure several times.
Stefano supported the Hamburg miniDebConf’s wafer website during the event, and set up an instance for the 2027 edition too.
Stefano supported the bursary team issuing bursaries for DebConf 26.
Stefano uploaded routine updates of python-pip, pystemmer, snowball-data, snowball (making up a mini, uncoordinated snowball transition), python-authlib, python-discovery, python-installer, python-mitogen, python-pipx, python-cachecontrol, platformdirs, and python-virtualenv.
Stefano fixed a small number of bugs in dh-python, culminating in the 7.20260524 upload.
Thorsten finally managed to upload a new upstream version of hplip. He also uploaded a new upstream version of epson-inkjet-printer-escpr. Last but not least with the help of other contributors he could fix bugs in lprng.
Lucas and Santiago contributed significantly to the DebConf 26 Content team; helping to organize the team, review and rate talk proposals.
Lucas also supported a packaging sprint held in India by rebuilding and publishing the latest results of the Ruby 3.4 transition effort.
Santiago continued contributing to the efforts to organize DebConf 26, especially supporting the local team with different tasks.
In collaboration with Emmanuel Arias, Santiago is mentoring Aryan Karamtoth, a GSoC participant that is working to introduce linux live-patching support in Debian. The GSoC project started in May, with community bonding and coding. Santiago reviewed a merge request to prepare the clang-extract package for debian. clang-extract is one of the building blocks that will help to extract specific functions from large C code, so only relevant code can be patched, without recompiling the whole original basecode.
Anupa assisted Jean-Pierre Giraud with the point release announcements for Debian 13.5 and Debian 12.14.
Colin backported various security fixes from OpenSSH 10.3 to all supported releases (including LTS and ELTS).
Colin backported IP quality-of-service fixes to OpenSSH in trixie. The situation there had been unsatisfactory for some time, and upstream reworked their QoS support in OpenSSH 10.1 in a way that typically produces much better results.
Colin imported new upstream versions of 26 Python packages, and fixed around 25 RC bugs for the Python team.

Debian Contributions: Detecting undeclared file conflicts, contributors.debian.org mini-sprint, security-tracker performance and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Fri, 15 May 2026 00:00:00 +0000

Debian Contributions: 2026-04

Undeclared file conflicts, by Helmut Grohne

The duplication checker, the Multi-Arch hinter, and the /usr-move analyzer share significant parts of their code. While the /usr-move transition is complete, the other tools needed a bit of love. Helmut added Python type annotations, slightly improved the performance of the duplication website and shared more code between these tools.

Building upon this Helmut looked into file conflicts of various kinds such as unrelated packages installing overlapping files, file type conflicts, mismatching directory metadata and shared files of Multi-Arch: same packages with varying content. Implementing reliable detection proved to be difficult due to the amount of corner cases. So Helmut semi-manually filed bugs. In that process, it became apparent that binNMUs do not reproduce SOURCE_DATE_EPOCH across architectures and therefore some shared files embedding the build date would vary in content. Additionally, a significant number of reports required further correspondence.

contributors.debian.org mini-sprint, by Enrico Zini

Enrico Zini met with Mattia Rizzolo to continue the work started at DebConf 25 on crediting contributions done via salsa, and to catch up with accumulated site issues.

Building on the same kind of infrastructure used to notify tag2upload, salsa.debian.org triggers a webping on pushes and merge request activity, which causes a small JSON payload to be queued in a private directory on contributors.debian.org.

We worked on processing, filtering and aggregating the files in the queue into a private, staging database table. When configuring a data source on the site, it is now possible to configure automated submission of contributions from information in the staging table. This makes it significantly simpler to credit contributors for all teams that use Salsa as their code repository and coordination tool, as the site can take care of the data mining for you.

See more details in the sprint report posted to debian-devel-announce.

MiniDebConf Campinas, by Lucas Kanashiro, Santiago Ruano Rincón and Antonio Terceiro

MiniDebConf Campinas was held between April 23rd and 25th, at the State University of Campinas, and was preceded by a MiniDebcamp between April 20th and 22nd. Freexian was Gold sponsor for the event, and Freexian collaborators were active contributors to the conference success.

Lucas and Santiago delivered a talk about Debian LTS during MiniDebConf Campinas 2026, where they described how the LTS project benefits Debian users and developers, while strengthening Debian itself.

Lucas and Antonio delivered a talk about internship programs in Debian during MiniDebConf Campinas 2026, with the goal of getting students interested in working in and with Debian.

Lucas took part in the MiniDebConf Campinas content team, reviewing/accepting talks and building the schedule.

Antonio led a session where he invited the audience to weigh in on current controversies in Debian. The session presented playful elements as colored signs to denote agree/disagree, and was not recorded, to help people feel more comfortable about speaking up. He might be convinced to lead a similar session at the next DebConf.

Antonio also organized a debate to discuss the consequences of new Brazilian regulation for the protection of children and adolescents in digital spaces for Debian and other free operating systems, but also for the free software community in general. This session was very fruitful and will lead into further actions, as one of the main outcomes was the realization that the free software community must follow the discussion leading up to similar regulations more closely to avoid being caught by surprise when they come into effect.

security-tracker performance, by Helmut Grohne and Emilio Pozuelo Monfort

Prompted by spontaneous influx of web requests on Freexian’s security-tracker back in February, we considered the options for managing that demand. One of our mitigations was making it faster. To that end, Helmut sent two MRs towards improving the situation. There are four notable improvements. The use of Python’s str.translate generally speeds up rendering of larger templates. Indexing the CVE names avoids a costly sequential table scan. Avoiding FFI calls while sorting and reducing the queryset speeds up the source package view. Emilio reviewed and deployed the changes on to the Debian instance. Together these changes provide a twofold speedup on both Freexian’s and Debian’s instance on average.

dput-ng data loss bug, by Colin Watson

Ian Jackson (not affiliated with Freexian) reported that dput-ng could lose data when using the local install method, which could cause misleading results in tests of other packages; they also filed an initial merge request to fix it. Colin improved this to isolate its tests properly, and uploaded it.

Miscellaneous contributions

Lucas coordinated the src:valkey update to version 9 in unstable with a potential co-maintainer.
Lucas provided a security update for src:valkey targeting “trixie”.
Thorsten did two uploads of foo2zjs, one to fix a bug and one to improve packaging. As there have been several CVEs published for cups he also did an upload of a new upstream version. Unfortunately this introduces a regression and another upload was needed to take care of a crash. The patch for one CVE also broke a test script, which is used by lots of printing packages in Debian. As a result some autopkgtest runs failed. This could be fixed as well and the only remaining issue that needs some more investigation is related to cups-pdf. It is also worth mentioning that some issues related to the apparmor configuration of cups could be resolved.
Helmut sent patches for 11 cross build failures.
Helmut sent a MR for enabling the new mainline YT6801 ethernet Linux driver and it is now working fine with Debian’s 7.x kernels.
Helmut upgraded a crossqa.debian.net autobuilder to “trixie”.
Carles using po-debconf-manager, improved Catalan translations: reviewed 2 packages, submitted 3 packages, deleted 5 packages.
Carles did further code developments for check-relations: steps towards making it production ready when the initial round of reports are analyzed. New “show-package” (information) command, improvements for “report_missing” cases, added support for ignoring packages for specific reasons, added unit tests, added CI. Used it to open 39 new bugs. Also followed up different open bugs
Raphaël completed the French translation of Zulip for the release of version 12.0. Zulip is a nice 100% free software threaded communication platform for distributed teams.
Stefano did routine uploads of python-pipx, python-mitogen, platformdirs, python-authlib, python-discovery, distro-info-data, python-virtualenv, python-certifi, python-wheel, pypy3.
Stefano uploaded distro-info-data updates to stable and oldstable proposed updates, with the latest Ubuntu release.
Stefano took part in DebConf 26 preparation meetings.
Stefano prepared DebConf’s online video streaming infrastructure for MiniDebConf Campinas, and configured the Debian reimbursement system to handle their travel bursary claims.
Stefano helped MiniDebConf Hamburg prepare their website for 2027.
Stefano did some sysadmin work on debian.social infrastructure.
Stefano reviewed Matthias’ python3.15 packaging and rebased his work on top of it.
Antonio implemented several improvements to the Debian CI platform, including but not limited to adding support for dark mode, dropping compatibility with ActiveRecord < 7 which is no longer shipped in Debian stable, and generating content-based links to static assets, in two parts.
Antonio debugged a general slowness in salsa, caused by loss of IPv6 connectivity between the salsa host and the remote object storage in “the cloud”, which is a problem due to an open upstream bug in gitlab.
Santiago reviewed different changes to the Salsa CI pipeline, including the new uscan test job, prepared by Thaís Rebouças Araujo, and the final review to introduce faketime testing, made by Áquila Macedo.
Santiago continued helping the DebConf 26 local team to prepare the conference.
Emilio updated libxpm to address a security issue.
Colin finished upgrading groff to 1.24.1; 1.24.0 and 1.24.1 were the first upstream releases since 2023 and had extensive changes, so this took some time to get right.
Colin released “bookworm” and “trixie” fixes for CVE-2026-3497 in openssh, and issued the corresponding BSA-130 for trixie-backports.
Colin upgraded openssh to 10.3p1.
Anupa worked on the accounting tasks for MiniDebConf Kanpur and prepared and submitted a report to the fiscal host.

Debusine workflow performance issues (by Colin Watson)

Colin Watson — Mon, 11 May 2026 00:00:00 +0000

During March and April, we had a number of performance issues that made Debusine’s core functions of running work requests and reflecting their results in workflows quite unreliable. Investigating and fixing this took up a lot of time from both the Debusine development team and Freexian’s sysadmins.

The central problems involved a series of database concurrency and worker communication issues that interacted in complex ways. On bad days, this caused between 10% and 25% of processed work requests to fail unnecessarily. We communicated some of the problems to users on IRC, but not consistently since we didn’t entirely understand the scope of the problems at the time.

Most of the problems are fixed now, but we had a retrospective meeting to make sure we understood what happened and that we learn from it. Here’s a summary.

Data model

Debusine’s workflows consist of many individual work requests. Each work request has a database row representing its state, which means that the overall state of a workflow is distributed across many rows. Changes to one work request (for example, when it is completed) can cause changes to other work requests (perhaps unblocking it so that it can be scheduled to an idle worker). Those changes may happen concurrently, and in practice often do.

Workers typically need to create artifacts containing the output of tasks: these include things like packages, build logs, and test output.

Debusine records task history so that it can make better decisions about how to schedule work requests. Since this might otherwise grow without bound, the server expires older parts of that history after a while. The same is true for many other kinds of data.

Causes

Because workflows involve changes that propagate between work requests, there were historically some cases where different parts of the system could deadlock due to trying to take update locks on overlapping sets of work request rows in different orders. We mitigated that somewhere around 2025-11-05 by locking entire workflows in one go before making any change that might need to propagate between work requests like this; that dealt with the deadlocks, but it’s quite a heavyweight locking strategy that sometimes caused significant delays.
We’ve been working for some time to make Debusine useful to Debian developers, and regression tracking is an important part of that: it lets developers test uploads without being too badly misled by tests in related packages that were already failing before they started. On 2026-03-11 we enabled this by default on debusine.debian.net, after testing it for a while. Although this is useful, it put more load on the system as a whole, often approximately doubling the number of work requests in a given workflow with many additional dependencies between them.
Like much of the world, we’re in an arms race with unethical scrapers desperately trying to feed everyone else’s data into LLMs before they run out of money. We saw a substantial uptick here towards the end of March, which meant that we had to temporarily disable regression tracking and to put some other mitigations in front of our web interface.
We historically haven’t had systematic internal timeouts. Prompted by ruff, a Google Summer of Code applicant went through and added timeouts in many places, including some calls between the worker and the server. This was fiddly work and the student did a solid job, so I’m not putting them on blast or anything! However, it did mean that some things that came in under load balancer timeouts now timed out earlier on the client side of the request (and hence in Debusine workers), which made some problems show up in different ways and be more obvious. This was deployed on 2026-04-03.

Fixes

Workflow orchestration

Figuring out what individual work requests need to be run as part of a workflow - the process we call “orchestration” - can be challenging. Unlike typical CI pipelines, these workflows often span substantial chunks of a distribution: a glibc update can involve retesting nearly everything! Nevertheless, it’s not particularly helpful for it to take hours just to build the workflow graph.

Fixing this involved many classic database optimizations such as adding indexes and CTEs, but probably the most effective fix was adding a cache for lookups within each orchestrator run or work request. Profiling showed that resolving lookups was a hot spot, and the way that task data is often passed down through a workflow meant that the same lookup could be resolved hundreds or thousands of times in a large workflow.

Expiry

We knew for quite some time that our expiry job took very aggressive locks, effectively blocking most of the rest of the system. This was an early decision to make the expiry logic simpler by allowing it to follow graphs without worrying about concurrent activity, but it clearly couldn’t stay that way forever.

Row locks in PostgreSQL was very helpful in figuring out the correct approach here. Since we’re mainly concerned about the possibility of new foreign key references being created to artifacts we’re considering for expiry, and since that would involve taking FOR KEY SHARE locks on those rows, we can explicitly take FOR UPDATE locks (which conflict with FOR KEY SHARE), and then recompute the set of artifacts to expire with any locked artifacts marked to keep. This was delicate work, but it saved minutes of downtime every day.

Whole-workflow locking

I mentioned earlier that we avoided some deadlock issues by taking locks on entire workflows. To ensure that these locks are effective even against code that isn’t specifically aware of them, this is implemented by using SELECT FOR UPDATE on all the work request rows in the workflow. In some cases the search for which rows to lock itself tripped up the PostgreSQL planner.

Scheduling

We run multiple Celery workers for various purposes. Some of them can do many things in parallel, but in some specific cases (notably the task scheduler) we only ever want a single instance to run at once. Unfortunately a bug in the systemd service meant that the scheduler often ran concurrently anyway! Once we fixed that, the scheduler logs became a lot less confusing.

When Debusine was small, it was reasonable for it to perform scheduling very aggressively, typically as soon as any change occurred to a work request or a worker that might possibly influence it. This doesn’t scale very well, though, and even though we tried to batch multiple scheduling triggers that occurred within a single transaction, it could still make debugging very confusing. We reduced the number of changes that would result in immediate scheduling, and deferred everything else to a regular “tick”.

The scheduler may not be able to assign a work request to an idle worker due to the workflow being locked. That isn’t a major problem in itself; it can just try again later. However, in very large workflows, we found that it often worked its way down all the pending work requests one by one finding that each of them was locked, which was slow and also produced a huge amount of log noise. It now assumes that if a work request is locked, then it might as well skip other work requests in the same workflow until the next scheduler run.

Between them, these changes reduced the number of locks typically being held on debusine.debian.net by about 80%:

Worker refactoring

The Debusine worker has always been partially asynchronous, but while it was actually executing a task - in other words, most of the time, at least in busy periods - it didn’t respond to inbound websocket messages, causing spurious disconnections. We restructured the whole worker to be fully event-based.

We also had to put quite a bit of effort into improving the path by which workers report work request completion, because if that hits a timeout then it can mean throwing away hours of work. We have some further improvements in mind, but for now we defer most of this work to a Celery task so that whole-workflow locks aren’t on the critical path.

Database write volume

One of our sysadmins observed that our database write volume was consistently very high. This was a puzzle, but for a long time we left that unexplored. Eventually we thought to ask PostgreSQL’s own statistics, and we found a surprise:

debusine=> SELECT relname AS table_name,
debusine->        n_tup_ins AS inserts,
debusine->        n_tup_upd AS updates,
debusine->        n_tup_del AS deletes,
debusine->        (n_tup_ins + n_tup_upd + n_tup_del) AS total_dml
debusine-> FROM pg_stat_user_tables
debusine-> WHERE (n_tup_ins + n_tup_upd + n_tup_del) > 0
debusine-> ORDER BY total_dml DESC
debusine-> LIMIT 20;
              table_name              | inserts |  updates   | deletes | total_dml
--------------------------------------+---------+------------+---------+------------
 db_collectionitem                    | 1418251 | 3578202388 | 3630143 | 3583250782
 db_token                             |   15143 |   11212106 |   11389 |   11238638
 db_workrequest                       |  386196 |    6399071 | 1820500 |    8605767
 db_fileinartifact                    | 2783021 |    1837929 | 1663887 |    6284837
 django_celery_results_taskresult     | 1819301 |    1501623 | 1791656 |    5112580
 db_artifact                          |  960077 |    3340859 |  663890 |    4964826
 db_collectionitemmatchconstraint     | 1550457 |          0 | 2207486 |    3757943
 db_artifactrelation                  | 2229382 |          0 | 1363825 |    3593207
 db_fileupload                        | 1023400 |    1057036 | 1023346 |    3103782
 db_file                              | 1673194 |          0 |  970252 |    2643446
 db_fileinstore                       | 1411995 |          0 |  970259 |    2382254
 db_filestore                         |       0 |    2381578 |       0 |    2381578
 django_session                       |  645423 |    1519880 |     531 |    2165834
 db_workrequest_dependencies          |  365877 |          0 |  936537 |    1302414
 db_worker                            |   18317 |     949280 |    9487 |     977084
 db_collection                        |   10061 |         85 |  177741 |     187887
 db_workerpooltaskexecutionstatistics |   28721 |          0 |       0 |      28721
 db_workerpoolstatistics              |    1640 |          0 |       0 |       1640
 db_workflowtemplate                  |     130 |        158 |     649 |        937
 db_identity                          |      76 |        661 |       0 |        737
(20 rows)

Oh my - that’s a lot of db_collectionitem updates and must surely be out of proportion with what we really need. Can we narrow that down by asking about the most recently-updated tuples?

debusine=> SELECT DISTINCT category
debusine-> FROM db_collectionitem
debusine-> WHERE id IN (
debusine->     SELECT id FROM db_collectionitem
debusine->     ORDER BY xmin::text::integer DESC LIMIT 10000
debusine-> );
           category
------------------------------
 debusine:historical-task-run
(1 row)

That might not be absolutely reliable, but it was certainly a hint. As per PostgreSQL’s documentation, by default UPDATE always performs physical updates to every matching row regardless of whether the data has changed, and our code to expire old task history entries wasn’t doing that properly. Once we knew where to look, it was easy to add some extra constraints.

This reduced our mean write volume on debusine.debian.net from about 23 MB/s to about 3 MB/s, which had an immediate knock-on effect on our request failure rate:

Current state

Our metrics indicate that things are a lot better now. We still have a few things to deal with, such as:

Some more performance fixes are on their way to fix some remaining cases where views are very slow or where file uploads from workers fail due to locks.
We have some changes in the works to revamp how work request changes propagate through workflows in a way that doesn’t require so many heavyweight locks.
We have a number of monitoring and alerting improvements we’d like to make, both for outcomes (things like slow Celery tasks) and possible root causes (database performance). We’d also like to deploy some more modern observability tools; hunting for things using journalctl isn’t terrible, but it’s not really the state of the art.
We need to improve how we communicate to users when we’re having operational problems, both informally (IRC, etc.) and on the site.
Retries don’t always behave the way you’d expect in workflows.

I hope this has been an interesting tour through the sorts of things that can go wrong in this kind of distributed system!

Monthly report about Debian Long Term Support, April 2026 (by Thorsten Alteholz)

Thorsten Alteholz — Mon, 11 May 2026 00:00:00 +0000

The Debian LTS Team, funded by Freexian’s Debian LTS offering, is pleased to report its activities for April.

Activity summary

During the month of April, 21 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 37 DLAs fixing 145 CVEs.

The team continued preparing security updates in its usual rhythm. Beyond the updates targeting Debian 11 (“bullseye”), which is the current release under LTS, the team also proposed updates for more recent releases (Debian 12 (“bookworm”) and Debian 13 (“trixie”)), including Debian unstable. We highlight several notable security updates here below.

Andrej Shadura prepared DLA 4525-1 for libyaml-syck-perl to fix a vulnerability related to a memory leak.
Andrej also prepared DLA 4551-1 for mbedtls to fix a leak of secrets.
Arnaud Rebillout prepared DLA 4532-1 for python3.9 to fix a use-after-free issue in several decompressors.
Arnaud also prepared DLA 4533-1 for systemd to fix multiple vulnerabilities, which might be also used to execute arbitrary code.
Bastien Roucariès prepared DLA 4529-1 for bind9 to fix a DNSSEC issues, which can cause the resolver to consume excessive CPU.
Bastien also prepared DLA 4539-1 for imagemagick to fix 21 vulnerabilities.
Emilio Pozuelo Monfort prepared DLA 4535-1 for openssh to fix a potentially execution of arbitrary code.
Emilio also Monfort prepared DLA 4526-1, DLA 4546-1 and DLA 4555-1 for firefox-esr to fix 31 vulnerabilities.
Jochen Sprickerhof prepared DLA 4524-1 for postgresql-13 to fix multiple vulnerabilities, which might be also used to execute arbitrary code.
Sylvain Beucler prepared DLA 4538-1 for perl to fix unauthorized access to data or arbitrary code execution.
Thorsten Alteholz prepared DLA 4545-1 for packagekit to fix a local privilege escalation.
Thorsten also prepared DLA 4544-1 for ntfs-3g to fix a local privilege escalation.
Tobias Frost prepared DLA 4521-1 for libpng1 to fix multiple vulnerabilities, which might be also used to execute arbitrary code.

Contributions from outside the LTS Team:

As usual, the thunderbird updates, released as DLA 4534-1 and DLA 4549-1, were prepared by its maintainer Christoph Goehre. This month 28 CVEs has been fixed. Thanks a lot for his continuous contributions. The DLAs have been sent by Emilio.
Thanks alot as well to Mathias Behrle for providing DLA 4543-1 for package simpleeval. The DLA has been sent by Santiago.

The LTS Team has also contributed with updates to the latest Debian releases:

Andreas Henriksson completed the upload of gvfs for trixie and bookworm
Ben Hutchings did uploads of several kernel packages to unstable and the corresponding backports repositories.
Sylvain took care of uploads of awstats to trixie and bookworm. He also did the same for 7zip-rar with an upload to bookworm-backports).

Some milestones in the lifecycle of two Debian releases are just around the corner. The support of Debian 12 will be handed over to the LTS team on June 11th 2026. After August 31st, support for Debian 11 will move from Debian LTS to ELTS managed by Freexian.

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 127 months)
- Civil Infrastructure Platform (CIP) (for 95 months)
- VyOS Inc (for 59 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 137 months)
- CONET Deutschland GmbH (for 121 months)
- University of Oxford (for 77 months)
- EDF SA (for 49 months)
- Dataport AöR (for 24 months)
- CERN (for 22 months)
Silver sponsors:
- Domeneshop AS (for 142 months)
- Nantes Métropole (for 136 months)
- Akamai - Linode (for 131 months)
- Univention GmbH (for 128 months)
- Université Jean Monnet de St Etienne (for 128 months)
- Ribbon Communications, Inc. (for 122 months)
- Exonet B.V. (for 111 months)
- Leibniz Rechenzentrum (for 106 months)
- Ministère de l’Europe et des Affaires Étrangères (for 89 months)
- Dinahosting SL (for 77 months)
- Upsun Formerly Platform.sh (for 71 months)
- Moxa Inc. (for 65 months)
- Deveryware (for 64 months)
- sipgate GmbH (for 63 months)
- OVH US LLC (for 61 months)
- Tilburg University (for 61 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 52 months)
- THINline s.r.o. (for 25 months)
- Copenhagen Airports A/S (for 19 months)
- Conseil Départemental de l’Isère (for 5 months)
Bronze sponsors:
- Evolix (for 142 months)
- Seznam.cz, a.s. (for 142 months)
- Intevation GmbH (for 139 months)
- Linuxhotel GmbH (for 139 months)
- Daevel SARL (for 138 months)
- Megaspace Internet Services GmbH (for 137 months)
- Greenbone AG (for 136 months)
- NUMLOG (for 136 months)
- WinGo AG (for 135 months)
- Entr’ouvert (for 126 months)
- Adfinis AG (for 124 months)
- Plat’Home (for 120 months)
- Tesorion (for 119 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 118 months)
- Bearstech (for 110 months)
- LiHAS (for 110 months)
- Catalyst IT Ltd (for 105 months)
- Demarcq SAS (for 99 months)
- Université Grenoble Alpes (for 85 months)
- TouchWeb SAS (for 77 months)
- SPiN AG (for 74 months)
- CoreFiling (for 70 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 61 months)
- Tem Innovations GmbH (for 56 months)
- WordFinder.pro (for 55 months)
- CNRS DT INSU Résif (for 54 months)
- Soliton Systems K.K. (for 49 months)
- Alter Way (for 47 months)
- SOBIS Software GmbH (for 22 months)
- Tuxera Inc. (for 13 months)
- OPM-OP AS (for 5 months)

Monthly report about Debian Long Term Support, March 2026 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Fri, 24 Apr 2026 00:00:00 +0000

The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for March.

Activity summary

During the month of March, 20 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 24 DLAs fixing 250 CVEs.

We also welcomed two new members: Lukas Märdian and Emmanuel Arias to the team, who actually started to contribute to the LTS project several months ago.

ansible (DLA 4502-1), prepared by Lee Garret in collaboration with Jochen, fixing a vulnerability that allows attackers to bypass unsafe content protections
asterisk (DLA 4515-1), prepared by Lukas Märdian, fixing four CVEs that include possible privilege escalations.
gimp (DLA 4500-1), prepared by Thorsten, fixing four CVEs related to denial of service or execution of arbitrary code.
gst-plugins-base1.0 and gst-plugins-ugly1.0 (DLA-4514-1, DLA-4516-1, respectively), both prepared by Utkarsh, addressing vulnerabilities that may yield to arbitrary code execution.
imagemagick, released by Bastien Roucariès (DLA 4497-1) fixing multiple vulnerabilities that could lead to information leaks, bypass of security policies, denial of service or arbitrary code execution.
libpng1.6 (DLA 4521-1), prepared by Tobias Frost, fixing an arbitrary code execution vulnerability
linux: Ben Hutchings released DLA 4498-1 and DLA 4499-1 for linux 5.10 and linux 6.1, respectively. Those updates especially address the “CrackArmor” flaw.
ruby-rack (DLA 4505-1), prepared by Utkarsh Gupta, addressing two vulnerabilities
strongswan (DLA 4512-1), prepared by Thorsten Alteholz, fixing a Denial of Service vulnerability
roundcube (DLA 4517-1) prepared by Guilhem Moulin, who discovered that one of the fixes provided by upstream was incomplete.

Contributions from outside the LTS Team:

As usual, the thunderbird update, released as DLA 4511-1, was prepared by its maintainer Christoph Goehre. Thanks a lot for his continuous contributions.

The LTS Team has also contributed with updates to the latest Debian releases:

Andreas Henriksson completed the uploads of glib2.0 for both trixie and bookworm
Arnaud Rebillout: python-cryptography for trixie
Arnaud and Bastien worked together to prepare a ca-certificates-java release for unstable
Bastien completed the upload of gpsd for trixie that was proposed in January.
Bastien uploaded a regression update of apache2 for trixie
Bastien prepared a zabbix point update for trixie
Bastien in collaboration with Markus released netty updates for trixie and bookworm DSA 6160-1
Daniel Leidert proposed python-tornado releases for both trixie and bookworm.
Daniel also prepared a python-authlib update for trixie
Guilhem prepared a mapserver update for bookworm.
Lucas Kanashiro proposed merge requests to fix three CVEs in erlang for both trixie and bookworm
Sylvain Beucler continued the work to replace p7zip with 7zip in the different supported releases, and proposed a point update for bookworm
Tobias prepared trixie and bookworm security updates, released as DSA-6189-1
Utkarsh prepared trixie and bookworm security update for ruby-rack, released as DSA-6180-1

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 126 months)
- Civil Infrastructure Platform (CIP) (for 94 months)
- VyOS Inc (for 59 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 137 months)
- CONET Deutschland GmbH (for 120 months)
- University of Oxford (for 77 months)
- EDF SA (for 48 months)
- Dataport AöR (for 23 months)
- CERN (for 21 months)
Silver sponsors:
- Domeneshop AS (for 141 months)
- Nantes Métropole (for 135 months)
- Akamai - Linode (for 131 months)
- Univention GmbH (for 127 months)
- Université Jean Monnet de St Etienne (for 127 months)
- Ribbon Communications, Inc. (for 121 months)
- Exonet B.V. (for 111 months)
- Leibniz Rechenzentrum (for 105 months)
- Ministère de l’Europe et des Affaires Étrangères (for 89 months)
- Dinahosting SL (for 76 months)
- Upsun Formerly Platform.sh (for 71 months)
- Moxa Inc. (for 65 months)
- Deveryware (for 64 months)
- sipgate GmbH (for 62 months)
- OVH US LLC (for 60 months)
- Tilburg University (for 60 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 52 months)
- THINline s.r.o. (for 24 months)
- Copenhagen Airports A/S (for 18 months)
- Conseil Départemental de l’Isère (for 4 months)
Bronze sponsors:
- Seznam.cz, a.s. (for 142 months)
- Evolix (for 141 months)
- Linuxhotel GmbH (for 139 months)
- Intevation GmbH (for 138 months)
- Daevel SARL (for 137 months)
- Megaspace Internet Services GmbH (for 136 months)
- Greenbone AG (for 135 months)
- NUMLOG (for 135 months)
- WinGo AG (for 134 months)
- Entr’ouvert (for 126 months)
- Adfinis AG (for 123 months)
- Plat’Home (for 120 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 118 months)
- Tesorion (for 118 months)
- Bearstech (for 110 months)
- LiHAS (for 110 months)
- Catalyst IT Ltd (for 104 months)
- Demarcq SAS (for 98 months)
- Université Grenoble Alpes (for 84 months)
- TouchWeb SAS (for 76 months)
- SPiN AG (for 73 months)
- CoreFiling (for 69 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 61 months)
- Tem Innovations GmbH (for 55 months)
- WordFinder.pro (for 55 months)
- CNRS DT INSU Résif (for 54 months)
- Soliton Systems K.K. (for 49 months)
- Alter Way (for 47 months)
- SOBIS Software GmbH (for 21 months)
- Tuxera Inc. (for 13 months)
- OPM-OP AS (for 4 months)

Debian Contributions: Debusine projects in GSoC, Debian CI updates, Salsa CI maintenance and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Wed, 15 Apr 2026 00:00:00 +0000

Debian Contributions: 2026-03

Debusine projects in Google’s Summer of Code

While Freexian initiated Debusine, and is investing a lot of resources in the project, we manage it as a true free software project that can and should have a broader community.

We always had documentation for new contributors and we aim to be reactive with them when they interact via the issue tracker or via merge requests. We decided to put those intentions under stress tests by proposing five projects for Google’s Summer of Code as part of Debian’s participation in that program.

Given that at least 11 candidates managed to get their merge request accepted in the last 30 days (interacting with the development team is part of the pre-requisites to apply to Google Summer of Code projects these days), the contributing experience must not be too bad. 🙂 If you want to try it out, we maintain a list of “quick fixes” that are accessible to newcomers. And as always, we welcome your feedback!

Debian CI: incus backend and upgrade to Bootstrap 5, by Antonio Terceiro

debci 3.14 was released on March 4th, with a followup 3.14.1 release with regression fixes a few days afterwards. Those releases were followed by new development and maintenance work that will provide extra capabilities and stability to the platform.

This month saw the initial version of an incus backend land in Debian CI. The transition into the new backend will be done carefully so as to not disrupt ‘testing’ migration. Each package will be running jobs with both the current lxc backend and with incus. Packages that have the same result on both backends will be migrated over, and packages that exhibit different results will be investigated further, resulting in bug reports and/or other communication with the maintainers.

On the frontend side, the code has been ported to Bootstrap 5 over from the now ancient Bootstrap 3. This need has been originally reported back in 2024 based on the lack of security support for Bootstrap 3. Beyond improving maintainability, this upgrade also enables support for dark mode in debci, which is still work in progress.

Both updates mentioned in this section will be available in a following debci release.

Salsa CI maintenance by Santiago Ruano Rincón et al.

Santiago reviewed some Salsa CI issues and reviewed associated merge requests. For example, he investigated a regression (#545), introduced by the move to sbuild, on the use of extra repositories configured as “.source” files; and reviewed the MR (!712) that fixes it.

Also, there were conflicts with changes made in debci 3.14 and debci 3.14.1 (those updates are mentioned above), and different people have contributed to fix the subsequent issues, in a long-term way. This includes Raphaël who proposed MR !707 and who also suggested Antonio to merge the Salsa CI patches to avoid similar errors in the future. This happened shortly after. Those fixes finally required the unrelated MR !709, which will prevent similar problems when building images.

To identify bugs related to the autopkgtest support in the backport suites as early as possible, Santiago proposed MR !708.

Finally, Santiago, in collaboration with Emmanuel Arias also had exchanges with GSoC candidates for the Salsa CI project, including the contributions they have made as merge requests. It is important to note that there are several very good candidates interested in participating. Thanks a lot to them for their work so far!

Miscellaneous contributions

Raphaël reported a zim bug affecting Debian Unstable users, which was already fixed in git apparently. He could thus cherry-pick the fix and update the package in Debian Unstable.
Carles created a new page on the InstallingDebianOn in Debian Wiki.
Carles submitted translation errors in the debian-installer Weblate.
Carles, using po-debconf-manager, improved Catalan translations: reviewed and submitted 3 packages. Also improved error handling when forking or submitting an MR if the fork already existed.
Carles kept improving check-relations: code base related general improvements (added strict typing, enabled pre-commit). Also added DebPorts support, virtual packages support and added commands for reporting missing relations and importing bugs from bugs.debian.org.
Antonio handled miscellaneous Salsa support requests.
Antonio improved the management of MiniDebConf websites by keeping all non-secret settings in git and fixed exporting these sites as static HTML.
Stefano uploaded routine updates to hatchling, python-mitogen, python-virtualenv, python-discovery, dh-python, pypy3, python-pipx, and git-filter-repo.
Faidon uploaded routine updates to crun, libmaxminddb, librdkafka, lowdown, platformdirs, python-discovery, sphinx-argparse-cli, tox, tox-uv.
Stefano and Santiago continued to help with DebConf 26 preparations.
Stefano reviewed some contributions to debian-reimbursements and handled admin for reimbursements.debian.net.
Stefano attended the Debian Technical Committee meeting.
Helmut sent 8 patches for cross build failures.
Building on the work of postmarketOS, Helmut managed to cross build systemd for musl in rebootstrap and sent several patches in the process.
Helmut reviewed several MRs of Johannes Schauer Marin Rodrigues expanding support for DPKG_ROOT to support installing hurd.
Helmut incorporated a final round of feedback for the Multi-Arch documentation in Debian policy, which finally made it into unstable together with documentation of Build-Profiles.
In order to fix python-memray, Helmut NMUed libunwind generally disabling C++ exception support as being an incompatible duplication of the gcc implementation. Unfortunately, that ended up breaking suricata on riscv64. After another NMU, python-memray finally migrated.
Thorsten uploaded new upstream versions of epson-inkjet-printer-escpr and sane-airscan. He also fixed a packaging bug in printer-driver-oki. As of systemd 260.1-1 the configuration of lpadmin has been added to the sysusers.d configuration. All printing packages can now simply depend on the systemd-sysusers package and don’t have to take care of its creation in maintainer scripts anymore.
In collaboration with Emmanuel Arias, Santiago had exchanges with GSoC candidates and reviewed the proposals of the Linux livepatching GSoC 2026 project.
Colin helped to fix CVE-2026-3497 in openssh and CVE-2026-28356 in multipart.
Colin upgraded tango and pytango to new upstream releases and packaged pybind11-stubgen (needed for pytango), thanks to a Freexian customer. Tests of reproducible builds revealed that pybind11-stubgen didn’t generate imports in a stable order; this is now fixed upstream.
Lucas fixed CVE-2025-67733 and CVE-2026-21863 affecting src:valkey in unstable and testing. Also reviewed the same fixes targeting stable proposed by Peter Wienemann.
Faidon worked with upstream and build-dep Debian maintainers on resolving blockers in order to bring pyHanko into Debian, starting with the adoption of python-pyhanko-certvalidator. pyHanko is a suite for signing and stamping PDF files, and one of the few libraries that can be leveraged to sign PDFs with eIDAS Qualified Electronic Signatures.
Anupa co-organized MiniDebConf Kanpur and attended the event with many others from all across India. She handled the accommodation arrangements along with the registration team members, worked on the budget and expenses. She was also a speaker at the event.
Lucas helped with content review/schedule for the MiniDebConf Campinas. Thanks Freexian for being a Gold sponsor!
Lucas organized and took part in a one-day in-person sprint to work on Ruby 3.4 transition. It was held in a coworking space in Brasilia - Brazil on April 6th. There were 5 DDs and they fixed multiple packages FTBFSing against Ruby 3.4 (coming to unstable soon hopefully). Lucas has been postponing a blog post about this sprint since then :-)

Monthly report about Debian Long Term Support, February 2026 (by Thorsten Alteholz)

Thorsten Alteholz — Mon, 16 Mar 2026 00:00:00 +0000

The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for February.

Activity summary

During the month of February, 20 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 35 DLAs fixing 527 CVEs.

We also welcomed Arnaud Rebillout to the team and had to say farewell to Roberto, who left the team after more than nine years as part of it.

Notable security updates:

Guilhem Moulin prepared DLA 4492-1 for gnutls28 to fix vulnerabilities which may lead to Denial of Service.
Utkarsh Gupta prepared DLA 4464-1 for xrdp, to fix a a vulnerability that could allow remote attackers to execute arbitrary code on the target system.
Emilio Pozuelo Monfort prepared DLA-4465-1 to replace ClamAV 1.0 with ClamAV 1.4. This latter is the current LTS version supported by upstream.
Markus Koschany prepared DLA 4468-1 for tomcat9, to fix a vulnerability that can be used to bypass security constraints.
Santiago Ruano Rincón prepared DLA 4471-1 to update package debian-security-support, the Debian security coverage checker.
Bastien Roucariès prepared DLA 4473-1 for zabbix, to fix a potential remote code execution vulnerability.
Paride Legovini prepared DLA 4478-1 for tcpflow, to fix a vulnerability that might result in DoS and potentially code execution.
Thorsten Alteholz prepared DLA 4477-1 for munge, to fix a vulnerability which may allow local users to leak the MUNGE cryptographic key and forge arbitrary credentials.
Ben Hutchings prepared DLA 4475-1 and DLA 4476-1 for Linux kernel updates.
Chris Lamb prepared DLA 4482-1 for ceph, to fix SSL certificate checking in the Python bindings.
Andreas Henriksson prepared DLA 4491-1 to fix vulnerabilities in glib2.0, which could result in denial of service, memory corruption or potentially arbitrary code execution.

Contributions from outside the LTS Team:

The update of nova was prepared by the maintainer, Thomas Goirand. The corresponding DLA 4486-1 was published by Carlos Henrique Lima Melara.
The updates of thunderbird were prepared by the maintainer Christoph Goehre. The corresponding DLA 4466-1 and DLA 4495-1 was published by Emilio Pozuelo Monfort.

The LTS Team has also contributed with updates to the latest Debian releases:

Jochen prepared a point update of wireshark for bookworm (#1127945).
Jochen prepared point updates of erlang for trixie (#1127606) and bookworm (#1127607).
Bastien helped preparing DSA 6160-1 for netty and uploaded a fixed package to unstable.
Bastien prepared a point update of zabbix for trixie (#1127437).
Tobias prepared a point update of modsecurity-crs for bookworm (#1128655).
Tobias prepared a point update of busybox for bookworm (#1129503).
Tobias helped preparing DSA 6138-1 for libpng1.6.
Daniel prepared point updates of python-authlib for trixie (#1129477) and bookworm (#1129246).
Ben uploaded several Linux kernel packages to trixie-backports and bookworm-backports.
Ben prepared point updates of wireless-regdb for trixie and bookworm.

Other than the work related to updates, Sylvain made several improvements to the documentation and tooling used by the team.

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 125 months)
- Civil Infrastructure Platform (CIP) (for 93 months)
- VyOS Inc (for 57 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 135 months)
- CONET Deutschland GmbH (for 119 months)
- Plat’Home (for 118 months)
- University of Oxford (for 75 months)
- EDF SA (for 47 months)
- Dataport AöR (for 22 months)
- CERN (for 20 months)
Silver sponsors:
- Domeneshop AS (for 140 months)
- Nantes Métropole (for 134 months)
- Akamai - Linode (for 129 months)
- Univention GmbH (for 126 months)
- Université Jean Monnet de St Etienne (for 126 months)
- Ribbon Communications, Inc. (for 120 months)
- Exonet B.V. (for 110 months)
- Leibniz Rechenzentrum (for 104 months)
- Ministère de l’Europe et des Affaires Étrangères (for 88 months)
- Dinahosting SL (for 75 months)
- Upsun Formerly Platform.sh (for 69 months)
- Moxa Inc. (for 63 months)
- Deveryware (for 62 months)
- sipgate GmbH (for 61 months)
- OVH US LLC (for 59 months)
- Tilburg University (for 59 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 50 months)
- THINline s.r.o. (for 23 months)
- Copenhagen Airports A/S (for 17 months)
- Conseil Départemental de l’Isère (for 3 months)
Bronze sponsors:
- Evolix (for 140 months)
- Seznam.cz, a.s. (for 140 months)
- Intevation GmbH (for 137 months)
- Linuxhotel GmbH (for 137 months)
- Daevel SARL (for 136 months)
- Megaspace Internet Services GmbH (for 135 months)
- Greenbone AG (for 134 months)
- NUMLOG (for 134 months)
- WinGo AG (for 133 months)
- Entr’ouvert (for 125 months)
- Adfinis AG (for 122 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 117 months)
- Tesorion (for 117 months)
- Bearstech (for 108 months)
- LiHAS (for 108 months)
- Catalyst IT Ltd (for 103 months)
- Demarcq SAS (for 97 months)
- Université Grenoble Alpes (for 83 months)
- TouchWeb SAS (for 75 months)
- SPiN AG (for 72 months)
- CoreFiling (for 68 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 59 months)
- Tem Innovations GmbH (for 54 months)
- WordFinder.pro (for 53 months)
- CNRS DT INSU Résif (for 52 months)
- Soliton Systems K.K. (for 47 months)
- Alter Way (for 45 months)
- Institut Camille Jordan (for 35 months)
- SOBIS Software GmbH (for 20 months)
- Tuxera Inc. (for 11 months)
- OPM-OP AS (for 3 months)

Regression Tracking in Debusine (by Stefano Rivera)

Stefano Rivera — Mon, 16 Mar 2026 00:00:00 +0000

Regression Tracking

Debusine is a tool designed for Debian developers and Operating System developers in general. Debusine can run QA pipelines to check that Debian packages are ready to upload. This blog post describes the regression tracking mechanism that’s recently become available in Debusine QA pipelines.

The debian_pipeline workflow in Debusine can build, test, and upload a package to the Debian archive (or any other repository, such as a native Debusine APT repository). The QA tests involve running the standard Debian QA utilities (lintian, autopkgtest, piuparts, blhc) on the built artifacts. In addition we can run the autopkgtests of every other package in the archive that depends on the built package, like britney does for testing migration in Debian. Some of these other packages may have currently-failing autopkgtests that have nothing to do with the changes in the upload under test.

For example:

Figuring out which of these failures are new (and thus worth investigating) has been a manual process in Debusine until now. We have just completed the basic functionality of the regression_tracking=true feature, and have enabled it in the upload-to-* workflows on debusine.debian.net.

With this enabled, you’ll get a new QA tab on your debian_pipeline workflows that shows the trend of each test:

This is determined by looking at recent task history for each task in the debian:qa-results collection. If there is no recent result for a given <package, version, architecture>, then tasks are queued under the “reference tests” qa workflow tree on the pipeline.

These reference tests are run by using the same tasks as the main qa workflow, but without the addition of the package under test. In fact, it uses the same qa workflow that we use to check the package, but with a few different parameters to populate the regression tracking results collection.

The debian:qa-results collection used for analyzing regressions is specified to the debian_pipeline with the regression_tracking_qa_results lookup parameter. On debusine.debian.net we have configured a debian:qa-results collection for sid that can be referenced and added to by tasks in any workspace.

Regressions can be more subtle than a simple Success → Failure. If the number of autopkgtests that fail increases, or the number of lintian tags emitted increases, those are also considered a regressions.

Using regression tracking now

It’s enabled by default on most of the upload-to-* workflows on debusine.debian.net. To disable, pass -O debusine_workflow_data.enable_regression_tracking=false when you dput an upload to debusine.

To use the regression-tracking in your own workflows, use a debian_pipeline workflow that is configured with enable_regression_tracking=true. This will require a qa_suite to be specified, pointing to the baseline suite.

We hope this will make it easier to check QA results for packages tested on debusine.debian.net.

Debian Contributions: Opening DebConf 26 Registration, Debian CI improvements and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 10 Mar 2026 00:00:00 +0000

Debian Contributions: 2026-02

DebConf 26 Registration, by Stefano Rivera, Antonio Terceiro, and Santiago Ruano Rincón

DebConf 26, to be held in Santa Fe Argentina in July, has opened for registration and event proposals. Stefano, Antonio, and Santiago all contributed to making this happen.

As always, some changes needed to be made to the registration system. Bigger changes were planned, but we ran out of time to implement them for DebConf 26. All 3 of us have had experience in hosting local DebConf events in the past and have been advising the DebConf 26 local team.

Debian CI improvements, by Antonio Terceiro

Debian CI is the platform responsible for automated testing of packages from the Debian archive, and its results are used by the Debian Release team automation as Quality Assurance to control the migration of packages from Debian unstable into testing, the base for the next Debian release. Antonio started developing an incus backend, and that prompted two rounds of improvements to the platform, including but not limited to allowing user to select a job execution backend (lxc, qemu) during the job submission, reducing the part of testbed image creation that requires superuser privileges and other refactorings and bug fixes. The platform API was also improved to reduce disruption when reporting results to the Release Team automation after service downtimes. Last, but not least, the platform now has support for testing packages against variants of autopkgtest, which will allow the Debian CI team to test new versions of autopkgtest before making releases to avoid widespread regressions.

Miscellaneous contributions

Carles improved po-debconf-manager while users requested features / found bugs. Improvements done - add packages from “unstable” instead of just salsa.debian.org, upgrade and merge templates of upgraded packages, finished adding typing annotations, improved deleting packages: support multiple line texts, add –debug to see “subprocess.run” commands, etc.
Carles, using po-debconf-manager, reviewed 7 Catalan translations and sent bug reports or MRs for 11 packages. Also reviewed the translations of fortunes-debian-hints and submitted possible changes in the hints.
Carles submitted MRs for reportbug (reportbug --ui gtk detecting the wrong dependencies), devscript (delete unused code from debrebuild and add recommended dependency), wcurl (format –help for 80 columns). Carles submitted a bug report for apt not showing the long descriptions of packages.
Carles resumed effort for checking relations (e.g. Recommends / Suggests) between Debian packages. A new codebase (still in early stages) was started with a new approach in order to detect, report and track the broken relations.
Emilio drove several transitions, most notably the haskell transition and the glibc/gcc-15/zlib transition for the s390 31-bit removal. This last one included reviewing and requeueing lots of autopkgtests due to britney losing a lot of results.
Emilio reviewed and uploaded poppler updates to experimental for a new transition.
Emilio reviewed, merged and deployed some performance improvements proposed for the security-tracker.
Stefano prepared routine updates for pycparser, python-confuse, python-cffi, python-mitogen, python-pip, wheel, platformdirs, python-authlib, and python-virtualenv.
Stefano updated Python 3.13 and 3.14 to the latest point releases, including security updates, and did some preliminary work for Python 3.15.
Stefano reviewed changes to dh-python and merged MRs.
Stefano did some debian.social sysadmin work, bridging additional IRC channels to Matrix.
Stefano and Antonio, as DebConf Committee Members, reviewed the DebConf 27 bids and took part in selecting the Japanese bid to host DebConf 27.
Helmut sent patches for 29 cross build failures.
Helmut continued to maintain rebootstrap addressing issues relating to specific architectures (such as musl-linux-any, hurd-any or s390x) or specific packages (such as binutils, brotli or fontconfig).
Helmut worked on diagnosing bugs such as rocblas #1126608, python-memray #1126944 upstream and greetd #1129070 with varying success.
Antonio provided support for multiple MiniDebConfs whose websites run wafer + wafer-debconf (the same stack as DebConf itself).
Antonio fixed the salsa tagpending webhook.
Antonio sent specinfra upstream a patch to fix detection of Debian systems in some situations.
Santiago reviewed some Merge Requests for the Salsa CI pipeline, including !703 and !704, that aim to improve how the build source job is handled by Salsa CI. Thanks a lot to Jochen for his work on this.
In collaboration with Emmanuel Arias, Santiago proposed a couple of projects for the Google Summer of Code (GSoC) 2026 round. Santiago has been reviewing applications and giving feedback to candidates.
Thorsten uploaded new upstream versions of ipp-usb, brlaser and gutenprint.
Raphaël updated publican to fix an old bug that became release critical and that happened only when building with the nocheck profile. Publican is a build dependency of the Debian’s Administrator Handbook and with that fix, the package is back into testing.
Raphaël implemented a small feature in Debusine that makes it possible to refer to a collection in a parent workspace even if a collection with the same name is present in the current workspace.
Lucas updated the current status of ruby packages affecting the Ruby 3.4 transition after a bunch of updates made by team members. He will follow up on this next month.
Lucas joined the Debian orga team for GSoC this year and tried to reach out to potential mentors.
Lucas did some content work for MiniDebConf Campinas - Brazil.
Colin published minor security updates to “bookworm” and “trixie” for CVE-2025-61984 and CVE-2025-61985 in OpenSSH, both of which allowed code execution via ProxyCommand in some cases. The “trixie” update also included a fix for mishandling of PerSourceMaxStartups.
Colin spotted and fixed a typo in the bug tracking system’s spam-handling rules, which in combination with a devscripts regression caused bts forwarded commands to be discarded.
Colin ported 12 more Python packages away from using the deprecated (and now removed upstream) pkg_resources module.
Anupa is co-organizing MiniDebConf Kanpur with Debian India team. Anupa was responsible for preparing the schedule, publishing it on the website, co-ordination with the fiscal host in addition to attending meetings.
Anupa attended the Debian Publicity team online sprint which was a skill sharing session.

Monthly report about Debian Long Term Support, January 2026 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Tue, 17 Feb 2026 00:00:00 +0000

The Debian LTS Team, funded by Freexian’s Debian LTS offering, is pleased to report its activities for January.

Activity summary

During the month of January, 20 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 33 DLAs fixing 216 CVEs.

Notable security updates:

python3.9, prepared by Andrej Shadura (DLA-4455-1), fixing multiple vulnerabilities in the Python interpreter.
php, prepared by Guilhem Moulin (DLA-4447-1), fixing two vulnerabilities that could yield to request forgery or denial of service.
apache2, prepared by Bastien Roucariès DLA-4452-1, fixing four CVEs.
linux-6.1, prepared by Ben Hutchings (DLA-4436-1), as a regular update of the linux 6.1 backport to Debian 11.
python-django, prepared by Chris Lamb (DLA-4458-1), resolving multiple vulnerabilities.
firefox-esr prepared by Emilio Pozuelo Monfort (DLA-4439-1)
gnupg2, prepared by Roberto Sánchez (DLA-4437-1), fixing multiple issues, including CVE-2025-68973 that could potentially be exploited to execute arbitrary code.
apache-log4j2, prepared by Markus Koschany (DLA-4444-1)
ceph, prepared by Utkarsh Gupta (DLA-4460-1)
inetutils, prepared by Andreas Henriksson (DLA-4453-1), fixing an authentication bypass in telnetd.

Moreover, Sylvain Beucler studied the security support status of p7zip, a fork of 7zip that has become unmaintained upstream. To avoid letting the users continue using an unsupported package, Sylvain has investigated a path forward in collaboration with the security team and the 7zip maintainer, looking to replace p7zip with 7zip. It is to note however that 7zip developers don’t reveal the information about the patches that fix CVEs, making it difficult to backport single patches to fix vulnerabilities in Debian released versions.

Contributions from outside the LTS Team:

Thunderbird, prepared by maintainer Christoph Goehre. The DLA (DLA-4442-1) was published by Emilio.

The LTS Team has also contributed with updates to the latest Debian releases:

Bastien uploaded gpsd to unstable, and proposed updates for trixie #1126121 and bookworm #1126168 to fix two CVEs.
Bastien also prepared the imagemagick updates for trixie and bookworm, released as DSA-6111-1, along with the bullseye update DLA-4448-1.
Chris proposed a trixie point update for python-django (#112646), and the work for bookworm was completed in February (#1079454). The longstanding bookworm update required tracking down a regression in the django-storages packages.
Markus prepared tomcat10 updates for trixie and bookworm (DSA-6120-1), and tomcat11 for trixie (DSA-6121-1)
Thorsten Alteholz prepared bookworm point updates for zvbi (#1126167) to fix five CVEs; taglib (#1126273) to fix one CVE; and libuev (#1126370) to fix one CVE.
Utkarsh prepared an unstable update of node-lodash to fix one CVE.

Other than the work related to updates, Sylvain made several improvements to the documentation and tooling used by the team.

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 124 months)
- Civil Infrastructure Platform (CIP) (for 92 months)
- VyOS Inc (for 56 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 134 months)
- CONET Deutschland GmbH (for 118 months)
- Plat’Home (for 117 months)
- University of Oxford (for 74 months)
- EDF SA (for 46 months)
- Dataport AöR (for 21 months)
- CERN (for 19 months)
Silver sponsors:
- Domeneshop AS (for 139 months)
- Nantes Métropole (for 133 months)
- Akamai - Linode (for 129 months)
- Univention GmbH (for 125 months)
- Université Jean Monnet de St Etienne (for 125 months)
- Ribbon Communications, Inc. (for 119 months)
- Exonet B.V. (for 109 months)
- Leibniz Rechenzentrum (for 103 months)
- Ministère de l’Europe et des Affaires Étrangères (for 87 months)
- Dinahosting SL (for 74 months)
- Upsun Formerly Platform.sh (for 68 months)
- Deveryware (for 62 months)
- Moxa Inc. (for 62 months)
- sipgate GmbH (for 60 months)
- OVH US LLC (for 58 months)
- Tilburg University (for 58 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 49 months)
- THINline s.r.o. (for 22 months)
- Copenhagen Airports A/S (for 16 months)
- Conseil Départemental de l’Isère
Bronze sponsors:
- Seznam.cz, a.s. (for 140 months)
- Evolix (for 139 months)
- Linuxhotel GmbH (for 137 months)
- Intevation GmbH (for 136 months)
- Daevel SARL (for 135 months)
- Megaspace Internet Services GmbH (for 134 months)
- Greenbone AG (for 133 months)
- NUMLOG (for 133 months)
- WinGo AG (for 132 months)
- Entr’ouvert (for 124 months)
- Adfinis AG (for 121 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 116 months)
- Tesorion (for 116 months)
- Bearstech (for 107 months)
- LiHAS (for 107 months)
- Catalyst IT Ltd (for 102 months)
- Demarcq SAS (for 96 months)
- Université Grenoble Alpes (for 82 months)
- TouchWeb SAS (for 74 months)
- SPiN AG (for 71 months)
- CoreFiling (for 67 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 58 months)
- Tem Innovations GmbH (for 53 months)
- WordFinder.pro (for 53 months)
- CNRS DT INSU Résif (for 51 months)
- Soliton Systems K.K. (for 47 months)
- Alter Way (for 44 months)
- Institut Camille Jordan (for 34 months)
- SOBIS Software GmbH (for 19 months)
- Tuxera Inc. (for 10 months)
- OPM-OP AS

Debian Contributions: cross building, rebootstrap updates, Refresh of the patch tagging guidelines and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Thu, 12 Feb 2026 00:00:00 +0000

Debian Contributions: 2026-01

cross building, by Helmut Grohne

In version 1.10.1, Meson merged a patch to make it call the correct g-ir-scanner by default thanks to Eli Schwarz. This problem affected more than 130 source packages. Helmut retried building them all and filed 69 patches as a result. A significant portion of those packages require another Meson change to call the correct vapigen. Another notable change is converting gnu-efi to multiarch, which ended up requiring changes to a number of other packages. Since Aurelien dropped the libcrypt-dev dependency from libc6-dev, this transition now is mostly complete and has resulted in most of the Perl ecosystem correctly expressing perl-xs-dev dependencies needed for cross building. It is these infrastructure changes affecting several client packages that this work targets. As a result of this continued work, about 66% of Debian’s source packages now have satisfiable cross Build-Depends in unstable and about 10000 (55%) actually can be cross built. There are now more than 500 open bug reports affecting more than 2000 packages most of which carry patches.

rebootstrap, by Helmut Grohne

Maintaining architecture cross-bootstrap requires continued effort for adapting to archive changes such as glib2.0 dropping a build profile or an e2fsprogs FTBFS. Beyond those generic problems, architecture-specific problems with e.g. musl-linux-any or sparc may arise. While all these changes move things forward on the surface, the bootstrap tooling has become a growing pile of patches. Helmut managed to upstream two changes to glibc for reducing its Build-Depends in the stage2 build profile and thanks Aurelien Jarno.

Refresh of the patch tagging guidelines, by Raphaël Hertzog

Debian Enhancement Proposal #3 (DEP-3) is named “Patch Tagging Guidelines” and standardizes meta-information that Debian contributors can put in patches included in Debian source packages. With the feedback received over the years, and with the change in the package management landscape, the need to refresh those guidelines became evident. As the initial driver of that DEP, I spent a good day reviewing all the feedback (that I kept in a folder) and producing a new version of the document. The changes aim to give more weight to the syntax that is compatible with git format-patch’s output, and also to clarify the expected uses and meanings of a couple of fields, including some algorithm that parsers should follow to define the state of the patch. After the announcement of the new draft on debian-devel, the revised DEP-3 received a significant number of comments that I still have to process.

Miscellaneous contributions

Helmut uploaded debvm making it work with unstable as a target distribution again.
Helmut modernized the code base backing dedup.debian.net significantly expanding the support for type checking.
Helmut fixed the multiarch hinter once more given feedback from Fabian Grünbichler.
Helmut worked on migrating the rocblas package to forky.
Raphaël fixed RC bug #1111812 in publican and did some maintenance for tracker.debian.org.
Carles added support in the festival Debian package for systemd socket activation and systemd service and socket units. Adapted the patch for upstream and created a merge request (also fixed a MacOS X building system error while working on it). Updated Orca Wiki documentation regarding festival. Discussed a 2007 bug/feature in festival which allowed having a local shell and that the new systemd socket activation has the same code path.
Carles using po-debconf-manager worked on Catalan translations: 7 reviewed and sent; 5 follow ups, 5 deleted packages.
Carles made some po-debconf-manager changes: now it attaches the translation file on follow ups, fixed bullseye compatibility issues.
Carles reviewed a new Catalan apt translation.
Carles investigated and reported a lxhotkey bug and sent a patch for the “abcde” package.
Carles made minor updates for Debian Wiki for different pages (lxde for dead keys, Ripping with abcde troubleshooting, VirtualBox troubleshooting).
Stefano renamed build-details.json in Python 3.14 to fix multiarch coinstallability.
Stefano audited the tooling and ignore lists for checking the contents of the python3.X-minimal packages, finding and fixing some issues in the process.
Stefano made a few uploads of python3-defaults and dh-python in support of Python 3.14-as-default in Ubuntu. Also investigated the risk of ignoring byte-compilation failures by default, and started down the road of implementing this.
Stefano did some sysadmin work on debian.social infrastructure.
Stefano and Santiago worked on preparations for DebConf 26. Especially to help the local team on opening the registration, and reviewing the budget to be presented for approval.
Stefano uploaded routine updates of python-virtualenv and python-flexmock.
Antonio collaborated with DSA on enabling a new proxy for salsa to prevent scrapers from taking the service down.
Antonio did miscellaneous salsa administrative tasks.
Antonio fixed a few Ruby packages towards the Ruby 3.4 transition.
Antonio started work on planned improvements to the DebConf registration system.
Santiago prepared unstable updates for the latest upstream versions of knot-dns and knot-resolver. The authoritative DNS server and DNS resolver software developed by CZ.NIC. It is worth highlighting that, given the separation of functionality compared to other implementations, knot-dns and knot-resolver are also less complex software, which results in advantages in terms of security: only three CVEs have been reported for knot-dns since 2011).
Santiago made some routine reviews of merge requests proposed for the Salsa CI’s pipeline. E.g. a proposal to fix how sbuild chooses the chroot when building a package for experimental.
Colin fixed lots of Python packages to handle Python 3.14 and to avoid using the deprecated pkg_resources module.
Colin added forky support to the images used in Salsa CI pipelines.
Colin began working on getting a release candidate of groff 1.24.0 (the first upstream release since mid-2023, so a very large set of changes) into experimental.
Lucas kept working on the preparation for Ruby 3.4 transition. Some packages fixed (support build against Ruby 3.3 and 3.4): ruby-rbpdf, jekyll, origami-pdf, ruby-kdl, ruby-twitter, ruby-twitter-text, ruby-globalid.
Lucas supported some potential mentors in the Google Summer of Code 26 program to submit their projects.
Anupa worked on the point release announcements for Debian 12.13 and 13.3 from the Debian publicity team side.
Anupa attended the publicity team meeting to discuss the team activities and to plan an online sprint in February.
Anupa attended meetings with the Debian India team to plan and coordinate the MinDebConf Kanpur and sent out related Micronews.
Emilio coordinated various transitions and helped get rid of llvm-toolchain-17 from sid.

Writing a new worker task for Debusine (by Carles Pina i Estany)

Carles Pina i Estany — Tue, 10 Feb 2026 00:00:00 +0000

Debusine is a tool designed for Debian developers and Operating System developers in general. You can try out Debusine on debusine.debian.net, and follow its development on salsa.debian.org.

This post describes how to write a new worker task for Debusine. It can be used to add tasks to a self-hosted Debusine instance, or to submit to the Debusine project new tasks to add new capabilities to Debusine.

Tasks are Debusine’s unit of work, and the lower-level pieces of Debusine workflows. Examples of tasks are Sbuild, Lintian, Debdiff (see the available tasks).

This post will document the steps to write a new basic worker task. The example will add a worker task that runs reprotest and creates an artifact of the new type ReprotestArtifact with the reprotest log.

Tasks are usually used by workflows. Workflows solve high-level goals by creating and orchestrating different tasks (e.g. a Sbuild workflow would create different Sbuild tasks, one for each architecture).

Overview of tasks

A task usually does the following:

It receives structured data defining its input artifacts and configuration
Input artifacts are downloaded
A process is run by the worker (e.g. lintian, debdiff, etc.). In this blog post, it will run reprotest
The output (files, logs, exit code, etc.) is analyzed, artifacts and relations might be generated, and the work request is marked as completed, either with Success or Failure

If you want to follow the tutorial and add the Reprotest task, your Debusine development instance should have at least one worker, one user, a debusine client set up, and permissions for the client to create tasks. All of this can be setup following the steps in the Contribute section of the documentation.

This blog post shows a functional Reprotest task. This task is not currently part of Debusine. The Reprotest task implementation is simplified (no error handling, unit tests, specific view, docs, some shortcuts in the environment preparation, etc.). At some point, in Debusine, we might add a debrebuild task which is based on buildinfo files and uses snapshot.debian.org to recreate the binary packages.

Defining the inputs of the task

The input of the reprotest task will be a source artifact (a Debian source package). We model the input with pydantic in debusine/tasks/models.py:

class ReprotestData(BaseTaskDataWithExecutor):
    """Data for Reprotest task."""

    source_artifact: LookupSingle

The ReprotestData is what the user will input. A LookupSingle is a lookup that resolves to a single artifact.

We would also have configuration for the desired variations to test, but we have left that out of this example for simplicity. Configuring variations is left as an exercise for the reader.

Since ReprotestData is a subclass of BaseTaskDataWithExecutor it also contains environment where the user can specify in which environment the task will run. The environment is an artifact with a Debian image.

Add the new `Reprotest` artifact data class

In order for the reprotest task to create a new Artifact of the type DebianReprotest with the log and output metadata: add the new category to ArtifactCategory in debusine/artifacts/models.py:

    REPROTEST = "debian:reprotest"

In the same file add the DebianReprotest class:

class DebianReprotest(ArtifactData):
    """Data for debian:reprotest artifacts."""

    reproducible: bool | None = None

    def get_label(self) -> str:
        """Return a short human-readable label for the artifact."""
        return "reprotest analysis"

It could also include the package name or version.

In the same file, map the REPROTEST category to its data model:

#: Index ArtifactData model classes by category
ARTIFACT_DATA_MODELS_BY_CATEGORY: dict[ArtifactCategory, type[ArtifactData]] = {
    …
    ArtifactCategory.REPROTEST: DebianReprotest,
}

(DebianReprotest must be defined above the ARTIFACT_DATA_MODELS_BY_CATEGORY dictionary)

In order to have the category listed in the work request output artifacts table, edit the file debusine/db/models/artifacts.py: In ARTIFACT_CATEGORY_ICON_NAMES add ArtifactCategory.REPROTEST: "folder", and in ARTIFACT_CATEGORY_SHORT_NAMES add ArtifactCategory.REPROTEST: "reprotest",.

Create the new Task class

In debusine/tasks/ create a new file reprotest.py.

reprotest.py

# Copyright © The Debusine Developers
# See the AUTHORS file at the top-level directory of this distribution
#
# This file is part of Debusine. It is subject to the license terms
# in the LICENSE file found in the top-level directory of this
# distribution. No part of Debusine, including this file, may be copied,
# modified, propagated, or distributed except according to the terms
# contained in the LICENSE file.

"""Task to use reprotest in debusine."""

from pathlib import Path
from typing import Any, override

from debusine import utils
from debusine.artifacts.local_artifact import ReprotestArtifact
from debusine.artifacts.models import (
    ArtifactCategory,
    DebianSourcePackage,
    DebianUpload,
    WorkRequestResults,
    get_source_package_name,
    get_source_package_version,
)
from debusine.client.models import RelationType
from debusine.tasks import BaseTaskWithExecutor, RunCommandTask, inputs
from debusine.tasks.inputs import Stage
from debusine.tasks.models import (
    BaseDynamicTaskDataWithExecutor,
    ReprotestData,
)


class Reprotest(
    RunCommandTask[ReprotestData, BaseDynamicTaskDataWithExecutor],
    BaseTaskWithExecutor[ReprotestData, BaseDynamicTaskDataWithExecutor],
):
    """Task to use reprotest in debusine."""

    TASK_VERSION = 1

    CAPTURE_OUTPUT_FILENAME = "reprotest.log"

    # Resolve environment from task data
    environment = inputs.EnvironmentInput(stage=Stage.PENDING)

    # Resolve source_artifact from task data into a specific artifact
    source_artifact = inputs.SingleInput(
        field="source_artifact",
        categories=(
            ArtifactCategory.SOURCE_PACKAGE,
            ArtifactCategory.UPLOAD,
        ),
        stage=Stage.PENDING,
    )

    def __init__(
        self,
        task_data: dict[str, Any],
        dynamic_task_data: dict[str, Any] | None = None,
    ) -> None:
        """Initialize object."""
        super().__init__(task_data, dynamic_task_data)

        self._reprotest_target: Path | None = None

    @override
    def get_subject(self) -> str | None:
        """Return the subject used to look up task configuration."""
        assert isinstance(
            self.source_artifact.data, (DebianSourcePackage, DebianUpload)
        )
        return get_source_package_name(self.source_artifact.data)

    def compute_dynamic_data(self) -> BaseDynamicTaskDataWithExecutor:
        """Compute and return BaseDynamicTaskData."""
        source_artifact = self.source_artifact
        assert isinstance(
            source_artifact.data, (DebianSourcePackage, DebianUpload)
        )
        package_name = get_source_package_name(source_artifact.data)
        version = get_source_package_version(source_artifact.data)

        return BaseDynamicTaskDataWithExecutor(
            environment_id=self.environment.artifact_id,
            subject=self.get_subject(),
            parameter_summary=f"{package_name}_{version}",
        )

    def fetch_input(self, destination: Path) -> bool:
        """Download the required artifacts."""
        assert self.dynamic_data

        artifact_id = self.source_artifact.artifact_id
        self.fetch_artifact(artifact_id, destination)

        return True

    def configure_for_execution(self, download_directory: Path) -> bool:
        """
        Find a .dsc in download_directory.

        Install reprotest and other utilities used in _cmdline.
        Set self._reprotest_target to it.

        :param download_directory: where to search the files
        :return: True if valid files were found
        """
        self._prepare_executor_instance()

        if self.executor_instance is None:
            raise AssertionError("self.executor_instance cannot be None")

        self.run_executor_command(
            ["apt-get", "update"],
            log_filename="install.log",
            run_as_root=True,
            check=True,
        )
        self.run_executor_command(
            [
                "apt-get",
                "--yes",
                "--no-install-recommends",
                "install",
                "reprotest",
                "dpkg-dev",
                "devscripts",
                "equivs",
                "sudo",
            ],
            log_filename="install.log",
            run_as_root=True,
        )

        self._reprotest_target = utils.find_file_suffixes(
            download_directory, [".dsc"]
        )
        return True

    def _cmdline(self) -> list[str]:
        """
        Build the reprotest command line.

        Use configuration of self.data and self._reprotest_target.
        """
        target = self._reprotest_target
        assert target is not None

        cmd = [
            "bash",
            "-c",
            f"TMPDIR=/tmp ; cd /tmp ; dpkg-source -x {target} package/; "
            "cd package/ ; mk-build-deps ; apt-get install --yes ./*.deb ; "
            "rm *.deb ; "
            "reprotest --vary=-time,-user_group,-fileordering,-domain_host .",
        ]

        return cmd

    @staticmethod
    def _cmdline_as_root() -> bool:
        r"""apt-get install --yes ./\*.deb must be run as root."""
        return True

    def task_result(
        self,
        returncode: int | None,
        execute_directory: Path,  # noqa: U100
    ) -> WorkRequestResults:
        """
        Evaluate task output and return success.

        For a successful run of reprotest:
        -must have the output file
        -exit code is 0

        :return: WorkRequestResults.SUCCESS or WorkRequestResults.FAILURE.
        """
        reprotest_file = execute_directory / self.CAPTURE_OUTPUT_FILENAME

        if reprotest_file.exists() and returncode == 0:
            return WorkRequestResults.SUCCESS

        return WorkRequestResults.FAILURE

    def upload_artifacts(
        self, exec_directory: Path, *, execution_result: WorkRequestResults
    ) -> None:
        """Upload the ReprotestArtifact with the files and relationships."""
        if not self.debusine:
            raise AssertionError("self.debusine not set")

        assert self.dynamic_data is not None
        assert self.dynamic_data.parameter_summary is not None

        reprotest_artifact = ReprotestArtifact.create(
            reprotest_output=exec_directory / self.CAPTURE_OUTPUT_FILENAME,
            reproducible=execution_result == WorkRequestResults.SUCCESS,
        )

        uploaded = self.debusine.upload_artifact(
            reprotest_artifact,
            workspace=self.workspace_name,
            work_request=self.work_request_id,
        )

        assert self.dynamic_data is not None
        self.debusine.relation_create(
            uploaded.id,
            self.source_artifact.artifact_id,
            RelationType.RELATES_TO,
        )

Below are the main parts with some basic explanation.

In order for Debusine to discover the task, in the file debusine/tasks/__init__.py add from debusine.tasks.reprotest import Reprotest; and , then in the list __all__ add "Reprotest".

Let’s explain the different parts of the Reprotest class:

Resolving inputs: input fields and dynamic data

The worker has no access to Debusine’s database. Lookups are all resolved before the task gets dispatched to a worker, so all it has to do is download the specified input artifacts.

The resolution is performed automatically by task input fields, which make the result of the resolution available as attributes of the task object.

Reprotest defines two members as input fields: environment and source_artifact, which resolve into InputArtifactSingle structures.

The get_subject method is used to compute the subject for looking up possible task configuration entries for this task, by representing the significant aspect of the task’s input: in this case, the source package name.

The compute_dynamic_data method is used when the task gets ready to be run, to perform the final consistency checks on the input fields and populate the rest of the dynamic task data. This structure holds information useful for displaying the task in the UI (like parameter_summary), for inspecting the lifetime of the task (subject, configuration_context), for statistics (runtime_context), and used to hold the IDs of artifacts before task input fields were introduced.

    def compute_dynamic_data(self) -> BaseDynamicTaskDataWithExecutor:
        """Compute and return BaseDynamicTaskData."""
        source_artifact = self.source_artifact
        assert isinstance(
            source_artifact.data, (DebianSourcePackage, DebianUpload)
        )
        package_name = get_source_package_name(source_artifact.data)
        version = get_source_package_version(source_artifact.data)

        return BaseDynamicTaskDataWithExecutor(
            environment_id=self.environment.artifact_id,
            subject=self.get_subject(),
            parameter_summary=f"{package_name}_{version}",
        )

`fetch_input` method

Download the required artifacts on the worker.

    def fetch_input(self, destination: Path) -> bool:
        """Download the required artifacts."""
        assert self.dynamic_data

        artifact_id = self.source_artifact.artifact_id
        self.fetch_artifact(artifact_id, destination)

        return True

`configure_for_execution` method

Install the packages needed by the task and set _reprotest_target, which is used to build the task’s command line.

    def configure_for_execution(self, download_directory: Path) -> bool:
        """
        Find a .dsc in download_directory.

        Install reprotest and other utilities used in _cmdline.
        Set self._reprotest_target to it.

        :param download_directory: where to search the files
        :return: True if valid files were found
        """
        self._prepare_executor_instance()

        if self.executor_instance is None:
            raise AssertionError("self.executor_instance cannot be None")

        self.run_executor_command(
            ["apt-get", "update"],
            log_filename="install.log",
            run_as_root=True,
            check=True,
        )
        self.run_executor_command(
            [
                "apt-get",
                "--yes",
                "--no-install-recommends",
                "install",
                "reprotest",
                "dpkg-dev",
                "devscripts",
                "equivs",
                "sudo",
            ],
            log_filename="install.log",
            run_as_root=True,
        )

        self._reprotest_target = utils.find_file_suffixes(
            download_directory, [".dsc"]
        )
        return True

`_cmdline` method

Return the command line to run the task.

In this case, and to keep the example simple, we will run reprotest directly in the worker’s executor VM/container, without giving it an isolated virtual server.

So, this command installs the build dependencies required by the package (so reprotest can build it) and runs reprotest itself.

    def _cmdline(self) -> list[str]:
        """
        Build the reprotest command line.

        Use configuration of self.data and self._reprotest_target.
        """
        target = self._reprotest_target
        assert target is not None

        cmd = [
            "bash",
            "-c",
            f"TMPDIR=/tmp ; cd /tmp ; dpkg-source -x {target} package/; "
            "cd package/ ; mk-build-deps ; apt-get install --yes ./*.deb ; "
            "rm *.deb ; "
            "reprotest --vary=-time,-user_group,-fileordering,-domain_host .",
        ]

        return cmd

Some reprotest variations are disabled. This is to keep the example simple with the set of packages to install and reprotest features.

`_cmdline_as_root` method

Since during the execution it’s needed to install packages, run it as root (in the container):

    @staticmethod
    def _cmdline_as_root() -> bool:
        r"""apt-get install --yes ./\*.deb must be run as root."""
        return True

`task_result` method

Task succeeded if a log is generated and the return code is 0.

    def task_result(
        self,
        returncode: int | None,
        execute_directory: Path,  # noqa: U100
    ) -> WorkRequestResults:
        """
        Evaluate task output and return success.

        For a successful run of reprotest:
        -must have the output file
        -exit code is 0

        :return: WorkRequestResults.SUCCESS or WorkRequestResults.FAILURE.
        """
        reprotest_file = execute_directory / self.CAPTURE_OUTPUT_FILENAME

        if reprotest_file.exists() and returncode == 0:
            return WorkRequestResults.SUCCESS

        return WorkRequestResults.FAILURE

`upload_artifacts` method

Create the ReprotestArtifact with the log and the reproducible boolean, upload it, and then add a relation between the ReprotestArtifact and the source package:

    def upload_artifacts(
        self, exec_directory: Path, *, execution_result: WorkRequestResults
    ) -> None:
        """Upload the ReprotestArtifact with the files and relationships."""
        if not self.debusine:
            raise AssertionError("self.debusine not set")

        assert self.dynamic_data is not None
        assert self.dynamic_data.parameter_summary is not None

        reprotest_artifact = ReprotestArtifact.create(
            reprotest_output=exec_directory / self.CAPTURE_OUTPUT_FILENAME,
            reproducible=execution_result == WorkRequestResults.SUCCESS,
        )

        uploaded = self.debusine.upload_artifact(
            reprotest_artifact,
            workspace=self.workspace_name,
            work_request=self.work_request_id,
        )

        assert self.dynamic_data is not None
        self.debusine.relation_create(
            uploaded.id,
            self.source_artifact.artifact_id,
            RelationType.RELATES_TO,
        )

Execution example

To run this task in a local Debusine (see steps to have it ready with an environment, permissions and users created) you can do:

$ python3 -m debusine.client artifact import-debian -w System http://deb.debian.org/debian/pool/main/h/hello/hello_2.10-5.dsc

(get the artifact ID from the output of that command)

The artifact can be seen in http://$DEBUSINE/debusine/System/artifact/$ARTIFACTID/.

Then create a reprotest.yaml:

$ cat <<EOF > reprotest.yaml
source_artifact: $ARTIFACT_ID
environment: "debian/match:codename=bookworm"
EOF

Instead of debian/match:codename=bookworm it could use the artifact ID.

Finally, create the work request to run the task:

$ python3 -m debusine.client create-work-request -w System reprotest --data reprotest.yaml

Using Debusine web you can see the work request, which should go to Running status, then Completed with Success or Failure (depending if reprotest could reproduce it or not). Clicking on the Output tab would have an artifact of type debian:reprotest with one file: the log. In the Metadata tab of the artifact it has Data: the package name and reproducible (true or false).

What is left to do?

This was a simple example of creating a task. Other things that could be done:

unit tests
documentation
configurable variations
running reprotest directly on the worker host, using the executor environment as a reprotest “virtual server”
in this specific example, the command line might be doing too many things that could maybe be done by other parts of the task, such as prepare_environment.
integrate it in a workflow so it’s easier to use (e.g. part of QaWorkflow)
extract more from the log than just pass/fail
display the output in a more useful way (implement an artifact specialized view)

Monthly report about Debian Long Term Support, December 2025 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Fri, 16 Jan 2026 00:00:00 +0000

The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for December.

Activity summary

During the month of December, 18 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 41 DLAs fixing 252 CVEs.

The team currently focuses on preparing security updates for Debian 11 “bullseye”, but also looks for contributing with updates for Debian 12 “bookworm”, Debian 13 “trixie” and even Debian unstable.

Notable security updates:

libsoup2.4 (DLA-4398-1), prepared by Andreas Henrikson, fixing several vulnerabilities.
glib2.0 (DLA-4412-1), published by Emilio Pozuelo Monfort, addressing multiple issues.
lasso (DLA-4397-1), prepared by Sylvain Beucler, addressing multiple issues, including a critical remote code execution (RCE) vulnerability (CVE-2025-47151)
roundcube (DLA 4415-1), prepared by Guilhem Moulin, fixing a cross-site-scripting (XSS) (CVE-2025-68461) and an information disclosure (CVE-2025-68460) vulnerabilities
mediawiki (DLA 4428-1), published by Guilhem, fixing multiple vulnerabilities could lead to information disclosure, denial of service or privilege escalation.
While the DLA has not been published yet, Charles Henrique Melara proposed upstream fixes for seven CVEs in ffmpeg: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/21275.
python-apt (DLA 4408-1), prepared by Utkarsh Gupta, in coordination with the Debian Security Team and Julian Andres Klode, the apt’s maintainer.
libpng1.6 (DLA-4396-1), published by Tobias Frost, completing the work started the previous month.

Notable non-security updates:

tzdata (DLA-4403-1), prepared by Emilio, including the latest changes to the leap second list and its expiry date, which was set for the end of December.

Contributions from outside the LTS Team:

Christoph Berg, co-maintainer of PostgreSQL in Debian, prepared a postgresql-13 update, released as DLA-4420-1

The LTS Team has also contributed with updates to the latest Debian releases:

Andreas proposed trixie and bookworm point updates for pgbouncer
Abhijith PA prepared a bookworm point update for php-dompdf
Thorsten Alteholz prepared an unstable update and a trixie point update for libcoap3
Thorsten prepared or completed different updates for unstable, trixie and bookworm for packages related to cups: an unstable update of cups to fix several issues related to the latest security update, a trixie point update for libcupsfilters, and trixie and bookworm point updates for cups-filter.
Bastien Roucariès prepared unstable, trixie and bookworm point updates for imagemagick
Bastien completed the bookworm point update for angular.js and the bookworm point update for squid.
Charles completed the bookworm point update for gdk-pixbuf.
Utkarsh prepared a trixie update for wordpress, that was released as DSA-6091-1.
Tobias prepared bookworm and trixie updates for libpng1.6, released as DSA-6076-1.
Tobias prepared sogo updates targeting unstable, and point updates of trixie and bookworm

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 123 months)
- Civil Infrastructure Platform (CIP) (for 91 months)
- VyOS Inc (for 55 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 133 months)
- CONET Deutschland GmbH (for 117 months)
- Plat’Home (for 116 months)
- University of Oxford (for 73 months)
- EDF SA (for 45 months)
- Dataport AöR (for 20 months)
- CERN (for 18 months)
Silver sponsors:
- Domeneshop AS (for 138 months)
- Nantes Métropole (for 132 months)
- Akamai - Linode (for 128 months)
- Univention GmbH (for 124 months)
- Université Jean Monnet de St Etienne (for 124 months)
- Ribbon Communications, Inc. (for 118 months)
- Exonet B.V. (for 108 months)
- Leibniz Rechenzentrum (for 102 months)
- Ministère de l’Europe et des Affaires Étrangères (for 86 months)
- Dinahosting SL (for 73 months)
- Upsun Formerly Platform.sh (for 67 months)
- Deveryware (for 61 months)
- Moxa Inc. (for 61 months)
- sipgate GmbH (for 59 months)
- OVH US LLC (for 57 months)
- Tilburg University (for 57 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 48 months)
- THINline s.r.o. (for 21 months)
- Copenhagen Airports A/S (for 15 months)
- Conseil Départemental de l’Isère
Bronze sponsors:
- Seznam.cz, a.s. (for 139 months)
- Evolix (for 138 months)
- Intevation GmbH (for 135 months)
- Linuxhotel GmbH (for 135 months)
- Daevel SARL (for 134 months)
- Megaspace Internet Services GmbH (for 133 months)
- Greenbone AG (for 132 months)
- NUMLOG (for 132 months)
- WinGo AG (for 131 months)
- Entr’ouvert (for 123 months)
- Adfinis AG (for 120 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 115 months)
- Tesorion (for 115 months)
- Bearstech (for 106 months)
- LiHAS (for 106 months)
- Catalyst IT Ltd (for 101 months)
- Demarcq SAS (for 95 months)
- Université Grenoble Alpes (for 81 months)
- TouchWeb SAS (for 73 months)
- SPiN AG (for 70 months)
- CoreFiling (for 66 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 57 months)
- Tem Innovations GmbH (for 52 months)
- WordFinder.pro (for 52 months)
- CNRS DT INSU Résif (for 50 months)
- Soliton Systems K.K. (for 46 months)
- Alter Way (for 43 months)
- Institut Camille Jordan (for 33 months)
- SOBIS Software GmbH (for 18 months)
- Tuxera Inc. (for 9 months)
- OPM-OP AS

Debian Contributions: dh-python development, Python 3.14 and Ruby 3.4 transitions, Surviving scraper traffic in Debian CI and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 13 Jan 2026 00:00:00 +0000

Debian Contributions: 2025-12

dh-python development, by Stefano Rivera

In Debian we build our Python packages with the help of a debhelper-compatible tool, dh-python. Before starting the 3.14 transition (that would rebuild many packages) we landed some updates to dh-python to fix bugs and add features. This started a month of attention on dh-python, iterating through several bug fixes, and a couple of unfortunate regressions.

dh-python is used by almost all packages containing Python (over 5000). Most of these are very simple, but some are complex and use dh-python in unexpected ways. It’s hard to avoid almost any change (including obvious bug fixes) from causing some unexpected knock-on behaviour. There is a fair amount of complexity in dh-python, and some rather “clever” code, which can make it tricky to work on.

All of this means that good QA is important. Stefano spent some time adding type annotations and specialized types to make it easier to see what the code is doing and catch mistakes. This has already made work on dh-python easier.

Now that Debusine has built-in repositories and debdiff support, Stefano could quickly test the effects of changes on many other packages. After each big change, he could upload dh-python to a repository, rebuild e.g. 50 Python packages with it, and see what differences appeared in the output. Reviewing the diffs is still a manual process, but can be improved.

Stefano did a small test on what it would take to replace direct setuptools setup.py calls with PEP-517 (pyproject-style) builds. There is more work to do here.

Python 3.14 transition, by Stefano Rivera (et al.)

In December the transition to add Python 3.14 as a supported version started in Debian unstable. To do this, we update the list of supported versions in python3-defaults, and then start rebuilding modules with C extensions from the leaves inwards. This had already been tested in a PPA and Ubuntu, so many of the biggest blocking compatibility issues with 3.14 had already been found and fixed. But there are always new issues to discover.

Thanks to a number of people in the Debian Python team, we got through the first bit of the transition fairly quickly. There are still a number of open bugs that need attention and many failed tests blocking migration to testing.

Python 3.14.1 released just after we started the transition, and very soon after, a follow-up 3.14.2 release came out to address a regression. We ran into another regression in Python 3.14.2.

Ruby 3.4 transition, by Lucas Kanashiro (et al.)

The Debian Ruby team just started the preparation to move the default Ruby interpreter version to 3.4. At the moment, ruby3.4 source package is already available in experimental, also ruby-defaults added support to Ruby 3.4. Lucas rebuilt all reverse dependencies against this new version of the interpreter and published the results here. Lucas also reached out to some stakeholders to coordinate the work.

Next steps are: 1) announcing the results to the whole team and asking for help to fix packages failing to build against the new interpreter; 2) file bugs against packages FTBFSing against Ruby 3.4 which are not fixed yet; 3) once we have a low number of build failures against Ruby 3.4, ask the Debian Release team to start the transition in unstable.

Surviving scraper traffic in Debian CI, by Antonio Terceiro

Like most of the open web, Debian Continuous Integration has been struggling for a while to keep up with the insatiable hunger from data scrapers everywhere. Solving this involved a lot of trial and error; the final result seems to be stable, and consists of two parts.

First, all Debian CI data pages, except the direct links to test log files (such as those provided by the Release Team’s testing migration excuses), now require users to be authenticated before being accessed. This means that the Debian CI data is no longer publicly browseable, which is a bit sad. However, this is where we are now.

Additionally, there is now a fail2ban powered firewall-level access limitation for clients that display an abusive access pattern. This went through several iterations, with some of them unfortunately blocking legitimate Debian contributors, but the current state seems to strike a good balance between blocking scrapers and not blocking real users. Please get in touch with the team on the #debci OFTC channel if you are affected by this.

A hybrid dependency solver for crossqa.debian.net, by Helmut Grohne

crossqa.debian.net continuously cross builds packages from the Debian archive. Like Debian’s native build infrastructure, it uses dose-builddebcheck to determine whether a package’s dependencies can be satisfied before attempting a build. About one third of Debian’s packages fail this check, so understanding the reasons is key to improving cross building. Unfortunately, dose-builddebcheck stops after reporting the first problem and does not display additional ones.

To address this, a greedy solver implemented in Python now examines each build-dependency individually and can report multiple causes. dose-builddebcheck is still used as a fall-back when the greedy solver does not identify any problems. The report for bazel-bootstrap is a lengthy example.

rebootstrap, by Helmut Grohne

Due to the changes suggested by Loongson earlier, rebootstrap now adds debhelper to its final installability test and builds a few more packages required for installing it. It also now uses a variant of build-essential that has been marked Multi-Arch: same (see foundational work from last year).

This in turn made the use of a non-default GCC version more difficult and required more work to make it work for gcc-16 from experimental. Ongoing archive changes temporarily regressed building fribidi and dash. libselinux and groff have received patches for architecture specific changes and libverto has been NMUed to remove the glib2.0 dependency.

Miscellaneous contributions

Stefano did some administrative work on debian.social and debian.net instances and Debian reimbursements.
Stefano did routine updates of python-authlib, python-mitogen, xdot.
Stefano spent several hours discussing Debian’s Python package layout with the PyPA upstream community. Debian has ended up with a very different on-disk installed Python layout than other distributions, and this continues to cause some frustration in many communities that have to have special workarounds to handle it. This ended up impacting cross builds as Helmut discovered.
Raphaël set up Debusine workflows for the various backports repositories on debusine.debian.net.
Zulip is not yet in Debian (RFP in #800052), but Raphaël helped on the French translation as he is experimenting with that discussion platform.
Antonio performed several routine Salsa maintenance tasks, including fixing salsa-nm-sync, the service that synchronizes project members data from LDAP to Salsa, which had been broken since salsa.debian.org was upgraded to “trixie”.
Antonio deployed a new amd64 worker host for Debian CI.
Antonio did several DebConf technical and administrative bits, including but adding support for custom check-in/check-out dates in the MiniDebConf registration module, publishing a call for bids for DebConf27.
Carles reviewed and submitted 14 Catalan translations using po-debconf-manager.
Carles improved po-debconf-manager: added “delete-package” command, “show-information” now uses properly formatted output (YAML), it now attaches the translation on the bug reports for which a merge request has been opened too long.
Carles investigated why some packages appeared in po-debconf-manager but not in the Debian l10n list. Turns out that some packages had debian/po/templates.pot (appearing in po-debconf-manager) but not the POTFILES.in file as expected. Created a script to find out which packages were in this or similar situation and reported bugs.
Carles tested and documented how to set up voices (mbrola and festival) if using Orca speech synthesizer. Commented a few issues and possible improvements in the debian-accessibility list.
Helmut sent patches for 48 cross build failures and initiated discussions on how to deal with two non-trivial matters. Besides Python mentioned above, CMake introduced a cmake_pkg_config builtin which is not aware of the host architecture. He also forwarded a Meson patch upstream.
Thorsten uploaded a new upstream version of cups to fix a nasty bug that was introduced by the latest security update.
Along with many other Python 3.14 fixes, Colin fixed a tricky segfault in python-confluent-kafka after a helpful debugging hint from upstream.
Colin upstreamed an improved version of an OpenSSH patch we’ve been carrying since 2008 to fix misleading verbose output from scp.
Colin used Debusine to coordinate transitions for astroid and pygments, and wrote up the astroid case on his blog.
Emilio helped with various transitions, and provided a build fix for opencv for the ffmpeg 8 transition.
Emilio tested the GNOME updates for “trixie” proposed updates (gnome-shell, mutter, glib2.0).
Santiago helped to review the status of how to test different build profiles in parallel on the same pipeline, using the test-build-profiles job. This means, for example, to simultaneously test build profiles such as nocheck and nodoc for the same git tree. Finally, Santiago provided MR !685 to fix the documentation.
Anupa prepared a bits post for Outreachy interns announcement along with Tássia Camões Araújo and worked on publicity team tasks.

How files are stored by Debusine (by Stefano Rivera)

Stefano Rivera — Wed, 31 Dec 2025 00:00:00 +0000

Debusine is a tool designed for Debian developers and Operating System developers in general. This post describes how Debusine stores and manages files.

Debusine has been designed to run a network of “workers” that can perform various “tasks” that consume and produce “artifacts”. The artifact itself is a collection of files structured into an ontology of artifact types. This generic architecture should be suited to many sorts of build & CI problems. We have implemented artifacts to support building a Debian-like distribution, but the foundations of Debusine aim to be more general than that.

For example a package build task takes a debian:source-package as input and produces some debian:binary-packages and a debian:package-build-log as output.

This generalized approach is quite different to traditional Debian APT archive implementations, which typically required having the archive contents on the filesystem. Traditionally, most Debian distribution management tasks happen within bespoke applications that cannot share much common infrastructure.

File Stores

Debusine’s files themselves are stored by the File Store layer. There can be multiple file stores configured, with different policies. Local storage is useful as the initial destination for uploads to Debusine, but it has to be backed up manually and might not scale to sufficiently large volumes of data. Remote storage such as S3 is also available. It is possible to serve a file from any store, with policies for which one to prefer for downloads and uploads.

Administrators can set policies for which file stores to use at the scope level, as well as policies for populating and draining stores of files.

Artifacts

As mentioned above, files are collected into Artifacts. They combine:

a set of files with names (including potentially parent directories)
a category, e.g. debian:source-package
key-value data in a schema specified by the category and stored as a JSON-encoded dictionary.

Within the stores, files are content-addressed: a file with a given SHA-256 digest is only stored once in any given store, and may be retrieved by that digest. When a new artifact is created, its files are uploaded to Debusine as needed. Some of the files may already be present in the Debusine instance. In that case, if the file is already part of the artifact’s workspace, then the client will not need to re-upload the file. But if not, it must be reuploaded to avoid users obtaining unauthorized access to existing file contents in another private workspace or multi-tenant scope.

Because the content-addressing makes storing duplicates cheap, it’s common to have artifacts that overlap files. For example a debian:upload will contain some of the same files as the related debian:source-package as well as the .changes file.

Looking at the debusine.debian.net instance that we run, we can see a content-addressing savings of 629 GiB across our (currently) 2 TiB file store. This is somewhat inflated by the Debian Archive import, that did not need to bother to share artifacts between suites. But it still shows reasonable real-world savings.

APT Repository Representation

Unlike a traditional Debian APT repository management tool, the source package and binary packages are not stored directly in the “pool” of an APT repository on disk on the debusine server. Instead we abstract the repository into a debian:suite collection within the Debusine database. The collection contains the artifacts that make up the APT repository.

To ensure that it can be safely represented as a valid URL structure (or files on disk) the suite collection maintains an index of the pool filenames of its artifacts.

Suite collections can combine into a debian:archive collection that shares a common file pool.

Debusine collections can keep an historical record of when things were added and removed. This, combined with the database-backed collection-driven repository representation makes it very easy to provide APT-consumable snapshot views to every point in a repository’s history.

Expiry

While a published distribution probably wants to keep the full history of all its package builds, we don’t need to retain all of the output of all QA tasks that were run. Artifacts can have an expiration delay or inherit one from their workspace. Once this delay has expired, artifacts which are not being held in any collection are eligible to be automatically cleaned up.

QA work that is done in a workspace that has automatic artifact expiry, and isn’t publishing the results to an APT suite, will safely automatically expire.

Daily Vacuum

A daily vacuum task handles all of the file periodic maintenance for file stores. It does some cleanup of working areas, a scan for unreferenced & missing files, and enforces file store policies. The policy work could be copying files for backup or moving files between stores to keep them within size limits (e.g. from a local upload store into a general cloud store).

In Conclusion

Debusine provides abstractions for low-level file storage and object collections. This allows storage to be scalable beyond a single filesystem and highly available. Using content-addressed storage minimizes data duplication within a Debusine instance.

For Debian distributions, storing the archive metadata entirely in a database made providing built-in snapshot support easy in Debusine.

Debusine repositories now in beta (by Colin Watson)

Colin Watson — Tue, 16 Dec 2025 00:00:00 +0000

We’re happy to announce that Debusine can now be used to maintain APT-compatible add-on package repositories for Debian. This facility is available in public beta to Debian developers and maintainers.

Why?

Debian developers typically put most of their effort towards maintaining the main Debian archive. However, it’s often useful to have other places to work, for various reasons:

Developers working on a set of packages might need to check that changes to several of them all work properly together on a real system.
Somebody fixing a bug might need to ask affected users to test the fix before uploading it to Debian.
Some projects are difficult to package in a way that meets Debian policy, or are too niche to include in Debian, but it’s still useful to distribute them in a packaged form.
For some packages, it’s useful to provide multiple upstream versions for multiple Debian releases, even though Debian itself would normally want to keep that to a minimum.

The Ubuntu ecosystem has had PPAs for a long time to meet these sorts of needs, but people working directly on Debian have had to make do with putting things together themselves using something like reprepro or aptly. Discussions about this have been happening for long enough that people started referring to PPAs for Debian as “bikesheds”, and users often find themselves trying to use Ubuntu PPAs on Debian systems and hoping that dependencies will be compatible enough for things to more or less work. This clearly isn’t ideal, and solving it is one of Freexian’s objectives for Debusine.

Developers publishing packages to Debusine repositories can take advantage of all Debusine’s existing facilities, including a battery of QA tests and regression tracking (coming soon). Repositories are signed using per-repository keys held in Debusine’s signing service, and uploads to repositories are built against the current contents of that repository as well as the corresponding base Debian release. All repositories include automatic built-in snapshot capabilities.

Who can use this service?

We’ve set up debusine.debian.net to allow using repositories. All Debian Developers and Debian Maintainers can log in there and publish packages to it. The resulting repositories are public by default.

debusine.debian.net only allows packages with licences that allow distribution by Debian, and it is intended primarily for work that could reasonably end up in Debian; Freexian reserves the right to remove repositories from it.

How can I use it?

If you are a Debian contributor, we’d be very excited to have you try this out, especially if you give us feedback. We have published instructions for developers on using this. Since this is a beta service, you can expect things to change, but we’ll maintain compatibility where we can.

If you’re interested in using this in a commercial setting, please contact Freexian to discuss what we can do for you.

Monthly report about Debian Long Term Support, November 2025 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Tue, 16 Dec 2025 00:00:00 +0000

The Debian LTS Team, funded by [Freexian’s Debian LTS offering] (https://www.freexian.com/lts/debian/), is pleased to report its activities for November.

Activity summary

During the month of November, 18 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 33 DLAs fixing 219 CVEs.

The LTS Team kept going with the usual cadence of preparing security updates for Debian 11 “bullseye”, but also for Debian 12 “bookworm”, Debian 13 “trixie” and even Debian unstable. As in previous months, we are pleased to say that there have been multiple contributions of LTS uploads by Debian Fellows outside the regular LTS Team.

Notable security updates:

Guilhem Moulin prepared DLA 4365-1 for unbound, a caching DNS resolver, fixing a cache poisoning vulnerability that could lead to domain hijacking.
Another update related to DNS software was made by Andreas Henriksson. Andreas completed the work on bind9, released as DLA 4364-1 to fix cache poisoning and Denial of Service (DoS) vulnerabilities.
Chris Lamb released DLA 4374-1 to fix a potential arbitrary code execution vulnerability in pdfminer, a tool for extracting information from PDF documents.
Ben Hutchings published a regular security update for the linux 6.1 bullseye backport, as DLA 4379-1.
A couple of other important recurrent updates were prepared by Emilio Pozuelo, who handled firefox-esr and thunderbird (in collaboration with Christoph Goehre), published as DLAs DLA 4370-1 and DLA 4372-1, respectively.

Contributions from fellows outside the LTS Team:

Thomas Goirand uploaded a bullseye update for keystone and swift
Jeremy Bícha prepared the bullseye update for gst-plugins-base1.0
As mentioned above, Christoph Goehre prepared the bullseye update for thunderbird.
Mathias Behrle provided feedback about the tryton-server and tryton-sao vulnerabilities that were disclosed last month, and helped to review the bullseye patches for tryton-server.

Other than the regular LTS updates for bullseye, the LTS Team has also contributed updates to the latest Debian releases:

Bastien Roucariès prepared a bookworm update for squid, the web proxy cache server.
Carlos Henrique Lima Melara filed a bookworm point update request for gdk-pixbuf to fix CVE-2025-7345, a heap buffer overflow vulnerability that could lead to arbitrary code execution.
Daniel Leidert prepared bookworm and trixie updates for r-cran-gh to fix CVE-2025-54956, an issue that may expose user credentials in HTTP responses.
Along with the bullseye updates for unbound mentioned above, Guilhem helped to prepare the trixie update for unbound.
In collaboration with Lukas Märdian, Tobias Frost prepared trixie and bookworm updates for log4cxx, the C++ port of the logging framework for JAVA.
Jochen Sprickerhof prepared a bookworm update for syslog-ng.
Utkarsh completed the bookworm update for wordpress, addressing multiple security issues in the popular blogging tool.

Beyond security updates, there has been a significant effort in revamping our documentation, aiming to make the processes more clear and consistent for all the members of the team. This work was mainly carried out by Sylvain, Jochen and Roberto.

We would like to express our gratitude to the sponsors for making the Debian LTS project possible. Also, special thanks to the fellows outside the LTS team for their valuable help.

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 122 months)
- Civil Infrastructure Platform (CIP) (for 90 months)
- VyOS Inc (for 54 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 132 months)
- CONET Deutschland GmbH (for 116 months)
- Plat’Home (for 115 months)
- University of Oxford (for 72 months)
- Deveryware (for 60 months)
- EDF SA (for 44 months)
- Dataport AöR (for 19 months)
- CERN (for 17 months)
Silver sponsors:
- Domeneshop AS (for 137 months)
- Nantes Métropole (for 131 months)
- Akamai - Linode (for 127 months)
- Univention GmbH (for 123 months)
- Université Jean Monnet de St Etienne (for 123 months)
- Ribbon Communications, Inc. (for 117 months)
- Exonet B.V. (for 107 months)
- Leibniz Rechenzentrum (for 101 months)
- Ministère de l’Europe et des Affaires Étrangères (for 85 months)
- Cloudways by DigitalOcean (for 74 months)
- Dinahosting SL (for 72 months)
- Upsun Formerly Platform.sh (for 66 months)
- Moxa Inc. (for 60 months)
- sipgate GmbH (for 58 months)
- OVH US LLC (for 56 months)
- Tilburg University (for 56 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 47 months)
- THINline s.r.o. (for 20 months)
- Copenhagen Airports A/S (for 14 months)
- Conseil Départemental de l’Isère
Bronze sponsors:
- Seznam.cz, a.s. (for 138 months)
- Evolix (for 137 months)
- Intevation GmbH (for 134 months)
- Linuxhotel GmbH (for 134 months)
- Daevel SARL (for 133 months)
- Megaspace Internet Services GmbH (for 132 months)
- Greenbone AG (for 131 months)
- NUMLOG (for 131 months)
- WinGo AG (for 130 months)
- Entr’ouvert (for 122 months)
- Adfinis AG (for 119 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 114 months)
- Tesorion (for 114 months)
- Bearstech (for 105 months)
- LiHAS (for 105 months)
- Catalyst IT Ltd (for 100 months)
- Demarcq SAS (for 94 months)
- Université Grenoble Alpes (for 80 months)
- TouchWeb SAS (for 72 months)
- SPiN AG (for 69 months)
- CoreFiling (for 65 months)
- Institut des sciences cognitives Marc Jeannerod (for 60 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 56 months)
- Tem Innovations GmbH (for 51 months)
- WordFinder.pro (for 51 months)
- CNRS DT INSU Résif (for 49 months)
- Soliton Systems K.K. (for 45 months)
- Alter Way (for 42 months)
- Institut Camille Jordan (for 32 months)
- SOBIS Software GmbH (for 17 months)
- Tuxera Inc. (for 8 months)
- OPM-OP AS

Debian Contributions: Updates about DebConf Video Team Sprint, rebootstrap, SBOM tooling in Debian and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Fri, 12 Dec 2025 00:00:00 +0000

Debian Contributions: 2025-11

DebConf Video Team Sprint

The DebConf Video Team records, streams, and publishes talks from DebConf and many miniDebConfs. A lot of the infrastructure development happens during setup for these events, but we also try to organize a sprint once a year to work on infrastructure, when there isn’t a DebConf about to happen. Stefano attended the sprint in Herefordshire this year and wrote up a report.

rebootstrap, by Helmut Grohne

A number of jobs were stuck in architecture-specific failures. gcc-15 and dpkg still disagree about whether PIE is enabled occasionally and big endian mipsen needed fixes in systemd. Beyond this regular uploads of libxml2 and gcc-15 required fixes and rebasing of pending patches.

Earlier, Loongson used rebootstrap to create the initial package set for loong64 and Miao Wang now submitted their changes. Therefore, there is now initial support for suites other than unstable and use with derivatives.

Building the support for Software Bill Of Materials tooling in Debian, by Santiago Ruano Rincón

Vendors of Debian-based products may/should be paying attention to the evolution of different jurisdictions (such as the CRA or updates on CISA’s Minimum Elements for a Software Bill of Materials) that require to make available Software Bill of Materials (SBOM) of their products. It is important then to have tools in Debian to make it easier to produce such SBOMs.

In this context, Santiago continued the work on packaging libraries related to SBOMs. This includes the packaging of the SPDX python library (python-spdx-tools), and its dependencies rdflib and mkdocs-include-markdown-plugin. System Package Data Exchange (SPDX), defined by ISO/IEC 5962:2021, is an open standard capable of representing systems with software components as SBOMs and other data and security references. SPDX and CycloneDX (whose python library python3-cyclonedx-lib was packaged by prior efforts this year), encompass the two main SBOM standards available today.

Miscellaneous contributions

Carles improved po-debconf-manager: added checking status of bug reports automatically via python-debianbts; changed some command line options naming or output based on user feedback; finished refactoring user interaction to rich; codebase is now flake8-compliant; added type safety with mypy.
Carles, using po-debconf-manager, created 19 bug reports for translations where the merge requests were pending; reviewed and created merge requests for 4 packages.
Carles planned a second version of the tool that detects packages that Recommends or Suggests packages which are not in Debian. He is taking ideas from dumat.
Carles submitted a pull request to python-unidiff2 (adapted from the original pull request to python-unidiff). He also started preparing a qnetload update.
Stefano did miscellaneous python package updates: mkdocs-macros-plugin, python-confuse, python-pip, python-mitogen.
Stefano reviewed a beets upload for a new maintainer who is taking it over.
Stefano handled some debian.net infrastructure requests.
Stefano updated debian.social infrastructure for the “trixie” point release.
The update broke jitsi.debian.social, Stefano put some time into debugging it and eventually enlisted upstream assistance, who solved the problem!
Stefano worked on some patches for Python that help Debian:
- GH-139914: The main HP PA-RISC support patch for 3.14.
- GH-141930: We observed an unhelpful error when failing to write a .pyc file during package installation. We may have fixed the problem, and at least made the error better.
- GH-141011: Ignore missing ifunc support on HP PA-RISC.
Stefano spun up a website for hamburg2026.mini.debconf.org.
Raphaël reviewed a merge request updating tracker.debian.org to rely on bootstrap
version 5.
Emilio coordinated various transitions.
Helmut sent patches for 26 cross build failures.
Helmut officially handed over the cleanup of the /usr-move transition.
Helmut monitored the transition moving libcrypt-dev out of build-essential and bumped the remaining bugs to rc-severity in coordination with the release team.
Helmut updated the Build-Profiles patch for debian-policy incorporating feedback from Sean Whitton with a lot of help from Nattie Mayer-Hutchings and Freexian colleagues.
Helmut discovered that the way mmdebstrap deals with start-stop-daemon may result in broken output and sent a patch.
As a result of armel being removed from “sid”, but not from “forky”, the multiarch hinter broke. Helmut fixed it.
Helmut uploaded debvm accepting a patch from Luca Boccassi to fix it for newer
systemd.
Colin began preparing for the second stage of the OpenSSH GSS-API key exchange package split.
Colin caught and fixed a devscripts regression due to it breaking part of Debusine.
Colin packaged django-pgtransaction and backported it to “trixie”, since it looks useful for Debusine.
Thorsten uploaded the packages lprng, cpdb-backend-cups, cpdb-libs and ippsample to fix some RC bugs as well as other bugs that accumulated over time. He also uploaded cups-filters to all Debian releases to fix three CVEs.

Debian's /usr-move transition has been completed (by Helmut Grohne)

Helmut Grohne — Mon, 08 Dec 2025 00:00:00 +0000

By now, the /usr-merge is an old transition. Effectively, it turns top-level directories such as /bin into symbolic links pointing below /usr. That way the entire operating system can be contained below the /usr hierarchy enabling e.g. image based update mechanisms. It was first supported in Debian 9, which is no longer in active use at this point (except for users of Freexian’s ELTS offer). When it became mandatory in Debian 12, it wasn’t really done though, because Debian’s package manager was not prepared to handle file system objects being referred to via two different paths. With nobody interested in handling the resulting issues, Freexian stepped in and funded a project lead by Helmut Grohne to resolve the remaining issues.

While the initial idea was to enhance the package manager, Debian’s members disagreed. They preferred an approach where files were simply tracked with their physical location while handling the resulting misbehavior of the package manager using package-specific workarounds. This has been recorded in the DEP17 document. During the Debian 13 release cycle, the plan has been implemented. A tool for detecting possible problems was developed specifically for this transition. Since all files are now tracked with their physical location and necessary workarounds have been added, problematic behavior is no longer triggered. An upgrade from Debian 12 to Debian 13 is unlikely to run into aliasing problems as a result.

This whole project probably consumed more than 1500 hours of work from Debian contributors, of which 700 were sponsored by Freexian through the work of Helmut Grohne. What remains is eventually removing the workarounds.

Monthly report about Debian Long Term Support, October 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Sat, 29 Nov 2025 00:00:00 +0000

The Debian LTS Team, funded by Freexian’s Debian LTS offering, is pleased to report its activities for October.

Activity summary

During the month of October, 21 contributors have been paid to work on Debian LTS (links to individual contributor reports are located below).

The team released 37 DLAs fixing 893 CVEs.

The team has continued in its usual rhythm, preparing and uploading security updates targeting LTS and ELTS, as well as helping with updates to oldstable, stable, testing, and unstable. Additionally, the team received several contributions of LTS uploads from Debian Developers outside the standing LTS Team.

Notable security updates:

https-everywhere, prepared by Markus Koschany, deals with a problem created by ownership of the https-rulesets.org domain passing to a malware operator
openjdk-17 and openjdk-11, prepared by Emilio Pozuelo Monfort, fixes XML external entity and certificate validation vulnerabilities
intel-microcode, prepared by Tobias Frost, fixes a variety of privilege escalation and denial of service vulnerabilities

Notable non-security updates:

distro-info-data, prepared by Stefano Rivera, updates information concerning current and upcoming Debian and Ubuntu releases

Contributions from outside the LTS Team:

Lukas Märdian, a Debian Developer, provided an update of log4cxx
Andrew Ruthven, one of the request-tracker4 maintainers, provided an update of request-tracker4
Christoph Goehre, co-maintainer of thunderbird, provided an update of thunderbird

Beyond the typical LTS updates, the team also helped the Debian community more broadly:

Guilhem Moulin prepared oldstable/stable updates of libxml2, and an unstable update of libxml2.9
Bastien Roucariès prepared oldstable/stable updates of imagemagick
Daniel Leidert prepared an oldstable update of python-authlib, oldstable update of libcommons-lang-java and stable update of libcommons-lang3-java
Utkarsh Gupta prepared oldstable/stable/testing/unstable updates of ruby-rack

The LTS Team is grateful for the opportunity to contribute to making LTS a high quality for sponsors and users. We are also particularly grateful for the collaboration from others outside the time; their contributions are important to the success of the LTS effort.

Individual Debian LTS contributor reports

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 121 months)
- Civil Infrastructure Platform (CIP) (for 89 months)
- VyOS Inc (for 54 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 132 months)
- Babiel GmbH (for 115 months)
- Plat’Home (for 115 months)
- University of Oxford (for 72 months)
- Deveryware (for 59 months)
- EDF SA (for 43 months)
- Dataport AöR (for 19 months)
- CERN (for 16 months)
Silver sponsors:
- Domeneshop AS (for 136 months)
- Nantes Métropole (for 130 months)
- Akamai - Linode (for 126 months)
- Univention GmbH (for 122 months)
- Université Jean Monnet de St Etienne (for 122 months)
- Ribbon Communications, Inc. (for 116 months)
- Exonet B.V. (for 106 months)
- Leibniz Rechenzentrum (for 100 months)
- Ministère de l’Europe et des Affaires Étrangères (for 84 months)
- Cloudways by DigitalOcean (for 73 months)
- Dinahosting SL (for 71 months)
- Upsun Formerly Platform.sh (for 66 months)
- Moxa Inc. (for 60 months)
- sipgate GmbH (for 57 months)
- OVH US LLC (for 55 months)
- Tilburg University (for 55 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 47 months)
- THINline s.r.o. (for 20 months)
- Copenhagen Airports A/S (for 13 months)
Bronze sponsors:
- Evolix (for 137 months)
- Seznam.cz, a.s. (for 137 months)
- Linuxhotel GmbH (for 134 months)
- Intevation GmbH (for 133 months)
- Daevel SARL (for 132 months)
- Megaspace Internet Services GmbH (for 131 months)
- Greenbone AG (for 130 months)
- NUMLOG (for 130 months)
- WinGo AG (for 130 months)
- Entr’ouvert (for 121 months)
- Adfinis AG (for 119 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 113 months)
- Tesorion (for 113 months)
- Bearstech (for 105 months)
- LiHAS (for 105 months)
- Catalyst IT Ltd (for 99 months)
- Demarcq SAS (for 93 months)
- Université Grenoble Alpes (for 80 months)
- TouchWeb SAS (for 72 months)
- SPiN AG (for 68 months)
- CoreFiling (for 64 months)
- Institut des sciences cognitives Marc Jeannerod (for 59 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 56 months)
- Tem Innovations GmbH (for 51 months)
- WordFinder.pro (for 50 months)
- CNRS DT INSU Résif (for 49 months)
- Soliton Systems K.K. (for 44 months)
- Alter Way (for 42 months)
- Institut Camille Jordan (for 32 months)
- SOBIS Software GmbH (for 16 months)
- Tuxera Inc. (for 8 months)

How we implemented a dark mode in Debusine (by Enrico Zini)

Enrico Zini — Tue, 25 Nov 2025 00:00:00 +0000

Having learnt that Bootstrap supports color modes, we decided to implement an option for users to enable dark mode in Debusine.

By default, the color mode is selected depending on the user browser preferences. If explicitly selected, we use a cookie to store the theme selection so that a user can choose different color modes in different browsers.

The work is in merge request !2401 and minimizes JavaScript dependencies like we do in other parts of debusine.

A view to select the theme

First is a simple view to configure the selected theme and store it in a cookie. If auto is selected, then the cookie is deleted to delegate theme selection to JavaScript:

class ThemeSelectionView(View):
    """Select and save the current theme."""

    def post(
        self, request: HttpRequest, *args: Any, **kwargs: Any  # noqa: U100
    ) -> HttpResponse:
        """Set the selected theme."""
        value = request.POST.get("theme", "auto")
        next_url = request.POST.get("next", None)
        if next_url is None:
            next_url = reverse("homepage:homepage")
        response = HttpResponseRedirect(next_url)
        if value == "auto":
            response.delete_cookie("theme")
        else:
            response.set_cookie(
                "theme", value, httponly=False, max_age=dt.timedelta(days=3650)
            )
        return response

The main base view of Debusine reads the value from the cookie and makes it available to the templates:

      def get_context_data(self, **kwargs: Any) -> dict[str, Any]:
          ctx = super().get_context_data(**kwargs)
          ctx["theme"] = self.request.COOKIES.get("theme", None)
          # ...
          return ctx

The base template will use this value to set data-bs-theme on the main <html> element, and that’s all that is needed to select the color mode in Bootstrap:

<html lang="en"{% if theme %} data-bs-theme="{{ theme }}"{% endif %}>

The view uses HTTP POST as it changes state, so theme selection happens in a form:

<form id="footer-theme" class="col-auto" method="post"
      action="{% url "theme-selection" %}">
    {% csrf_token %}
    <input type="hidden" name="next" value="{{ request.get_full_path }}">
    Theme:
    <button type="submit" name="theme" value="dark">dark</button>
    •
    <button type="submit" name="theme" value="light">light</button>
    •
    <button type="submit" name="theme" value="auto">auto</button>
</form>

Since we added the theme selection buttons in the footer, we use CSS to render the buttons in the same way as the rest of the footer links.

Bootstrap has a set of CSS variables that can be used to easily in sync with the site theme, and they are especially useful now that the theme is configurable:

footer button {
    background: none;
    border: none;
    margin: 0;
    padding: 0;
    color: var(--bs-link-color);
}

Theme autoselection

Bootstrap would support theme autoselection via browser preferences, but that requires rebuilding its Sass sources.

Alternatively, one can use JavaScript:

{% if not theme %}
    <script blocking="render">
    (function() {
        let theme = window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
        let [html] = document.getElementsByTagName("html");
        html.setAttribute("data-bs-theme", theme);
    })();
    </script>
{% endif %}

This reads the color scheme preferences and sets the data-bs-theme attribute on <html>.

The script is provided inline as it needs to use blocking="render" to avoid flashing a light background at the beginning of page load until the attribute is set.

Given that this is a render-blocking snippet, as an extra optimization it is not added to the page if a theme has been set.

Bootstrap CSS fixes

We were making use of the bootstrap btn-light class in navbars to highlight elements on hover, and that doesn’t work well with theme selection.

Lacking a button class that does the right thing across themes, we came up with a new CSS class that uses variables to define a button with hover highlight that works preserving the underlying color:

:root[data-bs-theme=light] {
    --debusine-hover-layer: rgb(0 0 0 / 20%);
    --debusine-hover-color-multiplier: 0.8;
    --debusine-disabled-color-multiplier: 1.5;
}
:root[data-bs-theme=dark] {
    --debusine-hover-layer: rgb(255 255 255 / 20%);
    --debusine-hover-color-multiplier: 1.2;
    --debusine-disabled-color-multiplier: 0.5;
}

/* Button that preserves the underlying color scheme */
.btn-debusine {
  --bs-btn-hover-color: rgb(from var(--bs-btn-color) calc(r * var(--debusine-hover-color-multiplier)) calc(g * var(--debusine-hover-color-multiplier)) calc(b * var(--debusine-hover-color-multiplier)));
  --bs-btn-hover-bg: var(--debusine-hover-layer);
  --bs-btn-disabled-color: rgb(from var(--bs-btn-color) calc(r * var(--debusine-disabled-color-multiplier)) calc(g * var(--debusine-disabled-color-multiplier)) calc(b * var(--debusine-disabled-color-multiplier)));
  --bs-btn-disabled-bg: var(--bs-btn-bg);
  --bs-btn-disabled-border-color: var(--bs-btn-border-color);
}

Dark mode!

This was a nice integration exercise with many little tricks, like how to read color scheme preferences from the browser, render form buttons as links, use bootstrap variables, prevent a flashing background, handle cookies in Django.

And Debusine now has a dark mode!

Debian Contributions: Upstreaming cPython patches, ansible-core autopkgtest robustness and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Thu, 13 Nov 2025 00:00:00 +0000

Debian Contributions: 2025-10

Upstreaming cPython patches, by Stefano Rivera

Python 3.14.0 (final) released in early October, and Stefano uploaded it to Debian unstable. The transition to support 3.14 has begun in Ubuntu, but hasn’t started in Debian, yet.

While build failures in Debian’s non-release ports are typically not a concern for package maintainers, Python is fairly low in the stack. If a new minor version has never successfully been built for a Debian port by the time we start supporting it, it will quickly become a problem for the port. Python 3.14 had been failing to build on two Debian ports architectures (hppa and m68k), but thankfully their porters provided patches. These were applied and uploaded, and Stefano forwarded the hppa one upstream. Getting it into shape for upstream approval took some work, and shook out several other regressions for the Python hppa port. Debugging these on slow hardware takes a while.

These two ports aren’t successfully autobuilding 3.14 yet (they’re both timing out in tests), but they’re at least manually buildable, which unblocks the ports.

Docutils 0.22 also landed in Debian around this time, and Python needed some work to build its docs with it. The upstream isn’t quite comfortable with distros using newer docutils, so there isn’t a clear path forward for these patches, yet.

The start of the Python 3.15 cycle was also a good time to renew submission attempts on our other outstanding python patches, most importantly multiarch tuples for stable ABI extension filenames.

ansible-core autopkgtest robustness, by Colin Watson

The ansible-core package runs its integration tests via autopkgtest. For some time, we’ve seen occasional failures in the expect, pip, and template_jinja2_non_native tests that usually go away before anyone has a chance to look into them properly. Colin found that these were blocking an openssh upgrade and so decided to track them down.

It turns out that these failures happened exactly when the libpython3.13-stdlib package had different versions in testing and unstable. A setup script removed /usr/lib/python3*/EXTERNALLY-MANAGED in order that pip can install system packages for some of the tests, but if a package shipping that file were ever upgraded then that customization would be undone, and the same setup script removed apt pins in a way that caused problems when autopkgtest was invoked in certain ways. In combination with this, one of the integration tests attempted to disable system apt sources while testing the behaviour of the ansible.builtin.apt module, but it failed to do so comprehensively enough and so that integration test accidentally upgraded the testbed from testing to unstable in the middle of the test. Chaos ensued.

Colin fixed this in Debian and contributed the relevant part upstream.

Miscellaneous contributions

Carles kept working on the missing-relations (packages which Recommends or Suggests packages that are not available in Debian). He improved the tooling to detect Suggested packages that are not available in Debian because they were removed (or changed names).
Carles improved po-debconf-manager to send translations for packages that are not in Salsa. He also improved the UI of the tool (using rich for some of the output).
Carles, using po-debconf-manager, reviewed and submitted 38 debconf template translations.
Carles created a merge request for distro-tracker to align text and input-field (postponed until distro-tracker uses Bootstrap 5).
Raphaël updated gnome-shell-extension-hamster for GNOME 49. It is a GNOME Shell integration for the Hamster time tracker.
Raphaël merged a couple of trivial merge requests, but he did not yet find the time to properly review and test the bootstrap 5 related merge requests that are still waiting on salsa.
Helmut sent patches for 20 cross build failures.
Helmut refactored debvm dropping support for running on “bookworm”. There are two “trixie” features improving the operation. mkfs.ext4 can now consume a tar archive to populate the filesystem via libarchive and dash now supports set -o pipefail. Beyond this change in operation, a number of robustness and quality issues have been resolved.
Thorsten fixed some bugs in the printing software and uploaded improved versions of brlaser and ifhp. Moreover he uploaded a new upstream version of cups.
Emilio updated xorg-server to the latest security release and helped with various transitions.
Santiago worked on and reviewed different Salsa CI MR to address some regressions introduced by the move to sbuild+unshare. Those MR included stop adding the salsa-ci user in the build image to the sbuild group, fix the suffix path used by mmdebstrap to create the chroot and update the documentation about how to use aptly repos in another project.
Santiago supported the work on the DebConf 26 organisation, particularly helping with an implemented method to count the votes to choose the conference logo.
Stefano reviewed Python PEP-725 and PEP-804, which hope to provide a mechanism to declare external (e.g. APT) dependencies in Python packages. Stefano engaged in discussion and provided feedback to the authors.
Stefano prepared for Berkeley DB removal in Python.
Stefano ported the backend to reverse-depends to Python 3 (yes, it had been running on 2.7) and migrated it to git from bzr.
Stefano updated miscellaneous packages, including beautifulsoup4, mkdocs-macros-plugin, python-pipx.
Stefano applied an upstream patch to pypy3, fixing an AST Compiler Assertion error.
Stefano uploaded an update to distro-info-data, including data for two additional Debian derivatives: eLxr and Devuan.
Stefano prepared an update to dh-python, the python packaging tool, merging several contributed patches and resolving some bugs.
Colin upgraded OpenSSH to 10.1p1, helped upstream to chase down some regressions, and further upgraded to 10.2p1. This is also now in trixie-backports.
Colin fixed several build regressions with Python 3.14, scikit-learn 1.7, and other transitions.
Colin investigated a malware report against tini, making use of reproducible builds to help demonstrate that this is highly likely to be a false positive.
Anupa prepared questions and collected interview responses from women contributors in Debian to publish the post as part of Ada Lovelace day 2025.

Debian Contributions: Old Debian Printing software and C23, Work to decommission packages.qa.debian.org, rebootstrap uses *-for-host and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 14 Oct 2025 00:00:00 +0000

Debian Contributions: 2025-09

Updating old Debian Printing software to meet C23 requirements, by Thorsten Alteholz

The work of Thorsten fell under the motto “gcc15”. Due to the introduction of gcc15 in Debian, the default language version was changed to C23. This means that for example, function declarations without parameters are no longer allowed. As old software, which was created with ANSI C (or C89) syntax, made use of such function declarations, it was a busy month. One could have used something like -std=c17 as compile flags, but this would have just postponed the tasks. As a result Thorsten uploaded modernized versions of ink, nm2ppa and rlpr for the Debian printing team.

Work done to decommission packages.qa.debian.org, by Raphaël Hertzog

Raphaël worked to decommission the old package tracking system (packages.qa.debian.org). After figuring out that it was still receiving emails from the bug tracking system (bugs.debian.org), from multiple debian lists and from some release team tools, he reached out to the respective teams to either drop those emails or adjust them so that they are sent to the current Debian Package Tracker (tracker.debian.org).

rebootstrap uses *-for-host, by Helmut Grohne

Architecture cross bootstrapping is an ongoing effort that has shaped Debian in various ways over the years. A longer effort to express toolchain dependencies now bears fruit. When cross compiling, it becomes important to express what architecture one is compiling for in Build-Depends. As these packages have become available in “trixie”, more and more packages add this extra information and in August, the libtool package gained a gfortran-for-host dependency. It was the first package in the essential build closure to adopt this and required putting the pieces together in rebootstrap that now has to build gcc-defaults early on. There still are hundreds of packages whose dependencies need to be updated though.

Miscellaneous contributions

Raphaël dropped the “Build Log Scan” integration in tracker.debian.org since it was showing stale data for a while as the underlying service has been discontinued.
Emilio updated pixman to 0.46.4.
Emilio coordinated several transitions, and NMUed guestfs-tools to unblock one.
Stefano uploaded Python 3.14rc3 to Debian unstable. It’s not yet used by any packages, but it allows testing the level of support in packages to begin.
Stefano upgraded almost all of the debian-social infrastructure to Debian “trixie”.
Stefano published the sponsorship brochures for DebConf 26.
Stefano attended the Debian Technical Committee meeting.
Stefano uploaded routine upstream updates for a handful of Python packages (pycparser, beautifulsoup4, platformdirs, pycparser, python-authlib, python-cffi, python-mitogen, python-resolvelib, python-super-collections, twine).
Stefano reviewed and responded to DebConf 25 feedback.
Stefano investigated and fixed a request visibility bug in debian-reimbursements (for admin-altered requests).
Lucas reviewed a couple of merge requests from external contributors for Go and Ruby packages.
Lucas updated some ruby packages to its latest upstream version (thin, passenger, and puma is still WIP).
Lucas set up the build environment to run rebuilds of reverse dependencies of ruby using ruby3.4. As an alternative, he is looking for personal repositories provided by Debusine to perform this task more easily. This is the preparation for the transition to ruby3.4 as the default in Debian.
Lucas helped on the next round of the Outreachy internship program.
Helmut sent patches for 30 cross build failures and responded to cross building support questions on the mailing list.
Helmut continued to maintain rebootstrap. As gcc version 15 became the default, test jobs for version 14 had to be dropped. A fair number of patches were applied to packages and could be dropped.
Helmut resumed removing RC-buggy packages from unstable and sponsored a termrec upload to avoid its deletion. This work was paused to give packages some time to migrate to “forky”.
Santiago reviewed different merge requests created by different contributors. Those MRs include a new test to build reverse dependencies, created by Aquila Macedo as part of his GSoC internship; restore how lintian was used in experimental, thanks Otto Kekäläinen; and the fix by Christian Bayle to support again extra repositories in deb822-style sources, whose support was broken with the move to sbuild+unshare last month.
While doing some new upstream release updates, thanks to Debusine’s reverse dependencies autopkgtest checks, Santiago discovered that paramiko 4.0 will introduce a regression in libcloud by the drop of support for the obsolete DSA keys. Santiago finally uploaded to unstable both paramiko 4.0, and a regression fix for libcloud.
Santiago has taken part in different discussions and meetings for the preparation of DebConf 26. The DebConf 26 local team aims to prepare for the conference with enough time in advance.
Carles kept working on the missing-package-relations and reporting missing Recommends. He improved the tooling to detect and report bugs creating 269 bugs and followed up comments. 37 bugs have been resolved, others acknowledged. The missing Recommends are a mixture of packages that are gone from Debian, packages that changed name, typos and also packages that were recommended but are not packaged in Debian.
Carles improved the missing-package-relations to report broken Suggests only for packages that used to be in Debian but are removed from it now. No bugs have been created yet for this case but identified 1320 of them.
Colin spent much of the month chasing down build/test regressions in various Python packages due to other upgrades, particularly relating to pydantic, python-pytest-asyncio, and rust-pyo3.
Colin optimized some code in ubuntu-dev-tools (affecting e.g. pull-debian-source) that made O(n) HTTP requests when it could instead make O(1).
Anupa published Micronews as part of Debian Publicity team work.

Monthly report about Debian Long Term Support, September 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 13 Oct 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In September, 20 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 10.0h assigned and 4.0h from previous period), thus carrying over 4.0h to the next month.
Andreas Henriksson did 1.0h (out of 0.0h assigned and 20.0h from previous period), thus carrying over 19.0h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 20.0h (out of 21.0h assigned), thus carrying over 1.0h to the next month.
Carlos Henrique Lima Melara did 10.0h (out of 12.0h assigned), thus carrying over 2.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 21.0h (out of 21.0h assigned).
Emilio Pozuelo Monfort did 39.75h (out of 40.0h assigned), thus carrying over 0.25h to the next month.
Guilhem Moulin did 15.0h (out of 15.0h assigned).
Jochen Sprickerhof did 12.0h (out of 9.25h assigned and 11.75h from previous period), thus carrying over 9.0h to the next month.
Lee Garrett did 13.5h (out of 21.0h assigned), thus carrying over 7.5h to the next month.
Lucas Kanashiro did 8.0h (out of 20.0h assigned), thus carrying over 12.0h to the next month.
Markus Koschany did 15.0h (out of 3.25h assigned and 17.75h from previous period), thus carrying over 6.0h to the next month.
Paride Legovini did 6.0h (out of 8.0h assigned), thus carrying over 2.0h to the next month.
Roberto C. Sánchez did 7.25h (out of 7.75h assigned and 13.25h from previous period), thus carrying over 13.75h to the next month.
Santiago Ruano Rincón did 13.25h (out of 13.5h assigned and 1.5h from previous period), thus carrying over 1.75h to the next month.
Sylvain Beucler did 17.0h (out of 7.75h assigned and 13.25h from previous period), thus carrying over 4.0h to the next month.
Thorsten Alteholz did 21.0h (out of 21.0h assigned).
Tobias Frost did 5.0h (out of 0.0h assigned and 8.0h from previous period), thus carrying over 3.0h to the next month.
Utkarsh Gupta did 16.5h (out of 14.25h assigned and 6.75h from previous period), thus carrying over 4.5h to the next month.

Evolution of the situation

In September, we released 38 DLAs.

Notable security updates:
- modsecurity-apache prepared by Adrian Bunk, fixes a cross-site scripting vulnerability
- cups, prepared by Thorsten Alteholz, fixes authentication bypass and denial of service vulnerabilities
- jetty9, prepared by Adrian Bunk, fixes the MadeYouReset vulnerability (a recent, well-known denial of service vulnerability)
- python-django, prepared by Chris Lamb, fixes a SQL injection vulnerability
- firefox-esr and thunderbird, prepared by Emilio Pozuelo Monfort, were updated from the 128.x ESR series to the 140.x ESR series, fixing a number of vulnerabilities as well
Notable non-security updates:
- wireless-regdb prepared by Ben Hutchings, updates information reflecting changes to radio regulations in many countries

There was one package update contributed by a Debian Developer outside of the LTS Team: an update of node-tar-fs, prepared by Xavier Guimard (a member of the Node packaging team).

Finally, LTS Team members also contributed updates of the following packages:

libxslt (to stable and oldstable), prepared by Guilhem Moulin, to address a regression introduced in a previous security update
libphp-adodb (to stable and oldstable), prepared by Abhijith PA
cups (to stable and oldstable), prepared by Thorsten Alteholz
u-boot (to oldstable), prepared by Daniel Leidert and Jochen Sprickerhof
libcommongs-lang3-java (to stable and oldstable), prepared by Daniel Leidert
python-internetarchive (to oldstable), prepared by Daniel Leidert

One other notable contribution by a member of the LTS Team is that Sylvain Beucler proposed a fix upstream for CVE-2025-2760 in gimp2. Upstream no longer supports gimp2, but it is still present in Debian LTS, and so proposing this fix upstream is of benefit to other distros which may still be supporting the older gimp2 packages.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 120 months)
- Civil Infrastructure Platform (CIP) (for 88 months)
- VyOS Inc (for 52 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 130 months)
- Akamai - Linode (for 124 months)
- Babiel GmbH (for 114 months)
- Plat’Home (for 113 months)
- University of Oxford (for 70 months)
- Deveryware (for 57 months)
- EDF SA (for 42 months)
- Dataport AöR (for 17 months)
- CERN (for 15 months)
Silver sponsors:
- Domeneshop AS (for 135 months)
- Nantes Métropole (for 129 months)
- Univention GmbH (for 121 months)
- Université Jean Monnet de St Etienne (for 121 months)
- Ribbon Communications, Inc. (for 115 months)
- Exonet B.V. (for 105 months)
- Leibniz Rechenzentrum (for 99 months)
- Ministère de l’Europe et des Affaires Étrangères (for 83 months)
- Cloudways by DigitalOcean (for 72 months)
- Dinahosting SL (for 70 months)
- Platform.sh SAS (for 64 months)
- Moxa Inc. (for 58 months)
- sipgate GmbH (for 56 months)
- OVH US LLC (for 54 months)
- Tilburg University (for 54 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 45 months)
- THINline s.r.o. (for 18 months)
- Copenhagen Airports A/S (for 12 months)
Bronze sponsors:
- Evolix (for 135 months)
- Seznam.cz, a.s. (for 135 months)
- Intevation GmbH (for 132 months)
- Linuxhotel GmbH (for 132 months)
- Daevel SARL (for 131 months)
- Megaspace Internet Services GmbH (for 130 months)
- Greenbone AG (for 129 months)
- NUMLOG (for 129 months)
- WinGo AG (for 128 months)
- Entr’ouvert (for 120 months)
- Adfinis AG (for 117 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 112 months)
- Tesorion (for 112 months)
- Bearstech (for 103 months)
- LiHAS (for 103 months)
- Catalyst IT Ltd (for 98 months)
- Demarcq SAS (for 92 months)
- Université Grenoble Alpes (for 78 months)
- TouchWeb SAS (for 70 months)
- SPiN AG (for 67 months)
- CoreFiling (for 63 months)
- Institut des sciences cognitives Marc Jeannerod (for 58 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 54 months)
- Tem Innovations GmbH (for 49 months)
- WordFinder.pro (for 48 months)
- CNRS DT INSU Résif (for 47 months)
- Soliton Systems K.K. (for 42 months)
- Alter Way (for 40 months)
- Institut Camille Jordan (for 30 months)
- SOBIS Software GmbH (for 15 months)
- Tuxera Inc. (for 6 months)

Using JavaScript in Debusine without depending on JavaScript (by Enrico Zini)

Enrico Zini — Fri, 12 Sep 2025 00:00:00 +0000

Debusine is a tool designed for Debian developers and Operating System developers in general. This posts describes our approach to the use of JavaScript, and some practical designs we came up with to integrate it with Django with minimal effort.

Debusine web UI and JavaScript

Debusine currently has 3 user interfaces: a client on the command line, a RESTful API, and a Django-based Web UI.

Debusine’s web UI is a tool to interact with the system, and we want to spend most of our efforts in creating a system that works and works well, rather than chasing the latest and hippest of the frontend frameworks for the web.

Also, Debian as a community has an aversion to having parts of the JavaScript ecosystem in the critical path of its core infrastructure, and in our professional experience this aversion is not at all unreasonable.

This leads to having some interesting requirements for the web UI, that (rather surprisingly, one would think) one doesn’t usually find advertised in many projects:

Straightforward to create and maintain.
Well integrated with Django.
Easy to package in Debian, with as little vendoring as possible, which helps mitigate supply chain attacks
Usable without JavaScript whenever possible, for progressive enhancement rather than core functionality.

The idea is to avoid growing the technical complexity and requirements of the web UI, both server-side and client-side, for functionality that is not needed for this kind of project, with tools that do not fit well in our ecosystem.

Also, to limit the complexity of the JavaScript portions that we do develop, we choose to limit our JavaScript browser supports to the main browser versions packaged in Debian Stable, plus recent oldstable.

This makes JavaScript easier to write and maintain, and it also makes it less needed, as modern HTML plus modern CSS interfaces can go a long way with less scripting interventions.

We recently encoded JavaScript practices and tradeoffs in a JavaScript Practices chapter of Debusine’s documentation.

How we use JavaScript

From the start we built the UI using Bootstrap, which helps in having responsive layouts that can also work on mobile devices.

When we started having large select fields, we introduced Select2 to make interaction more efficient, and which degrades gracefully to working HTML.

Both Bootstrap and Select2 are packaged in Debian.

Form validation is done server-side by Django, and we do not reimplement it client-side in JavaScript, as we prefer the extra round trip through a form submission to the risk of mismatches between the two validations.

In those cases where a UI task is not at all possible without JavaScript, we can make its support mandatory as long as the same goal can be otherwise achieved using the debusine client command.

Django messages as Bootstrap toasts

Django has a Messages framework that allows different parts of a view to push messages to the user, and it is useful to signal things like a successful form submission, or warnings on unexpected conditions.

Django messages integrate well with Bootstrap toasts, which use a recognisable notification language, are nicely dismissible and do not invade the rest of the page layout.

Since toasts require JavaScript to work, we added graceful degradation. to Bootstrap alerts

Doing so was surprisingly simple: we handle the toasts as usual, and also render the plain alerts inside a <noscript> tag.

This is precisely the intended usage of the <noscript> tag, and it works perfectly: toasts are displayed by JavaScript when it’s available, or rendered as alerts when not.

The resulting Django template is something like this:

<div aria-live="polite" aria-atomic="true" class="position-relative">
    <div class="toast-container position-absolute top-0 end-0 p-3">
    {% for message in messages %}
        <div class="toast" role="alert" aria-live="assertive" aria-atomic="true">
            <div class="toast-header">
                <strong class="me-auto">{{ message.level_tag|capfirst }}</strong>
                <button type="button"
                        class="btn-close"
                        data-bs-dismiss="toast"
                        aria-label="Close"></button>
            </div>
            <div class="toast-body">{{ message }}</div>
        </div>
    {% endfor %}
    </div>
</div>

<!-- … -->

{% if messages %}
<noscript>
    {% for message in messages %}
        <div class="alert alert-primary" role="alert">
            {{ message }}
        </div>
    {% endfor %}
</noscript>
{% endif %}

We have a webpage to test the result.

JavaScript incremental improvement of formsets

Debusine is built around workspaces, which are, among other things, containers for resources.

Workspaces can inherit from other workspaces, which act as fallback lookups for resources. This allows, for example, to maintain an experimental package to be built on Debian Unstable, without the need to copy the whole Debian Unstable workspace. A workspace can inherit from multiple others, which are looked up in order.

When adding UI to configure workspace inheritance, we faced the issue that plain HTML forms do not have a convenient way to perform data entry of an ordered list.

We initially built the data entry around Django formsets, which support ordering using an extra integer input field to enter the ordering position. This works, and it’s good as a fallback, but we wanted something more appropriate, like dragging and dropping items to reorder them, as the main method of interaction.

Our final approach renders the plain formset inside a <noscript> tag, and the JavaScript widget inside a display: none element, which is later shown by JavaScript code.

As the workspace inheritance is edited, JavaScript serializes its state into <form type='hidden'> fields that match the structure used by the formset, so that when the form is submitted, the view performs validation and updates the server state as usual without any extra maintenance burden.

Serializing state as hidden form fields looks a bit vintage, but it is an effective way of preserving the established data entry protocol between the server and the browser, allowing us to do incremental improvement of the UI while minimizing the maintenance effort.

More to come

Debusine is now gaining significant adoption and is still under active development, with new features like personal archives coming soon.

This will likely mean more user stories for the UI, so this is a design space that we are going to explore again and again in the coming future.

Meanwhile, you can try out Debusine on debusine.debian.net, and follow its development on salsa.debian.org!

Debian Contributions: Preparing for setup.py install deprecation, Salsa CI, Debian 13 "trixie" release and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Thu, 11 Sep 2025 00:00:00 +0000

Debian Contributions: 2025-08

Preparing for `setup.py install` deprecation, by Colin Watson

setuptools upstream will be removing the setup.py install command on 31 October. While this may not trickle down immediately into Debian, it does mean that in the near future nearly all Python packages will have to use pybuild-plugin-pyproject (though they don’t necessarily have to use pyproject.toml; this is just a question of how the packaging runs the build system). Some of the Python team talked about this a bit at DebConf, and Colin volunteered to write up some notes on cases where this isn’t straightforward. This page will likely grow as the team works on this problem.

Salsa CI, by Santiago Ruano Rincón

Santiago fixed some pending issues in the MR that moves the pipeline to sbuild+unshare, and after several months, Santiago was able to mark the MR as ready. Part of the recent fixes include handling external repositories, honoring the RELEASE autodetection from d/changelog (thanks to Ahmed Siam for spotting the main reason of the issue), and fixing a regression about the apt resolver for *-backports releases. Santiago is currently waiting for a final review and approval from other members of the Salsa CI team, and being able to merge it. Thanks to all the folks who have helped testing the changes or provided feedback so far. If you want to test the current MR, you need to include the following pipeline definition in your project’s CI config file:

---
include:
  - https://salsa.debian.org/santiago/pipeline/raw/sbuild-unshare-02-salsa-ci/salsa-ci.yml
  - https://salsa.debian.org/santiago/pipeline/raw/sbuild-unshare-02-salsa-ci/pipeline-jobs.yml

As a reminder, this MR will make the Salsa CI pipeline build the packages more similar to how it’s built by the Debian official builders. This will also save some resources, since the default pipeline will have one stage less (the provisioning) stage, and will make it possible for more projects to be built on salsa.debian.org (including large projects and those from the OCaml ecosystem), etc. See the different issues being fixed in the MR description.

Debian 13 “trixie” release, by Emilio Pozuelo Monfort

On August 9th, Debian 13 “trixie” was released, building on two years worth of updates and bug fixes from hundreds of developers. Emilio helped coordinate the release, communicating with several teams involved in the process.

DebConf 26 Site Visit, by Stefano Rivera

Stefano visited Santa Fe, Argentina, the site for DebConf 26 next year. The aim of the visit was to help build a local team and see the conference venue first-hand. Stefano and Nattie represented the DebConf Committee. The local team organized Debian meetups in Buenos Aires and Santa Fe, where Stefano presented a talk on Debian and DebConf. Venues were scouted and the team met with the university management and local authorities.

Miscellaneous contributions

Raphaël updated tracker.debian.org after the “trixie” release to add the new “forky” release in the set of monitored distributions. He also reviewed and deployed the work of Scott Talbert showing open merge requests from salsa in the “action needed” panel.
Raphaël reviewed some DEP-3 changes to modernize the embedded examples in light of the broad git adoption.
Raphaël configured new workflows on debusine.debian.net to upload to “trixie” and trixie-security, and officially announced the service on debian-devel-announce, inviting Debian developers to try the service for their next upload to unstable.
Carles created a merge request for django-compressor upstream to fix an error when concurrent node processing happened. This will allow removing a workaround added in openstack-dashboard and avoid the same bug in other projects that use django-compressor.
Carles prepared a system to detect packages that Recommends packages which don’t exist in unstable. Processed (either reported or ignored due to mis-detected problems or temporary problems) 16% of the reports. Will continue next month.
Carles got familiar and gave feedback for the freedict-wikdict package. Planned contributions with the maintainer to improve the package.
Helmut responded to queries related to /usr-move.
Helmut adapted crossqa.d.n to the release of “trixie”.
Helmut diagnosed sufficient failures in rebootstrap to make it work with gcc-15.
Helmut fixed the CI pipeline of debvm.
Helmut sent patches for 19 cross build problems.
Faidon discovered that the Multi-Arch hinter would emit confusing hints about :any annotations. Helmut identified the root cause to be the handling of virtual packages and fixed it.
Enrico took some dust off python-debiancontributors and prototyped a receiving end for salsa webpings, to start followup work to contributors.debian.org discussions at DebConf25.
Colin upgraded about 70 Python packages to new upstream versions, which is around 10% of the backlog; this included a complicated Pydantic upgrade in collaboration with the Rust team.
Colin fixed a bug in debbugs that caused incoming emails to bugs.debian.org with certain header contents to go missing.
Thorsten uploaded sane-airscan, which was already in experimental, to unstable.
Thorsten created a script to automate the upload of new upstream versions of foomatic-db. The database contains information about printers and regularly gets an update. Now it is possible to keep the package more up to date in Debian.
Stefano prepared updates to almost all of his packages that had new versions waiting to upload to unstable. (beautifulsoup4, hatch-vcs, mkdocs-macros-plugin, pypy3, python-authlib, python-cffi, python-mitogen, python-pip, python-pipx, python-progress, python-truststore, python-virtualenv, re2, snowball, soupsieve).
Stefano uploaded two new python3.13 point releases to unstable.
Stefano updated distro-info-data in stable releases, to document the “trixie” release and expected EoL dates.
Stefano did some debian.social sysadmin work (keeping up quotas with growing databases and filesystems).
Stefano supported the Debian treasurers in processing some of the DebConf 25 reimbursements.
Lucas uploaded ruby3.4 to experimental. It was already approved by FTP masters.
Lucas uploaded ruby-defaults to experimental to add support for ruby3.4. It will allow us to start triggering test rebuilds and catch any FTBFS with ruby3.4.
Lucas did some administrative work for Google Summer of Code (GSoC) and replied to some queries from mentors and students.
Anupa helped to organize release parties for Debian 13 and Debian Day events.
Anupa did the live coverage for the Debian 13 release and prepared the Bits post for the release announcement and 32nd Debian Day as part of the Debian Publicity team.
Anupa attended a Debian Day event organized by FOSS club SSET as a speaker.

Monthly report about Debian Long Term Support, August 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Thu, 11 Sep 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In August, 21 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 0.0h assigned and 14.0h from previous period), thus carrying over 4.0h to the next month.
Andrej Shadura did 12.0h (out of 9.0h assigned and 3.0h from previous period).
Bastien Roucariès did 20.0h (out of 19.75h assigned and 0.25h from previous period).
Ben Hutchings did 22.75h (out of 16.5h assigned and 6.25h from previous period).
Carlos Henrique Lima Melara did 10.0h (out of 10.0h assigned).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 23.25h (out of 23.25h assigned).
Emilio Pozuelo Monfort did 23.25h (out of 23.25h assigned).
Guilhem Moulin did 15.0h (out of 15.0h assigned).
Jochen Sprickerhof did 11.0h (out of 6.0h assigned and 16.75h from previous period), thus carrying over 11.75h to the next month.
Lee Garrett did 16.25h (out of 0.0h assigned and 16.25h from previous period).
Lucas Kanashiro did 20.0h (out of 1.25h assigned and 18.75h from previous period).
Markus Koschany did 5.0h (out of 13.0h assigned and 9.75h from previous period), thus carrying over 17.75h to the next month.
Paride Legovini did 8.0h (out of 0.0h assigned and 8.0h from previous period).
Roberto C. Sánchez did 7.5h (out of 11.75h assigned and 11.0h from previous period), thus carrying over 15.25h to the next month.
Santiago Ruano Rincón did 13.5h (out of 7.25h assigned and 7.75h from previous period), thus carrying over 1.5h to the next month.
Stefano Rivera did 0.5h (out of 0.0h assigned and 3.0h from previous period), thus carrying over 2.5h to the next month.
Sylvain Beucler did 10.0h (out of 23.25h assigned), thus carrying over 13.25h to the next month.
Thorsten Alteholz did 22.75h (out of 22.75h assigned).
Tobias Frost did 4.0h (out of 0.0h assigned and 12.0h from previous period), thus carrying over 8.0h to the next month.
Utkarsh Gupta did 16.0h (out of 22.75h assigned), thus carrying over 6.75h to the next month.

Evolution of the situation

In August, we released 27 DLAs.

The month of August marked the release of Debian 13 (codename “trixie”). This is worth noting because it brought with it the return of the customary fast development pace of Debian unstable, which included several contributions from LTS Team members. More on that below.

Of the many security updates which were published (and a few non-security updates as well), some notable ones are highlighted here.

Notable security updates:
- gnutls28 prepared by Adrian Bunk, fixes several potential denial of service vulnerabilities
- apache2, prepared by Bastien Roucariès, fixes several vulnerabilities including a potential denial of service and SSL/TLS-related access control
- mbedtls (original update, regression update) prepared by Andrej Shadura, fixes several potential denial of service and information disclosure vulnerabilities
- openjdk-17, prepared by Emilio Pozuelo Monfort, fixes several vulnerabilities which could result in denial of service, information disclosure or weakened TLS connections
Notable non-security updates:
- distro-info-data, prepared by Stefano Rivera, adds information concerning future Debian and Ubuntu releases
- ca-certificates-java, prepared by Bastien Roucariès, fixes some bugs which could disrupt future updates

The LTS Team continues to welcome the collaboration of maintainers from across the Debian community. The contributions of maintainers from outside the LTS Team include: postgresql-13 (Christoph Berg), sope (Jordi Mallach), thunderbird (Carsten Schoenert), and iperf3 (Roberto Lumbreras).

Finally, LTS Team members also contributed updates of the following packages:

redis (to stable), prepared by Chris Lamb
firebird3.0 (to oldstable and stable), prepared by Adrian Bunk
node-tmp (to oldstable, stable, and unstable), prepared by Adrian Bunk
openjpeg2 (to oldstable, stable, and unstable), prepared by Adrian Bunk
apache2 (to oldstable), prepared by Bastien Roucariès
unbound (to oldstable), prepared by Guilhem Moulin
luajit (to oldstable), prepared by Guilhem Moulin
golang-github-gin-contrib-cors (to oldstable and stable), prepared by Thorsten Alteholz
libcoap3 (to stable), prepared by Thorsten Alteholz
libcommons-lang-java and libcommons-lang3-java (both to unstable), prepared by Daniel Leidert
python-flask-cors (to oldstable), prepared by Daniel Leidert

The LTS Team would especially like to thank our many longtime friends and sponsors for their support and collaboration.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 119 months)
- Civil Infrastructure Platform (CIP) (for 87 months)
- VyOS Inc (for 51 months)
Gold sponsors:
- F. Hoffmann-La Roche AG (for 129 months)
- Akamai - Linode (for 123 months)
- Babiel GmbH (for 113 months)
- Plat’Home (for 112 months)
- University of Oxford (for 69 months)
- Deveryware (for 56 months)
- EDF SA (for 41 months)
- Dataport AöR (for 16 months)
- CERN (for 14 months)
Silver sponsors:
- Domeneshop AS (for 134 months)
- Nantes Métropole (for 128 months)
- Univention GmbH (for 120 months)
- Université Jean Monnet de St Etienne (for 120 months)
- Ribbon Communications, Inc. (for 114 months)
- Exonet B.V. (for 103 months)
- Leibniz Rechenzentrum (for 98 months)
- Ministère de l’Europe et des Affaires Étrangères (for 81 months)
- Cloudways by DigitalOcean (for 71 months)
- Dinahosting SL (for 69 months)
- Platform.sh SAS (for 63 months)
- Moxa Inc. (for 57 months)
- sipgate GmbH (for 55 months)
- OVH US LLC (for 53 months)
- Tilburg University (for 53 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 44 months)
- THINline s.r.o. (for 17 months)
- Copenhagen Airports A/S (for 11 months)
Bronze sponsors:
- Evolix (for 134 months)
- Seznam.cz, a.s. (for 134 months)
- Intevation GmbH (for 131 months)
- Linuxhotel GmbH (for 131 months)
- Daevel SARL (for 130 months)
- Megaspace Internet Services GmbH (for 129 months)
- Greenbone AG (for 128 months)
- NUMLOG (for 128 months)
- WinGo AG (for 127 months)
- Entr’ouvert (for 118 months)
- Adfinis AG (for 116 months)
- Tesorion (for 111 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 110 months)
- Bearstech (for 102 months)
- LiHAS (for 102 months)
- Catalyst IT Ltd (for 97 months)
- Demarcq SAS (for 91 months)
- Université Grenoble Alpes (for 77 months)
- TouchWeb SAS (for 69 months)
- SPiN AG (for 66 months)
- CoreFiling (for 62 months)
- Institut des sciences cognitives Marc Jeannerod (for 57 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 53 months)
- Tem Innovations GmbH (for 48 months)
- WordFinder.pro (for 47 months)
- CNRS DT INSU Résif (for 46 months)
- Soliton Systems K.K. (for 41 months)
- Alter Way (for 39 months)
- Institut Camille Jordan (for 29 months)
- SOBIS Software GmbH (for 14 months)
- Tuxera Inc. (for 5 months)

Monthly report about Debian Long Term Support, July 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 15 Aug 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In July, 17 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 19.0h (out of 19.0h assigned).
Andrej Shadura did 5.0h (out of 0.0h assigned and 8.0h from previous period), thus carrying over 3.0h to the next month.
Bastien Roucariès did 18.5h (out of 18.75h assigned), thus carrying over 0.25h to the next month.
Ben Hutchings did 12.5h (out of 3.25h assigned and 15.5h from previous period), thus carrying over 6.25h to the next month.
Carlos Henrique Lima Melara did 10.0h (out of 10.0h assigned).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 18.75h (out of 17.25h assigned and 1.5h from previous period).
Emilio Pozuelo Monfort did 18.75h (out of 18.75h assigned).
Guilhem Moulin did 15.0h (out of 14.0h assigned and 1.0h from previous period).
Jochen Sprickerhof did 2.0h (out of 16.5h assigned and 2.25h from previous period), thus carrying over 16.75h to the next month.
Lee Garrett did 7.0h (out of 0.0h assigned and 23.25h from previous period), thus carrying over 16.25h to the next month.
Markus Koschany did 9.0h (out of 18.75h assigned), thus carrying over 9.75h to the next month.
Roberto C. Sánchez did 10.25h (out of 18.5h assigned and 2.75h from previous period), thus carrying over 11.0h to the next month.
Santiago Ruano Rincón did 7.25h (out of 12.75h assigned and 2.25h from previous period), thus carrying over 7.75h to the next month.
Sylvain Beucler did 18.75h (out of 18.75h assigned).
Thorsten Alteholz did 15.0h (out of 15.0h assigned).
Utkarsh Gupta did 15.0h (out of 1.0h assigned and 14.0h from previous period).

Evolution of the situation

In July, we released 24 DLAs.

Notable security updates:
- angular.js, prepared by Bastien Roucariès, fixes multiple vulnerabilities including input sanitization and potential regular expression denial of service (ReDoS)
- tomcat9, prepared by Markus Koschany, fixes an assortment of vulnerabilities
- mediawiki, prepared by Guilhem Moulin, fixes several information disclosure and privilege escalation vulnerabilities
- php7.4, prepared by Guilhem Moulin, fixes several server side request forgery and denial of service vulnerabilities

This month’s contributions from outside the regular team include an update to thunderbird, prepared by Christoph Goehre (the package maintainer).

LTS Team members also contributed updates of the following packages:

commons-beanutils (to stable and unstable), prepared by Adrian Bunk
djvulibre (to oldstable, stable, and unstable), prepared by Adrian Bunk
git (to stable), prepared by Adrian Bunk
redis (to oldstable), prepared by Chris Lamb
libxml2 (to oldstable), prepared by Guilhem Moulin
commons-vfs (to oldstable), prepared by Daniel Leidert

Additionally, LTS Team member Santiago Ruano Rincón proposed and implemented an improvement to the debian-security-support package. This package is available so that interested users can quickly determine if any installed packages are subject to limited security support or are excluded entirely from security support. However, there was not previously a way to identify explicitly supported packages, which has become necessary to note exceptions to broad exclusion policies (e.g., those which apply to substantial package groups, like modules belonging to the Go and Rust language ecosystems). Santiago’s work has enabled the notation of exceptions to these exclusions, thus ensuring that users of debian-security-support have accurate status information concerning installed packages.

DebCamp 25 Security Tracker Sprint

The previously announced security tracker sprint took place at DebCamp from 7-13 July. Participants included 8 members of the standing LTS Team, 2 active Debian Developers with an interest in LTS, 3 community members, and 1 member of the Debian Security Team (who provided guidance and reviews on proposed changes to the security tracker); participation was a mix of in person at the venue in Brest, France and remote. During the days of the sprint, the team tackled a wide range of bugs and improvements, mostly targeting the security tracker.

The sprint participants worked on the following items:

Completed during the sprint:
- Implementation of a resource which provides an alternate view of the CVE history contained in the main security tracker
- Implementation of a feature which identifies CVEs that have been fixed via a DLA but which remain unfixed in more recent releases (associated tests are still a work in progress)
- A minor bug fix to the LTS Team’s CVE triage tooling
- Removal of some dead code
Still in progress as of the end of the sprint:
- Proposed implementation of support for vulnerabilities that don’t affect the binaries (only in the sources)
- Proposed implementation of support for tracking uploads to proposed-updates
- Continued work (which was in progress prior to the sprint) on tooling to export security tracker data in CSAF and VEX formats
- Proposed implementation of visual distinction between vulnerable/unimportant/ignored CVEs
- Proposed implementation of support for identifying CVEs that have been fixed in older and newer releases but which remain unfixed in LTS
- Proposed implementation of tooling that checks the consistency of the list of CVEs associated with a specific security update which is being prepared
- Draft documentation of the security tracker’s JSON data export schema
- Proposed clean-up of inconsistent historical entries in the DSA index
- Proposed improvement to how the security tracker handles requests for non-existent resources
- Proposed bug fix for inconsistencies in the security tracker JSON data export
- Proposed improvement to more accurate display of CVE states that are currently all shown as “fixed” (1 2)
- Proposed bug fix for turning URLs from text into clickable links
- A minor bug fix to the security tracker’s linkage to Ubuntu security resources
- Proposed implementation of the ability to identify CVEs for re-triage by the LTS Team
- Continued work (which was in progress prior to the sprint) on improved tooling to support security releases of packages from language ecosystems that rely heavily on static linking

As can be seen from the above list, only a small number of changes were brought to completion during the sprint week itself. Given the very compressed timeframe involved, the broad scope of tasks which were under consideration, and the highly sensitive data managed by the security tracker, this is not entirely unexpected and in no way diminishes the great work done by the sprint participants. The LTS Team would especially like to thank Salvatore Bonaccorso of the Debian Security Team for making himself available throughout the sprint to answer questions, for providing guidance on the work, and for helping the work by reviewing and merging the MRs which were able to merged during the sprint itself.

In the weeks that follow the sprint, the team will continue working towards completing the in progress items.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 118 months)
- Civil Infrastructure Platform (CIP) (for 86 months)
- VyOS Inc (for 50 months)
Gold sponsors:
- Roche Diagnostics International AG (for 128 months)
- Akamai - Linode (for 123 months)
- Babiel GmbH (for 112 months)
- Plat’Home (for 111 months)
- University of Oxford (for 68 months)
- Deveryware (for 55 months)
- EDF SA (for 40 months)
- Dataport AöR (for 15 months)
- CERN (for 13 months)
Silver sponsors:
- Domeneshop AS (for 133 months)
- Nantes Métropole (for 127 months)
- Univention GmbH (for 119 months)
- Université Jean Monnet de St Etienne (for 119 months)
- Ribbon Communications, Inc. (for 113 months)
- Exonet B.V. (for 103 months)
- Leibniz Rechenzentrum (for 97 months)
- Ministère de l’Europe et des Affaires Étrangères (for 81 months)
- Cloudways by DigitalOcean (for 70 months)
- Dinahosting SL (for 68 months)
- Platform.sh SAS (for 62 months)
- Moxa Inc. (for 56 months)
- sipgate GmbH (for 54 months)
- OVH US LLC (for 52 months)
- Tilburg University (for 52 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 43 months)
- THINline s.r.o. (for 16 months)
- Copenhagen Airports A/S (for 10 months)
Bronze sponsors:
- Evolix (for 133 months)
- Seznam.cz, a.s. (for 133 months)
- Intevation GmbH (for 130 months)
- Linuxhotel GmbH (for 130 months)
- Daevel SARL (for 129 months)
- Megaspace Internet Services GmbH (for 128 months)
- Greenbone AG (for 127 months)
- NUMLOG (for 127 months)
- WinGo AG (for 126 months)
- Entr’ouvert (for 118 months)
- Adfinis AG (for 115 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 110 months)
- Tesorion (for 110 months)
- Bearstech (for 101 months)
- LiHAS (for 101 months)
- Catalyst IT Ltd (for 96 months)
- Demarcq SAS (for 90 months)
- Université Grenoble Alpes (for 76 months)
- TouchWeb SAS (for 68 months)
- SPiN AG (for 65 months)
- CoreFiling (for 61 months)
- Institut des sciences cognitives Marc Jeannerod (for 56 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 52 months)
- Tem Innovations GmbH (for 47 months)
- WordFinder.pro (for 47 months)
- CNRS DT INSU Résif (for 45 months)
- Soliton Systems K.K. (for 41 months)
- Alter Way (for 38 months)
- Institut Camille Jordan (for 28 months)
- SOBIS Software GmbH (for 13 months)
- Tuxera Inc. (for 4 months)

Debian Contributions: DebConf 25, OpenSSH upgrades, Cross compilation collaboration and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 12 Aug 2025 00:00:00 +0000

Debian Contributions: 2025-07

DebConf 25, by Stefano Rivera and Santiago Ruano Rincón

In July, DebConf 25 was held in Brest, France. Freexian was a gold sponsor and most of the Freexian team attended the event. Many fruitful discussions were had amongst our team and within the Debian community.

DebConf itself was organized by a local team in Brest, that included Santiago (who now lives in Uruguay). Stefano was also deeply involved in the organization, as a DebConf committee member, core video team, and the lead developer for the conference website. Running the conference took an enormous amount of work, consuming all of Stefano and Santiago’s time for most of July.

Lucas Kanashiro was active in the DebConf content team, reviewing talks and scheduling them. There were many last-minute changes to make during the event.

Anupa Ann Joseph was part of the Debian publicity team doing live coverage of DebConf 25 and was part of the DebConf 25 content team reviewing the talks. She also assisted the local team to procure the lanyards.

Recorded sessions presented by Freexian collaborators, often alongside other friends in Debian, included:

Welcome to Debconf 25! (Santiago, Anupa, and others)
Debian.net Team BoF (Stefano and others)
Publicity Team BoF (Anupa and others)
Using Debusine to pre-test your unstable uploads (Colin)
Reviving (un)schroot? (Helmut)
Debusine Workflow BoF (Enrico and Colin)
Debian LTS BoF (Lucas, Santiago, and others)
Meet the Technical Committee (Stefano, Helmut, and others)
Debian Python BoF (Stefano)
Cross building BoF (Helmut)
Debian Outreach Session (Lucas)
Meet the people behind Debian Artwork (Anupa and others)
debian.social BoF (Stefano and others)
DebConf Committee BoF (Stefano and others)
Salsa CI BoF (Santiago and others)
DebConf 27: In your city? (Stefano and others)
Closing Ceremony (Santiago and many others)

OpenSSH upgrades, by Colin Watson

Towards the end of a release cycle, people tend to do more upgrade testing, and this sometimes results in interesting problems. Manfred Stock reported “No new SSH connections possible during large part of upgrade to Debian Trixie”, which would have affected many people upgrading from Debian 12 (bookworm), with potentially severe consequences for people upgrading remote systems. In fact, there were two independent problems that each led to much the same symptom:

As part of hardening the OpenSSH server, OpenSSH 9.8 split the monolithic sshd listener process into two pieces: a minimal network listener (still called sshd), and an sshd-session process dealing with each individual session. Before this change, when sshd received an incoming connection, it forked and re-executed itself with some special parameters to deal with it; after this change, it forks and executes sshd-session instead, and sshd no longer accepts the parameters it used to accept for this.

Debian package upgrades happen (roughly) in two phases: first we unpack the new files onto disk, and then we run some configuration steps which usually include things like restarting services. Normally this is fine, because the old service keeps on working until it’s restarted. In this case, unpacking the new files onto disk immediately stopped new SSH connections from working: the old sshd received the connection and tried to hand it off to a freshly-executed copy of the new sshd binary on disk, which no longer supports this. This wasn’t much of a problem when upgrading OpenSSH on its own or with a small number of other packages, but in release upgrades it left a large gap when you can’t SSH to the system any more, and if anything fails in that interval then you could be in trouble.

After trying a couple of other approaches, Colin landed on the idea of having the openssh-server package divert /usr/sbin/sshd to /usr/sbin/sshd.session-split before the unpack step of an upgrade from before 9.8, then removing the diversion and moving the new file into place once it’s ready to restart the service. This reduces the period when new connections fail to a minimum.
Most OpenSSH processes, including sshd, check for a compatible version of the OpenSSL library when they start up. This check used to be very picky, among other things requiring both the major and minor part of the version number to match. OpenSSL 3 has a better versioning policy, and so OpenSSH 9.4p1 relaxed this check.

Unfortunately, bookworm shipped with OpenSSH 9.2p1, so as soon as you unpacked the new OpenSSL library during an upgrade, sshd stopped working. This couldn’t be fixed by a change in trixie; we needed to change bookworm in advance of the upgrade so that it would tolerate newer versions of OpenSSL, and time was tight if we wanted this to be available before the release of Debian 13.

Fortunately, there’s a stable-updates mechanism for exactly this sort of thing, and the stable release managers kindly accepted Colin’s proposal to fix this there.

The net result is that if you apply updates to bookworm (including stable-updates / bookworm-updates, which is enabled by default) before starting the upgrade to trixie, everything should be fine.

Cross compilation collaboration, by Helmut Grohne

Supporting cross building in Debian packages touches lots of areas of the archive and quite some of these matters reside in shared responsibility between different teams. Hence, DebConf was an ideal opportunity to settle long-standing issues.

Fortran: agreements reached on how to proceed (thanks to Alastair McKinstry)
Go: agreements reached on how to proceed (thanks to Mathias Gibbens)
Perl: fixed long-standing pkg-config interaction problem (thanks to gregor herrmann)
Python: no conclusion reached regarding dependency duplication (python3-dev:any, libpython3-dev) yet
Qt/KDE: found a way forward for kconf_update (thanks to Aurélien COUDERC)
Ruby: fixed problem affecting any ruby extension build (thanks to Lucas)

The cross building bof sparked lively discussions as a significant fraction of developers employ cross builds to get their work done. In the trixie release, about two thirds of the packages can satisfy their cross Build-Depends and about half of the packages actually can be cross built.

Miscellaneous contributions

Raphaël Hertzog updated tracker.debian.org to remove references to Debian 10 which was moved to archive.debian.org, and had many fruitful discussions related to Debusine during DebConf 25.
Carles Pina prepared some data, questions and information for the DebConf 25 l10n and i18n BoF.
Carles Pina demoed and discussed possible next steps for po-debconf-manager with different teams in DebConf 25. He also reviewed Catalan translations and sent them to the packages.
Carles Pina started investigating a django-compressor bug: reproduced the bug consistently and prepared a PR for django-compressor upstream (likely more details next month). Looked at packaging frictionless-py.
Stefano Rivera triaged Python CVEs against pypy3.
Stefano prepared an upload of a new upstream release of pypy3 to Debian experimental (due to the freeze).
Stefano uploaded python3.14 RC1 to Debian experimental.
Thorsten Alteholz uploaded a new upstream version of sane-airscan to experimental. He also started to work on a new upstream version of hplip.
Colin backported fixes for CVE-2025-50181 and CVE-2025-50182 in python-urllib3, and fixed several other release-critical or important bugs in Python team packages.
Lucas uploaded ruby3.4 to experimental as a starting point for the ruby-defaults transition that will happen after Trixie release.
Lucas coordinated with the Release team the fix of the remaining RC bugs involving ruby packages, and got them all fixed.
Lucas, as part of the Debian Ruby team, kicked off discussions to improve internal process/tooling.
Lucas, as part of the Debian Outreach team, engaged in multiple discussions around internship programs we run and also what else we could do to improve outreach in the Debian project.
Lucas joined the Local groups BoF during DebConf 25 and shared all the good experiences from the Brazilian community and committed to help to document everything to try to support other groups.
Helmut spent significant time with Samuel Thibault on improving architecture cross bootstrap for hurd-any mostly reviewing Samuel’s patches. He proposed a patch for improving bash’s detection of its pipesize and a change to dpkg-shlibdeps to improve behavior for building cross toolchains.
Helmut reiterated the multiarch policy proposal with a lot of help from Nattie Mayer-Hutchings, Rhonda D’Vine and Stuart Prescott.
Helmut finished his work on the process based unschroot prototype that was the main feature of his talk (see above).
Helmut analyzed a multiarch-related glibc upgrade failure induced by a /usr-move mitigation of systemd and sent a patch and regression fix both of which reached trixie in time. Thanks to Aurelien Jarno and the release team for their timely cooperation.
Helmut resurrected an earlier discussion about changing the semantics of Architecture: all packages in a multiarch context in order to improve the long-standing interpreter problem. With help from Tollef Fog Heen better semantics were discovered and agreement was reached with Guillem Jover and Julian Andres Klode to consider this change. The idea is to record a concrete architecture for every Architecture: all package in the dpkg database and enable choosing it as non-native.
Helmut implemented type hints for piuparts.
Helmut reviewed and improved a patch set of Jochen Sprickerhof for debvm.
Anupa was involved in discussions with the Debian Women team during DebConf 25.
Anupa started working for the trixie release coverage and started coordinating release parties.
Emilio helped coordinate the release of Debian 13 trixie.

Secure boot signing with Debusine (by Colin Watson)

Colin Watson — Mon, 04 Aug 2025 00:00:00 +0000

Debusine aims to be an integrated solution to build, distribute and maintain a Debian-based distribution. At Debconf 25, we talked about using it to pre-test uploads to Debian unstable, and also touched on how Freexian is using it to help maintain the Debian LTS and ELTS projects.

When Debian 10 (buster) moved to ELTS status in 2024, this came with a new difficulty that hadn’t existed for earlier releases. Debian 10 added UEFI Secure Boot support, meaning that there are now signed variants of the boot loader and Linux kernel packages. Debian has a system where certain packages are configured as needing to be signed, and those packages include a template for a source package along with the unsigned objects themselves. The signing service generates detached signatures for all those objects, and then uses the template to build a source package that it uploads back to the archive for building in the usual way.

Once buster moved to ELTS, it could no longer rely on Debian’s signing service for all this. Freexian operates parallel infrastructure for the archive, and now needed to operate a parallel signing service as well. By early 2024 we were already planning to move ELTS infrastructure towards Debusine, and so it made sense to build a signing service there as well.

Separately, we were able to obtain a Microsoft signature for Freexian’s shim build, allowing us to chain this into the trust path for most deployed x86 machines.

Freexian can help other organizations running Debian derivatives through the same process, and can provide secure signing infrastructure to the standards required for UEFI Secure Boot.

Prior art

We considered both code-signing (Debian’s current implementation) and lp-signing (Ubuntu’s current implementation) as prior art. Neither was quite suitable for various reasons.

code-signing relies on polling a configured URL for each archive to fetch a GPG-signed list of signing requests, which would have been awkward for us to set up, and it assumes that unsigned packages are sufficiently trusted for it to be able to run dpkg -x and dpkg-source -b on them outside any containment. dpkg -x has had the occasional security vulnerability, so this seemed unwise for a service that might need to deal with signing packages for multiple customers.
lp-signing is a microservice accepting authenticated requests, and is careful to avoid needing to manipulate packages itself. However, this relies on a different and incompatible mechanism for indicating that packages should be signed, which wasn’t something we wanted to introduce in ELTS.

Workers

Debusine already had an established system of external workers that run tasks under various kinds of containment. This seems like a good fit: after all, what’s a request to sign a package but a particular kind of task? But there are some problems here: workers can run essentially arbitrary code (such as build scripts in source packages), and even though that’s under containment, we don’t want to give such machines access to highly-sensitive data such as private keys.

Fortunately, we’d already introduced the idea of different kinds of workers a few months beforehand, in order to be able to run privileged “server tasks” that have direct access to the Debusine database. We built on that and added “signing workers”, which are much like external workers except that they only run signing tasks, no other types of tasks run on them, and they have access to a private database with information about the keys managed by their Debusine instance. (Django’s support for multiple databases made this quite easy to arrange: we were able to keep everything in the same codebase.)

Key management

It’s obviously bad practice to store private key material in the clear, but at the same time the signing workers are essentially oracles that will return signatures on request while ensuring that the rest of Debusine has no access to private key material, so they need to be able to get hold of it themselves. Hardware security modules (HSMs) are designed for this kind of thing, but they can be inconvenient to manage when large numbers of keys are involved.

Some keys are more valuable than others. If the signing key used for an experimental archive leaks, the harm is unlikely to be particularly serious; but if the ELTS signing key leaks, many customers will be affected. To match this, we implemented two key protection arrangements for the time being: one suitable for low-value keys encrypts the key in software with a configured key and stores the public key and ciphertext in the database, while one suitable for high-value keys stores keys as PKCS #11 URIs that can be set up manually by an instance administrator. We packaged some YubiHSM tools to make this easier for our sysadmins.

The signing worker calls back to the Debusine server to check whether a given work request is authorized to use a given signing key. All operations related to private keys also produce an audit log entry in the private signing database, so we can track down any misuse.

Tasks

Getting Debusine to do anything new usually requires figuring out how to model the operation as a task. In this case, that was complicated by wanting to run as little code as possible on the signing workers: in particular, we didn’t want to do all the complicated package manipulations there.

The approach we landed on was a chain of three tasks:

ExtractForSigning runs on a normal external worker. It takes the result of a package build and picks out the individual files from it that need to be signed, storing them as separate artifacts.
Sign runs on a signing worker, and (of course) makes the actual signatures, storing them as artifacts.
AssembleSignedSource runs on a normal external worker. It takes the signed artifacts and produces a source package containing them, based on the template found in the unsigned binary package.

Workflows

Of course, we don’t want people to have to create all those tasks directly and figure out how to connect everything together for themselves, and that’s what workflows are good at. The make_signed_source workflow does all the heavy lifting of creating the right tasks with the right input data and making them depend on each other in the right ways, including fanning out multiple copies of all this if there are multiple architectures or multiple template packages involved. Since you probably don’t want to stop at just having the signed source packages, it also kicks off builds to produce signed binary packages.

Even this is too low-level for most people to use directly, so we wrapped it all up in our debian_pipeline workflow, which just needs to be given a few options to enable signing support (and those options can be locked down by workspace owners).

What’s next?

In most cases this work has been enough to allow ELTS to carry on issuing kernel security updates without too much disruption, which was the main goal; but there are other uses for a signing system. We included OpenPGP support from early on, which allows Debusine to sign its own builds, and we’ll soon be extending that to sign APT repositories hosted by Debusine.

The current key protection arrangements could use some work. Supporting automatically-generated software-encrypted keys and manually-generated keys in an HSM is fine as far as it goes, but it would be good to be able to have the best of both worlds by being able to automatically generate keys protected by an HSM. This needs some care, as HSMs often have quite small limits on the number of objects they can store at any one time, and the usual workaround is to export keys from the HSM “under wrap” (encrypted by a key known only to the HSM) so that they can be imported only when needed. We have a general idea of how to do this, but doing it efficiently will need care.

We’d be very interested in hearing from organizations that need this sort of thing, especially for Debian derivatives. Debusine provides lots of other features that can help you. Please get in touch with us at sales@freexian.com if any of this sounds useful to you.

Debian Contributions: unschroot, DebConf 25 preparations and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Sat, 12 Jul 2025 00:00:00 +0000

Debian Contributions: 2025-06

unschroot, by Helmut Grohne

Quite a while back, the sbuild maintainers added the unshare backend to enable better isolation of builds, but in doing so sbuild now effectively bundles a container runtime. unschroot is an attempt to separate containment from sbuild by implementing the same features and more in a schroot-compatible way. Last year, vague feature parity was achieved, but going beyond required changing the model from keeping state in the filesystem to keeping Linux namespaces as session state. A proof of concept is now available. While it still has sharp corners, it enables building packages on a squashfs with an overlayfs or id-mapped bind mounting of your ccache neither of which is possible with sbuild’s unshare backend. There shall be a DebConf25 presentation about this work.

DebConf 25, by Stefano Rivera, Santiago Ruano Rincón and Lucas Kanashiro

DebConf 25 is now under way in Brest, France. Santiago is part of the “local” team running the event, and Stefano Rivera is part of the DebConf committee, supporting the event, as well as the video team. Both have spent considerable time in the last month, getting things ready for DebConf. Lucas Kanashiro built the schedule for DebConf 25. Also followed-up on multiple requests from speakers and stakeholders.

Miscellaneous contributions

Carles did general maintenance on simplemonitor, qnetload and qdacco packages; provided simplemonitor upstream feedback on new feature.
Carles’s updates about po-debconf-manager: prepared for DebCamp/DebConf, used it for reviewing and merging different packages. Also fixed multispeech po-debconf templates.
Colin Watson found a crash in pterm (PuTTY’s terminal emulator) when running in a Wayland session, and backported the resulting upstream fix to trixie.
Colin responded to an upstream groff bug report about URLs being dropped from PDF output in some cases on Debian, and backported the fix to trixie.
Helmut dealt with issues related to /usr-move. Most prominently Christian Hofstaedler reported an upgrade failure. /usr-move is a contributing factor here as that’s what caused systemd to upgrade a number of Breaks and Replaces to Conflicts. dumat needed some help with dropping mips64el from testing and Theodore Ts’o forwarded a fuse2fs upgrade failure.
Helmut sent patches for 25 cross build failures.
Helmut debugged rebootstrap failures and worked around build failures related to gcc-15 when they had patches and sent ones otherwise.
Thorsten Alteholz uploaded cups to fix a FTBFS-bug. This bug was introduced by a change in systemd, which bumped the maximum number of open files. This resulted in a longer test duration that triggered a timeout so that the build failed. Thorsten also uploaded mtink and lprng, which got new translation files.
Lucas Kanashiro followed-up on multiple unblock requests for ruby packages due to reproducible builds fixes. All of them were accepted into trixie.
Lucas Kanashiro discussed license issues with upstream involving Redis 8 new license and the possibility of backporting patches to old versions with a different license. Outcome is that upstream is adding a new paragraph to their license to allow the backport for security fixes.
Lucas Kanashiro fixed multiple CVEs reported against valkey in unstable and trixie.
Lucas Kanashiro gave a Debian packaging course of 8 hours for students at a free software development course at the University of Sao Paulo.
Lucas Kanashiro fixed a couple of cross building issues in the ruby ecosystem with Helmut’s help.
Lucas Kanashiro is working on a debci fix for #1107645 (ongoing).
Stefano Rivera updated python-mitogen to the latest beta releases with upstream support for Ansible 12.
Stefano Rivera spent some time winding up DebConf 24 books.
Stefano Rivera fixed packages that were blocking cPython 3.13.5 from migrating to trixie, and filed an unblock request.
Stefano Rivera investigated a regression in cPython 3.13 that was breaking OpenStack Nova. There is a patch in progress for cPython, but it is not ready for use, yet.
Santiago reviewed different MRs in Salsa CI. For example, the MR !605 proposed by Aquila that aims to introduce a new debdiff job, as well as the autopkgtest MR !33 to extend the support to architectures other than amd64. Also reviewed MR !611 by Aayush Raj that fixes the autopkgtest images cleanup. And the MR !614, prepared by Charles, to change the suffix name used to bump the version used in the pipeline.
Anupa procured supplies needed for the DebConf ID tag for the DebConf registration team and co-ordinated its transport to the venue.
Anupa joined Nattie to complete the registration team tasks.

Monthly report about Debian Long Term Support, June 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Sat, 12 Jul 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In June, 20 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 14.0h assigned).
Adrian Bunk did 23.5h (out of 23.5h assigned).
Andreas Henriksson did 3.0h (out of 3.0h assigned and 17.0h from previous period), thus carrying over 17.0h to the next month.
Andrej Shadura did 2.0h (out of 3.0h assigned and 7.0h from previous period), thus carrying over 8.0h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 8.0h (out of 7.5h assigned and 16.0h from previous period), thus carrying over 15.5h to the next month.
Carlos Henrique Lima Melara did 12.0h (out of 12.0h assigned).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 22.0h (out of 22.5h assigned and 1.0h from previous period), thus carrying over 1.5h to the next month.
Emilio Pozuelo Monfort did 23.5h (out of 16.75h assigned and 6.75h from previous period).
Guilhem Moulin did 14.0h (out of 11.5h assigned and 3.5h from previous period), thus carrying over 1.0h to the next month.
Jochen Sprickerhof did 21.0h (out of 0.5h assigned and 22.75h from previous period), thus carrying over 2.25h to the next month.
Lucas Kanashiro did 20.0h (out of 20.0h assigned).
Markus Koschany did 23.25h (out of 17.0h assigned and 6.25h from previous period).
Roberto C. Sánchez did 21.25h (out of 20.75h assigned and 3.25h from previous period), thus carrying over 2.75h to the next month.
Santiago Ruano Rincón did 12.75h (out of 15.0h assigned), thus carrying over 2.25h to the next month.
Sean Whitton did 1.0h (out of 4.25h assigned and 1.75h from previous period), thus carrying over 5.0h to the next month.
Sylvain Beucler did 23.5h (out of 23.5h assigned).
Thorsten Alteholz did 15.0h (out of 15.0h assigned).
Tobias Frost did 2.5h (out of 12.0h assigned), thus carrying over 9.5h to the next month.

Evolution of the situation

In June, we released 35 DLAs.

Notable security updates:
- mariadb-10.5, prepared by Otto Kekäläinen, fixes vulnerabilities which could result in denial of service, information disclosure, or unauthorized data modification
- python-django, prepared by Chris Lamb, fixes vulnerabilities which would result in log injection or denial of service
- webkit2gtk, prepared by Emilio Pozuelo Monfort, fixes many vulnerabilities which could results in a wide range of issues
- xorg-server, prepared by Emilio Pozuelo Monfort, fixes multiple vulnerabilities which may result in privilege escalation
- sudo, prepared by Thorsten Alteholz, fixes a vulnerability which could result in privilege escalation
Notable non-security updates:
- debian-security-support, prepared by Santiago Ruano Rincón, updates status of packages which receive limited security support or which have reached the end of security support
- dns-root-data, prepared by Sylvain Beucler, updates the DNSSEC trust anchors

This month’s contributions from outside the regular team include the mariadb-10.5 update mentioned above, prepared by Otto Kekäläinen (the package maintainer); an update to libfile-find-rule-perl, prepared by Salvatore Bonaccorso (a member of the Debian Security Team); an update to activemq, prepared by Emmanuel Arias (a maintainer of the package).

Additionally, LTS Team members contributed stable updates of the following packages:

curl, prepared by Carlos Henrique Lima Melara
python-tornado, prepared by Daniel Leidert
python-flask-cors, prepared by Daniel Leidert
common-vfs, prepared by Daniel Leidert
cjson, prepared by Adrian Bunk
icu, prepared by Adrian Bunk
node-tar-fs, prepared by Adrian Bunk
rar, prepared by Adrian Bunk

Something of particular noteworthiness is that LTS contributor Carlos Henrique Lima Melara discovered a regression in the upstream fix for CVE-2023-2753 in curl. The corrective action which he took included providing a patch to upstream, uploading a stable update of curl, and further updating the version of curl in LTS.

DebConf, the annual Debian Conference, is coming up in July and, as is customary each year, the week preceding the conference will feature an event called DebCamp. The DebCamp week provides an opportunity for teams and other interested groups/individuals to meet together in person in the same venue as the conference itself, with the purpose of doing focused work, often called “sprints”. LTS coordinator Roberto C. Sánchez has announced that the LTS Team is planning to hold a sprint primarily focused on the Debian security tracker and the associated tooling used by the LTS Team and the Debian Security Team.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 117 months)
- Civil Infrastructure Platform (CIP) (for 85 months)
- VyOS Inc (for 49 months)
Gold sponsors:
- Roche Diagnostics International AG (for 127 months)
- Akamai - Linode (for 121 months)
- Babiel GmbH (for 111 months)
- Plat’Home (for 110 months)
- University of Oxford (for 67 months)
- Deveryware (for 54 months)
- EDF SA (for 39 months)
- Dataport AöR (for 14 months)
- CERN (for 12 months)
Silver sponsors:
- Domeneshop AS (for 132 months)
- Nantes Métropole (for 126 months)
- Univention GmbH (for 118 months)
- Université Jean Monnet de St Etienne (for 118 months)
- Ribbon Communications, Inc. (for 112 months)
- Exonet B.V. (for 102 months)
- Leibniz Rechenzentrum (for 96 months)
- Ministère de l’Europe et des Affaires Étrangères (for 80 months)
- Cloudways by DigitalOcean (for 69 months)
- Dinahosting SL (for 67 months)
- Platform.sh SAS (for 61 months)
- Moxa Inc. (for 55 months)
- sipgate GmbH (for 53 months)
- OVH US LLC (for 51 months)
- Tilburg University (for 51 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 42 months)
- THINline s.r.o. (for 15 months)
- Copenhagen Airports A/S (for 9 months)
Bronze sponsors:
- Evolix (for 132 months)
- Seznam.cz, a.s. (for 132 months)
- Intevation GmbH (for 129 months)
- Linuxhotel GmbH (for 129 months)
- Daevel SARL (for 128 months)
- Megaspace Internet Services GmbH (for 127 months)
- Greenbone AG (for 126 months)
- NUMLOG (for 126 months)
- WinGo AG (for 125 months)
- Entr’ouvert (for 116 months)
- Adfinis AG (for 114 months)
- Tesorion (for 109 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 108 months)
- Bearstech (for 100 months)
- LiHAS (for 100 months)
- Catalyst IT Ltd (for 95 months)
- Demarcq SAS (for 89 months)
- Université Grenoble Alpes (for 75 months)
- TouchWeb SAS (for 67 months)
- SPiN AG (for 64 months)
- CoreFiling (for 60 months)
- Institut des sciences cognitives Marc Jeannerod (for 55 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 51 months)
- Tem Innovations GmbH (for 46 months)
- WordFinder.pro (for 45 months)
- CNRS DT INSU Résif (for 44 months)
- Soliton Systems K.K. (for 39 months)
- Alter Way (for 37 months)
- Institut Camille Jordan (for 27 months)
- SOBIS Software GmbH (for 12 months)
- Tuxera Inc. (for 3 months)

Debian Contributions: Updated Austin, DebConf 25 preparations continue and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Wed, 11 Jun 2025 00:00:00 +0000

Debian Contributions: 2025-05

Updated Austin, by Colin Watson and Helmut Grohne

Austin is a frame stack sampling profiler for Python. It allows profiling Python applications without instrumenting them while losing some accuracy in the process, and is the only one of its kind presently packaged for Debian. Unfortunately, it hadn’t been uploaded in a while and hence the last Python version it worked with was 3.8. We updated it to a current version and also dealt with a number of architecture-specific problems (such as unintended sign promotion, 64bit time_t fallout and strictness due to -Wformat-security ) in cooperation with upstream. With luck, it will migrate in time for trixie.

Preparing for DebConf 25, by Stefano Rivera and Santiago Ruano Rincón

DebConf 25 is quickly approaching, and the organization work doesn’t stop. In May, Stefano continued supporting the different teams. Just to give a couple of examples, Stefano made changes in DebConf 25 website to make BoF and sprints submissions public, so interested people can already know if a BoF or sprint for a given subject is planned, allowing coordination with the proposer; or to enhance how statistics are made public to help the work of the local team.

Santiago has participated in different tasks, including the logistics of the conference, like preparing more information about the public transportation that will be available. Santiago has also taken part in activities related to fundraising and reviewing more event proposals.

Miscellaneous contributions

Lucas fixed security issues in Valkey in unstable.
Lucas tried to help with the update of Redis to version 8 in unstable. The package hadn’t been updated for a while due to licensing issues, but now upstream maintainers fixed them.
Lucas uploaded around 20 ruby-* packages to unstable that weren’t updated for some years to make them build reproducible. Thanks to reproducible builds folks to point out those issues. Also some unblock requests (and follow-ups) were needed to make them reach trixie in time for the release.
Lucas is organizing a Debian Outreach session for DebConf 25, reaching out to all interns of Google Summer of Code and Outreachy programs from the last year. The session will be presented by in-person interns and also video recordings from the interns interested in participating but did not manage to attend the conference.
Lucas continuously works on DebConf Content team tasks. Replying to speakers, sponsors, and communicating internally with the team.
Carles improved po-debconf-manager: fixed bugs reported by Catalan translator, added possibility to import packages out of salsa, added using non-default project branches on salsa, polish to get ready for DebCamp.
Carles tested new “apt” in trixie and reported bugs to “apt”, “installation-report”, “libqt6widget6”.
Carles used po-debconf-manager and imported remaining 80 packages, reviewed 20 translations, submitted (MR or bugs) 54 translations.
Carles prepared some topics for translation BoF in DebConf (gathered feedback, first pass on topics).
Helmut gave an introductory talk about the mechanics of Linux namespaces at MiniDebConf Hamburg.
Helmut sent 25 patches for cross compilation failures.
Helmut reviewed, refined and applied a patch from Jochen Sprickerhof to make the Multi-Arch hinter emit more hints for pure Python modules.
Helmut sat down with Christoph Berg (not affiliated with Freexian) and extended unschroot to support directory-based chroots with overlayfs. This is a feature that was lost in transitioning from sbuild’s schroot backend to its unshare backend. unschroot implements the schroot API just enough to be usable with sbuild and otherwise works a lot like the unshare backend. As a result, apt.postgresql.org now performs its builds contained in a user namespace.
Helmut looked into a fair number of rebootstrap failures most of which related to musl or gcc-15 and imported patches or workarounds to make those builds proceed.
Helmut updated dumat to use sqop fixing earlier PGP verification problems thanks to Justus Winter and Neal Walfield explaining a lot of sequoia at MiniDebConf Hamburg.
Helmut got the previous zutils update for /usr-move wrong again and had to send another update.
Helmut looked into why debvm’s autopkgtests were flaky and with lots of help from Paul Gevers and Michael Tokarev tracked it down to a race condition in qemu. He updated debvm to trigger the problem less often and also fixed a wrong dependency using Luca Boccassi’s patch.
Santiago continued the switch to sbuild for Salsa CI (that was stopped for some months), and has been mainly testing linux, since it’s a complex project that heavily customizes the pipeline. Santiago is preparing the changes for linux to submit a MR soon.
In openssh, Colin tracked down some intermittent sshd crashes to a root cause, and issued bookworm and bullseye updates for CVE-2025-32728.
Colin spent some time fixing up fail2ban, mainly reverting a patch that caused its tests to fail and would have banned legitimate users in some common cases.
Colin backported upstream fixes for CVE-2025-48383 (django-select2) and CVE-2025-47287 (python-tornado) to unstable.
Stefano supported video streaming and recording for 2 miniDebConfs in May: Maceió and Hamburg. These had overlapping streams for one day, which is a first for us.
Stefano packaged the new version of python-virtualenv that includes our patches for not including the wheel for wheel.
Stefano got all involved parties to agree (in principle) to meet at DebConf for a mediated discussion on a dispute that was brought to the technical committee.
Anupa coordinated the swag purchase for DebConf 25 with Juliana and Nattie.
Anupa joined the publicity team meeting for discussing the upcoming events and BoF at DebConf 25.
Anupa worked with the publicity team to publish Bits post to welcome GSoc 2025 Interns.

Monthly report about Debian Long Term Support, May 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Wed, 11 Jun 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In May, 22 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 8.0h (out of 0.0h assigned and 8.0h from previous period).
Adrian Bunk did 26.0h (out of 26.0h assigned).
Andreas Henriksson did 1.0h (out of 15.0h assigned and 3.0h from previous period), thus carrying over 17.0h to the next month.
Andrej Shadura did 3.0h (out of 10.0h assigned), thus carrying over 7.0h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 8.0h (out of 20.0h assigned and 4.0h from previous period), thus carrying over 16.0h to the next month.
Carlos Henrique Lima Melara did 12.0h (out of 11.0h assigned and 1.0h from previous period).
Chris Lamb did 15.5h (out of 0.0h assigned and 15.5h from previous period).
Daniel Leidert did 25.0h (out of 26.0h assigned), thus carrying over 1.0h to the next month.
Emilio Pozuelo Monfort did 21.0h (out of 16.75h assigned and 11.0h from previous period), thus carrying over 6.75h to the next month.
Guilhem Moulin did 11.5h (out of 8.5h assigned and 6.5h from previous period), thus carrying over 3.5h to the next month.
Jochen Sprickerhof did 3.5h (out of 8.75h assigned and 17.5h from previous period), thus carrying over 22.75h to the next month.
Lee Garrett did 26.0h (out of 12.75h assigned and 13.25h from previous period).
Lucas Kanashiro did 20.0h (out of 18.0h assigned and 2.0h from previous period).
Markus Koschany did 20.0h (out of 26.25h assigned), thus carrying over 6.25h to the next month.
Roberto C. Sánchez did 20.75h (out of 24.0h assigned), thus carrying over 3.25h to the next month.
Santiago Ruano Rincón did 15.0h (out of 12.5h assigned and 2.5h from previous period).
Sean Whitton did 6.25h (out of 6.0h assigned and 2.0h from previous period), thus carrying over 1.75h to the next month.
Sylvain Beucler did 26.25h (out of 26.25h assigned).
Thorsten Alteholz did 15.0h (out of 15.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).
Utkarsh Gupta did 1.0h (out of 15.0h assigned), thus carrying over 14.0h to the next month.

Evolution of the situation

In May, we released 54 DLAs.

The LTS Team was particularly active in May, publishing a higher than normal number of advisories, as well as helping with a wide range of updates to packages in stable and unstable, plus some other interesting work. We are also pleased to welcome several updates from contributors outside the regular team.

Notable security updates:
- containerd, prepared by Andreas Henriksson, fixes a vulnerability that could cause containers launched as non-root users to be run as root
- libapache2-mod-auth-openidc, prepared by Moritz Schlarb, fixes a vulnerability which could allow an attacker to crash an Apache web server with libapache2-mod-auth-openidc installed
- request-tracker4, prepared by Andrew Ruthven, fixes multiple vulnerabilities which could result in information disclosure, cross-site scripting and use of weak encryption for S/MIME emails
- postgresql-13, prepared by Bastien Roucariès, fixes an application crash vulnerability that could affect the server or applications using libpq
- dropbear, prepared by Guilhem Moulin, fixes a vulnerability which could potentially result in execution of arbitrary shell commands
- openjdk-17, openjdk-11, prepared by Thorsten Glaser, fixes several vulnerabilities, which include denial of service, information disclosure or bypass of sandbox restrictions
- glibc, prepared by Sean Whitton, fixes a privilege escalation vulnerability
Notable non-security updates:
- wireless-regdb, prepared by Ben Hutchings, updates information reflecting changes to radio regulations in many countries

This month’s contributions from outside the regular team include the libapache2-mod-auth-openidc update mentioned above, prepared by Moritz Schlarb (the maintainer of the package); the update of request-tracker4, prepared by Andrew Ruthven (the maintainer of the package); and the updates of openjdk-17 and openjdk-11, also noted above, prepared by Thorsten Glaser.

Additionally, LTS Team members contributed stable updates of the following packages:

rubygems and yelp/yelp-xsl, prepared by Lucas Kanashiro
simplesamlphp, prepared by Tobias Frost
libbson-xs-perl, prepared by Roberto C. Sánchez
fossil, prepared by Sylvain Beucler
setuptools and mydumper, prepared by Lee Garrett
redis and webpy, prepared by Adrian Bunk
xrdp, prepared by Abhijith PA
tcpdf, prepared by Santiago Ruano Rincón
kmail-account-wizard, prepared by Thorsten Alteholz

Other contributions were also made by LTS Team members to packages in unstable:

proftpd-dfsg DEP-8 tests (autopkgtests) were provided to the maintainer, prepared by Lucas Kanashiro
a regular upload of libsoup2.4, prepared by Sean Whitton
a regular upload of setuptools, prepared by Lee Garrett

Freexian, the entity behind the management of the Debian LTS project, has been working for some time now on the development of an advanced CI platform for Debian-based distributions, called Debusine. Recently, Debusine has reached a level of feature implementation that makes it very usable. Some members of the LTS Team have been using Debusine informally, and during May LTS coordinator Santiago Ruano Rincón has made a call for the team to help with testing of Debusine, and to help evaluate its suitability for the LTS Team to eventually begin using as the primary mechanism for uploading packages into Debian. Team members who have started using Debusine are providing valuable feedback to the Debusine development team, thus helping to improve the platform for all users. Actually, a number of updates, for both bullseye and bookworm, made during the month of May were handled using Debusine, e.g. rubygems’s DLA-4163-1.

By the way, if you are a Debian Developer, you can easily test Debusine following the instructions found at https://wiki.debian.org/DebusineDebianNet.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 116 months)
- Civil Infrastructure Platform (CIP) (for 84 months)
- VyOS Inc (for 48 months)
Gold sponsors:
- Roche Diagnostics International AG (for 126 months)
- Akamai - Linode (for 120 months)
- Babiel GmbH (for 110 months)
- Plat’Home (for 109 months)
- University of Oxford (for 66 months)
- Deveryware (for 53 months)
- EDF SA (for 38 months)
- Dataport AöR (for 13 months)
- CERN (for 11 months)
Silver sponsors:
- Domeneshop AS (for 131 months)
- Nantes Métropole (for 125 months)
- Univention GmbH (for 117 months)
- Université Jean Monnet de St Etienne (for 117 months)
- Ribbon Communications, Inc. (for 111 months)
- Exonet B.V. (for 100 months)
- Leibniz Rechenzentrum (for 95 months)
- Ministère de l’Europe et des Affaires Étrangères (for 78 months)
- Cloudways by DigitalOcean (for 68 months)
- Dinahosting SL (for 66 months)
- Bauer Xcel Media Deutschland KG (for 60 months)
- Platform.sh SAS (for 60 months)
- Moxa Inc. (for 54 months)
- sipgate GmbH (for 52 months)
- OVH US LLC (for 50 months)
- Tilburg University (for 50 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 41 months)
- THINline s.r.o. (for 14 months)
- Copenhagen Airports A/S (for 8 months)
Bronze sponsors:
- Evolix (for 131 months)
- Seznam.cz, a.s. (for 131 months)
- Intevation GmbH (for 128 months)
- Linuxhotel GmbH (for 128 months)
- Daevel SARL (for 127 months)
- Bitfolk LTD (for 126 months)
- Megaspace Internet Services GmbH (for 126 months)
- Greenbone AG (for 125 months)
- NUMLOG (for 125 months)
- WinGo AG (for 124 months)
- Entr’ouvert (for 115 months)
- Adfinis AG (for 113 months)
- Tesorion (for 108 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 107 months)
- Bearstech (for 99 months)
- LiHAS (for 99 months)
- Catalyst IT Ltd (for 94 months)
- Demarcq SAS (for 88 months)
- Université Grenoble Alpes (for 74 months)
- TouchWeb SAS (for 66 months)
- SPiN AG (for 63 months)
- CoreFiling (for 59 months)
- Institut des sciences cognitives Marc Jeannerod (for 54 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 50 months)
- Tem Innovations GmbH (for 45 months)
- WordFinder.pro (for 44 months)
- CNRS DT INSU Résif (for 43 months)
- Soliton Systems K.K. (for 38 months)
- Alter Way (for 36 months)
- Institut Camille Jordan (for 26 months)
- SOBIS Software GmbH (for 11 months)
- Tuxera Inc.

Monthly report about Debian Long Term Support, April 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 16 May 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In April, 22 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 56.25h (out of 56.25h assigned).
Andreas Henriksson did 15.0h (out of 20.0h assigned), thus carrying over 5.0h to the next month.
Andrej Shadura did 10.0h (out of 6.0h assigned and 4.0h from previous period).
Bastien Roucariès did 31.5h (out of 31.5h assigned).
Ben Hutchings did 8.0h (out of 0.0h assigned and 12.0h from previous period), thus carrying over 4.0h to the next month.
Carlos Henrique Lima Melara did 11.0h (out of 12.0h assigned), thus carrying over 1.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 26.0h (out of 26.0h assigned).
Emilio Pozuelo Monfort did 30.0h (out of 39.25h assigned and 0.25h from previous period), thus carrying over 9.5h to the next month.
Guilhem Moulin did 8.5h (out of 3.25h assigned and 11.75h from previous period), thus carrying over 6.5h to the next month.
Jochen Sprickerhof did 12.5h (out of 20.75h assigned and 9.25h from previous period), thus carrying over 17.5h to the next month.
Lee Garrett did 26.25h (out of 7.75h assigned and 31.75h from previous period), thus carrying over 13.25h to the next month.
Lucas Kanashiro did 50.0h (out of 0.0h assigned and 52.0h from previous period), thus carrying over 2.0h to the next month.
Markus Koschany did 39.5h (out of 39.5h assigned).
Roberto C. Sánchez did 9.0h (out of 0.0h assigned and 12.0h from previous period), thus carrying over 3.0h to the next month.
Santiago Ruano Rincón did 12.5h (out of 7.5h assigned and 7.5h from previous period), thus carrying over 2.5h to the next month.
Sean Whitton did 7.0h (out of 7.0h assigned).
Stefano Rivera did 0.5h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 9.5h to the next month.
Sylvain Beucler did 39.5h (out of 39.25h assigned and 0.25h from previous period).
Thorsten Alteholz did 15.0h (out of 15.0h assigned).
Tobias Frost did 12.0h (out of 7.75h assigned and 4.25h from previous period).
Utkarsh Gupta did 2.0h (out of 2.0h assigned).

Evolution of the situation

In April, we released 46 DLAs.

Notable security updates:
- jetty9, prepared by Markus Koschany, fixes an information disclosure and potential remote code execution vulnerability
- zabbix, prepared by Tobias Frost, fixes several vulnerabilities, encompassing denial of service, information disclosure or remote code inclusion
- glibc, prepared by Sean Whitton, fixes a buffer overflow vulnerability
Notable non-security updates:
- tzdata, prepared by Emilio Pozuelo Monfort, brings the latest timezone database release
- php-horde-editor and php-horde-imp, prepared by Sylvain Beucler, have been updated to switch from CKEditor v3, which is EOL, to CKEditor v4; this builds upon work done last month by Sylvain and Bastien for the complete removal of ckeditor3
- distro-info-data, prepared by Stefano Rivera, adds information concerning future Debian and Ubuntu releases

The LTS team continues to welcome the collaboration of maintainers and other interested parties from outside the regular team. In April, we had external updates contributed by: Yadd - lemonldap-ng and Moritz Schlarb - libapache2-mod-auth-openidc

A point release of the current stable Debian 12 (codename “bookworm”) is planned for mid-May and several LTS contributors have prepared packages for this update, many of them prepared in conjunction with related LTS updates of the same packages:

glib2.0, haproxy, imagemagick, poppler, and python-h11, prepared by Adrian Bunk
rubygems, prepared by Lucas Kanashiro
ruby3.1 (in collaboration with Lucas Kanashiro), twitter-bootstrap3, twitterboot-strap4, wpa, and erlang, prepared by Bastien Roucariès (corresponding updates of twitter-bootstrap3 and twitter-bootstrap4 were also uploaded to Debian unstable)
abseil, prepared by Tobias Frost (a corresponding update was also uploaded to Debian unstable)
vips, prepared by Guilhem Moulin

Additional updates of ruby3.3 and rubygems were prepared for Debian unstable by Lucas Kanashiro.

And finally, a highlight of our continued commitment to enhancing long term support efforts in upstream projects. Freexian, as the primary entity behind the management and execution of the LTS project, has partnered with Invisible Things Lab to extend the upstream security support of Xen 4.17, which is shipped in Debian 12 “bookworm” (the current stable release). This partnership will result in significantly improved lifecycle support for users of Xen on bookworm, and members of the LTS team will play a part in this endeavour. The Freexian announcement has additional details.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 115 months)
- Civil Infrastructure Platform (CIP) (for 83 months)
- VyOS Inc (for 47 months)
Gold sponsors:
- Roche Diagnostics International AG (for 125 months)
- Akamai - Linode (for 120 months)
- Babiel GmbH (for 109 months)
- Plat’Home (for 108 months)
- University of Oxford (for 65 months)
- Deveryware (for 53 months)
- EDF SA (for 37 months)
- Dataport AöR (for 12 months)
- CERN (for 10 months)
Silver sponsors:
- Domeneshop AS (for 130 months)
- Nantes Métropole (for 124 months)
- Univention GmbH (for 116 months)
- Université Jean Monnet de St Etienne (for 116 months)
- Ribbon Communications, Inc. (for 110 months)
- Exonet B.V. (for 100 months)
- Leibniz Rechenzentrum (for 94 months)
- Ministère de l’Europe et des Affaires Étrangères (for 78 months)
- Cloudways by DigitalOcean (for 67 months)
- Dinahosting SL (for 65 months)
- Bauer Xcel Media Deutschland KG (for 59 months)
- Platform.sh SAS (for 59 months)
- Moxa Inc. (for 53 months)
- sipgate GmbH (for 51 months)
- OVH US LLC (for 49 months)
- Tilburg University (for 49 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 40 months)
- THINline s.r.o. (for 13 months)
- Copenhagen Airports A/S (for 7 months)
Bronze sponsors:
- Seznam.cz, a.s. (for 131 months)
- Evolix (for 130 months)
- Intevation GmbH (for 127 months)
- Linuxhotel GmbH (for 127 months)
- Daevel SARL (for 126 months)
- Bitfolk LTD (for 125 months)
- Megaspace Internet Services GmbH (for 125 months)
- Greenbone AG (for 124 months)
- NUMLOG (for 124 months)
- WinGo AG (for 123 months)
- Entr’ouvert (for 115 months)
- Adfinis AG (for 112 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 107 months)
- Tesorion (for 107 months)
- Bearstech (for 98 months)
- LiHAS (for 98 months)
- Catalyst IT Ltd (for 93 months)
- Supagro (for 88 months)
- Demarcq SAS (for 87 months)
- Université Grenoble Alpes (for 73 months)
- TouchWeb SAS (for 65 months)
- SPiN AG (for 62 months)
- CoreFiling (for 58 months)
- Institut des sciences cognitives Marc Jeannerod (for 53 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 49 months)
- Tem Innovations GmbH (for 44 months)
- WordFinder.pro (for 44 months)
- CNRS DT INSU Résif (for 42 months)
- Soliton Systems K.K. (for 38 months)
- Alter Way (for 35 months)
- Institut Camille Jordan (for 25 months)
- SOBIS Software GmbH (for 10 months)
- Tuxera Inc.

Debian Contributions: DebConf 25 preparations, PyPA tools updates, Removing libcrypt-dev from build-essential and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Mon, 12 May 2025 00:00:00 +0000

Debian Contributions: 2025-04

DebConf 25 Preparations, by Stefano Rivera and Santiago Ruano Rincón

DebConf 25 preparations continue. In April, the bursary team reviewed and ranked bursary applications. Santiago Ruano Rincón examined the current state of the conference’s finances, to see if we could allocate any more money to bursaries. Stefano Rivera supported the bursary team’s work with infrastructure and advice and added some metrics to assist Santiago’s budget review. Santiago was also involved in different parts of the organization, including Content team matters, as reviewing the first of proposals, preparing public information about the new Academic Track; or coordinating different aspects of the Day trip activities and the Conference Dinner.

PyPA tools updates, by Stefano Rivera

Around the beginning of the freeze (in retrospect, definitely too late) Stefano looked at updating setuptools in the archive to 78.1.0. This brings support for more comprehensive license expressions (PEP-639), that people are expected to adopt soon upstream. While the reverse-autopkgtests all passed, it all came with some unexpected complications, and turned into a mini-transition. The new setuptools broke shebangs for scripts (pypa/setuptools#4952).

It also required a bump of wheel to 0.46 and wheel 0.46 now has a dependency outside the standard library (it de-vendored packaging). This meant it was no longer suitable to distribute a standalone wheel.whl file to seed into new virtualenvs, as virtualenv does by default. The good news here is that setuptools doesn’t need wheel any more, it included its own implementation of the bdist_wheel command, in 70.1. But the world hadn’t adapted to take advantage of this, yet. Stefano scrambled to get all of these issues resolved upstream and in Debian:

pip: Don’t check for wheel when invoked with --no-use-pep517 (pypa/pip#13330), automatically do --no-use-pep517 builds without wheel (pypa/pip#13358, rejected).
virtualenv: Don’t include wheel (pypa/virtualenv#2868) except on Python 3.8 (pypa/virtualenv#2876) as pip dropped Python 3.8 support in the same release that included #13330.
python3.13: Update bundled setuptools in test.wheeldata (python/cpython#132415).
python-cffi: No need to install wheel any more (python-cffi/cffi#165).

We’re now at the point where python3-wheel-whl is no longer needed in Debian unstable, and it should migrate to trixie.

Removing `libcrypt-dev` from `build-essential`, by Helmut Grohne

The crypt function was originally part of glibc, but it got separated to libxcrypt. As a result, libc6-dev now depends on libcrypt-dev. This poses a cycle during architecture cross bootstrap. As the number of packages actually using crypt is relatively small, Helmut proposed removing the dependency. He analyzed an archive rebuild kindly performed by Santiago Vila (not affiliated with Freexian) and estimated the necessary changes. It looks like we may complete this with modifications to less than 300 source packages in the forky cycle. Half of the bugs have been filed at this time. They are tracked with libcrypt-* usertags.

Miscellaneous contributions

Carles uploaded a new version of simplemonitor.
Carles improved the documentation of salsa-ci-team/pipeline regarding piuparts arguments.
Carles closed an FTBFS on gcc-15 on qnetload.
Carles worked on Catalan translations using po-debconf-manager: reviewed 57 translations and created their merge requests in salsa, created 59 bug reports for packages that didn’t merge in more than 30 days. Followed-up merge requests and comments in bug reports. Managed some translations manually for packages that are not in Salsa.
Lucas did some work on the DebConf Content and Bursary teams.
Lucas fixed multiple CVEs and bugs involving the upgrade from bookworm to trixie in ruby3.3.
Lucas fixed a CVE in valkey in unstable.
Stefano updated beautifulsoup4, python-authlib, python-html2text, python-packaging, python-pip, python-soupsieve, and unidecode.
Stefano packaged python-dependency-groups, a new vendored library in python-pip.
During an afternoon Bug Squashing Party in Montevideo, Santiago uploaded a couple of packages fixing RC bugs #1057226 and #1102487. The latter was a sponsored upload.
Thorsten uploaded new upstream versions of brlaser, ptouch-driver and sane-airscan to get the latest upstream bug fixes into Trixie.
Raphaël filed an upstream bug on zim for a graphical glitch that he has been experiencing.
Colin Watson upgraded openssh to 10.0p1 (also known as 10.0p2), and debugged various follow-up bugs. This included adding riscv64 support to vmdb2 in passing, and enabling native wtmpdb support so that wtmpdb last now reports the correct tty for SSH connections.
Colin fixed dput-ng’s –override option, which had never previously worked.
Colin fixed a security bug in debmirror.
Colin did his usual routine work on the Python team: 21 packages upgraded to new upstream versions, 8 CVEs fixed, and about 25 release-critical bugs fixed.
Helmut filed patches for 21 cross build failures.
Helmut uploaded a new version of debvm featuring a new tool debefivm-create to generate EFI-bootable disk images compatible with other tools such as libvirt or VirtualBox. Much of the work was prototyped in earlier months. This generalizes mmdebstrap-autopkgtest-build-qemu.
Helmut continued reporting undeclared file conflicts and suggested package removals from unstable.
Helmut proposed build profiles for libftdi1 and gnupg2. To deal with recently added dependencies in the architecture cross bootstrap package set.
Helmut managed the /usr-move transition. He worked on ensuring that systemd would comply with Debian’s policy. Dumat continues to locate problems here and there yielding discussion occasionally. He sent a patch for an upgrade problem in zutils.
Anupa worked with the Debian publicity team to publish Micronews and Bits posts.
Anupa worked with the DebConf 25 content team to review talk and event proposals for DebConf 25.

Freexian partners with Invisible Things Lab to extend security support for Xen hypervisor (by )

Tue, 29 Apr 2025 00:00:00 +0000

Freexian is pleased to announce a partnership with Invisible Things Lab to extend the security support of the Xen type-1 hypervisor version 4.17. Three years after its initial release, Xen 4.17, the version available in Debian 12 “bookworm”, will reach end-of-security-support status upstream on December 2025. The aim of our partnership with Invisible Things is to extend the security support until, at least, July 2027. We may also explore a possibility of extending the support until June 2028, to coincide with the end of Debian 12 LTS support-period.

The security support of Xen in Debian, since Debian 8 “jessie” until Debian 11 “bullseye”, reached its end before the end of the life cycle of the release. We aim then to significantly improve the situation of Xen in Debian 12. As with similar efforts, we would like to mention that this is an experiment and that we will do our best to make it a success. We are aiming to try and to extend the security support for Xen versions included in future Debian releases, including Debian 13 “trixie”.

In the long term, we hope that this effort will ultimately allow the Xen Project to increase the official security support period for Xen releases from the current three years to at least five years, with the extra work being funded by the community of companies benefiting from the longer support period.

If your company relies on Xen and wants to help sustain LTS versions of Xen, please reach out to us. For companies using Debian, the simplest way is to subscribe to Freexian’s Debian LTS offer at a gold level (or above) and let us know that you want to contribute to Xen LTS when you send in your subscription form. For others, please reach out to us at sales@freexian.com and we will figure out a way to help you contribute.

In the mean time, this initiative has been made possible thanks to the current LTS sponsors and ELTS customers. We hope the entire community of Debian and Xen users will benefit from this initiative.

For any queries you might have, please don’t hesitate to contact us at sales@freexian.com.

About Invisible Things Lab

Invisible Things Lab (ITL) offers low-level security consulting auditing services for x86 virtualization technologies; C, C++, and assembly codebases; Intel SGX; binary exploitation and mitigations; and more. ITL also specializes in Qubes OS and Gramine consulting, including deployment, debugging, and feature development.

Monthly report about Debian Long Term Support, March 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 28 Apr 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In March, 20 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 51.5h (out of 0.0h assigned and 51.5h from previous period).
Andreas Henriksson did 20.0h (out of 20.0h assigned).
Andrej Shadura did 6.0h (out of 10.0h assigned), thus carrying over 4.0h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 12.0h (out of 12.0h assigned and 12.0h from previous period), thus carrying over 12.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 26.0h (out of 23.0h assigned and 3.0h from previous period).
Emilio Pozuelo Monfort did 37.0h (out of 36.5h assigned and 0.75h from previous period), thus carrying over 0.25h to the next month.
Guilhem Moulin did 8.25h (out of 11.0h assigned and 9.0h from previous period), thus carrying over 11.75h to the next month.
Jochen Sprickerhof did 18.0h (out of 24.25h assigned and 3.0h from previous period), thus carrying over 9.25h to the next month.
Lee Garrett did 10.25h (out of 0.0h assigned and 42.0h from previous period), thus carrying over 31.75h to the next month.
Lucas Kanashiro did 4.0h (out of 0.0h assigned and 56.0h from previous period), thus carrying over 52.0h to the next month.
Markus Koschany did 27.25h (out of 27.25h assigned).
Roberto C. Sánchez did 8.25h (out of 7.0h assigned and 17.0h from previous period), thus carrying over 15.75h to the next month.
Santiago Ruano Rincón did 17.5h (out of 19.75h assigned and 5.25h from previous period), thus carrying over 7.5h to the next month.
Sean Whitton did 7.0h (out of 7.0h assigned).
Sylvain Beucler did 32.0h (out of 31.0h assigned and 1.25h from previous period), thus carrying over 0.25h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 7.75h (out of 12.0h assigned), thus carrying over 4.25h to the next month.
Utkarsh Gupta did 15.0h (out of 15.0h assigned).

Evolution of the situation

In March, we have released 31 DLAs.

Notable security updates:
- linux-6.1 (1 2)and linux, prepared by Ben Hutchings, fixed an extensive list of vulnerabilities
- firefox-esr, prepared by Emilio Pozuelo Monfort, fixed a variety of vulnerabilities
- intel-microcode, prepared by Tobias Frost, fixed several local privilege escalation, denial of service, and information disclosure vulnerabilities
- vim, prepared by Sean Whitton, fixed a multitude of vulnerabilities, including many application crashes, buffer overflows, and out-of-bounds reads

The recent trend of contributions from contributors external to the formal LTS team has continued. LTS contributor Sylvain Beucler reviewed and facilitated an update to openvpn proposed by Aquila Macedo, resulting in the publication of DLA 4079-1. Thanks a lot to Aquila for preparing the update.

The LTS Team continues to make contributions to the current stable Debian release, Debian 12 (codename “bookworm”). LTS contributor Bastien Roucariès prepared a stable upload of krb5 to ensure that fixes made in the LTS release, Debian 11 (codename “bullseye”) were also made available to stable users. Additional stable updates, for tomcat10 and jetty9, were prepared by LTS contributor Markus Koschany. And, finally, LTS contributor Utkarsh Gupta prepared stable updates for rails and ruby-rack.

LTS contributor Emilio Pozuelo Monfort has continued his ongoing improvements to the Debian security tracker and its associated tooling, making the data contained in the tracker more reliable and easing interaction with it.

The ckeditor3 package, which has been EOL by upstream for some time, is still depended upon by the PHP Horde packages in Debian. Sylvain, along with Bastien, did monumental work in coordinating with maintainers, security team fellows, and other Debian teams, to formally declare the EOL of the ckeditor3 package in Debian 11 and in Debian 12. Additionally, as a result of this work Sylvain has worked towards the removal of ckeditor3 as a dependency by other packages in order to facilitate the complete removal of ckeditor3 from all future Debian releases.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 114 months)
- Civil Infrastructure Platform (CIP) (for 82 months)
- VyOS Inc (for 47 months)
Gold sponsors:
- Roche Diagnostics International AG (for 125 months)
- Akamai - Linode (for 119 months)
- Babiel GmbH (for 108 months)
- Plat’Home (for 108 months)
- University of Oxford (for 65 months)
- Deveryware (for 52 months)
- EDF SA (for 36 months)
- Dataport AöR (for 12 months)
- CERN (for 9 months)
Silver sponsors:
- Domeneshop AS (for 129 months)
- Nantes Métropole (for 123 months)
- Univention GmbH (for 115 months)
- Université Jean Monnet de St Etienne (for 115 months)
- Ribbon Communications, Inc. (for 109 months)
- Exonet B.V. (for 99 months)
- Leibniz Rechenzentrum (for 93 months)
- Ministère de l’Europe et des Affaires Étrangères (for 77 months)
- Cloudways by DigitalOcean (for 66 months)
- Dinahosting SL (for 64 months)
- Bauer Xcel Media Deutschland KG (for 59 months)
- Platform.sh SAS (for 59 months)
- Moxa Inc. (for 53 months)
- sipgate GmbH (for 50 months)
- OVH US LLC (for 48 months)
- Tilburg University (for 48 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 40 months)
- Soliton Systems K.K. (for 37 months)
- THINline s.r.o. (for 13 months)
- Copenhagen Airports A/S (for 6 months)
Bronze sponsors:
- Evolix (for 130 months)
- Seznam.cz, a.s. (for 130 months)
- Linuxhotel GmbH (for 127 months)
- Intevation GmbH (for 126 months)
- Daevel SARL (for 125 months)
- Bitfolk LTD (for 124 months)
- Megaspace Internet Services GmbH (for 124 months)
- Greenbone AG (for 123 months)
- NUMLOG (for 123 months)
- WinGo AG (for 123 months)
- Entr’ouvert (for 114 months)
- Adfinis AG (for 112 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 106 months)
- Tesorion (for 106 months)
- Bearstech (for 98 months)
- LiHAS (for 98 months)
- Catalyst IT Ltd (for 92 months)
- Supagro (for 88 months)
- Demarcq SAS (for 86 months)
- Université Grenoble Alpes (for 72 months)
- TouchWeb SAS (for 65 months)
- SPiN AG (for 61 months)
- CoreFiling (for 57 months)
- Institut des sciences cognitives Marc Jeannerod (for 52 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 49 months)
- Tem Innovations GmbH (for 44 months)
- WordFinder.pro (for 43 months)
- CNRS DT INSU Résif (for 42 months)
- Alter Way (for 35 months)
- Institut Camille Jordan (for 25 months)
- SOBIS Software GmbH (for 9 months)
- Tuxera Inc.

Debian Contributions: Preparations for Trixie, Updated debvm, DebConf 25 registration website updates and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Wed, 09 Apr 2025 00:00:00 +0000

Debian Contributions: 2025-03

Preparing for Trixie, by Raphaël Hertzog

As we are approaching the trixie freeze, it is customary for Debian developers to review their packages and clean them up in preparation for the next stable release.

That’s precisely what Raphaël did with publican, a package that had not seen any change since the last Debian release and that partially stopped working along the way due to a major Perl upgrade. While upstream’s activity is close to zero, hope is not yet entirely gone as the git repository moved to a new location a couple of months ago and contained the required fix. Raphaël also developed another fix to avoid an annoying warning that was seen at runtime.

Raphaël also ensured that the last upstream version of zim was uploaded to Debian unstable, and developed a fix for gnome-shell-extension-hamster to make it work with GNOME 48 and thus ensure that the package does not get removed from trixie.

Abseil and re2 transition in Debian, by Stefano Rivera

One of the last transitions to happen for trixie was an update to abseil, bringing it up to 202407. This library is a dependency for one of Freexian’s customers, as well as blocking newer versions of re2, a package maintained by Stefano.

The transition had been stalled for several months while some issues with reverse dependencies were investigated and dealt with. It took a final push to make the transition happen, including fixing a few newly discovered problems downstream. The abseil package’s autopkgtests were (trivially) broken by newer cmake versions, and some tests started failing on PPC64 (a known issue upstream).

`debvm` uploaded, by Helmut Grohne

debvm is a command line tool for quickly creating a Debian-based virtual machine for testing purposes. Over time, it accumulated quite a few minor issues as well as CI failures. The most notorious one was an ARM32 failure present since August. It was diagnosed down to a glibc bug by Tj and Chris Hofstaedtler and little has happened since then. To have debvm work somewhat, it now contains a workaround for this situation. Few changes are expected to be noticeable, but related tools such as apt, file, linux, passwd, and qemu required quite a few adaptations all over the place. Much of the necessary debugging was contributed by others.

DebConf 25 Registration website, by Stefano Rivera and Santiago Ruano Rincón

DebConf 25, the annual Debian developer conference, is now open for registration. Other than preparing the conference website, getting there always requires some last minute changes to the software behind the registration interface and this year was no exception. Every year, the conference is a little different to previous years, and has some different details that need to be captured from attendees. And every year we make minor incremental improvements to fix long-standing problems.

New concepts this year included: brunch, the closing talks on the departure day, venue security clearance, partial contributions towards food and accommodation bursaries, and attendee-selected bursary budgets.

Miscellaneous contributions

Helmut uploaded guess-concurrency incorporating feedback from others.
Helmut reacted to rebootstrap CI results and adapted it to cope with changes in unstable.
Helmut researched real world /usr-move fallout though little was actually attributable. He also NMUed systemd unsuccessfully.
Helmut sent 12 cross build patches.
Helmut looked into undeclared file conflicts in Debian more systematically and filed quite some bugs.
Helmut attended the cross/bootstrap sprint in Würzburg. A report of the event is pending.
Lucas worked on the CFP and tracks definition for DebConf 25.
Lucas worked on some bits involving Rails 7 transition.
Carles investigated why the job piuparts on salsa-ci/pipeline was passing but was failing on piuparts.debian.org for simplemonitor package. Created an issue and MR with a suggested fix, under discussion.
Carles improved the documentation of salsa-ci/pipeline: added documentation for different variables.
Carles made debian-history package reproducible (with help from Chris Lamb).
Carles updated simplemonitor package (new upstream version), prepared a new qdacco version (fixed bugs in qdacco, packaged with the upgrade from Qt 5 to Qt 6).
Carles reviewed and submitted translations to Catalan for adduser, apt, shadow, apt-listchanges.
Carles reviewed, created merge-requests for translations to Catalan of 38 packages (using po-debconf-manager tooling). Created 40 bug reports for some merge requests that haven’t been actioned for some time.
Colin Watson fixed 59 RC bugs (including 26 packages broken by the long-overdue removal of dh-python’s dependency on python3-setuptools), and upgraded 38 packages (mostly Python-related) to new upstream versions.
Colin worked with Pranav P to track down and fix a dnspython autopkgtest regression on s390x caused by an endianness bug in pylsqpack.
Colin fixed a time-based test failure in python-dateutil that would have triggered in 2027, and contributed the fix upstream.
Colin fixed debconf to automatically use the noninteractive frontend if stdin is not a terminal.
Stefano bisected and fixed a pypy translation regression on Debian stable and older on 32-bit ARM.
Emilio coordinated and helped finish various transitions in light of the transition freeze.
Thorsten Alteholz uploaded cups-filters to fix an FTBFS with a new upstream version of qpdf.
With the aim of enhancing the support for packages related to Software Bill of Materials (SBOMs) in recent industrial standards, Santiago has worked on finishing the packaging of and uploaded CycloneDX python library. There is on-going work about SPDX python tools, but it requires (build-)dependencies currently not shipped in Debian, such as owlrl and pyshacl.
Anupa worked with the Publicity team to announce the Debian 12.10 point release.
Anupa with the support of Santiago prepared an announcement and announced the opening of CfP and Registrations for DebConf 25.

Monthly report about Debian Long Term Support, February 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 28 Mar 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In February, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 8.0h assigned and 6.0h from previous period), thus carrying over 4.0h to the next month.
Adrian Bunk did 12.0h (out of 0.0h assigned and 63.5h from previous period), thus carrying over 51.5h to the next month.
Andrej Shadura did 10.0h (out of 6.0h assigned and 4.0h from previous period).
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 12.0h (out of 8.0h assigned and 16.0h from previous period), thus carrying over 12.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 23.0h (out of 20.0h assigned and 6.0h from previous period), thus carrying over 3.0h to the next month.
Emilio Pozuelo Monfort did 53.0h (out of 53.0h assigned and 0.75h from previous period), thus carrying over 0.75h to the next month.
Guilhem Moulin did 11.0h (out of 3.25h assigned and 16.75h from previous period), thus carrying over 9.0h to the next month.
Jochen Sprickerhof did 27.0h (out of 30.0h assigned), thus carrying over 3.0h to the next month.
Lee Garrett did 11.75h (out of 9.5h assigned and 44.25h from previous period), thus carrying over 42.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Roberto C. Sánchez did 7.0h (out of 14.75h assigned and 9.25h from previous period), thus carrying over 17.0h to the next month.
Santiago Ruano Rincón did 19.75h (out of 21.75h assigned and 3.25h from previous period), thus carrying over 5.25h to the next month.
Sean Whitton did 6.0h (out of 6.0h assigned).
Sylvain Beucler did 52.5h (out of 14.75h assigned and 39.0h from previous period), thus carrying over 1.25h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 17.0h (out of 17.0h assigned).

Evolution of the situation

In February, we have released 38 DLAs.

Notable security updates:
- pam-u2f, prepared by Patrick Winnertz, fixed an authentication bypass vulnerability
- openjdk-17, prepared by Emilio Pozuelo Monfort, fixed an authorization bypass/information disclosure vulnerability
- firefox-esr, prepared by Emilio Pozuelo Monfort, fixed several vulnerabilities
- thunderbird, prepared by Emilio Pozuelo Monfort, fixed several vulnerabilities
- postgresql-13, prepared by Christoph Berg, fixed an SQL injection vulnerability
- freerdp2, prepared by Tobias Frost, fixed several vulnerabilities
- openssh, prepared by Colin Watson, fixed a machine-in-the-middle vulnerability

LTS contributors Emilio Pozuelo Monfort and Santiago Ruano Rincón coordinated the administrative aspects of LTS updates of postgresql-13 and pam-u2f, which were prepared by the respective maintainers, to whom we are most grateful.

As has become the custom of the LTS team, work is under way on a number of package updates targeting Debian 12 (codename “bookworm”) with fixes for a variety of vulnerabilities. In February, Guilhem Moulin prepared an upload of sssd, while several other updates are still in progress. Bastien Roucariès prepared an upload of krb5 for unstable as well.

Given the importance of the Debian Security Tracker to the work of the LTS Team, we regularly contribute improvements to it. LTS contributor Emilio Pozuelo Monfort reviewed and merged a change to improve performance, and then dealt with unexpected issues that arose as a result. He also made improvements in the processing of CVEs which are not applicable to Debian.

Looking to the future (the release of Debian 13, codename “trixie”, and beyond), LTS contributor Santiago Ruano Rincón has initiated a conversation among the broader community involved in the development of Debian. The purpose of the discussion is to explore ways to improve the long term supportability of packages in Debian, specifically by focusing effort on ensuring that each Debian release contains the “best” supported upstream version of packages with a history of security issues.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 113 months)
- Civil Infrastructure Platform (CIP) (for 81 months)
- VyOS Inc (for 46 months)
Gold sponsors:
- Roche Diagnostics International AG (for 124 months)
- Akamai - Linode (for 118 months)
- Babiel GmbH (for 107 months)
- Plat’Home (for 107 months)
- University of Oxford (for 64 months)
- Deveryware (for 51 months)
- EDF SA (for 35 months)
- Dataport AöR (for 11 months)
- CERN (for 8 months)
Silver sponsors:
- Domeneshop AS (for 128 months)
- Nantes Métropole (for 122 months)
- Univention GmbH (for 114 months)
- Université Jean Monnet de St Etienne (for 114 months)
- Ribbon Communications, Inc. (for 108 months)
- Exonet B.V. (for 98 months)
- Leibniz Rechenzentrum (for 92 months)
- Ministère de l’Europe et des Affaires Étrangères (for 76 months)
- Cloudways by DigitalOcean (for 65 months)
- Dinahosting SL (for 63 months)
- Bauer Xcel Media Deutschland KG (for 58 months)
- Platform.sh SAS (for 58 months)
- Moxa Inc. (for 52 months)
- sipgate GmbH (for 49 months)
- OVH US LLC (for 47 months)
- Tilburg University (for 47 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 39 months)
- Soliton Systems K.K. (for 36 months)
- THINline s.r.o. (for 12 months)
- Copenhagen Airports A/S (for 5 months)
Bronze sponsors:
- Evolix (for 129 months)
- Seznam.cz, a.s. (for 129 months)
- Linuxhotel GmbH (for 126 months)
- Intevation GmbH (for 125 months)
- Daevel SARL (for 124 months)
- Bitfolk LTD (for 123 months)
- Megaspace Internet Services GmbH (for 123 months)
- Greenbone AG (for 122 months)
- NUMLOG (for 122 months)
- WinGo AG (for 122 months)
- Entr’ouvert (for 113 months)
- Adfinis AG (for 111 months)
- GNI MEDIA (for 105 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 105 months)
- Tesorion (for 105 months)
- Bearstech (for 97 months)
- LiHAS (for 97 months)
- Catalyst IT Ltd (for 91 months)
- Supagro (for 87 months)
- Demarcq SAS (for 85 months)
- Université Grenoble Alpes (for 71 months)
- TouchWeb SAS (for 64 months)
- SPiN AG (for 60 months)
- CoreFiling (for 56 months)
- Institut des sciences cognitives Marc Jeannerod (for 51 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 48 months)
- Tem Innovations GmbH (for 43 months)
- WordFinder.pro (for 42 months)
- CNRS DT INSU Résif (for 41 months)
- Alter Way (for 34 months)
- Institut Camille Jordan (for 24 months)
- SOBIS Software GmbH (for 8 months)
- Tuxera Inc.

Debian Contributions: Debian.Social administration, DebConf 25 preparations, Fixing Time-based test failure in Python requests package and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 11 Mar 2025 00:00:00 +0000

Debian Contributions: 2025-02

Debian.Social administration, by Stefano Rivera

Over the last year, the Debian.social services outgrew the infrastructure that was supporting them. The matrix bridge in particular was hosted on a cloud instance backed by a large expensive storage volume. Debian.CH rented a new large physical server to host all these instances, earlier this year. Stefano set up Incus on the new physical machine and migrated all the old debian.social LXC Containers, libvirt VMs, and cloud instances into Incus-managed LXC containers.

Stefano set up Prometheus monitoring and alerts for the new infrastructure and a Grafana dashboard. The current stack of debian.social services seem to comfortably fit on the new machine, with good room to grow.

DebConf 25, by Santiago Ruano Rincón and Stefano Rivera

DebConf 25 preparations continue. The team is currently finalizing a budget. Stefano helped to review the current budget proposals and suggest approaches for balancing it.

Stefano installed a Zammad instance to organize queries from attendees, for the registration and visa teams.

Santiago continued discussions with possible caterers so we can have options for the different diet requirements and that could fit into the DebConf budget. Also, in collaboration with Anupa, Santiago pushed the first draft changes to document the venue information in the DebConf 25 website and how to get to Brest.

Time-based test failure in requests, by Colin Watson

Colin fixed a fun bug in the Python requests package. Santiago Vila has been running tests of what happens when Debian packages are built on a system in which time has been artificially set to somewhere around the end of the support period for the next Debian release, in order to make it easier to do things like issuing security updates for the lifetime of that release. In this case, the failure indicated an expired test certificate, and since the repository already helpfully included scripts to regenerate those certificates, it seemed natural to try regenerating them just before running tests. However, this failed for more obscure reasons and Colin spent some time investigating. This turned out to be because the test CA was missing the CA constraint and so recent versions of OpenSSL reject it; Colin sent a pull request to fix this.

Priority list for outdated packages, by Santiago Ruano Rincón

Santiago started a discussion on debian-devel about packages that have a history of security issues and that are outdated regarding new upstream releases. The goal of the mentioned effort is to have a prioritized list of packages needing some work, from a security point of view. Moreover, the aim of publicly sharing the list of packages with the Debian Developers community is to make it easier to look at the packages maintained by teams, or even other maintainers’ where help could be welcome. Santiago is planning to take into account the feedback provided in debian-devel and to propose a tooling that could help to regularly bring collective awareness of these packages.

Miscellaneous contributions

Carles worked on English to Catalan po-debconf translations: reviewed translations, created merge requests and followed up with developers for more than 30 packages using po-debconf-manager.
Carles helped users, fixed bugs and implemented downloading updated templates on po-debconf-manager.
Carles packaged a new upstream version of python-pyaarlo.
Carles improved reproducibility of qnetload (now reported as reproducible) and simplemonitor (followed up with upstream and pending update of Debian package).
Carles collaborated with debian-history package: fixed FTBFS from master branch, enabled salsa-ci and investigated reproducibility.
Emilio improved support for automatically marking CVEs as NOT-FOR-US in the security-tracker, closing #1073012.
Emilio updated xorg-server and xwayland in unstable, fixing the last round of security vulnerabilities.
Stefano prepared a few PyPy and cPython uploads, and started the python3.13-only transition.
Helmut Grohne sent patches for 24 cross build failures.
Helmut fixed two problems in the Debian /usr-merge analysis tool. In one instance, it would overmatch Debian bugs to issues and in another it would fail to recognize Pre-Depends as a conflict mechanism.
Helmut attempted making rebootstrap work for gcc-15 with limited success as very many packages FTBFS with gcc-15 due to using function declarations without arguments.
Helmut provided a change to the security-tracker that would pre-compute /data/json during database updates rather than on demand resulting in a reduced response time.
Colin uploaded OpenSSH security updates for testing/unstable, bookworm, bullseye, buster, and stretch.
Colin fixed upstream monitoring for 26 Python packages, and upgraded 54 packages (mostly Python-related, but also PuTTY) to new upstream versions.
Colin updated python-django in bookworm-backports to 4.2.18 (issuing BSA-121), and added new backports of python-django-dynamic-fixture and python-django-pgtrigger, all of which are dependencies of debusine.
Thorsten Alteholz finally managed to upload hplip to fix two release critical and some normal bugs. The next step in March would be to upload the latest version of hplip.
Faidon updated crun in unstable & trixie, resolving a long-standing request of enabling criu support and thus enabling podman with checkpoint/restore functionality (With gratitude to Salvatore Bonaccorso and Reinhard Tartler for the cooperation and collaboration).
Faidon uploaded a number of packages (librdkafka, libmaxminddb, python-maxminddb, lowdown, tox, tox-uv, pyproject-api, xiccd and gdnsd) bringing them up to date with new upstream releases, resolving various bugs.
Lucas Kanashiro uploaded some ruby packages involved in the Rails 7 transition with new upstream releases.
Lucas triaged a ruby3.1 bug (#1092595)) and prepared a fix for the next stable release update.
Lucas set up the needed wiki pages and updated the Debian Project status in the Outreachy portal, in order to send out a call for projects and mentors for the next round of Outreachy.
Anupa joined Santiago to prepare a list of companies to contact via LinkedIn for DebConf 25 sponsorship.
Anupa printed Debian stickers and sponsorship brochures, flyers for DebConf 25 to be distributed at FOSS ASIA summit 2025.
Anupa participated in the Debian publicity team meeting and discussed the upcoming events and tasks.
Raphaël packaged zim 0.76.1 and integrated an upstream patch for another regression that he reported.
Raphaël worked with the Debian System Administrators for tracker.debian.org to better cope with gmail’s requirement for mails to be authenticated.

Monthly report about Debian Long Term Support, January 2025 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 14 Feb 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In January, 20 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 8.0h (out of 14.0h assigned), thus carrying over 6.0h to the next month.
Adrian Bunk did 36.5h (out of 47.75h assigned and 52.25h from previous period), thus carrying over 63.5h to the next month.
Andrej Shadura did 11.0h (out of 11.0h assigned and 4.0h from previous period), thus carrying over 4.0h to the next month.
Arturo Borrero Gonzalez did 9.0h (out of 10.0h assigned), thus carrying over 1.0h to the next month.
Bastien Roucariès did 22.0h (out of 22.0h assigned).
Ben Hutchings did 8.0h (out of 21.0h assigned and 3.0h from previous period), thus carrying over 16.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 20.0h (out of 23.0h assigned and 3.0h from previous period), thus carrying over 6.0h to the next month.
Emilio Pozuelo Monfort did 34.0h (out of 7.0h assigned and 27.75h from previous period), thus carrying over 0.75h to the next month.
Guilhem Moulin did 3.25h (out of 20.0h assigned), thus carrying over 16.75h to the next month.
Jochen Sprickerhof did 23.0h (out of 15.0h assigned and 8.0h from previous period).
Lee Garrett did 15.75h (out of 8.5h assigned and 51.5h from previous period), thus carrying over 44.25h to the next month.
Lucas Kanashiro did 8.0h (out of 32.0h assigned and 32.0h from previous period), thus carrying over 56.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Roberto C. Sánchez did 14.75h (out of 13.5h assigned and 10.5h from previous period), thus carrying over 9.25h to the next month.
Santiago Ruano Rincón did 21.75h (out of 18.75h assigned and 6.25h from previous period), thus carrying over 3.25h to the next month.
Sean Whitton did 8.5h (out of 8.5h assigned).
Sylvain Beucler did 10.5h (out of 0.0h assigned and 49.5h from previous period), thus carrying over 39.0h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).

Evolution of the situation

In January, we have released 33 DLAs.

There were numerous security and non-security updates to Debian 11 (codename “bullseye”) during January.

Notable security updates:
- rsync, prepared by Thorsten Alteholz, fixed several CVEs (including information leak and path traversal vulnerabilities)
- tomcat9, prepared by Markus Koschany, fixed several CVEs (including denial of service and information disclosure vulnerabilities)
- ruby2.7, prepared by Bastien Roucariès, fixed several CVEs (including denial of service vulnerabilities)
- tiff, prepared by Adrian Bunk, fixed several CVEs (including NULL ptr, buffer overflow, use-after-free, and segfault vulnerabilities)
Notable non-security updates:
- linux-6.1, prepared by Ben Hutchings, has been packaged for bullseye (this was done specifically to provide a supported upgrade path for systems that currently use kernel packages from the “bullseye-backports” suite)
- debian-security-support, prepared by Santiago Ruano Rincón, which formalized the EOL of intel-mediasdk and node-matrix-js-sdk

In addition to the security and non-security updates targeting “bullseye”, various LTS contributors have prepared uploads targeting Debian 12 (codename “bookworm”) with fixes for a variety of vulnerabilities. Abhijith PA prepared an upload of puma; Bastien Roucariès prepared an upload of node-postcss with fixes for data processing and denial of service vulnerabilities; Daniel Leidert prepared updates for setuptools, python-asyncssh, and python-tornado; Lee Garrett prepared an upload of ansible-core; and Guilhem Moulin prepared updates for python-urllib3, sqlparse, and opensc. Santiago Ruano Rincón also worked on tracking and filing some issues about packages that need an update in recent releases to avoid regressions on upgrade. This relates to CVEs that were fixed in buster or bullseye, but remain open in bookworm. These updates, along with Santiago’s work on identifying and tracking similar issues, underscore the LTS Team’s commitment to ensuring that the work we do as part of LTS also benefits the current Debian stable release.

LTS contributor Sean Whitton also prepared an upload of jinja2 and Santiago Ruano Rincón prepared an upload of openjpeg2 for Debian unstable (codename “sid”), as part of the LTS Team effort to assist with package uploads to unstable.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 112 months)
- Civil Infrastructure Platform (CIP) (for 80 months)
- VyOS Inc (for 44 months)
Gold sponsors:
- Roche Diagnostics International AG (for 122 months)
- Akamai - Linode (for 116 months)
- Babiel GmbH (for 106 months)
- Plat’Home (for 105 months)
- University of Oxford (for 62 months)
- Deveryware (for 49 months)
- EDF SA (for 34 months)
- Dataport AöR (for 9 months)
- CERN (for 7 months)
Silver sponsors:
- Domeneshop AS (for 127 months)
- Nantes Métropole (for 121 months)
- Univention GmbH (for 113 months)
- Université Jean Monnet de St Etienne (for 113 months)
- Ribbon Communications, Inc. (for 107 months)
- Exonet B.V. (for 97 months)
- Leibniz Rechenzentrum (for 91 months)
- Ministère de l’Europe et des Affaires Étrangères (for 75 months)
- Cloudways by DigitalOcean (for 64 months)
- Dinahosting SL (for 62 months)
- Bauer Xcel Media Deutschland KG (for 56 months)
- Platform.sh SAS (for 56 months)
- Moxa Inc. (for 50 months)
- sipgate GmbH (for 48 months)
- OVH US LLC (for 46 months)
- Tilburg University (for 46 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 37 months)
- Soliton Systems K.K. (for 34 months)
- THINline s.r.o. (for 10 months)
- Copenhagen Airports A/S (for 4 months)
Bronze sponsors:
- Evolix (for 127 months)
- Seznam.cz, a.s. (for 127 months)
- Intevation GmbH (for 124 months)
- Linuxhotel GmbH (for 124 months)
- Daevel SARL (for 123 months)
- Bitfolk LTD (for 122 months)
- Megaspace Internet Services GmbH (for 122 months)
- Greenbone AG (for 121 months)
- NUMLOG (for 121 months)
- WinGo AG (for 120 months)
- Entr’ouvert (for 111 months)
- Adfinis AG (for 109 months)
- Tesorion (for 104 months)
- GNI MEDIA (for 103 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 103 months)
- Bearstech (for 95 months)
- LiHAS (for 95 months)
- Catalyst IT Ltd (for 90 months)
- Supagro (for 85 months)
- Demarcq SAS (for 84 months)
- Université Grenoble Alpes (for 70 months)
- TouchWeb SAS (for 62 months)
- SPiN AG (for 59 months)
- CoreFiling (for 55 months)
- Institut des sciences cognitives Marc Jeannerod (for 50 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 46 months)
- Tem Innovations GmbH (for 41 months)
- WordFinder.pro (for 40 months)
- CNRS DT INSU Résif (for 39 months)
- Alter Way (for 32 months)
- Institut Camille Jordan (for 22 months)
- SOBIS Software GmbH (for 7 months)

Debian Contributions: Python 3.13 as the default Python 3 version, Fixing qtpaths6 for cross compilation, sbuild support for Salsa CI, Rails 7 transition, DebConf preparations and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 11 Feb 2025 00:00:00 +0000

Debian Contributions: 2025-01

Python 3.13 is now the default Python 3 version in Debian, by Stefano Rivera and Colin Watson

The Python 3.13 as default transition has now completed. The next step is to remove Python 3.12 from the archive, which should be very straightforward, it just requires rebuilding C extension packages in no particular order. Stefano fixed some miscellaneous bugs blocking the completion of the 3.13 as default transition.

Fixing `qtpaths6` for cross compilation, by Helmut Grohne

While Qt5 used to use qmake to query installation properties, Qt6 is moving more and more to CMake and to ease that transition it relies on more qtpaths. Since this tool is not naturally aware of the architecture it is called for, it tends to produce results for the build architecture. Therefore, more than 100 packages were picking up a multiarch directory for the build architecture during cross builds. In collaboration with the Qt/KDE team and Sandro Knauß in particular (none affiliated with Freexian), we added an architecture-specific wrapper script in the same way qmake has one for Qt5 and Qt6 already. The relevant CMake module has been updated to prefer the triplet-prefixed wrapper. As a result, most of the KDE packages now cross build on unstable ready in time for the trixie release.

`/usr`-move, by Helmut Grohne

In December, Emil Södergren reported that a live-build was not working for him and in January, Colin Watson reported that the proposed mitigation for debian-installer-utils would practically fail. Both failures were to be attributed to a wrong understanding of implementation-defined behavior in dpkg-divert. As a result, all M18 mitigations had to be reviewed and many of them replaced. Many have been uploaded already and all instances have received updated patches.

Even though dumat has been in operation for more than a year, it gained recent changes. For one thing, analysis of architectures other than amd64 was requested. Chris Hofstaedler (not affiliated with Freexian) kindly provided computing resources for repeatedly running it on the larger set. Doing so revealed various cross-architecture undeclared file conflicts in gcc, glibc, and binutils-z80, but it also revealed a previously unknown /usr-move issue in rpi.rpi-common. On top of that, dumat produced false positive diagnostics and wrongly associated Debian bugs in some cases, both of which have now been fixed. As a result, a supposedly fixed python3-sepolicy issue had to be reopened.

rebootstrap, by Helmut Grohne

As much as we think of our base system as stable, it is changing a lot and the architecture cross bootstrap tooling is very sensitive to such changes requiring permanent maintenance. A problem that recently surfaced was that building a binutils cross toolchain would result in a binutils-for-host package that would not be practically installable as it would depend on a binutils-common package that was not built. This turned into an examination of binutils-common and noticing that it actually differed across architectures even though it should not. Johannes Schauer Marin Rodrigues (not affiliated with Freexian) and Colin Watson kindly helped brainstorm possible solutions. Eventually, Helmut provided a patch to move gprofng bits out of binutils-common. Independently, Matthias Klose (not affiliated with Freexian) split out binutils-gold into a separate source package. As a result, binutils-common is now equal across architectures and can be marked Multi-Arch: foreign resolving the initial problem.

Salsa CI, by Santiago Ruano Rincón

Santiago continued the work about the sbuild support for Salsa CI, that was mentioned in the previous month report. The !568 merge request that created the new build image was merged, making it easier to test !569 with external projects. Santiago used a fork of the debusine repo to try the draft !569, and some issues were spotted, and part of them fixed. This is the last debusine pipeline run with the current !569: https://salsa.debian.org/santiago/debusine/-/pipelines/794233. One of the last improvements relates to how to enable projects to customize the pipeline, in an equivalent way than they currently do in the extract-source and build jobs. While this is work-in-progress, the results are rather promising. Next steps include deciding on introducing schroot support for bookworm, bookworm-security, and older releases, as they are done in the official debian buildd.

DebConf preparations, by Stefano Rivera and Santiago Ruano Rincón

DebConf will be happening in Brest, France, in July. Santiago continued the DebConf 25 organization work, looking for catering providers.

Both Stefano and Santiago have been reaching out to some potential sponsors. DebConf depends on sponsors to cover the organization cost, if your company depends on Debian, please consider sponsoring DebConf.

Stefano has been winding up some of the finances from previous DebConfs. Finalizing reimbursements to team members from DebConf 23, and handling some outstanding issues from DebConf 24. Stefano and the rest of the DebConf committee have been reviewing bids for DebConf 26, to select the next venue.

Ruby 3.3 is now the default Ruby interpreter, by Lucas Kanashiro

Ruby 3.3 is about to become the default Ruby interpreter for Trixie. Many bugs were fixed by Lucas and the Debian Ruby team during the sprint hold in Paris during Jan 27-31. The next step is to remove support of Ruby 3.1, which is the alternative Ruby interpreter for now. Thanks to the Debian Release team for all the support, especially Emilio Pozuelo Monfort.

Rails 7 transition, by Lucas Kanashiro

Rails 6 has been shipped by Debian since Bullseye, and as a WEB framework, many issues (especially security related issues) have been encountered and the maintainability of it becomes harder and harder. With that in mind, during the Debian Ruby team sprint last month, the transition to Rack 3 (an important dependency of rails containing many breaking changes) was started in Debian unstable, it is ongoing. Once it is done, the Rails 7 transition will take place, and Rails 7 should be shipped in Debian Trixie.

Miscellaneous contributions

Stefano improved a poor ImportError for users of the turtle module on Python 3, who haven’t installed the python3-tk package.
Stefano updated several packages to new upstream releases.
Stefano added the Python extension to the re2 package, allowing for the use of the Google RE2 regular expression library as a direct replacement for the standard library re module.
Stefano started provisioning a new physical server for the debian.social infrastructure.
Carles improved simplemonitor (documentation on systemd integration, worked with upstream for fixing a bug).
Carles upgraded packages to new upstream versions: python-ring-doorbell and python-asyncclick.
Carles did po-debconf translations to Catalan: reviewed 44 packages and submitted translations to 90 packages (via salsa merge requests or bugtracker bugs).
Carles maintained po-debconf-manager with small fixes.
Raphaël worked on some outstanding DEP-14 merge request and participated in the associated discussion. The discussions have been more contentious than anticipated, somewhat exacerbated by Otto’s desire to conclude fast while the required tool support is not yet there.
Raphaël, with the help of Philipp Kern from the DSA team, upgraded tracker.debian.org to use Django 4.2 (from bookworm-backports) which in turn enabled him to configure authentication via salsa.debian.org. It’s now possible to login to tracker.debian.org with your salsa credentials!
Raphaël updated zim — a nice desktop wiki that is very handy to organize your day-to-day digital life — to the latest upstream version (0.76).
Helmut sent patches for 10 cross build failures.
Helmut continued working on a tool for memory-based concurrency limit of builds.
Helmut NMUed libtool, opensysusers and virtualbox.
Enrico tried to support Helmut in working out tricky usrmerge situations
Thorsten Alteholz uploaded a new upstream version of brlaser.
Colin Watson upgraded 33 Python packages to new upstream versions, including fixes for CVE-2024-42353, CVE-2024-47532, and CVE-2025-22153.
Emilio Pozuelo managed various transitions, and fixed various RC bugs (telepathy-glib, xorg, xserver-xorg-video-vesa, apitrace, mesa).
Anupa attended the monthly team meeting for Debian publicity team and shared the social media stats.
Anupa assisted Jean-Pierre Giraud in the point release announcement for Debian 12.9 and published the Micronews.
Anupa took part in multiple Debian publicity team discussions regarding our presence in social media platforms.

Monthly report about Debian Long Term Support, December 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 13 Jan 2025 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In December, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 14.0h assigned).
Adrian Bunk did 47.75h (out of 53.0h assigned and 47.0h from previous period), thus carrying over 52.25h to the next month.
Andrej Shadura did 6.0h (out of 17.0h assigned and -7.0h from previous period after hours given back), thus carrying over 4.0h to the next month.
Bastien Roucariès did 22.0h (out of 22.0h assigned).
Ben Hutchings did 15.0h (out of 0.0h assigned and 18.0h from previous period), thus carrying over 3.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 23.0h (out of 17.0h assigned and 9.0h from previous period), thus carrying over 3.0h to the next month.
Emilio Pozuelo Monfort did 32.25h (out of 40.5h assigned and 19.5h from previous period), thus carrying over 27.75h to the next month.
Guilhem Moulin did 22.5h (out of 9.75h assigned and 12.75h from previous period).
Jochen Sprickerhof did 2.0h (out of 3.5h assigned and 6.5h from previous period), thus carrying over 8.0h to the next month.
Lee Garrett did 8.5h (out of 14.75h assigned and 45.25h from previous period), thus carrying over 51.5h to the next month.
Lucas Kanashiro did 32.0h (out of 10.0h assigned and 54.0h from previous period), thus carrying over 32.0h to the next month.
Markus Koschany did 40.0h (out of 20.0h assigned and 20.0h from previous period).
Roberto C. Sánchez did 13.5h (out of 6.75h assigned and 17.25h from previous period), thus carrying over 10.5h to the next month.
Santiago Ruano Rincón did 18.75h (out of 24.75h assigned and 0.25h from previous period), thus carrying over 6.25h to the next month.
Sean Whitton did 6.0h (out of 2.0h assigned and 4.0h from previous period).
Sylvain Beucler did 10.5h (out of 21.5h assigned and 38.5h from previous period), thus carrying over 49.5h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).

Evolution of the situation

In December, we have released 29 DLAs.

The LTS Team has published updates to several notable packages. Contributor Guilhem Moulin published an update of php7.4, a widely-used open source general purpose scripting language, which addressed denial of service, authorization bypass, and information disclosure vulnerabilities. Contributor Lucas Kanashiro published an update of clamav, an antivirus toolkit for Unix and Linux, which addressed denial of service and authorization bypass vulnerabilities. Finally, contributor Tobias Frost published an update of intel-microcode, the microcode for Intel microprocessors, which well help to ensure that processor hardware is protected against several local privilege escalation and local denial of service vulnerabilities.

Beyond our customary LTS package updates, the LTS Team has made contributions to Debian’s stable bookworm release and its experimental section. Notably, contributor Lee Garrett published a stable update of dnsmasq. The LTS update was previously published in November and in December Lee continued working to bring the same fixes (addressing the high profile KeyTrap and NSEC3 vulnerabilities) to the dnsmasq package in Debian bookworm. This package was accepted for inclusion in the Debian 12.9 point release scheduled for January 2025. Addititionally, contributor Sean Whitton provided assistance, via upload sponsorships, to the Debian maintainers of xen. This assistance resulted in two uploads of xen into Debian’s experimental section, which will contribute to the next Debian stable release having a version of xen with better longterm support from the upstream development team.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 111 months)
- Civil Infrastructure Platform (CIP) (for 79 months)
- VyOS Inc (for 43 months)
Gold sponsors:
- Roche Diagnostics International AG (for 121 months)
- Akamai - Linode (for 115 months)
- Babiel GmbH (for 105 months)
- Plat’Home (for 104 months)
- University of Oxford (for 61 months)
- Deveryware (for 48 months)
- EDF SA (for 33 months)
- Dataport AöR (for 8 months)
- CERN (for 6 months)
Silver sponsors:
- Domeneshop AS (for 126 months)
- Nantes Métropole (for 120 months)
- Univention GmbH (for 112 months)
- Université Jean Monnet de St Etienne (for 112 months)
- Ribbon Communications, Inc. (for 106 months)
- Exonet B.V. (for 96 months)
- Leibniz Rechenzentrum (for 90 months)
- Ministère de l’Europe et des Affaires Étrangères (for 74 months)
- Cloudways by DigitalOcean (for 63 months)
- Dinahosting SL (for 61 months)
- Bauer Xcel Media Deutschland KG (for 55 months)
- Platform.sh SAS (for 55 months)
- Moxa Inc. (for 49 months)
- sipgate GmbH (for 47 months)
- OVH US LLC (for 45 months)
- Tilburg University (for 45 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 36 months)
- Soliton Systems K.K. (for 33 months)
- THINline s.r.o. (for 9 months)
- Copenhagen Airports A/S (for 3 months)
Bronze sponsors:
- Evolix (for 126 months)
- Seznam.cz, a.s. (for 126 months)
- Intevation GmbH (for 123 months)
- Linuxhotel GmbH (for 123 months)
- Daevel SARL (for 122 months)
- Bitfolk LTD (for 121 months)
- Megaspace Internet Services GmbH (for 121 months)
- Greenbone AG (for 120 months)
- NUMLOG (for 120 months)
- WinGo AG (for 119 months)
- Entr’ouvert (for 111 months)
- Adfinis AG (for 108 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 103 months)
- Tesorion (for 103 months)
- GNI MEDIA (for 102 months)
- Bearstech (for 94 months)
- LiHAS (for 94 months)
- Catalyst IT Ltd (for 89 months)
- Supagro (for 84 months)
- Demarcq SAS (for 83 months)
- Université Grenoble Alpes (for 69 months)
- TouchWeb SAS (for 61 months)
- SPiN AG (for 58 months)
- CoreFiling (for 54 months)
- Institut des sciences cognitives Marc Jeannerod (for 49 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 45 months)
- Tem Innovations GmbH (for 40 months)
- WordFinder.pro (for 39 months)
- CNRS DT INSU Résif (for 38 months)
- Alter Way (for 31 months)
- Institut Camille Jordan (for 21 months)
- SOBIS Software GmbH (for 6 months)

Debian Contributions: Tracker.debian.org updates, Salsa CI improvements, Coinstallable build-essential, Python 3.13 transition, Ruby 3.3 transition and more! (by Anupa Ann Joseph, Stefano Rivera)

Anupa Ann Joseph, Stefano Rivera — Thu, 09 Jan 2025 00:00:00 +0000

Debian Contributions: 2024-12

Tracker.debian.org updates, by Raphaël Hertzog

Profiting from end-of-year vacations, Raphaël prepared for tracker.debian.org to be upgraded to Debian 12 bookworm by getting rid of the remnants of python3-django-jsonfield in the code (it was superseded by a Django-native field). Thanks to Philipp Kern from the Debian System Administrators team, the upgrade happened on December 23rd.

Raphaël also improved distro-tracker to better deal with invalid Maintainer fields which recently caused multiples issues in the regular data updates (#1089985, MR 105). While working on this, he filed #1089648 asking dpkg tools to error out early when maintainers make such mistakes.

Finally he provided feedback to multiple issues and merge requests (MR 106, issues #21, #76, #77), there seems to be a surge of interest in distro-tracker lately. It would be nice if those new contributors could stick around and help out with the significant backlog of issues (in the Debian BTS, in Salsa).

Salsa CI improvements, by Santiago Ruano Rincón

Given that the Debian buildd network now relies on sbuild using the unshare backend, and that Salsa CI’s reproducibility testing needs to be reworked (#399), Santiago resumed the work for moving the build job to use sbuild. There was some related work a few months ago that was focused on sbuild with the schroot and the sudo backends, but those attempts were stalled for different reasons, including discussions around the convenience of the move (#296). However, using sbuild and unshare avoids all of the drawbacks that have been identified so far. Santiago is preparing two merge requests: !568 to introduce a new build image, and !569 that moves all the extract-source related tasks to the build job. As mentioned in the previous reports, this change will make it possible for more projects to use the pipeline to build the packages (See #195). Additional advantages of this change include a more optimal way to test if a package builds twice in a row: instead of actually building it twice, the Salsa CI pipeline will configure sbuild to check if the clean target of debian/rules correctly restores the source tree, saving some CPU cycles by avoiding one build. Also, the images related to Ubuntu won’t be needed anymore, since the build job will create chroots for different distributions and vendors from a single common build image. This will save space in the container registry. More changes are to come, especially those related to handling projects that customize the pipeline and make use of the extract-source job.

Coinstallable `build-essential`, by Helmut Grohne

Building on the gcc-for-host work of last December, a notable patch turning build-essential Multi-Arch: same became feasible. Whilst the change is small, its implications and foundations are not. We still install crossbuild-essential-$ARCH for cross building and due to a britney2 limitation, we cannot have it depend on the host’s C library. As a result, there are workarounds in place for sbuild and pbuilder. In turning build-essential Multi-Arch: same, we may actually express these dependencies directly as we install build-essential:$ARCH instead. The crossbuild-essential-$ARCH packages will continue to be available as transitional dummy packages.

Python 3.13 transition, by Colin Watson and Stefano Rivera

Building on last month’s work, Colin, Stefano, and other members of the Debian Python team fixed 3.13 compatibility bugs in many more packages, allowing 3.13 to now be a supported but non-default version in testing. The next stage will be to switch to it as the default version, which will start soon. Stefano did some test-rebuilds of packages that only build for the default Python 3 version, to find issues that will block the transition. The default version transition typically shakes out some more issues in applications that (unlike libraries) only test with the default Python version.

Colin also fixed Sphinx 8.0 compatibility issues in many packages, which otherwise threatened to get in the way of this transition.

Ruby 3.3 transition, by Lucas Kanashiro

The Debian Ruby team decided to ship Ruby 3.3 in the next Debian release, and Lucas took the lead of the interpreter transition with the assistance of the rest of the team. In order to understand the impact of the new interpreter in the ruby ecosystem, ruby-defaults was uploaded to experimental adding ruby3.3 as an alternative interpreter, and a mass rebuild of reverse dependencies was done here. Initially, a couple of hundred packages were failing to build, after many rounds of rebuilds, adjustments, and many uploads we are down to 30 package build failures, of those, 21 packages were asked to be removed from testing and for the other 9, bugs were filled. All the information to track this transition can be found here. Now, we are waiting for PHP 8.4 to finish to avoid any collision. Once it is done the Ruby 3.3 transition will start in unstable.

Miscellaneous contributions

Enrico Zini redesigned the way nm.debian.org stores historical audit logs and personal data backups.
Carles Pina submitted a new package (python-firebase-messaging) and prepared updates for python3-ring-doorbell.
Carles Pina developed further po-debconf-manager: better state transition, fixed bugs, automated assigning translators and reviewers on edit, updating po header files automatically, fixed bugs, etc.
Carles Pina reviewed, submitted and followed up the debconf templates translation (more than 20 packages) and translated some packages (about 5).
Santiago continued to work on DebConf 25 organization related tasks, including handling the logo survey and results. Stefano spent time on DebConf 25 too.
Santiago continued the exploratory work about linux livepatching with Emmanuel Arias. Santiago and Emmanuel found a challenge since kpatch won’t fully support linux in trixie and newer, so they are exploring alternatives such as klp-build.
Helmut maintained the /usr-move transition filing bugs in e.g. bubblewrap, e2fsprogs, libvpd-2.2-3, and pam-tmpdir and corresponding on related issues such as kexec-tools and live-build. The removal of the usrmerge package unfortunately broke debootstrap and was quickly reverted. Continued fallout is expected and will continue until trixie is released.
Helmut sent patches for 10 cross build failures and worked with Sandro Knauß on stuck Qt/KDE patches related to cross building.
Helmut continued to maintain rebootstrap removing the need to build gnu-efi in the process.
Helmut collaborated with Emanuele Rocca and Jochen Sprickerhof on an interesting adventure in diagnosing why gcc would FTBFS in recent sbuild.
Helmut proposed supporting build concurrency limits in coreutils’s nproc. As it turns out nproc is not a good place for this functionality.
Colin worked with Sandro Tosi and Andrej Shadura to finish resolving the multipart vs. python-multipart name conflict, as mentioned last month.
Colin upgraded 48 Python packages to new upstream versions, fixing four CVEs and a number of compatibility bugs with recent Python versions.
Colin issued an openssh bookworm update with a number of fixes that had accumulated over the last year, especially fixing GSS-API key exchange which had been quite broken in bookworm.
Stefano fixed a minor bug in debian-reimbursements that was disallowing combination PDFs containing JAL tickets, encoded in UTF-16.
Stefano uploaded a stable update to PyPy3 in bookworm, catching up with security issues resolved in cPython.
Stefano fixed a regression in the eventlet from his Python 3.13 porting patch.
Stefano continued discussing a forwarded patch (renaming the sysconfigdata module) with cPython upstream, ending in a decision to drop the patch from Debian. This will need some continued work.
Anupa participated in the Debian Publicity team meeting in December, which discussed the team activities done in 2024 and projects for 2025.

Monthly report about Debian Long Term Support, November 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 13 Dec 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In November, 20 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 6.0h assigned and 8.0h from previous period).
Adrian Bunk did 53.0h (out of 15.0h assigned and 85.0h from previous period), thus carrying over 47.0h to the next month.
Andrej Shadura did 7.0h (out of 7.0h assigned).
Arturo Borrero Gonzalez did 1.0h (out of 10.0h assigned), thus carrying over 9.0h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 0.0h (out of 24.0h assigned), thus carrying over 24.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 17.0h (out of 26.0h assigned), thus carrying over 9.0h to the next month.
Emilio Pozuelo Monfort did 40.5h (out of 60.0h assigned), thus carrying over 19.5h to the next month.
Guilhem Moulin did 7.25h (out of 7.5h assigned and 12.5h from previous period), thus carrying over 12.75h to the next month.
Jochen Sprickerhof did 3.5h (out of 10.0h assigned), thus carrying over 6.5h to the next month.
Lee Garrett did 14.75h (out of 15.25h assigned and 44.75h from previous period), thus carrying over 45.25h to the next month.
Lucas Kanashiro did 10.0h (out of 54.0h assigned and 10.0h from previous period), thus carrying over 54.0h to the next month.
Markus Koschany did 20.0h (out of 40.0h assigned), thus carrying over 20.0h to the next month.
Roberto C. Sánchez did 6.75h (out of 9.75h assigned and 14.25h from previous period), thus carrying over 17.25h to the next month.
Santiago Ruano Rincón did 24.75h (out of 23.5h assigned and 1.5h from previous period), thus carrying over 0.25h to the next month.
Sean Whitton did 2.0h (out of 6.0h assigned), thus carrying over 4.0h to the next month.
Sylvain Beucler did 21.5h (out of 9.5h assigned and 50.5h from previous period), thus carrying over 38.5h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 12.0h (out of 10.5h assigned and 1.5h from previous period).

Evolution of the situation

In November, we have released 38 DLAs.

The LTS coordinators, Roberto and Santiago, delivered a talk at the Mini-DebConf event in Toulouse, France. The title of the talk was “How LTS goes beyond LTS”. The talk covered work done by the LTS Team during the past year. This included contributions related to individual packages in Debian (such as tomcat, jetty, radius, samba, apache2, ruby, and many others); improvements to tooling and documentation useful to the Debian project as a whole; and contributions to upstream work (apache2, freeimage, node-dompurify, samba, and more). Additionally, several contributors external to the LTS Team were highlighted for their contributions to LTS. Readers are encouraged to watch the video of the presentation for a more detailed review of various ways in which the LTS team has contributed more broadly to the Debian project and to the free software community during the past year.

We wish to specifically thank Salvatore (of the Debian Security Team) for swiftly handling during November the updates of needrestart and libmodule-scandeps-perl, both of which involved arbitrary code execution vulnerabilities. We are happy to see increased involvement in LTS work by contributors from outside the formal LTS Team.

The work of the LTS Team in November was otherwise unremarkable, encompassing the customary triage, development, testing, and release of numerous DLAs, along with some associated contributions to related packages in stable and unstable.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 110 months)
- Civil Infrastructure Platform (CIP) (for 78 months)
- VyOS Inc (for 42 months)
Gold sponsors:
- Roche Diagnostics International AG (for 120 months)
- Akamai - Linode (for 114 months)
- Babiel GmbH (for 104 months)
- Plat’Home (for 103 months)
- CINECA (for 78 months)
- University of Oxford (for 60 months)
- Deveryware (for 47 months)
- EDF SA (for 32 months)
- Dataport AöR (for 7 months)
- CERN (for 5 months)
Silver sponsors:
- Domeneshop AS (for 125 months)
- Nantes Métropole (for 119 months)
- Univention GmbH (for 111 months)
- Université Jean Monnet de St Etienne (for 111 months)
- Ribbon Communications, Inc. (for 105 months)
- Exonet B.V. (for 95 months)
- Leibniz Rechenzentrum (for 89 months)
- Ministère de l’Europe et des Affaires Étrangères (for 73 months)
- Cloudways by DigitalOcean (for 62 months)
- Dinahosting SL (for 60 months)
- Bauer Xcel Media Deutschland KG (for 54 months)
- Platform.sh SAS (for 54 months)
- Moxa Inc. (for 48 months)
- sipgate GmbH (for 46 months)
- OVH US LLC (for 44 months)
- Tilburg University (for 44 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 35 months)
- Soliton Systems K.K. (for 32 months)
- THINline s.r.o. (for 8 months)
- Copenhagen Airports A/S
Bronze sponsors:
- Evolix (for 125 months)
- Seznam.cz, a.s. (for 125 months)
- Intevation GmbH (for 122 months)
- Linuxhotel GmbH (for 122 months)
- Daevel SARL (for 121 months)
- Bitfolk LTD (for 120 months)
- Megaspace Internet Services GmbH (for 120 months)
- Greenbone AG (for 119 months)
- NUMLOG (for 119 months)
- WinGo AG (for 118 months)
- Entr’ouvert (for 110 months)
- Adfinis AG (for 107 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 102 months)
- Tesorion (for 102 months)
- GNI MEDIA (for 101 months)
- Bearstech (for 93 months)
- LiHAS (for 93 months)
- Catalyst IT Ltd (for 88 months)
- Supagro (for 83 months)
- Demarcq SAS (for 82 months)
- Université Grenoble Alpes (for 68 months)
- TouchWeb SAS (for 60 months)
- SPiN AG (for 57 months)
- CoreFiling (for 53 months)
- Institut des sciences cognitives Marc Jeannerod (for 48 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 44 months)
- Tem Innovations GmbH (for 39 months)
- WordFinder.pro (for 38 months)
- CNRS DT INSU Résif (for 37 months)
- Alter Way (for 30 months)
- Institut Camille Jordan (for 20 months)
- SOBIS Software GmbH (for 5 months)

Debian Contributions: OpenMPI transitions, cPython 3.12.7+ update uploads, Python 3.13 Transition, and more! (by Anupa Ann Joseph, Stefano Rivera)

Anupa Ann Joseph, Stefano Rivera — Mon, 09 Dec 2024 00:00:00 +0000

Debian Contributions: 2024-11

Transition management, by Emilio Pozuelo Monfort

Emilio has been helping finish the mpi-defaults switch to mpich on 32-bit architectures, and the openmpi transitions. This involves filing bugs for the reverse dependencies, doing NMUs, and requesting removals for outdated (Not Built from Source) binaries on 32-bit architectures where openmpi is no longer available. Those transitions got entangled with a few others, such as the petsc stack, and were blocking many packages from migrating to testing. These transitions were completed in early December.

cPython 3.12.7+ update uploads, by Stefano Rivera

Python 3.12 had failed to build on mips64el, due to an obscure dh_strip failure. The mips64el porters never figured it out, but the missing build on mips64el was blocking migration to Debian testing. After waiting a month, enough changes had accumulated in the upstream 3.12 maintenance git branch that we could apply them in the hope of changing the output enough to avoid breaking dh_strip. This worked.

Of course there were other things to deal with too. A test started failing due to a Debian-specific patch we carry for python3.x-minimal, and it needed to be reworked. And Stefano forgot to strip the trailing + from PY_VERSION, which confuses some python libraries. This always requires another patch when applying git updates from the maintenance branch. Stefano added a build-time check to catch this mistake in the future. Python 3.12.7 migrated.

Python 3.13 Transition, by Stefano Rivera and Colin Watson

During November the Python 3.13-add transition started. This is the first stage of supporting a new version of Python in Debian archive (after preparatory work), adding it as a new supported but non-default version. All packages with compiled Python extensions need to be re-built to add support for the new version.

We have covered the lead-up to this transition in the past. Due to preparation, many of the failures we hit were expected and we had patches waiting in the bug tracker. These could be NMUed to get the transition moving. Others had been known about but hadn’t been worked on, yet.

Some other packages ran into new issues, as we got further into the transition than we’d been able to in preparation. The whole Debian Python team has been helping with this work.

The rebuild stage of the 3.13-add transition is now over, but many packages need work before britney will let python3-defaults migrate to testing.

Limiting build concurrency based on available RAM, by Helmut Grohne

In recent years, the concurrency of CPUs has been increasing as has the demand for RAM by linkers. What has not been increasing as quickly is the RAM supply in typical machines. As a result, we more frequently run into situations where the package builds exhaust memory when building at full concurrency. Helmut initiated a discussion about generalizing an approach to this in Debian packages. Researching existing code that limits concurrency as well as providing possible extensions to debhelper and dpkg to provide concurrency limits based on available system RAM. Thus far there is consensus on the need for a more general solution, but ideas are still being collected for the precise solution.

MiniDebConf Toulouse at Capitole du Libre

The whole Freexian Collaborator team attended MiniDebConf Toulouse, part of the Capitole du Libre event. Several members of the team gave talks:

Santiago spoke on Linux Live Patching in Debian, presenting an update on the idea since DebConf 24. This includes the initial requirements for the livepatch package format, that would be used to distribute the livepatches.
Stefano, Colin, Enrico, and Carles spoke on Using Debusine to Automate QA.
Santiago and Roberto spoke on How LTS Goes Beyond LTS.
Helmut spoke on Cross Building.
Carles gave a lightning talk on po-debconf-manager.

Stefano and Anupa worked as part of the video team, streaming and recording the event’s talks.

Miscellaneous contributions

Stefano looked into packaging the latest upstream python-falcon version in Debian, in support of the Python 3.13 transition. This appeared to break python-hug, which is sadly looking neglected upstream, and the best course of action is probably its removal from Debian.
Stefano uploaded videos from various 2024 Debian events to PeerTube and YouTube.
Stefano and Santiago visited the site for DebConf 2025 in Brest, after the MiniDebConf in Toulouse, to meet with the local team and scout out the venue.

The on-going DebConf 25 organization work of last month also included handling the logo and artwork call for proposals.
Stefano helped the press team to edit a post for bits.debian.org on OpenStreetMap’s migration to Debian.
Carles implemented multiple language support on po-debconf-manager and tested it using Portuguese-Brazilian during MiniDebConf Toulouse. The system was also tested and improved by reviewing more than 20 translations to Catalan, creating merge requests for those packages, and providing user support to new users. Additionally, Carles implemented better status transitions, configuration keys management and other small improvements.
Helmut sent 32 patches for cross build failures. The wireplumber one was an interactive collaboration with Dylan Aïssi.
Helmut continued to monitor the /usr-move, sent a patch for lib64readline8 and continued several older patch conversations. lintian now reports some aliasing issues in unstable.
Helmut initiated a discussion on the semantics of *-for-host packages. More feedback is welcome.
Helmut improved the crossqa.debian.net infrastructure to fail running lintian less often in larger packages.
Helmut continued maintaining rebootstrap mostly dropping applied patches and continuing discussions of submitted patches.
Helmut prepared a non-maintainer upload of gzip for several long-standing bugs.
Colin came up with a plan for resolving the multipart vs. python-multipart name conflict, and began work on converting reverse-dependencies.
Colin upgraded 42 Python packages to new upstream versions. Some were complex: python-catalogue had some upstream version confusion, pydantic and rpds-py involved several Rust package upgrades as prerequisites, and python-urllib3 involved first packaging python-quart-trio and then vendoring an unpackaged test-dependency.
Colin contributed Incus support to needrestart upstream.
Lucas set up a machine to do a rebuild of all ruby reverse dependencies to check what will be broken by adding ruby 3.3 as an alternative interpreter. The tool used for this is mass-rebuild and the initial rebuilds have already started. The ruby interpreter maintainers are planning to experiment with debusine next time.
Lucas is organizing a Debian Ruby sprint towards the end of January in Paris. The plan of the team is to finish any missing bits of Ruby 3.3 transition at the time, try to push Rails 7 transition and fix RC bugs affecting the ruby ecosystem in Debian.
Anupa attended a Debian Publicity team meeting in-person during MiniDebCamp Toulouse.
Anupa moderated and posted in the Debian Administrator group in LinkedIn.

Tryton 7.0 LTS reaches Debian trixie (by Mathias Behrle, Raphaël Hertzog and Anupa Ann Joseph)

Mathias Behrle, Raphaël Hertzog and Anupa Ann Joseph — Fri, 29 Nov 2024 00:00:00 +0000

Tryton is a FOSS software suite which is highly modular and scalable. Tryton along with its standard modules can provide a complete ERP solution or it can be used for specific functions of a business like accounting, invoicing etc.

Debian packages for Tryton are being maintained by Mathias Behrle. You can follow him on Mastodon or get his help on Tryton related projects through MBSolutions (his own consulting company).

Freexian has been sponsoring Mathias’s packaging work on Tryton for a while, so that Debian gets all the quarterly bug fix releases as well as the security release in a timely manner.

About Tryton 7.0 LTS

Lately Mathias has been busy packaging Tryton 7.0 LTS. As the “LTS” tag implies, this release is recommended for production deployments since it will be supported until November 2028. This release brings numerous bug fixes, performance improvements and various new features.

As part of this work, 41 new Tryton modules and 6 dependency packages have been added to Debian, significantly broadening the options available to Debian users and improving integration with Tryton systems.

Running different versions of Tryton on different Debian releases

To provide extended compatibility, a dedicated Tryton mirror is being managed and is available at https://debian.m9s.biz/debian/. This mirror hosts backports for all supported Tryton series, ensuring availability for a variety of Debian releases and deployment scenarios.

These initiatives highlight MBSolutions’ technical contributions to the Tryton community, made possible by Freexian’s financial backing. Together, we are advancing the Tryton ecosystem for Debian users.

Monthly report about Debian Long Term Support, October 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Tue, 12 Nov 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In October, 20 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 6.0h (out of 7.0h assigned and 7.0h from previous period), thus carrying over 8.0h to the next month.
Adrian Bunk did 15.0h (out of 87.0h assigned and 13.0h from previous period), thus carrying over 85.0h to the next month.
Arturo Borrero Gonzalez did 10.0h (out of 10.0h assigned).
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 4.0h (out of 0.0h assigned and 4.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 29.0h (out of 26.0h assigned and 3.0h from previous period).
Emilio Pozuelo Monfort did 60.0h (out of 23.5h assigned and 36.5h from previous period).
Guilhem Moulin did 7.5h (out of 19.75h assigned and 0.25h from previous period), thus carrying over 12.5h to the next month.
Lee Garrett did 15.25h (out of 0.0h assigned and 60.0h from previous period), thus carrying over 44.75h to the next month.
Lucas Kanashiro did 10.0h (out of 10.0h assigned and 10.0h from previous period), thus carrying over 10.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 14.5h (out of 6.5h assigned and 17.5h from previous period), thus carrying over 9.5h to the next month.
Roberto C. Sánchez did 9.75h (out of 24.0h assigned), thus carrying over 14.25h to the next month.
Santiago Ruano Rincón did 23.5h (out of 25.0h assigned), thus carrying over 1.5h to the next month.
Sean Whitton did 6.25h (out of 1.0h assigned and 5.25h from previous period).
Stefano Rivera did 1.0h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 9.0h to the next month.
Sylvain Beucler did 9.5h (out of 16.0h assigned and 44.0h from previous period), thus carrying over 50.5h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 10.5h (out of 12.0h assigned), thus carrying over 1.5h to the next month.

Evolution of the situation

In October, we have released 35 DLAs.

Some notable updates prepared in October include denial of service vulnerability fixes in nss, regression fixes in apache2, multiple fixes in php7.4, and new upstream releases of firefox-esr, openjdk-17, and opendk-11.

Additional contributions were made for the stable Debian 12 bookworm release by several LTS contributors. Arturo Borrero Gonzalez prepared a parallel update of nss, Bastien Roucariès prepared a parallel update of apache2, and Santiago Ruano Rincón prepared updates of activemq for both LTS and Debian stable.

LTS contributor Bastien Roucariès undertook a code audit of the cacti package and in the process discovered three new issues in node-dompurify, which were reported upstream and resulted in the assignment of three new CVEs.

As always, the LTS team continues to work towards improving the overall sustainability of the free software base upon which Debian LTS is built. We thank our many committed sponsors for their ongoing support.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- Toshiba Corporation (for 109 months)
- Civil Infrastructure Platform (CIP) (for 77 months)
- VyOS Inc (for 41 months)
Gold sponsors:
- Roche Diagnostics International AG (for 119 months)
- Akamai - Linode (for 113 months)
- Babiel GmbH (for 103 months)
- Plat’Home (for 102 months)
- CINECA (for 77 months)
- University of Oxford (for 59 months)
- Deveryware (for 46 months)
- EDF SA (for 31 months)
- Dataport AöR (for 6 months)
- CERN (for 4 months)
Silver sponsors:
- Domeneshop AS (for 124 months)
- Nantes Métropole (for 118 months)
- Univention GmbH (for 110 months)
- Université Jean Monnet de St Etienne (for 110 months)
- Ribbon Communications, Inc. (for 104 months)
- Exonet B.V. (for 94 months)
- Leibniz Rechenzentrum (for 88 months)
- Ministère de l’Europe et des Affaires Étrangères (for 72 months)
- Cloudways by DigitalOcean (for 61 months)
- Dinahosting SL (for 59 months)
- Bauer Xcel Media Deutschland KG (for 53 months)
- Platform.sh SAS (for 53 months)
- Moxa Inc. (for 47 months)
- sipgate GmbH (for 45 months)
- OVH US LLC (for 43 months)
- Tilburg University (for 43 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 34 months)
- Soliton Systems K.K. (for 31 months)
- THINline s.r.o. (for 7 months)
- Copenhagen Airports A/S
Bronze sponsors:
- Evolix (for 124 months)
- Seznam.cz, a.s. (for 124 months)
- Intevation GmbH (for 121 months)
- Linuxhotel GmbH (for 121 months)
- Daevel SARL (for 120 months)
- Bitfolk LTD (for 119 months)
- Megaspace Internet Services GmbH (for 119 months)
- Greenbone AG (for 118 months)
- NUMLOG (for 118 months)
- WinGo AG (for 117 months)
- Entr’ouvert (for 108 months)
- Adfinis AG (for 106 months)
- Tesorion (for 101 months)
- GNI MEDIA (for 100 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 100 months)
- Bearstech (for 92 months)
- LiHAS (for 92 months)
- Catalyst IT Ltd (for 87 months)
- Supagro (for 82 months)
- Demarcq SAS (for 81 months)
- Université Grenoble Alpes (for 67 months)
- TouchWeb SAS (for 59 months)
- SPiN AG (for 56 months)
- CoreFiling (for 52 months)
- Institut des sciences cognitives Marc Jeannerod (for 47 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 43 months)
- Tem Innovations GmbH (for 38 months)
- WordFinder.pro (for 37 months)
- CNRS DT INSU Résif (for 36 months)
- Alter Way (for 29 months)
- Institut Camille Jordan (for 19 months)
- SOBIS Software GmbH (for 4 months)

Debian Contributions: October’s report (by Anupa Ann Joseph)

Anupa Ann Joseph — Fri, 08 Nov 2024 00:00:00 +0000

Debian Contributions: 2024-10

rebootstrap, by Helmut Grohne

After significant changes earlier this year, the state of architecture cross bootstrap is normalizing again. More and more architectures manage to complete rebootstrap testing successfully again. Here are two examples of what kind of issues the bootstrap testing identifies.

At some point, libpng1.6 would fail to cross build on musl architectures whereas it would succeed on other ones failing to locate zlib. Adding --debug-find to the cmake invocation eventually revealed that it would fail to search in /usr/lib/<triplet>, which is the default library path. This turned out to be a bug in cmake assuming that all linux systems use glibc. libpng1.6 also gained a baseline violation for powerpc and ppc64 by enabling the use of AltiVec there.

The newt package would fail to cross build for many 32-bit architectures whereas it would succeed for armel and armhf due to -Wincompatible-pointer-types. It turns out that this flag was turned into -Werror and it was compiling with a warning earlier. The actual problem is a difference in signedness between wchar_t and FriBidChar (aka uint32_t) and actually affects native building on i386.

Miscellaneous contributions

Helmut sent 35 patches for cross build failures.
Stefano Rivera uploaded the Python 3.13.0 final release.
Stefano continued to rebuild Python packages with C extensions using Python 3.13, to catch compatibility issues before the 3.13-add transition starts.
Stefano uploaded new versions of a handful of Python packages, including: dh-python, objgraph, python-mitogen, python-truststore, and python-virtualenv.
Stefano packaged a new release of mkdocs-macros-plugin, which required packaging a new Python package for Debian, python-super-collections (now in NEW review).
Stefano helped the mini-DebConf Online Brazil get video infrastructure up and running for the event. Unfortunately, Debian’s online-DebConf setup has bitrotted over the last couple of years, and it eventually required new temporary Jitsi and Jibri instances.
Colin Watson fixed a number of autopkgtest failures to get ansible back into testing.
Colin fixed an ssh client failure in certain cases when using GSS-API key exchange, and added an integration test to ensure this doesn’t regress in future.
Colin worked on the Python 3.13 transition, fixing problems related to it in 15 packages. This included upstream work in a number of packages (postgresfixture, python-asyncssh, python-wadllib).
Colin upgraded 41 Python packages to new upstream versions.
Carles improved po-debconf-manager: now it can create merge requests to Salsa automatically (created 17, new batch coming this month), imported almost all the packages with debconf translation templates whose VCS is Salsa (currently 449 imported), added statistics per package and language, improved command line interface options. Performed user support fixing different issues. Also prepared an abstract for the talk at MiniDebConf Toulouse.
Santiago Ruano Rincón continued the organization work for the DebConf 25 conference, to be held in Brest, France. Part of the work relates to the initial edits of the sponsoring brochure. Thanks to Benjamin Somers who finalized the French and English versions.
Raphaël forwarded a couple of zim and hamster bugs to the upstream developers, and tried to diagnose a delayed startup of gdm on his laptop (cf #1085633).
On behalf of the Debian Publicity Team, Anupa interviewed 7 women from the Debian community, old and new contributors. The interview was published in Bits from Debian.

Monthly report about Debian Long Term Support, September 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 11 Oct 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In September, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 7.0h (out of 0.0h assigned and 14.0h from previous period), thus carrying over 7.0h to the next month.
Adrian Bunk did 51.75h (out of 9.25h assigned and 55.5h from previous period), thus carrying over 13.0h to the next month.
Arturo Borrero Gonzalez did 10.0h (out of 0.0h assigned and 10.0h from previous period).
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 20.0h (out of 12.0h assigned and 12.0h from previous period), thus carrying over 4.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 23.0h (out of 26.0h assigned), thus carrying over 3.0h to the next month.
Emilio Pozuelo Monfort did 23.5h (out of 22.25h assigned and 37.75h from previous period), thus carrying over 36.5h to the next month.
Guilhem Moulin did 22.25h (out of 20.0h assigned and 2.5h from previous period), thus carrying over 0.25h to the next month.
Lucas Kanashiro did 10.0h (out of 5.0h assigned and 15.0h from previous period), thus carrying over 10.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 6.5h (out of 14.5h assigned and 9.5h from previous period), thus carrying over 17.5h to the next month.
Roberto C. Sánchez did 24.75h (out of 21.0h assigned and 3.75h from previous period).
Santiago Ruano Rincón did 19.0h (out of 19.0h assigned).
Sean Whitton did 0.75h (out of 4.0h assigned and 2.0h from previous period), thus carrying over 5.25h to the next month.
Sylvain Beucler did 16.0h (out of 42.0h assigned and 18.0h from previous period), thus carrying over 44.0h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 17.0h (out of 7.5h assigned and 9.5h from previous period).

Evolution of the situation

In September, we have released 52 DLAs.

September marked the first full month of Debian 11 bullseye under the responsibility of the LTS Team and the team immediately got to work, publishing more than 4 dozen updates.

Some notable updates include ruby2.7 (denial-of-service, information leak, and remote code execution), git (various arbitrary code execution vulnerabilities), firefox-esr (multiple issues), gnutls28 (information disclosure), thunderbird (multiple issues), cacti (cross site scripting and SQL injection), redis (unauthorized access, denial of service, and remote code execution), mariadb-10.5 (arbitrary code execution), cups (arbitrary code execution).

Several LTS contributors have also contributed package updates which either resulted in a DSA (a Debian Security Announcement, which applies to Debian 12 bookworm) or in an upload that will be published at the next stable point release of Debian 12 bookworm. This list of packages includes cups, cups-filters, booth, nghttp2, puredata, python3.11, sqlite3, and wireshark. This sort of work, contributing fixes to newer Debian releases (and sometimes even to unstable), helps to ensure that upgrades from a release in the LTS phase of its lifecycle to a newer release do not expose users to vulnerabilities which have been closed in the older release.

Looking beyond Debian, LTS contributor Bastien Roucariès has worked with the upstream developers of apache2 to address regressions introduced upstream by some recent vulnerability fixes and he has also reached out to the community regarding a newly discovered security issue in the dompurify package. LTS contributor Santiago Ruano Rincón has undertaken the work of triaging and reproducing nearly 4 dozen CVEs potentially affecting the freeimage package. The upstream development of freeimage appears to be dormant and some of the issues have languished for more than 5 years. It is unclear how much can be done without the aid of upstream, but we will do our best to provide as much help to the community as we can feasibly manage.

Finally, it is sometimes necessary to limit or discontinue support for certain packages. The transition of a release from being under the responsibility of the Debian Security Team to that of the LTS Team is an occasion where we assess any pending decisions in this area and formalize them. Please see the announcement for a complete list of packages which have been designated as unsupported.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 108 months)
- Civil Infrastructure Platform (CIP) (for 76 months)
- VyOS Inc (for 40 months)
Gold sponsors:
- Roche Diagnostics International AG (for 118 months)
- Akamai - Linode (for 112 months)
- Babiel GmbH (for 102 months)
- Plat’Home (for 101 months)
- CINECA (for 76 months)
- University of Oxford (for 58 months)
- Deveryware (for 45 months)
- EDF SA (for 30 months)
- Dataport AöR (for 5 months)
- CERN (for 3 months)
Silver sponsors:
- Domeneshop AS (for 123 months)
- Nantes Métropole (for 117 months)
- Univention GmbH (for 109 months)
- Université Jean Monnet de St Etienne (for 109 months)
- Ribbon Communications, Inc. (for 103 months)
- Exonet B.V. (for 92 months)
- Leibniz Rechenzentrum (for 87 months)
- Ministère de l’Europe et des Affaires Étrangères (for 70 months)
- Cloudways by DigitalOcean (for 60 months)
- Dinahosting SL (for 58 months)
- Bauer Xcel Media Deutschland KG (for 52 months)
- Platform.sh SAS (for 52 months)
- Moxa Inc. (for 46 months)
- sipgate GmbH (for 44 months)
- OVH US LLC (for 42 months)
- Tilburg University (for 42 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 33 months)
- Soliton Systems K.K. (for 30 months)
- THINline s.r.o. (for 6 months)
- Copenhagen Airports A/S
Bronze sponsors:
- Evolix (for 123 months)
- Seznam.cz, a.s. (for 123 months)
- Intevation GmbH (for 120 months)
- Linuxhotel GmbH (for 120 months)
- Daevel SARL (for 119 months)
- Bitfolk LTD (for 118 months)
- Megaspace Internet Services GmbH (for 118 months)
- Greenbone AG (for 117 months)
- NUMLOG (for 117 months)
- WinGo AG (for 116 months)
- Entr’ouvert (for 107 months)
- Adfinis AG (for 105 months)
- Tesorion (for 100 months)
- GNI MEDIA (for 99 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 99 months)
- Bearstech (for 91 months)
- LiHAS (for 91 months)
- Catalyst IT Ltd (for 86 months)
- Supagro (for 81 months)
- Demarcq SAS (for 80 months)
- Université Grenoble Alpes (for 66 months)
- TouchWeb SAS (for 58 months)
- SPiN AG (for 55 months)
- CoreFiling (for 51 months)
- Institut des sciences cognitives Marc Jeannerod (for 46 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 42 months)
- Tem Innovations GmbH (for 37 months)
- WordFinder.pro (for 36 months)
- CNRS DT INSU Résif (for 35 months)
- Alter Way (for 28 months)
- Institut Camille Jordan (for 18 months)
- SOBIS Software GmbH (for 3 months)

Debian Contributions: Packaging Pydantic v2, Reworking of glib2.0 for cross bootstrap, Python archive rebuilds and more! (by Anupa Ann Joseph)

Anupa Ann Joseph — Thu, 10 Oct 2024 00:00:00 +0000

Debian Contributions: 2024-09

Pydantic v2, by Colin Watson

Pydantic is a useful library for validating data in Python using type hints: Freexian uses it in a number of projects, including Debusine. Its Debian packaging had been stalled at 1.10.17 in testing for some time, partly due to needing to make sure everything else could cope with the breaking changes introduced in 2.x, but mostly due to needing to sort out packaging of its new Rust dependencies. Several other people (notably Alexandre Detiste, Andreas Tille, Drew Parsons, and Timo Röhling) had made some good progress on this, but nobody had quite got it over the line and it seemed a bit stuck.

Colin upgraded a few Rust libraries to new upstream versions, packaged rust-jiter, and chased various failures in other packages. This eventually allowed getting current versions of both pydantic-core and pydantic into testing. It should now be much easier for us to stay up to date routinely.

Reworking of glib2.0 for cross bootstrap, by Helmut Grohne

Simon McVittie (not affiliated with Freexian) earlier restructured the libglib2.0-dev such that it would absorb more functionality and in particular provide tools for working with .gir files. Those tools practically require being run for their host architecture (practically this means running under qemu-user) which is at odds with the requirements of architecture cross bootstrap. The qemu requirement was expressed in package dependencies and also made people unhappy attempting to use libglib2.0-dev for i386 on amd64 without resorting to qemu. The use of qemu in architecture bootstrap is particularly problematic as it tends to not be ready at the time bootstrapping is needed.

As a result, Simon proposed and implemented the introduction of a libgio-2.0-dev package providing a subset of libglib2.0-dev that does not require qemu. Packages should continue to use libglib2.0-dev in their Build-Depends unless involved in architecture bootstrap. Helmut reviewed and tested the implementation and integrated the necessary changes into rebootstrap. He also prepared a patch for libverto to use the new package and proposed adding forward compatibility to glib2.0.

Helmut continued working on adding cross-exe-wrapper to architecture-properties and implemented autopkgtests later improved by Simon. The cross-exe-wrapper package now provides a generic mechanism to a program on a different architecture by using qemu when needed only. For instance, a dependency on cross-exe-wrapper:i386 provides a i686-linux-gnu-cross-exe-wrapper program that can be used to wrap an ELF executable for the i386 architecture. When installed on amd64 or i386 it will skip installing or running qemu, but for other architectures qemu will be used automatically. This facility can be used to support cross building with targeted use of qemu in cases where running host code is unavoidable as is the case for GObject introspection.

This concludes the joint work with Simon and Niels Thykier on glib2.0 and architecture-properties resolving known architecture bootstrap regressions arising from the glib2.0 refactoring earlier this year.

Analyzing binary package metadata, by Helmut Grohne

As Guillem Jover (not affiliated with Freexian) continues to work on adding metadata tracking to dpkg, the question arises how this affects existing packages. The dedup.debian.net infrastructure provides an easy playground to answer such questions, so Helmut gathered file metadata from all binary packages in unstable and performed an explorative analysis. Some results include:

binutils-mipsen uses wrong file ownership
/usr-merge is not the only cause for aliasing problems in Debian.

Guillem also performed a cursory analysis and reported other problem categories such as mismatching directory permissions for directories installed by multiple packages and thus gained a better understanding of what consistency checks dpkg can enforce.

Python archive rebuilds, by Stefano Rivera

Last month Stefano started to write some tooling to do large-scale rebuilds in debusine, starting with finding packages that had already started to fail to build from source (FTBFS) due to the removal of setup.py test. This month, Stefano did some more rebuilds, starting with experimental versions of dh-python.

During the Python 3.12 transition, we had added a dependency on python3-setuptools to dh-python, to ease the transition. Python 3.12 removed distutils from the stdlib, but many packages were expecting it to still be available. Setuptools contains a version of distutils, and dh-python was a convenient place to depend on setuptools for most package builds. This dependency was never meant to be permanent. A rebuild without it resulted in mass-filing about 340 bugs (and around 80 more by mistake).

A new feature in Python 3.12, was to have unittest’s test runner exit with a non-zero return code, if no tests were run. We added this feature, to be able to detect tests that are not being discovered, by mistake. We are ignoring this failure, as we wouldn’t want to suddenly cause hundreds of packages to fail to build, if they have no tests. Stefano did a rebuild to see how many packages were affected, and found that around 1000 were. The Debian Python community has not come to a conclusion on how to move forward with this.

As soon as Python 3.13 release candidate 2 was available, Stefano did a rebuild of the Python packages in the archive against it. This was a more complex rebuild than the others, as it had to be done in stages. Many packages need other Python packages at build time, typically to run tests. So transitions like this involve some manual bootstrapping, followed by several rounds of builds. Not all packages could be tested, as not all their dependencies support 3.13 yet. The result was around 100 bugs in packages that need work to support Python 3.13. Many other packages will need additional work to properly support Python 3.13, but being able to build (and run tests) is an important first step.

Miscellaneous contributions

Carles prepared the update of python-pyaarlo package to a new upstream release.
Carles worked on updating python-ring-doorbell to a new upstream release. Unfinished, pending to package a new dependency python3-firebase-messaging RFP #1082958 and its dependency python3-http-ece RFP #1083020.
Carles improved po-debconf-manager. Main new feature is that it can open Salsa merge requests. Aiming for a lightning talk in MiniDebConf Toulouse (November) to be functional end to end and get feedback from the wider public for this proof of concept.
Carles helped one translator to use po-debconf-manager (added compatibility for bullseye, fixed other issues) and reviewed 17 package templates.
Colin upgraded the OpenSSH packaging to 9.9p1.
Colin upgraded the various YubiHSM packages to new upstream versions, enabled more tests, fixed yubihsm-shell build failures on some 32-bit architectures, made yubihsm-shell build reproducibly, and fixed yubihsm-connector to apply udev rules to existing devices when the package is installed. As usual, bookworm-backports is up to date with all these changes.
Colin fixed quite a bit of fallout from setuptools 72.0.0 removing setup.py test, backported a large upstream patch set to make buildbot work with SQLAlchemy 2.0, and upgraded 25 other Python packages to new upstream versions.
Enrico worked with Jakob Haufe to get him up to speed for managing sso.debian.org
Raphaël did remove spam entries in the list of teams on tracker.debian.org (see #1080446), and he applied a few external contributions, fixing a rendering issue and replacing the DDPO link with a more useful alternative. He also gave feedback on a couple of merge requests that required more work. As part of the analysis of the underlying problem, he suggested to the ftpmasters (via #1083068) to auto-reject packages having the “too-many-contacts” lintian error, and he raised the severity of #1076048 to serious to actually have that 4 year old bug fixed.
Raphaël uploaded zim and hamster-time-tracker to fix issues with Python 3.12 getting rid of setuptools. He also uploaded a new gnome-shell-extension-hamster to cope with the upcoming transition to GNOME 47.
Helmut sent seven patches and sponsored one upload for cross build failures.
Helmut uploaded a Nagios/Icinga plugin check-smart-attributes for monitoring the health of physical disks.
Helmut collaborated on sbuild reviewing and improving a MR for refactoring the unshare backend.
Helmut sent a patch fixing coinstallability of gcc-defaults.
Helmut continued to monitor the evolution of the /usr-move. With more and more key packages such as libvirt or fuse3 fixed. We’re moving into the boring long-tail of the transition.
Helmut proposed updating the meson buildsystem in debhelper to use env2mfile.
Helmut continued to update patches maintained in rebootstrap. Due to the work on glib2.0 above, rebootstrap moves a lot further, but still fails for any architecture.
Santiago reviewed some Merge Request in Salsa CI, such as: !478, proposed by Otto to extend the information about how to use additional runners in the pipeline and !518, proposed by Ahmed to add support for Ubuntu images, that will help to test how some debian packages, including the complex MariaDB are built on Ubuntu.

Santiago also prepared !545, which will make the reprotest job more consistent with the result seen on reproducible-builds.
Santiago worked on different tasks related to DebConf 25. Especially he drafted the fundraising brochure (which is almost ready).
Thorsten Alteholz uploaded package libcupsfilter to fix the autopkgtest and a dependency problem of this package. After package splix was abandoned by upstream and OpenPrinting.org adopted its maintenance, Thorsten uploaded their first release.
Anupa published posts on the Debian Administrators group in LinkedIn and moderated the group, one of the tasks of the Debian Publicity Team.
Anupa helped organize DebUtsav 2024. It had over 100 attendees with hand-on sessions on making initial contributions to Linux Kernel, Debian packaging, submitting documentation to Debian wiki and assisting Debian Installations.

Monthly report about Debian Long Term Support, August 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Wed, 11 Sep 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In August, 16 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 44.5h (out of 46.5h assigned and 53.5h from previous period), thus carrying over 55.5h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 9.0h (out of 0.0h assigned and 21.0h from previous period), thus carrying over 12.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 12.0h (out of 7.0h assigned and 5.0h from previous period).
Emilio Pozuelo Monfort did 22.25h (out of 6.5h assigned and 53.5h from previous period), thus carrying over 37.75h to the next month.
Guilhem Moulin did 17.5h (out of 8.75h assigned and 11.25h from previous period), thus carrying over 2.5h to the next month.
Lee Garrett did 11.5h (out of 58.0h assigned and 2.0h from previous period), thus carrying over 48.5h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 14.5h (out of 4.0h assigned and 20.0h from previous period), thus carrying over 9.5h to the next month.
Roberto C. Sánchez did 8.25h (out of 5.0h assigned and 7.0h from previous period), thus carrying over 3.75h to the next month.
Santiago Ruano Rincón did 21.5h (out of 11.5h assigned and 10.0h from previous period).
Sean Whitton did 4.0h (out of 2.25h assigned and 3.75h from previous period), thus carrying over 2.0h to the next month.
Sylvain Beucler did 42.0h (out of 46.0h assigned and 14.0h from previous period), thus carrying over 18.0h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).
Tobias Frost did 2.5h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 9.5h to the next month.

Evolution of the situation

In August, we have released 1 DLAs.

During the month of August Debian 11 "bullseye" officially transitioned to the responsibility of the LTS team (on 2024-08-15). However, because the final point release (11.11) was not made until 2024-08-31, LTS contributors were prevented from uploading packages to bullseye until after the point release had been made. That said, the team was not at all idle, and was busy at work on a variety of tasks which impacted both LTS and the broader Debian community, as well as preparing uploads which will be released during the month of September.

Of particular note, LTS contributor Bastien Roucariès prepared updates of the putty and cacti packages for bookworm (1 2) and bullseye (1 2), which were accepted by the old-stable release managers for the August point releases. He also analysed several security regressions in the apache2 package. LTS contributor Emilio Pozuelo Monfort worked on the Rust toolchain in bookworm and bullseye, which will be needed to support the upcoming Firefox ESR and Thunderbird ESR releases from the Mozilla project. Additionally, LTS contributor Thorsten Alteholz prepared bookworm and bullseye updates of the cups package (1 2), which were accepted by the old-stable release managers for the August point releases.

LTS contributor Markus Koschany collaborated with Emmanuel Bourg, co-maintainer of the tomcat packages in Debian. Regressions in a proposed security fix necessitated the updating of the tomcat10 package in Debian to the latest upstream release.

LTS contributors Bastien and Santiago Ruano Rincón collaborated with the upstream developers and the Debian maintainer (Bernhard Schmidt) of the FreeRADIUS project towards addressing the BlastRADIUS vulnerability in the bookworm and bullseye versions of the freeradius package. If you use FreeRADIUS in Debian bookworm or bullseye, we encourage you to test the packages following the instructions found in the call for testers to help identifying any possible regression that could be introduced with these updates.

Testing is an important part of the work the LTS Team does, and in that vein LTS contributor Sean Whitton worked on improving the documentation and tooling around creating test filesystems which can be used for testing a variety of package update scenarios.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 107 months)
- Civil Infrastructure Platform (CIP) (for 75 months)
- VyOS Inc (for 39 months)
Gold sponsors:
- Roche Diagnostics International AG (for 117 months)
- Akamai - Linode (for 111 months)
- Babiel GmbH (for 101 months)
- Plat’Home (for 100 months)
- CINECA (for 75 months)
- University of Oxford (for 57 months)
- Deveryware (for 44 months)
- EDF SA (for 29 months)
- Dataport AöR (for 4 months)
Silver sponsors:
- Domeneshop AS (for 122 months)
- Nantes Métropole (for 116 months)
- Univention GmbH (for 108 months)
- Université Jean Monnet de St Etienne (for 108 months)
- Ribbon Communications, Inc. (for 102 months)
- Exonet B.V. (for 91 months)
- Leibniz Rechenzentrum (for 86 months)
- Ministère de l’Europe et des Affaires Étrangères (for 69 months)
- Cloudways by DigitalOcean (for 59 months)
- Dinahosting SL (for 57 months)
- Bauer Xcel Media Deutschland KG (for 51 months)
- Platform.sh SAS (for 51 months)
- Moxa Inc. (for 45 months)
- sipgate GmbH (for 43 months)
- OVH US LLC (for 41 months)
- Tilburg University (for 41 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 32 months)
- Soliton Systems K.K. (for 29 months)
- THINline s.r.o. (for 5 months)
Bronze sponsors:
- Evolix (for 122 months)
- Seznam.cz, a.s. (for 122 months)
- Intevation GmbH (for 119 months)
- Linuxhotel GmbH (for 119 months)
- Daevel SARL (for 118 months)
- Bitfolk LTD (for 117 months)
- Megaspace Internet Services GmbH (for 117 months)
- Greenbone AG (for 116 months)
- NUMLOG (for 116 months)
- WinGo AG (for 115 months)
- Entr’ouvert (for 106 months)
- Adfinis AG (for 104 months)
- Tesorion (for 99 months)
- GNI MEDIA (for 98 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 98 months)
- Bearstech (for 90 months)
- LiHAS (for 90 months)
- Catalyst IT Ltd (for 85 months)
- Supagro (for 80 months)
- Demarcq SAS (for 79 months)
- Université Grenoble Alpes (for 65 months)
- TouchWeb SAS (for 57 months)
- SPiN AG (for 54 months)
- CoreFiling (for 50 months)
- Institut des sciences cognitives Marc Jeannerod (for 45 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 41 months)
- Tem Innovations GmbH (for 36 months)
- WordFinder.pro (for 35 months)
- CNRS DT INSU Résif (for 34 months)
- Alter Way (for 27 months)
- Institut Camille Jordan (for 17 months)
- SOBIS Software GmbH

Debian Contributions: Python 3 patches, OpenSSH GSS-API split, rebootstrap, salsa CI, etc. (by Anupa Ann Joseph)

Anupa Ann Joseph — Tue, 10 Sep 2024 00:00:00 +0000

Debian Contributions: 2024-08

Debian Python 3 patch review, by Stefano Rivera

Last month, at DebConf, Stefano reviewed the current patch set of Debian’s cPython packages with Matthias Klose, the primary maintainer until now. As a result of that review, Stefano re-reviewed the patchset, updating descriptions, etc. A few patches were able to be dropped, and a few others were forwarded upstream.

One finds all sorts of skeletons doing reviews like this. One of the patches had been inactive (fortunately, because it was buggy) since the day it was applied, 13 years ago. One is a cleanup that probably only fixes a bug on HPUX, and is a result of copying code from xfree86 into Python 25 years ago. It was fixed in xfree86 a year later. Others support just Debian-specific functionality and probably never seemed worth forwarding. Or good cleanup that only really applies to Debian.

A trivial new patch would allow Debian to multiarch co-install Python stable ABI dynamic extensions (like we can with regular dynamic extensions). Performance concerns are stalling it in review, at the moment.

DebConf 24 Organization, by Stefano Rivera

Stefano helped organize DebConf 24, which concluded in early August. The event is run by a large entirely volunteer team. The work involved in making this happen is far too varied to describe here. While Freexian provides funding for 20% of collaborator time to spend on Debian-related work, it only covers a small fraction of contributions to time-intensive tasks like this.

Since the end of the event, Stefano has been doing some work on the conference finances, and initiated the reimbursement process for travel bursaries.

Archive rebuilds on Debusine, by Stefano Rivera

The recent setuptools 73 upload to Debian unstable removed the test subcommand, breaking many packages that were using python3 setup.py test in their Debian packaging. Stefano did a partial archive-rebuild using debusine.debian.net to find the regressions and file bugs.

Debusine will be a powerful tool to do QA work like this for Debian in the future, but it doesn’t have all the features needed to coordinate rebuild-testing, yet. They are planned to be fleshed out in the next year. In the meantime, Debusine has the building blocks to work through a queue of package building tasks and store the results, it just needs to be driven from outside the system.

So, Stefano started working on a set of tools using the Debusine client API to perform archive rebuilds, found and tagged existing bugs, and filed many more.

OpenSSH GSS-API split, by Colin Watson

Colin landed the first stage of the planned split of GSS-API authentication and key exchange support in Debian’s OpenSSH packaging. In order to allow for smooth upgrades, the second stage will have to wait until after the Debian 13 (trixie) release; but once that’s done, as upstream puts it, “this substantially reduces the amount of pre-authentication attack surface exposed on your users’ sshd by default”.

OpenSSL vs. cryptography, by Colin Watson

Colin facilitated a discussion between Debian’s OpenSSL team and the upstream maintainers of Python cryptography about a new incompatibility between Debian’s OpenSSL packaging and cryptography’s handling of OpenSSL’s legacy provider, which was causing a number of build and test failures. While the issue remains open, the Debian OpenSSL maintainers have effectively reverted the change now, so it’s no longer a pressing problem.

/usr-move, by Helmut Grohne

There are less than 40 source packages left to move files to /usr, so what we’re left with is the long tail of the transition. Rather than fix all of them, Helmut started a discussion on removing packages from unstable and filed a first batch. As libvirt is being restructured in experimental, we’re handling the fallout in collaboration with its maintainer Andrea Bolognani. Since base-files validates the aliasing symlinks before upgrading, it was discovered that systemd has its own ideas with no solution as of yet. Helmut also proposed that dash checks for ineffective diversions of /bin/sh and that lintian warns about aliased files.

rebootstrap by Helmut Grohne

Bootstrapping Debian for a new or existing CPU architecture still is a quite manual process. The rebootstrap project attempts to automate part of the early stage, but it still is very sensitive to changes in unstable. We had a number of fairly intrusive changes this year already. August included a little more fallout from the earlier gcc-for-host work where the C++ include search path would end up being wrong in the generated cross toolchain. A number of packages such as util-linux (twice), libxml2, libcap-ng or systemd had their stage profiles broken. e2fsprogs gained a cycle with libarchive-dev due to having gained support for creating an ext4 filesystem from a tar archive. The restructuring of glib2.0 remains an unsolved problem for now, but libxt and cdebconf should be buildable without glib2.0.

Salsa CI, by Santiago Ruano Rincón

Santiago completed the initial RISC-V support (!523) in the Salsa CI’s pipeline. The main work started in July, but it was required to take into account some comments in the review (thanks to Ahmed!) and some final details in [!534]. riscv64 is the most recently supported port in Debian, which will be part of trixie. As its name suggests, the new build-riscv64 job makes it possible to test that a package successfully builds in the riscv64 architecture. The RISC-V runner (salsaci riscv64 runner 01) runs in a couple of machines generously provided by lab.rvperf.org. Debian Developers interested in running this job in their projects should enable the runner (salsaci riscv64 runner 01) in Settings / CI / Runners, and follow the instructions available at https://salsa.debian.org/salsa-ci-team/pipeline/#build-job-on-risc-v.

Santiago also took part in discussions about how to optimize the build jobs and reviewed !537 to make the build-source job to only satisfy the Build-Depends and Build-Conflicts fields by Andrea Pappacoda. Thanks a lot to him!

Miscellaneous contributions

Stefano submitted patches for BeautifulSoup to support the latest soupsieve and lxml.
Stefano uploaded pypy3 7.3.17, upgrading the cPython compatibility from 3.9 to 3.10. Then ran into a GCC-14-related regression, which had to be ignored for now as it’s proving hard to fix.
Colin released libpipeline 1.5.8 and man-db 2.13.0; the latter included foundations allowing adding an autopkgtest for man-db.
Colin upgraded 19 Python packages to new upstream versions (fixing 5 CVEs), fixed several other build failures, fixed a Python 3.12 compatibility issue in zope.security, and made python-nacl build reproducibly.
Colin tracked down test failures in python-asyncssh and Ruby resulting from certain odd /etc/hosts configurations.
Carles upgraded the packages python-ring-doorbell and simplemonitor to new upstream versions.
Carles started discussions and implementation of a tool (still in early days) named “po-debconf-manager”: a way for translators and reviewers to collaborate using git as a backend instead of mailing list; and submit the translations using salsa MR. More information next month.
Carles (dog-fooding “po-debconf-manager”) reviewed debconf templates translated by a collaborator.
Carles reviewed and submitted the translation of “apt”.
Helmut sent 19 patches for improving cross building.
Helmut implemented the cross-exe-wrapper proposed by Simon McVittie for use with glib2.0.
Helmut detailed what it takes to make Perl’s ExtUtils::PkgConfig suitable for cross building.
Helmut made the deletion of the root password work in debvm in all situations and implemented a test case using expect.
Anupa attended Debian Publicity team meeting and is moderating and posting on Debian Administrators LinkedIn group.
Thorsten uploaded package gutenprint to fix a FTBFS with gcc14 and package ipp-usb to fix a /usr-merge issue.
Santiago updated bzip2 to fix a long-standing bug that requested to include a pkg-config file. An important impact of this change is that it makes it possible to use Rust bindings for libbz2 by Sequoia, an implementation of OpenPGP.

Debian Contributions: autopkgtest/incus builds, live-patching, Salsa CI, Python 3.13 (by Stefano Rivera)

Stefano Rivera — Mon, 12 Aug 2024 00:00:00 +0000

Debian Contributions: 2024-07

autopkgtest/Incus build streamlining, by Colin Watson

Colin contributed a change to allow maintaining Incus container and VM images in parallel. Both of these are useful (containers are faster, but some tests need full machine isolation), and the build tools previously didn’t handle that very well.

This isn’t yet in unstable, but once it is, keeping both flavours of unstable images up to date will be a simple matter of running this regularly:

RELEASE=sid autopkgtest-build-incus images:debian/trixie
RELEASE=sid autopkgtest-build-incus --vm images:debian/trixie

Linux live-patching, by Santiago Ruano Rincón

In collaboration with Emmanuel Arias, Santiago continued the work on the support for applying security fixes to the Linux kernel in Debian, without the need to reboot the machine. As mentioned in the previous month report, kpatch 0.9.9-1 (and 0.9.9-2 afterwards) was uploaded to unstable in July, closing the Intent to Salvage (ITS) bug. With this upload, the remaining RC bugs were solved, and kpatch was able to transition to Debian testing recently. Kpatch is expected to be an important component in the live-patching support, since it makes it easy to build a patch as a kernel module. Emmanuel and Santiago continued to work on the design for Linux live-patching and presented the current status in the DebConf24 presentation.

Salsa CI, by Santiago Ruano Rincón

To be able to add RISC-V support and to avoid using tools not packaged in Debian (See #331), the Salsa CI pipeline first needed to move away from kaniko to build the images used by the pipeline. Santiago created a merge request to use buildah instead, and it was merged last month. Santiago also prepared a couple of more MRs related to how the images are built: initial RISC-V support, that should be merged after improving how built images are tested. The switch to buildah introduced a regression in the work-in-progress MR that adds new build image so the build job can run sbuild. Santiago hopes to address this regression and continue with the sbuild-related MRs in August.

Additionally, Santiago also contributed to the install docker-cli instead of docker.io in the piuparts image MR, and reviewed others such as reprotest: Add –append-build-command option, fix failure at manual pipeline run when leaving RELEASE variable empty and Fix image not found error on image building stage.

Python 3.13 Betas, by Stefano Rivera

As Python 3.13 is approaching the first release, Stefano has been uploading the beta releases to Debian unstable. Most of these have uncovered small bugs that needed to be investigated and fixed.

Stefano also took the time to review the current patch set against cPython in Debian.

Python 3.13 isn’t marked as a supported Python release in Debian’s Python tooling, yet, so nothing has been built against it, yet. Now that the Python 3.12 transition has completed, the next task will be to start trying to build Debian’s Python module packages against Python 3.13, to estimate the work required to transition to 3.13 in unstable.

Miscellaneous contributions

Carles Pina updated the packages python-asyncclick, python-pyaarlo and prepared updates for python-ring-doorbell and simplemonitor.
Carles Pina updated (reviewing or translating) Catalan translations for adduser, apt-listchanges, debconf and shadow.
Colin merged OpenSSH 9.8, and prepared a corresponding release note for DSA support now being disabled. This version included some substantial changes to split the server into a listener binary and a per-session binary, and those required some corresponding changes in the GSS-API key exchange patch. Sorting out the details of this and getting it to work again took some time.
Colin upgraded 11 Python packages to new upstream versions, and modernized the build process and/or added non-superficial autopkgtests to several more.
Raphaël Hertzog tweaked tracker.debian.org’s debci task to work around changes in the JSON output. He also improved tracker.debian.org’s ability to detect bounces due to spam to avoid unsubscribing emails that are not broken, but that are better than Debian at rejecting spam.
Helmut Grohne monitored the /usr-move transition with few incidents. A notable one is that some systems have ended up with aliasing links that don’t match the ones installed by base-files which could lead to an unpack error from dpkg. This is now prevented by having base-files.preinst error out.
Helmut investigated toolchain bootstrap failures with gcc-14 in rebootstrap but would only discover the cause in August.
Helmut sent a MR for the cross-exe-wrapper requested by Simon McVittie for gobject-introspection. It is a way of conditionally requesting qemu-user when emulation is required for execution during cross compilation.
Helmut sent three patches for cross build failures.
Thorsten Alteholz uploaded packages lprint and magicfilter to fix RC-bugs that appeared due to the introduction of gcc-14.
Santiago continued to work on activities related to the DebConf24 Content Team, including reviewing the schedule and handling updates on it.
Santiago worked on preparations for the DebConf25, to be held in Brest, France, next year. A video of the BoF presented during DebConf24 can be found here.
Stefano worked on preparations for DebConf24, and helped to run the event.

Monthly report about Debian Long Term Support, July 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 12 Aug 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In July, 13 contributors have been paid to work on Debian LTS, their reports are available:

Bastien Roucariès did 20.0h (out of 20.0h assigned).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 5.0h (out of 4.0h assigned and 6.0h from previous period), thus carrying over 5.0h to the next month.
Guilhem Moulin did 8.75h (out of 4.5h assigned and 15.5h from previous period), thus carrying over 11.25h to the next month.
Lee Garrett did 51.5h (out of 10.5h assigned and 43.0h from previous period), thus carrying over 2.0h to the next month.
Lucas Kanashiro did 5.0h (out of 5.0h assigned and 15.0h from previous period), thus carrying over 15.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 4.0h (out of 10.0h assigned and 14.0h from previous period), thus carrying over 20.0h to the next month.
Roberto C. Sánchez did 5.0h (out of 5.25h assigned and 6.75h from previous period), thus carrying over 7.0h to the next month.
Santiago Ruano Rincón did 6.0h (out of 16.0h assigned), thus carrying over 10.0h to the next month.
Sean Whitton did 2.25h (out of 6.0h assigned), thus carrying over 3.75h to the next month.
Sylvain Beucler did 39.5h (out of 2.5h assigned and 51.0h from previous period), thus carrying over 14.0h to the next month.
Thorsten Alteholz did 11.0h (out of 11.0h assigned).

Evolution of the situation

In July, we have released 1 DLA.

August will be the month that Debian 11 makes the transition to LTS. Our contributors have already been hard at work with preparatorty tasks and also with making contributions to packages in Debian 11 in close collaboration with the Debian security team and package maintainers. As a result, users and sponsors should not observe any especially notable differences as the transition occurs.

While only one DLA was released in July (as a result of the transitional state of Debian 11 “bullseye”), there were some notable highlights. LTS contributor Guilhem Moulin prepared an update of libvirt for Debian 11 (in collaboration with the Old-Stable Release Managers and the Debian Security Team) to fix a number of outstanding CVEs which did not rise to the level of a DSA by the Debian Security Team. The update prepared by Guilhem will be included in Debian 11 as part of the final point release at the end of August, one of the final transition steps by the Release Managers as Debian 11 moves entirely to the LTS Team’s responsibility. Notable work was also undertaken by contributors Lee Garrett (fixes on the ansible test suite and a bullseye update), Lucas Kanashiro (Rust toolchain, utilized by the clamav, firefox-esr, and thunderbird packages), and Sylvain Beucler (fixes on the ruby2.5/2.7 test suites and CI infrastructure), which will help improve the quality of updates produced during the next LTS cycle.

June was the final month of LTS for Debian 10 (as announced on the debian-lts-announce mailing list). No additional Debian 10 security updates will be made available on security.debian.org.

However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for customers of the Extended LTS offer. Subscribe right away if you still have Debian 10 systems which must be kept secure (and which cannot yet be upgraded).

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 106 months)
- Civil Infrastructure Platform (CIP) (for 74 months)
- VyOS Inc (for 38 months)
Gold sponsors:
- Roche Diagnostics International AG (for 116 months)
- Linode (for 110 months)
- Babiel GmbH (for 100 months)
- Plat’Home (for 99 months)
- CINECA (for 74 months)
- University of Oxford (for 56 months)
- Deveryware (for 43 months)
- EDF SA (for 28 months)
- Dataport AöR (for 3 months)
Silver sponsors:
- Domeneshop AS (for 121 months)
- Nantes Métropole (for 115 months)
- Univention GmbH (for 107 months)
- Université Jean Monnet de St Etienne (for 107 months)
- Ribbon Communications, Inc. (for 101 months)
- Exonet B.V. (for 91 months)
- Leibniz Rechenzentrum (for 85 months)
- Ministère de l’Europe et des Affaires Étrangères (for 69 months)
- Cloudways by DigitalOcean (for 58 months)
- Dinahosting SL (for 56 months)
- Bauer Xcel Media Deutschland KG (for 50 months)
- Platform.sh SAS (for 50 months)
- Moxa Inc. (for 44 months)
- sipgate GmbH (for 42 months)
- OVH US LLC (for 40 months)
- Tilburg University (for 40 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 31 months)
- Soliton Systems K.K. (for 28 months)
- THINline s.r.o. (for 4 months)
Bronze sponsors:
- Evolix (for 121 months)
- Seznam.cz, a.s. (for 121 months)
- Intevation GmbH (for 118 months)
- Linuxhotel GmbH (for 118 months)
- Daevel SARL (for 117 months)
- Bitfolk LTD (for 116 months)
- Megaspace Internet Services GmbH (for 116 months)
- Greenbone AG (for 115 months)
- NUMLOG (for 115 months)
- WinGo AG (for 114 months)
- Entr’ouvert (for 105 months)
- Adfinis AG (for 103 months)
- Tesorion (for 98 months)
- GNI MEDIA (for 97 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 97 months)
- Bearstech (for 89 months)
- LiHAS (for 89 months)
- Catalyst IT Ltd (for 84 months)
- Supagro (for 79 months)
- Demarcq SAS (for 78 months)
- Université Grenoble Alpes (for 64 months)
- TouchWeb SAS (for 56 months)
- SPiN AG (for 53 months)
- CoreFiling (for 49 months)
- Institut des sciences cognitives Marc Jeannerod (for 44 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 40 months)
- Tem Innovations GmbH (for 35 months)
- WordFinder.pro (for 34 months)
- CNRS DT INSU Résif (for 33 months)
- Alter Way (for 26 months)
- Institut Camille Jordan (for 16 months)
- SOBIS Software GmbH

Monthly report about Debian Long Term Support, June 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 12 Jul 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In June, 18 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 47.0h (out of 74.25h assigned and 11.75h from previous period), thus carrying over 39.0h to the next month.
Arturo Borrero Gonzalez did 6.0h (out of 6.0h assigned).
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 15.5h (out of 16.0h assigned and 8.0h from previous period), thus carrying over 8.5h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 4.0h (out of 8.0h assigned and 2.0h from previous period), thus carrying over 6.0h to the next month.
Emilio Pozuelo Monfort did 23.25h (out of 49.5h assigned and 10.5h from previous period), thus carrying over 36.75h to the next month.
Guilhem Moulin did 4.5h (out of 13.0h assigned and 7.0h from previous period), thus carrying over 15.5h to the next month.
Lee Garrett did 17.0h (out of 25.0h assigned and 35.0h from previous period), thus carrying over 43.0h to the next month.
Lucas Kanashiro did 5.0h (out of 10.0h assigned and 10.0h from previous period), thus carrying over 15.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 10.0h (out of 6.5h assigned and 17.5h from previous period), thus carrying over 14.0h to the next month.
Roberto C. Sánchez did 5.25h (out of 7.75h assigned and 4.25h from previous period), thus carrying over 6.75h to the next month.
Santiago Ruano Rincón did 22.5h (out of 14.5h assigned and 8.0h from previous period).
Sean Whitton did 6.5h (out of 6.0h assigned and 0.5h from previous period).
Stefano Rivera did 0.5h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 9.5h to the next month.
Sylvain Beucler did 9.0h (out of 24.5h assigned and 35.5h from previous period), thus carrying over 51.0h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).

Evolution of the situation

In June, we have released 31 DLAs.

Notable security updates in June included:

git: multiple vulnerabilities, which may result in privilege escalation, denial of service, and arbitrary code execution
sendmail: SMTP smuggling allowed remote attackers bypass SPF protection checks
cups: arbitrary remote code execution

Looking further afield to the broader Debian ecosystem, LTS contributor Bastien Roucariès also patched sendmail in Debian 12 (bookworm) and 11 (bullseye) in order to fix the previously mentioned SMTP smuggling vulnerability. Furthermore, LTS contributor Thorsten Alteholz provided fixes for the cups packages in Debian 12 (bookworm) and 11 (bullseye) in order to fix the aforementioned arbitrary remote code execution vulnerability.

Additionally, LTS contributor Ben Hutchings has commenced work on an updated backport of Linux kernel 6.1 to Debian 11 (bullseye), in preparation for bullseye transitioning to the responsibility of the LTS Team (and the associated closure of the bullseye-backports repository). LTS contributor Lucas Kanashiro also began the preparatory work of backporting parts of the rust/cargo toolchain to Debian 11 (bullseye) in order to make future updates of the clamav virus scanner possible.

June was the final month of LTS for Debian 10 (as announced on the debian-lts-announce mailing list). No additional Debian 10 security updates will be made available on security.debian.org.

However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for the customers of the Extended LTS offer. Subscribe right away if you still have Debian 10 which must be kept secure (and which cannot yet be upgraded).

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 105 months)
- Civil Infrastructure Platform (CIP) (for 73 months)
- VyOS Inc (for 37 months)
Gold sponsors:
- Roche Diagnostics International AG (for 115 months)
- Linode (for 109 months)
- Babiel GmbH (for 99 months)
- Plat’Home (for 98 months)
- CINECA (for 73 months)
- University of Oxford (for 55 months)
- Deveryware (for 42 months)
- EDF SA (for 27 months)
- Dataport AöR
Silver sponsors:
- Domeneshop AS (for 120 months)
- Nantes Métropole (for 114 months)
- Univention GmbH (for 106 months)
- Université Jean Monnet de St Etienne (for 106 months)
- Ribbon Communications, Inc. (for 100 months)
- Exonet B.V. (for 90 months)
- Leibniz Rechenzentrum (for 84 months)
- Ministère de l’Europe et des Affaires Étrangères (for 68 months)
- Cloudways by DigitalOcean (for 57 months)
- Dinahosting SL (for 55 months)
- Bauer Xcel Media Deutschland KG (for 49 months)
- Platform.sh SAS (for 49 months)
- Moxa Inc. (for 43 months)
- sipgate GmbH (for 41 months)
- OVH US LLC (for 39 months)
- Tilburg University (for 39 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 30 months)
- Soliton Systems K.K. (for 27 months)
- THINline s.r.o. (for 3 months)
Bronze sponsors:
- Evolix (for 120 months)
- Seznam.cz, a.s. (for 120 months)
- Intevation GmbH (for 117 months)
- Linuxhotel GmbH (for 117 months)
- Daevel SARL (for 116 months)
- Bitfolk LTD (for 115 months)
- Megaspace Internet Services GmbH (for 115 months)
- Greenbone AG (for 114 months)
- NUMLOG (for 114 months)
- WinGo AG (for 113 months)
- Ecole Centrale de Nantes - LHEEA (for 109 months)
- Entr’ouvert (for 104 months)
- Adfinis AG (for 102 months)
- Tesorion (for 97 months)
- GNI MEDIA (for 96 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 96 months)
- Bearstech (for 88 months)
- LiHAS (for 88 months)
- Catalyst IT Ltd (for 83 months)
- Supagro (for 78 months)
- Demarcq SAS (for 77 months)
- Université Grenoble Alpes (for 63 months)
- TouchWeb SAS (for 55 months)
- SPiN AG (for 52 months)
- CoreFiling (for 48 months)
- Institut des sciences cognitives Marc Jeannerod (for 43 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 39 months)
- Tem Innovations GmbH (for 34 months)
- WordFinder.pro (for 33 months)
- CNRS DT INSU Résif (for 32 months)
- Alter Way (for 25 months)
- Institut Camille Jordan (for 15 months)

Debian Contributions: YubiHSM packaging, unschroot, live-patching, and more! (by Stefano Rivera)

Stefano Rivera — Wed, 10 Jul 2024 00:00:00 +0000

Debian Contributions: 2024-06

YubiHSM packaging, by Colin Watson

Freexian is starting to use YubiHSM devices (hardware security modules) as part of some projects, and we wanted to have the supporting software directly in Debian rather than needing to use third-party repositories. Since Yubico publish everything we need under free software licences, Colin packaged yubihsm-connector, yubihsm-shell, and python-yubihsm from https://developers.yubico.com/, in some cases based partly on the upstream packaging, and got them all into Debian unstable. Backports to bookworm will be forthcoming once they’ve all reached testing.

`unschroot` by Helmut Grohne

Following an in-person discussion at MiniDebConf Berlin, Helmut attempted splitting the containment functionality of sbuild --chroot-mode=unshare into a dedicated tool interfacing with sbuild as a variant of --chroot-mode=schroot providing a sufficiently compatible interface.

While this seemed technically promising initially, a discussion on debian-devel indicated a desire to rely on an existing container runtime such as podman instead of using another Debian-specific tool with unclear long term maintenance. None of the existing container runtimes meet the specific needs of sbuild, so further advancing this matter implies a compromise one way or another.

Linux live-patching, by Santiago Ruano Rincón

In collaboration with Emmanuel Arias, Santiago is working on the development of linux live-patching for Debian. For the moment, this is in an exploratory phase, that includes how to handle the different patches that will need to be provided. kpatch could help significantly in this regard. However, kpatch was removed from unstable because there are some RC bugs affecting the version that was present in Debian unstable. Santiago packaged the most recent upstream version (0.9.9) and filed an Intent to Salvage bug. Santiago is waiting for an ACK by the maintainer, and will upload to unstable after July 10th, following the package salvaging rules. While kpatch 0.9.9 fixes the main issues, it still needs some work to properly support Debian and the Linux kernel versions packaged in our distribution. More on this in the report next month.

Salsa CI, by Santiago Ruano Rincón

The work by Santiago in Salsa CI this month includes a merge request to ease testing how the production images are built from the changes introduced by future merge requests. By default, the pipelines triggered by a merge request build a subset of the images built for production, to reduce the use of resources, and because most of the time the subset of staging images is enough to test the proposed modifications. However, sometimes it is needed to test how the full set of production images is built, and the above mentioned MR helps to do that. The changes include documentation, so hopefully this will make it easier to test future contributions.

Also, for being able to include support for RISC-V, Salsa CI needs to replace kaniko as the tool used to build the images. Santiago tested buildah, but there are some issues when pushing built images for non-default platform architectures (i386, armhf, armel) to the container registry. Santiago will continue to work on this to find a solution.

Miscellaneous contributions

Stefano Rivera prepared updates for a number of Python modules.
Stefano uploaded the latest point release of Python 3.12 and the latest Python 3.13 beta. Both uncovered upstream regressions that had to be addressed.
Stefano worked on preparations for DebConf 24.
Stefano helped SPI to reconcile their financial records for DebConf 23.
Colin did his usual routine work on the Python team, upgrading 36 packages to new upstream versions (including fixes for four CVEs in python-aiohttp), fixing RC bugs in ipykernel, ipywidgets, khard, and python-repoze.sphinx.autointerface, and packaging zope.deferredimport which was needed for a new upstream version of python-persistent.
Colin removed the user_readenv option from OpenSSH’s PAM configuration (#1018260), and prepared a release note.
Thorsten Alteholz uploaded a new upstream version of cups.
Nicholas Skaggs updated xmacro to support reproducible builds (#1014428), DEP-3 and DEP-5 compatibility, along with utilizing hardening build flags. Helmut supported and uploaded package.
As a result of login having become non-essential, Helmut uploaded debvm to unstable and stable and fixed a crossqa.debian.net worker.
Santiago worked on the Content Team activities for DebConf24. Together with other DebConf25 team members, Santiago wrote a document for the head of the venue to describe the project of the conference.

Monthly report about Debian Long Term Support, May 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Wed, 12 Jun 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In May, 17 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 34.25h (out of 24.0h assigned and 22.0h from previous period), thus carrying over 11.75h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 16.0h (out of 24.0h assigned), thus carrying over 8.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 8.0h (out of 10.0h assigned), thus carrying over 2.0h to the next month.
Emilio Pozuelo Monfort did 35.5h (out of 46.0h assigned), thus carrying over 10.5h to the next month.
Guilhem Moulin did 13.0h (out of 14.75h assigned and 5.25h from previous period), thus carrying over 7.0h to the next month.
Lee Garrett did 11.0h (out of 37.25h assigned and 8.75h from previous period), thus carrying over 35.0h to the next month.
Lucas Kanashiro did 10.0h (out of 20.0h assigned), thus carrying over 10.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 6.5h (out of 22.5h assigned and 1.5h from previous period), thus carrying over 17.5h to the next month.
Roberto C. Sánchez did 7.75h (out of 11.0h assigned and 1.0h from previous period), thus carrying over 4.25h to the next month.
Santiago Ruano Rincón did 8.0h (out of 16.0h assigned), thus carrying over 8.0h to the next month.
Sean Whitton did 5.5h (out of 5.5h assigned and 0.5h from previous period), thus carrying over 0.5h to the next month.
Sylvain Beucler did 10.5h (out of 0.75h assigned and 45.25h from previous period), thus carrying over 35.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 7.75h (out of 10.0h assigned and 2.0h from previous period), thus carrying over 4.25h to the next month.

Evolution of the situation

In May, we have released 20 DLAs.

Notable security updates in May included:

apache2: multiple vulnerabilities which may result in HTTP response splitting, denial of service, or authorization bypass (by Bastien Roucariès, in collaboration with apache2 maintainer Yadd)
bind9: two vulnerabilities, called KeyTrap and NSEC3, which may result in denial of service (by Santiago Ruano Rincón)
python-pymysql: potential SQL injection attack (by Chris Lamb)

The aforementioned apache2 was prepared by its Debian maintainer Yadd. This update also involved work on the package test suite in buster, which contributor Bastien Roucariès then forwarded to the apache2 package in unstable. More importantly, a regression in fossil was reported, and Bastien prepared a fix for it. Bastien coordinated the upload of both packages to minimize the introduction of regressions.

Contributor Daniel Leidert also prepared an upload of runc to Debian 11 in order fix a number of CVEs still affecting that package. Finally, contributor Thorsten Alteholz prepared uploads for qtbase-opensource-src, libjwt, and libmicrohttpd in Debian 11. Note that Debian 11 will pass into the LTS phase of support in August and these updates will improve the state and long-term supportability of Debian 11.

Debian 10 is presently in its final month of LTS support (as announced on the debian-lts-announce mailing list, support will end on June 30th), after which no new security updates will be made available on security.debian.org.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 105 months)
- Civil Infrastructure Platform (CIP) (for 73 months)
- VyOS Inc (for 37 months)
Gold sponsors:
- Roche Diagnostics International AG (for 116 months)
- Linode (for 110 months)
- Babiel GmbH (for 99 months)
- Plat’Home (for 99 months)
- CINECA (for 73 months)
- University of Oxford (for 55 months)
- Deveryware (for 42 months)
- EDF SA (for 26 months)
- CERN
Silver sponsors:
- Domeneshop AS (for 120 months)
- Nantes Métropole (for 115 months)
- Univention GmbH (for 106 months)
- Université Jean Monnet de St Etienne (for 106 months)
- Ribbon Communications, Inc. (for 100 months)
- Exonet B.V. (for 90 months)
- Leibniz Rechenzentrum (for 84 months)
- Ministère de l’Europe et des Affaires Étrangères (for 67 months)
- Cloudways by DigitalOcean (for 57 months)
- Dinahosting SL (for 55 months)
- Bauer Xcel Media Deutschland KG (for 49 months)
- Platform.sh SAS (for 49 months)
- Moxa Inc. (for 43 months)
- sipgate GmbH (for 40 months)
- OVH US LLC (for 38 months)
- Tilburg University (for 38 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 30 months)
- Soliton Systems K.K. (for 27 months)
- THINline s.r.o.
Bronze sponsors:
- Evolix (for 121 months)
- Seznam.cz, a.s. (for 121 months)
- Intevation GmbH (for 118 months)
- Linuxhotel GmbH (for 118 months)
- Daevel SARL (for 116 months)
- Bitfolk LTD (for 115 months)
- Megaspace Internet Services GmbH (for 115 months)
- NUMLOG (for 115 months)
- Greenbone AG (for 114 months)
- WinGo AG (for 114 months)
- Ecole Centrale de Nantes - LHEEA (for 110 months)
- Entr’ouvert (for 105 months)
- Adfinis AG (for 102 months)
- GNI MEDIA (for 97 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 97 months)
- Tesorion (for 97 months)
- Bearstech (for 88 months)
- LiHAS (for 88 months)
- Catalyst IT Ltd (for 83 months)
- Supagro (for 78 months)
- Demarcq SAS (for 77 months)
- Université Grenoble Alpes (for 63 months)
- TouchWeb SAS (for 55 months)
- SPiN AG (for 52 months)
- CoreFiling (for 47 months)
- Institut des sciences cognitives Marc Jeannerod (for 42 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 39 months)
- Tem Innovations GmbH (for 34 months)
- WordFinder.pro (for 33 months)
- CNRS DT INSU Résif (for 32 months)
- Alter Way (for 25 months)
- Institut Camille Jordan (for 14 months)

Debian Contributions: DebConf Bursaries, /usr-move, sbuild, and more! (by Stefano Rivera)

Stefano Rivera — Fri, 07 Jun 2024 00:00:00 +0000

DebConf Bursary updates, by Utkarsh Gupta

Utkarsh is the bursaries team lead for DebConf 24. Bursary requests are dispatched to a team of volunteers to review. The results are collated, adjusted and merged to produce priority lists of requests to fund. Utkarsh raised the team, coordinated the review, and issued bursaries to attendees.

/usr-move, by Helmut Grohne

More and more, the /usr-move transition is being carried out by multiple contributors and many performed around a hundred of the requested uploads. Of these, Helmut contributed five patches and two uploads. As a result, there are less than 350 packages left to be converted, and all of the non-trivial cases have patches. We started with three times that number. Thanks to everyone involved for supporting this effort.

For people interested in background information of this transition, Helmut gave a presentation at MiniDebConf Berlin 2024 (slides).

sbuild, by Helmut Grohne

While unshare mode of sbuild has existed for quite a while, it is now getting significant use in Debian, and new problems are popping up. Helmut looked into an apparmor-related failure and provided a diagnosis. While relevant code would detect the chroot nature of a schroot backend and skip apparmor tests, the unshare environment would be just good enough to run and fail the test. As sbuild exposes fewer special kernel filesystems, the tests will be skipped again.

Another problem popped up when gobject-introspection added a dependency on the host architecture Python interpreter in a cross build environment. sbuild would prefer installing (and failing) a host architecture Python to installing the qemu alternative. Attempts to fix this would result in systemd killing sbuild. ischroot as used by libc6.postinst would not classify the unshare environment as a chroot. Therefore libc6.postinst would run telinit which would kill the build process. This is a complex interaction problem that shall eventually be solved by providing triggers from libc6 to be implemented by affected init systems.

Salsa CI updates, by Santiago Ruano Rincón

Several issues arose about Salsa CI last month, and it is probably worth mentioning part of the challenges of defining its framework in YAML. With the upcoming end-of-support of Debian 10 “buster” as LTS, armel was removed from deb.debian.org, making the jobs that build images for buster/armel to fail. While the removal of buster/armel from the repositories is a natural change, it put some light on the “flaws” in the Salsa CI design regarding the support of the different Debian releases. Currently, the images are defined like these (from .images-debian.yml):

.all-supported-releases: &all-supported-releases
  - stretch
  - stretch-backports
  - buster
  - bullseye
  - bullseye-backports
  - bookworm
  - bookworm-backports
  - trixie
  - sid
  - experimental

And from them, different images are built according to the different jobs and how they are supported, for example:

images-prod-arm:
  stage: build
  extends: .build_template
  tags:
    - $SALSA_CI_ARM_RUNNER_TAG
  parallel:
    matrix:
      # Base image, all releases, all arches
      - IMAGE_NAME: base
        ARCH:
          - arm32v5
          - arm32v7
          - arm64v8
        RELEASE: *all-supported-releases

The removal of buster/armel could be easily reflected as:

images-prod-arm:
  stage: build
  extends: .build_template
  tags:
    - $SALSA_CI_ARM_RUNNER_TAG
  parallel:
    matrix:
      # Base image, fully supported releases, all arches
      - IMAGE_NAME: base
        ARCH:
          - arm32v5
          - arm32v7
          - arm64v8
        RELEASE:
          - stretch
          - buster
          - bullseye
          - bullseye-backports
          - bookworm
          - bookworm-backports
          - trixie
          - sid
          - experimental
      # buster only supports armhf and arm64
      - IMAGE_NAME: base
        ARCH:
          - arm32v7
          - arm64v8
        RELEASE: buster

Evidently, this increases duplication of the release support data, which is of course not optimal and it is error prone when changing the data about supported releases. A better approach would be to have two different YAML lists, such as:

# releases that have partial support. E.g.: buster is transitioning to
# Debian LTS, and buster armel is no longer found in deb.debian.org
.old-releases: &old-releases
  - stretch
  - buster

.currently-supported-releases: &currently-supported-releases
  - bullseye
  - bullseye-backports
  - bookworm
  - bookworm-backports
  - trixie
  - sid
  - experimental

and then a unified list:

.all-supported-releases: &all-supported-releases
  - *old-releases
  - *currently-supported-releases

that could be used in the matrix of the jobs that build all the images available in the pipeline container registry.

However, due to limitations in GitLab, it is not possible to expand the variables or mapping values in a parallel:matrix context. At least not in an elegant fashion.

This is the kind of issue that recently arose and that Santiago is currently working to solve, in the simplest possible way.

Astute readers would notice that stretch is listed in the fully supported releases. And there is no problem with stretch, because it is built from archive.debian.org. Otto actually has tried to fix the broken image build job doing the same, but it is still incorrect, because the security repository is not (yet) available in archive.debian.org.

Additionally, Santiago has also worked on other merge requests, such as:

Archiving DebConf Websites, by Stefano Rivera

DebConf, the annual Debian conference, has its own new website every year. These are typically complex dynamic web applications (featuring registration, call for papers, scheduling, etc.) Once the conference is over, there is no need to keep maintaining these applications, so we archive the sites off as static HTML, and serve them from Debian’s static CDN.

Stefano archived the websites for the last two DebConfs.

The schedule system behind DebConf 14 and 15’s websites was a derivative of Canonical’s summit system. This was only used for a couple of years before migrating to wafer, the current system. Archiving summit content has been on the “nice to have” list for years, but nobody has ever tackled it. The machine that served the sites went away a couple of years ago. After much digging, a backup of the database was found, and Stefano got this code running on an ancient Python 2.7. Recently Stefano put this all together and hooked in an archive export to finally get this content preserved.

Python 3.x and pypy3 security bug triage, by Stefano Rivera

Stefano Rivera triaged all the open security bugs against the Python 3.x and PyPy3 packages for Debian’s stable and LTS releases. Several had been fixed but this wasn’t recorded in the security tracker.

Linux livepatching support for Debian, by Santiago Ruano Rincón

In collaboration with Emmanuel Arias, Santiago filed ITP bug #1070494. As stated in the bug, more than an Intent to Package, it is an Intent to Design and Implement live patching support for the Linux kernel in Debian. For now, Emmanuel and Santiago have done exploratory work and they are working to understand the different possibilities to implement livepatching. One possible direction is to rely on kpatch, and the other is to package the modules using regular packaging tools. Also, it is needed to evaluate if it is possible to rely on distributing the modules via packages, or instead as a service, as it is done by some commercial distributions.

Miscellaneous contributions

Thorsten Alteholz uploaded cups-bjnp to improve packaging.
Colin Watson tracked down a baffling CI issue in openssh to unblock several merge requests, removed the user_readenv=1 option from its PAM configuration, and started on the first stage of his plan to split out GSS-API key exchange support to separate packages.
Colin did his usual routine work on the Python team, upgrading 26 packages to new upstream versions, and cherry-picking an upstream PR to fix a pytest 8 incompatibility in ipywidgets.
Colin NMUed a couple of packages to reduce the need for explicit overrides in Packages-arch-specific, and removed some other obsolete entries from there.
Emilio managed various library transitions, and helped finish a few of the remaining t64 transitions.
Helmut sent a patch for enabling piuparts to work as a regular user building on earlier work.
Helmut sent patches for 7 cross build failures, 6 other debian bugs and fixed an infrastructure problem in crossqa.debian.net.
Nicholas worked on a sponsored package upload, and discovered the blhc tool for diagnosing build hardening.
Stefano Rivera started and completed the re2 transition. The release team suggested moving to a virtual package scheme that includes the absl ABI (as re2 now depends on it). Adopted this.
Stefano continued to work on DebConf 24 planning.
Santiago continued to work on DebConf24 Content tasks as well as Debconf25 organisation.

Discover release 0.3.0 of the debusine software factory (by Colin Watson)

Colin Watson — Fri, 24 May 2024 00:00:00 +0000

Debusine is a Free Software project developed by Freexian to manage scheduling and distribution of Debian-related tasks to a network of worker machines. It was started some time back, but its development pace has recently increased significantly thanks to funding from the Sovereign Tech Fund. You can read more about it in its documentation.

For more background, Enrico Zini and Carles Pina i Estany gave a talk on Debusine in November 2023 at the mini-DebConf in Cambridge.

We described the work from our first funded milestone in a post to debian-devel-announce in March.

We’ve recently finished work on our second funded milestone, culminating in releasing version 0.3.0 to unstable. Our focus on this milestone was on new building blocks to allow us to automatically orchestrate QA tasks in bulk. Full details are in our release history document. As usual, debusine.debian.net is up to date with our latest work.

Collections

In the previous milestone, debusine could store artifacts and run tasks against those artifacts. However, on its own this required the user to do a lot of manual work, because the only way to refer to an artifact was by its ID.

We now have the concept of a collection, which can store references to other artifacts (or indeed to other collections) with some attached metadata. These are structured by category, so for example a debian:suite collection contains references to source and binary package artifacts with their names, versions, and architectures as metadata. This allows us to look up artifacts using a simple query language instead of just by ID.

At the moment, the main visible effect of this is that our Getting started with debusine tutorial no longer needs users of debusine.debian.net to create their own build environments before being able to submit other work requests: they can refer to existing environments using something like debian/match:codename=trixie:variant=sbuild instead.

We also have a basic user interface allowing you to browse existing collections, accessible via the relevant workspace (such as the default System workspace).

Workflows

We’ve always known that individual tasks were just a starting point: real-world requirements often involve chaining many tasks together, as many Debian developers already do using the Salsa CI pipeline. debusine intends to approach a similar problem from a different angle, defining common workflows that can be applied at the scale of a whole distribution without being tightly coupled to where each package’s code is hosted.

In time we intend to define a way for users to specify their own workflows, but rather than getting too bogged down in this we started by building a couple of predefined workflows into debusine. The update_environments workflow is used to create multiple build environments in bulk, while the sbuild workflow builds a source package for all the architectures that it supports and for which debusine has workers. (debusine.debian.net currently has amd64 and arm64 workers, supporting the amd64, arm64, armel, armhf, and i386 architectures between them.)

Upcoming work will build on this by adding more workflows that chain tasks together in various ways, such as workflows that build a package and run QA tasks on the results, or a workflow that builds a package and uploads the result to an upload queue.

Next steps

Our next planned milestone involves expanding debusine’s capability as a build daemon. For that, we already know that there are a number of specific extra workflow steps we need to add, and we’ve reached out to some members of Debian’s buildd team to ask for feedback on what they consider necessary. We hope to be able to replace some of Freexian’s own build infrastructure with debusine in the near future.

Monthly report about Debian Long Term Support, April 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Tue, 14 May 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In April, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.5h (out of 0.0h assigned and 14.0h from previous period), thus carrying over 13.5h to the next month.
Adrian Bunk did 35.75h (out of 17.25h assigned and 40.5h from previous period), thus carrying over 22.0h to the next month.
Bastien Roucariès did 25.0h (out of 25.0h assigned).
Ben Hutchings did 24.0h (out of 9.0h assigned and 15.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 10.0h (out of 10.0h assigned).
Emilio Pozuelo Monfort did 46.0h (out of 12.0h assigned and 34.0h from previous period).
Guilhem Moulin did 14.75h (out of 20.0h assigned), thus carrying over 5.25h to the next month.
Lee Garrett did 51.25h (out of 0.0h assigned and 60.0h from previous period), thus carrying over 8.75h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 22.5h (out of 19.5h assigned and 4.5h from previous period), thus carrying over 1.5h to the next month.
Roberto C. Sánchez did 11.0h (out of 9.25h assigned and 2.75h from previous period), thus carrying over 1.0h to the next month.
Santiago Ruano Rincón did 20.0h (out of 20.0h assigned).
Sean Whitton did 9.5h (out of 4.5h assigned and 5.5h from previous period), thus carrying over 0.5h to the next month.
Stefano Rivera did 1.5h (out of 0.0h assigned and 10.0h from previous period), thus carrying over 8.5h to the next month.
Sylvain Beucler did 12.5h (out of 22.75h assigned and 35.0h from previous period), thus carrying over 45.25h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 10.0h (out of 12.0h assigned), thus carrying over 2.0h to the next month.
Utkarsh Gupta did 3.25h (out of 28.5h assigned and 29.25h from previous period), thus carrying over 54.5h to the next month.

Evolution of the situation

In April, we have released 28 DLAs.

During the month of April, there was one particularly notable security update made in LTS. Guilhem Moulin prepared DLA-3782-1 for util-linux (part of the set of base packages and containing a number of important system utilities) in order to address a possible information disclosure vulnerability.

Additionally, several contributors prepared updates for oldstable (bullseye), stable (bookworm), and unstable (sid), including:

ruby-rack: prepared for oldstable, stable, and unstable by Adrian Bunk
wpa: prepared for oldstable, stable, and unstable by Bastien Roucariès
zookeeper: prepared for stable by Bastien Roucariès
libjson-smart: prepared for unstable by Bastien Roucariès
ansible: prepared for stable and unstable, including autopkgtest fixes to increase future supportability, by Lee Garrett
wordpress: prepared for oldstable and stable by Markus Koschany
emacs and org-mode: prepared for oldstable and stable by Sean Whitton
qtbase-opensource-src: prepared for oldstable and stable by Thorsten Alteholz
libjwt: prepared for oldstable by Thorsten Alteholz
libmicrohttpd: prepared for oldstable by Thorsten Alteholz

These fixes were in addition to corresponding updates in LTS.

Another item to highlight in this month’s report is an update to the distro-info-data database by Stefano Rivera. This update ensures that Debian buster systems have the latest available information concerning the end-of-life dates and other related information for all releases of Debian and Ubuntu.

As announced on the debian-lts-announce mailing list, it is worth to point out that we are getting close to the end of support of Debian 10 as LTS. After June 30th, no new security updates will be made available on security.debian.org.

However, Freexian and its team of paid Debian contributors will continue to maintain Debian 10 going forward for the customers of the Extended LTS offer. If you still have Debian 10 servers to keep secure, it’s time to subscribe!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 104 months)
- Civil Infrastructure Platform (CIP) (for 72 months)
Gold sponsors:
- Roche Diagnostics International AG (for 115 months)
- Linode (for 109 months)
- Babiel GmbH (for 98 months)
- Plat’Home (for 98 months)
- CINECA (for 72 months)
- University of Oxford (for 54 months)
- Deveryware (for 41 months)
- VyOS Inc (for 36 months)
- EDF SA (for 25 months)
Silver sponsors:
- Domeneshop AS (for 119 months)
- Nantes Métropole (for 114 months)
- Univention GmbH (for 105 months)
- Université Jean Monnet de St Etienne (for 105 months)
- Ribbon Communications, Inc. (for 99 months)
- Exonet B.V. (for 89 months)
- Leibniz Rechenzentrum (for 83 months)
- Ministère de l’Europe et des Affaires Étrangères (for 67 months)
- Cloudways by DigitalOcean (for 56 months)
- Dinahosting SL (for 54 months)
- Bauer Xcel Media Deutschland KG (for 48 months)
- Platform.sh SAS (for 48 months)
- Moxa Inc. (for 42 months)
- sipgate GmbH (for 39 months)
- OVH US LLC (for 37 months)
- Tilburg University (for 37 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 29 months)
- Soliton Systems K.K. (for 26 months)
- THINline s.r.o.
Bronze sponsors:
- Evolix (for 120 months)
- Seznam.cz, a.s. (for 120 months)
- Intevation GmbH (for 117 months)
- Linuxhotel GmbH (for 117 months)
- Daevel SARL (for 115 months)
- Bitfolk LTD (for 114 months)
- Megaspace Internet Services GmbH (for 114 months)
- NUMLOG (for 114 months)
- Greenbone AG (for 113 months)
- WinGo AG (for 113 months)
- Ecole Centrale de Nantes - LHEEA (for 109 months)
- Entr’ouvert (for 104 months)
- Adfinis AG (for 102 months)
- GNI MEDIA (for 96 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 96 months)
- Tesorion (for 96 months)
- Bearstech (for 87 months)
- LiHAS (for 87 months)
- Catalyst IT Ltd (for 82 months)
- Supagro (for 77 months)
- Demarcq SAS (for 76 months)
- Université Grenoble Alpes (for 62 months)
- TouchWeb SAS (for 54 months)
- SPiN AG (for 51 months)
- CoreFiling (for 46 months)
- Institut des sciences cognitives Marc Jeannerod (for 41 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 38 months)
- Tem Innovations GmbH (for 33 months)
- WordFinder.pro (for 32 months)
- CNRS DT INSU Résif (for 31 months)
- Alter Way (for 24 months)
- Institut Camille Jordan (for 13 months)

Debian Contributions: Salsa CI updates, OpenSSH option review, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Sun, 12 May 2024 00:00:00 +0000

P.S. We’ve completed over a year of writing these blogs. If you have any suggestions on how to make them better or what you’d like us to cover, or any other opinions/reviews you might have, et al, please let us know by dropping an email to us. We’d be happy to hear your thoughts. :)

Salsa CI updates & GSoC candidacy, by Santiago Ruano Rincon

In the context of Google Summer of Code (GSoC), Santiago continued the mentoring work, following the applications of three of the candidates. This work started in March, but Aquila Macedo, Ahmed Siam and Piyush Raj continued in April to propose and review MRs. For example, Update CI pipeline to utilize specific blhc image per release and Remove references to buster-backports by Aquila, or the reviews the candidates made to Document the structure of the different components of the pipeline (see below).

Unfortunately, the Salsa CI project didn’t get any slot from the GSoC program in the end.

Along with the Salsa CI related work, Santiago improved the documentation of Salsa CI, to make it easier for newcomers (as the GSoC candidates) or people willing to fork the project to understand its internals. Documentation is an aspect where a lot of improvements can be made.

OpenSSH option review, by Colin Watson

In light of last month’s xz-utils backdoor, Colin did an extensive review of some of the choices in Debian’s OpenSSH packaging. Some work on this has already been done (removing uses of libsystemd and reducing tcp-wrappers linkage); the next step is likely to be to start work on the plan to split out GSS-API key exchange again.

Miscellaneous contributions

Utkarsh Gupta started to put together and kickstart the bursary team ahead of DebConf 24, to be held in Busan, South Korea.
Utkarsh Gupta reviewed some MRs and docs for the bursary team for the DC24 website.
Helmut Grohne sent patches for 19 cross build failures and submitted a gcc patch removing LIMITS_H_TEST upstream.
Helmut sent 8 bug reports with 3 patches related to the /usr-move.
Helmut diagnosed why /dev/stdout is not accessible in sbuild --mode=unshare.
Helmut diagnosed the time64-induced glibc FTBFS.
Helmut sent patches for fixing initramfs triggers on firmware removal.
Thorsten Alteholz uploaded foo2zjs and fixed two bugs, one related to /usr-merge. Likewise the upload of cups-filters (from the 1.x branch) fixed three bugs. In order to fix an RC bug in cpdb-backends-cups, which was updated to the 2.x branch, the new package libcupsfilters has been introduced. Last but not least an upload of hplip fixed one RC bug and an upload of gutenprint fixed two of them. All of these RC bugs were more or less related to the time_t transition.
Santiago continued to work in the DebConf organization tasks, including some for the DebConf 24 Content Team, and looking to build a local community for DebConf 25.
Stefano Rivera made a couple of uploads of dh-python to Debian, and a few other general package update uploads.
Stefano did some winding up of DebConf 23 finances, including closing bursary claims and recording the amounts spent on travel bursaries.
Stefano opened DebConf 24 registration, which always requires some last-minute work on the website.
Colin released man-db 2.12.1.
Colin fixed a regression in groff’s PDF output.
In the Python team, Colin fixed build/autopkgtest failures in seven packages, and updated ten packages to new upstream versions.

Debian Contributions: SSO Authentication for jitsi.debian.social, /usr-move updates, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Fri, 12 Apr 2024 00:00:00 +0000

SSO Authentication for jitsi.debian.social, by Stefano Rivera

Debian.social’s jitsi instance has been getting some abuse by (non-Debian) people sharing sexually explicit content on the service. After playing whack-a-mole with this for a month, and shutting the instance off for another month, we opened it up again and the abuse immediately re-started.

Stefano sat down and wrote an SSO Implementation that hooks into Jitsi’s existing JWT SSO support. This requires everyone using jitsi.debian.social to have a Salsa account.

With only a little bit of effort, we could change this in future, to only require an account to open a room, and allow guests to join the call.

/usr-move, by Helmut Grohne

The biggest task this month was sending mitigation patches for all of the /usr-move issues arising from package renames due to the 2038 transition. As a result, we can now say that every affected package in unstable can either be converted with dh-sequence-movetousr or has an open bug report. The package set relevant to debootstrap except for the set that has to be uploaded concurrently has been moved to /usr and is awaiting migration. The move of coreutils happened to affect piuparts which hard codes the location of /bin/sync and received multiple updates as a result.

Miscellaneous contributions

Stefano Rivera uploaded a stable release update to python3.11 for bookworm, fixing a use-after-free crash.
Stefano uploaded a new version of python-html2text, and updated python3-defaults to build with it.
In support of Python 3.12, Stefano dropped distutils as a Build-Dependency from a few packages, and uploaded a complex set of patches to python-mitogen.
Stefano landed some merge requests to clean up dead code in dh-python, removed the flit plugin, and uploaded it.
Stefano uploaded new upstream versions of twisted, hatchling, python-flexmock, python-authlib, python–mitogen, python-pipx, and xonsh.
Stefano requested removal of a few packages supporting the Opsis HDMI2USB hardware that DebConf Video team used to use for HDMI capture, as they are not being maintained upstream. They started to FTBFS, with recent sdcc changes.
DebConf 24 is getting ready to open registration, Stefano spent some time fixing bugs in the website, caused by infrastructure updates.
Stefano reviewed all the DebConf 23 travel reimbursements, filing requests for more information from SPI where our records mismatched.
Stefano spun up a Wafer website for the Berlin 2024 mini DebConf.
Roberto C. Sánchez worked on facilitating the transfer of upstream maintenance responsibility for the dormant Shorewall project to a new team led by the current maintainer of the Shorewall packages in Debian.
Colin Watson fixed build failures in celery-haystack-ng, db1-compat, jsonpickle, libsdl-perl, kali, knews, openssh-ssh1, python-json-log-formatter, python-typing-extensions, trn4, vigor, and wcwidth. Some of these were related to the 64-bit time_t transition, since that involved enabling -Werror=implicit-function-declaration.
Colin fixed an off-by-one error in neovim, which was already causing a build failure in Ubuntu and would eventually have caused a build failure in Debian with stricter toolchain settings.
Colin added an sshd@.service template to openssh to help newer systemd versions make containers and VMs SSH-accessible over AF_VSOCK sockets.
Following the xz-utils backdoor, Colin spent some time testing and discussing OpenSSH upstream’s proposed inline systemd notification patch, since the current implementation via libsystemd was part of the attack vector used by that backdoor.
Utkarsh reviewed and sponsored some Go packages for Lena Voytek and Rajudev.
Utkarsh also helped Mitchell Dzurick with the adoption of pyparted package.
Helmut sent 10 patches for cross build failures.
Helmut partially fixed architecture cross bootstrap tooling to deal with changes in linux-libc-dev and the recent gcc-for-host changes and also fixed a 64bit-time_t FTBFS in libtextwrap.
Thorsten Alteholz uploaded several packages from debian-printing: cjet, lprng, rlpr and epson-inkjet-printer-escpr were affected by the newly enabled compiler switch -Werror=implicit-function-declaration. Besides fixing these serious bugs, Thorsten also worked on other bugs and could fix one or the other.
Carles updated simplemonitor and python-ring-doorbell packages with new upstream versions.
Santiago is still working on the Salsa CI MRs to adapt the build jobs so they can rely on sbuild. Current work includes adapting the images used by the build job, implementing the basic sbuild support the related jobs, and adjusting the support for experimental and *-backports releases..
Additionally, Santiago reviewed some MR such as Make timeout action explicit in the logs and the subsequent Implement conditional timeout verbosity, and the batch of MRs included in https://salsa.debian.org/salsa-ci-team/pipeline/-/merge_requests/482.
Santiago also reviewed applications for the improving Salsa CI in Debian GSoC 2024 project. We received applications from four very talented candidates. The selection process is currently ongoing. A huge thanks to all of them!
As part of the DebConf 24 organization, Santiago has taken part in the Content team discussions.

Monthly report about Debian Long Term Support, March 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 12 Apr 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In March, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 10.0h assigned and 4.0h from previous period), thus carrying over 14.0h to the next month.
Adrian Bunk did 59.5h (out of 47.5h assigned and 52.5h from previous period), thus carrying over 40.5h to the next month.
Bastien Roucariès did 22.0h (out of 20.0h assigned and 2.0h from previous period).
Ben Hutchings did 9.0h (out of 2.0h assigned and 22.0h from previous period), thus carrying over 15.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 12.0h (out of 12.0h assigned).
Emilio Pozuelo Monfort did 0.0h (out of 3.0h assigned and 57.0h from previous period), thus carrying over 60.0h to the next month.
Guilhem Moulin did 22.5h (out of 7.25h assigned and 15.25h from previous period).
Holger Levsen did 0.0h (out of 0.5h assigned and 11.5h from previous period), thus carrying over 12.0h to the next month.
Lee Garrett did 0.0h (out of 0.0h assigned and 60.0h from previous period), thus carrying over 60.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 19.5h (out of 24.0h assigned), thus carrying over 4.5h to the next month.
Roberto C. Sánchez did 9.25h (out of 3.5h assigned and 8.5h from previous period), thus carrying over 2.75h to the next month.
Santiago Ruano Rincón did 19.0h (out of 16.5h assigned and 2.5h from previous period).
Sean Whitton did 4.5h (out of 4.5h assigned and 1.5h from previous period), thus carrying over 1.5h to the next month.
Sylvain Beucler did 25.0h (out of 24.5h assigned and 35.5h from previous period), thus carrying over 35.0h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).
Utkarsh Gupta did 19.5h (out of 0.0h assigned and 48.75h from previous period), thus carrying over 29.25h to the next month.

Evolution of the situation

In March, we have released 31 DLAs.

Adrian Bunk was responsible for updating gtkwave not only in LTS, but also in unstable, stable, and old-stable as well. This update involved an upload of a new upstream release of gtkwave to each target suite to address 82 separate CVEs. Guilhem Moulin prepared an update of libvirt which was particularly notable, as it fixed multiple vulnerabilities which would lead to denial of service or information disclosure.

In addition to the normal security updates, multiple LTS contributors worked at getting various packages updated in more recent Debian releases, including gross for bullseye/bookworm (by Adrian Bunk), imlib2 for bullseye, jetty9 and tomcat9/10 for bullseye/bookworm (by Markus Koschany), samba for bullseye, py7zr for bullseye (by Santiago Ruano Rincón), cacti for bullseye/bookwork (by Sylvain Beucler), and libmicrohttpd for bullseye (by Thorsten Alteholz). Additionally, Sylvain actively coordinated with cacti upstream concerning an incomplete fix for CVE-2024-29894.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 103 months)
- Civil Infrastructure Platform (CIP) (for 71 months)
Gold sponsors:
- Roche Diagnostics International AG (for 114 months)
- Linode (for 108 months)
- Babiel GmbH (for 97 months)
- Plat’Home (for 97 months)
- CINECA (for 71 months)
- University of Oxford (for 53 months)
- Deveryware (for 40 months)
- VyOS Inc (for 35 months)
- EDF SA (for 24 months)
Silver sponsors:
- Domeneshop AS (for 118 months)
- Nantes Métropole (for 112 months)
- Univention GmbH (for 104 months)
- Université Jean Monnet de St Etienne (for 104 months)
- Ribbon Communications, Inc. (for 98 months)
- Exonet B.V. (for 88 months)
- Leibniz Rechenzentrum (for 82 months)
- Ministère de l’Europe et des Affaires Étrangères (for 65 months)
- Cloudways by DigitalOcean (for 55 months)
- Dinahosting SL (for 53 months)
- Bauer Xcel Media Deutschland KG (for 47 months)
- Platform.sh SAS (for 47 months)
- Moxa Inc. (for 41 months)
- sipgate GmbH (for 38 months)
- OVH US LLC (for 36 months)
- Tilburg University (for 36 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 28 months)
- Soliton Systems K.K. (for 25 months)
- THINline s.r.o.
Bronze sponsors:
- Evolix (for 119 months)
- Seznam.cz, a.s. (for 119 months)
- Intevation GmbH (for 116 months)
- Linuxhotel GmbH (for 116 months)
- Daevel SARL (for 114 months)
- Bitfolk LTD (for 113 months)
- Megaspace Internet Services GmbH (for 113 months)
- Greenbone AG (for 112 months)
- NUMLOG (for 112 months)
- WinGo AG (for 112 months)
- Ecole Centrale de Nantes - LHEEA (for 108 months)
- Entr’ouvert (for 103 months)
- Adfinis AG (for 100 months)
- GNI MEDIA (for 95 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 95 months)
- Tesorion (for 95 months)
- Bearstech (for 86 months)
- LiHAS (for 86 months)
- Catalyst IT Ltd (for 81 months)
- Supagro (for 76 months)
- Demarcq SAS (for 75 months)
- Université Grenoble Alpes (for 61 months)
- TouchWeb SAS (for 53 months)
- SPiN AG (for 50 months)
- CoreFiling (for 45 months)
- Institut des sciences cognitives Marc Jeannerod (for 40 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 37 months)
- Tem Innovations GmbH (for 32 months)
- WordFinder.pro (for 31 months)
- CNRS DT INSU Résif (for 30 months)
- Alter Way (for 23 months)
- Institut Camille Jordan (for 12 months)

Monthly report about Debian Long Term Support, February 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Thu, 14 Mar 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In February, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 14.0h assigned), thus carrying over 4.0h to the next month.
Adrian Bunk did 13.5h (out of 24.25h assigned and 41.75h from previous period), thus carrying over 52.5h to the next month.
Bastien Roucariès did 20.0h (out of 20.0h assigned).
Ben Hutchings did 2.0h (out of 14.5h assigned and 9.5h from previous period), thus carrying over 22.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 10.0h (out of 10.0h assigned).
Emilio Pozuelo Monfort did 3.0h (out of 28.25h assigned and 31.75h from previous period), thus carrying over 57.0h to the next month.
Guilhem Moulin did 7.25h (out of 4.75h assigned and 15.25h from previous period), thus carrying over 12.75h to the next month.
Holger Levsen did 0.5h (out of 3.5h assigned and 8.5h from previous period), thus carrying over 11.5h to the next month.
Lee Garrett did 0.0h (out of 18.25h assigned and 41.75h from previous period), thus carrying over 60.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Roberto C. Sánchez did 3.5h (out of 8.75h assigned and 3.25h from previous period), thus carrying over 8.5h to the next month.
Santiago Ruano Rincón did 13.5h (out of 13.5h assigned and 2.5h from previous period), thus carrying over 2.5h to the next month.
Sean Whitton did 4.5h (out of 0.5h assigned and 5.5h from previous period), thus carrying over 1.5h to the next month.
Sylvain Beucler did 24.5h (out of 27.75h assigned and 32.25h from previous period), thus carrying over 35.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).
Utkarsh Gupta did 11.25h (out of 26.75h assigned and 33.25h from previous period), thus carrying over 48.75 to the next month.

Evolution of the situation

In February, we have released 17 DLAs.

The number of DLAs published during February was a bit lower than usual, as there was much work going on in the area of triaging CVEs (a number of which turned out to not affect Debian buster, and others which ended up being duplicates, or were otherwise determined to be invalid). Of the packages which did receive updates, notable were sudo (to fix a privilege management issue), and iwd and wpa (both of which suffered from authentication bypass vulnerabilities).

While this has already been announced in the Freexian blog, we would like to mention here the start of the Long Term Support project for Samba 4.17. You can find all the important details in that post, but we would like to highlight that it is thanks to our LTS sponsors that we are able to fund the work from our partner, Catalyst, towards improving the security support of Samba in Debian 12 (Bookworm).

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 102 months)
- Civil Infrastructure Platform (CIP) (for 70 months)
Gold sponsors:
- Roche Diagnostics International AG (for 113 months)
- Linode (for 107 months)
- Babiel GmbH (for 96 months)
- Plat’Home (for 96 months)
- CINECA (for 70 months)
- University of Oxford (for 52 months)
- Deveryware (for 39 months)
- VyOS Inc (for 34 months)
- EDF SA (for 23 months)
Silver sponsors:
- Domeneshop AS (for 117 months)
- Nantes Métropole (for 112 months)
- Univention GmbH (for 103 months)
- Université Jean Monnet de St Etienne (for 103 months)
- Ribbon Communications, Inc. (for 97 months)
- Exonet B.V. (for 87 months)
- Leibniz Rechenzentrum (for 81 months)
- Ministère de l’Europe et des Affaires Étrangères (for 64 months)
- Cloudways by DigitalOcean (for 54 months)
- Dinahosting SL (for 52 months)
- Bauer Xcel Media Deutschland KG (for 46 months)
- Platform.sh SAS (for 46 months)
- Moxa Inc. (for 40 months)
- sipgate GmbH (for 37 months)
- OVH US LLC (for 35 months)
- Tilburg University (for 35 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 27 months)
- Soliton Systems K.K. (for 24 months)
Bronze sponsors:
- Evolix (for 118 months)
- Seznam.cz, a.s. (for 118 months)
- Intevation GmbH (for 115 months)
- Linuxhotel GmbH (for 115 months)
- Daevel SARL (for 113 months)
- Bitfolk LTD (for 112 months)
- Megaspace Internet Services GmbH (for 112 months)
- NUMLOG (for 112 months)
- Greenbone AG (for 111 months)
- WinGo AG (for 111 months)
- Ecole Centrale de Nantes - LHEEA (for 107 months)
- Entr’ouvert (for 102 months)
- Adfinis AG (for 99 months)
- GNI MEDIA (for 94 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 94 months)
- Tesorion (for 94 months)
- Bearstech (for 85 months)
- LiHAS (for 85 months)
- Catalyst IT Ltd (for 80 months)
- Supagro (for 75 months)
- Demarcq SAS (for 74 months)
- Université Grenoble Alpes (for 60 months)
- TouchWeb SAS (for 52 months)
- SPiN AG (for 49 months)
- CoreFiling (for 44 months)
- Institut des sciences cognitives Marc Jeannerod (for 39 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 36 months)
- Tem Innovations GmbH (for 31 months)
- WordFinder.pro (for 30 months)
- CNRS DT INSU Résif (for 29 months)
- Alter Way (for 22 months)
- Institut Camille Jordan (for 11 months)

Debian Contributions: Upcoming Improvements to Salsa CI, /usr-move, packaging simplemonitor, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Wed, 13 Mar 2024 00:00:00 +0000

/usr-move, by Helmut Grohne

Much of the work was spent on handling interaction with time time64 transition and sending patches for mitigating fallout. The set of packages relevant to debootstrap is mostly converted and the patches for glibc and base-files have been refined due to feedback from the upload to Ubuntu noble. Beyond this, he sent patches for all remaining packages that cannot move their files with dh-sequence-movetousr and packages using dpkg-divert in ways that dumat would not recognize.

Upcoming improvements to Salsa CI, by Santiago Ruano Rincón

Last month, Santiago Ruano Rincón started the work on integrating sbuild into the Salsa CI pipeline. Initially, Santiago used sbuild with the unshare chroot mode. However, after discussion with josch, jochensp and helmut (thanks to them!), it turns out that the unshare mode is not the most suitable for the pipeline, since the level of isolation it provides is not needed, and some test suites would fail (eg: krb5). Additionally, one of the requirements of the build job is the use of ccache, since it is needed by some C/C++ large projects to reduce the compilation time. In the preliminary work with unshare last month, it was not possible to make ccache to work.

Finally, Santiago changed the chroot mode, and now has a couple of POC (cf: 1 and 2) that rely on the schroot and sudo, respectively. And the good news is that ccache is successfully used by sbuild with schroot!

The image here comes from an example of building grep. At the end of the build, ccache -s shows the statistics of the cache that it used, and so a little more than half of the calls of that job were cacheable. The most important pieces are in place to finish the integration of sbuild into the pipeline.

Other than that, Santiago also reviewed the very useful merge request !346, made by IOhannes zmölnig to autodetect the release from debian/changelog. As agreed with IOhannes, Santiago is preparing a merge request to include the release autodetection use case in the very own Salsa CI’s CI.

Packaging simplemonitor, by Carles Pina i Estany

Carles started using simplemonitor in 2017, opened a WNPP bug in 2022 and started packaging simplemonitor dependencies in October 2023. After packaging five direct and indirect dependencies, Carles finally uploaded simplemonitor to unstable in February.

During the packaging of simplemonitor, Carles reported a few issues to upstream. Some of these were to make the simplemonitor package build and run tests reproducibly. A reproducibility issue was reprotest overriding the timezone, which broke simplemonitor’s tests. There have been discussions on resolving this upstream in simplemonitor and in reprotest, too.

Carles also started upgrading or improving some of simplemonitor’s dependencies.

Miscellaneous contributions

Stefano Rivera spent some time doing admin on debian.social infrastructure. Including dealing with a spike of abuse on the Jitsi server.
Stefano started to prepare a new release of dh-python, including cleaning out a lot of old Python 2.x related code. Thanks to Niels Thykier (outside Freexian) for spear-heading this work.
DebConf 24 planning is beginning. Stefano discussed venues and finances with the local team and remotely supported a site-visit by Nattie (outside Freexian).
Also in the DebConf 24 context, Santiago took part in discussions and preparations related to the Content Team.
A JIT bug was reported against pypy3 in Debian Bookworm. Stefano bisected the upstream history to find the patch (it was already resolved upstream) and released an update to pypy3 in bookworm.
Enrico participated in /usr-merge discussions with Helmut.
Colin Watson backported a python-channels-redis fix to bookworm, rediscovered while working on debusine.
Colin dug into a cluster of celery build failures and tracked the hardest bit down to a Python 3.12 regression, now fixed in unstable. celery should be back in testing once the 64-bit time_t migration is out of the way.
Thorsten Alteholz uploaded a new upstream version of cpdb-libs. Unfortunately upstream changed the naming of their release tags, so updating the watch file was a bit demanding. Anyway this version 2.0 is a huge step towards introduction of the new Common Print Dialog Backends.
Helmut send patches for 48 cross build failures.
Helmut changed debvm to use mkfs.ext4 instead of genext2fs.
Helmut sent a debci MR for improving collector robustness.
In preparation for DebConf 25, Santiago worked on the Brest Bid.

Long term support for Samba 4.17 (by )

Mon, 26 Feb 2024 00:00:00 +0000

Freexian is pleased to announce a partnership with Catalyst to extend the security support of Samba 4.17, which is the version packaged in Debian 12 Bookworm. Samba 4.17 will reach upstream’s end-of-support this upcoming March (2024), and the goal of this partnership is to extend it until June 2028 (i.e. the end of Debian 12’s regular security support).

One of the main aspects of this project is that it will also include support for Samba as Active Directory Domain Controller (AD-DC). Unfortunately, support for Samba as AD-DC in Debian 11 Bullseye, Debian 10 Buster and older releases has been discontinued before the end of the life cycle of those Debian releases. So we really expect to improve the situation of Samba in Debian 12 Bookworm, ensuring full support during the 5 years of regular security support.

We would like to mention that this is an experiment, and we will do our best to make it a success, and to try to continue it for Samba versions included in future Debian releases.

Our long term goal is to bring confidence to Samba’s upstream development community that they can mark some releases as being supported for 5 years (or more) and that the corresponding work will be funded by companies that benefit from this work (because we would have already built that community).

If your company relies on Samba and wants to help sustain LTS versions of Samba, please reach out to us. For companies using Debian, the simplest way is to subscribe to our Debian LTS offer at a gold level (or above) and let us know that you want to contribute to Samba LTS when you send your subscription form. For others, please reach out to us at sales@freexian.com and we will figure out a way to contribute.

In the mean time, this project has been possible thanks to the current LTS sponsors and ELTS customers. We hope the whole community of Debian and Samba users will benefit from it.

For any question, don’t hesitate to contact us.

Monthly report about Debian Long Term Support, January 2024 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 12 Feb 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In January, 16 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 7.0h assigned and 7.0h from previous period).
Bastien Roucariès did 22.0h (out of 16.0h assigned and 6.0h from previous period).
Ben Hutchings did 14.5h (out of 8.0h assigned and 16.0h from previous period), thus carrying over 9.5h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 10.0h (out of 10.0h assigned).
Emilio Pozuelo Monfort did 10.0h (out of 14.75h assigned and 27.0h from previous period), thus carrying over 31.75h to the next month.
Guilhem Moulin did 9.75h (out of 25.0h assigned), thus carrying over 15.25h to the next month.
Holger Levsen did 3.5h (out of 12.0h assigned), thus carrying over 8.5h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Roberto C. Sánchez did 8.75h (out of 9.5h assigned and 2.5h from previous period), thus carrying over 3.25h to the next month.
Santiago Ruano Rincón did 13.5h (out of 8.25h assigned and 7.75h from previous period), thus carrying over 2.5h to the next month.
Sean Whitton did 0.5h (out of 0.25h assigned and 5.75h from previous period), thus carrying over 5.5h to the next month.
Sylvain Beucler did 9.5h (out of 23.25h assigned and 18.5h from previous period), thus carrying over 32.25h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 12.0h (out of 10.25h assigned and 1.75h from previous period).
Utkarsh Gupta did 8.5h (out of 35.75h assigned), thus carrying over 24.75h to the next month.

Evolution of the situation

In January, we have released 25 DLAs.

A variety of particularly notable packages were updated during January. Among those updates were the Linux kernel (both versions 5.10 and 4.19), mariadb-10.3, openjdk-11, firefox-esr, and thunderbird.

In addition to the many other LTS package updates which were released in January, LTS contributors continue their efforts to make impactful contributions both within the Debian community and beyond.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 101 months)
- Civil Infrastructure Platform (CIP) (for 69 months)
Gold sponsors:
- Roche Diagnostics International AG (for 112 months)
- Linode (for 106 months)
- Babiel GmbH (for 95 months)
- Plat’Home (for 95 months)
- CINECA (for 69 months)
- University of Oxford (for 51 months)
- Deveryware (for 38 months)
- VyOS Inc (for 33 months)
- EDF SA (for 22 months)
Silver sponsors:
- Domeneshop AS (for 116 months)
- Nantes Métropole (for 110 months)
- Univention GmbH (for 102 months)
- Université Jean Monnet de St Etienne (for 102 months)
- Ribbon Communications, Inc. (for 96 months)
- Exonet B.V. (for 86 months)
- Leibniz Rechenzentrum (for 80 months)
- Ministère de l’Europe et des Affaires Étrangères (for 63 months)
- Cloudways by DigitalOcean (for 53 months)
- Dinahosting SL (for 51 months)
- Bauer Xcel Media Deutschland KG (for 45 months)
- Platform.sh SAS (for 45 months)
- Moxa Inc. (for 39 months)
- sipgate GmbH (for 36 months)
- OVH US LLC (for 34 months)
- Tilburg University (for 34 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 26 months)
- Soliton Systems K.K. (for 23 months)
Bronze sponsors:
- Evolix (for 117 months)
- Seznam.cz, a.s. (for 117 months)
- Intevation GmbH (for 114 months)
- Linuxhotel GmbH (for 114 months)
- Daevel SARL (for 112 months)
- Bitfolk LTD (for 111 months)
- Megaspace Internet Services GmbH (for 111 months)
- Greenbone AG (for 110 months)
- NUMLOG (for 110 months)
- WinGo AG (for 110 months)
- Ecole Centrale de Nantes - LHEEA (for 106 months)
- Entr’ouvert (for 101 months)
- Adfinis AG (for 98 months)
- GNI MEDIA (for 93 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 93 months)
- Tesorion (for 93 months)
- Bearstech (for 84 months)
- LiHAS (for 84 months)
- Catalyst IT Ltd (for 79 months)
- Supagro (for 74 months)
- Demarcq SAS (for 73 months)
- Université Grenoble Alpes (for 59 months)
- TouchWeb SAS (for 51 months)
- SPiN AG (for 48 months)
- CoreFiling (for 43 months)
- Institut des sciences cognitives Marc Jeannerod (for 38 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 35 months)
- Tem Innovations GmbH (for 30 months)
- WordFinder.pro (for 29 months)
- CNRS DT INSU Résif (for 28 months)
- Alter Way (for 21 months)
- Institut Camille Jordan (for 10 months)

Debian Contributions: Upcoming Improvements to Salsa CI, /usr-move, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Sun, 11 Feb 2024 00:00:00 +0000

Upcoming Improvements to Salsa CI, by Santiago Ruano Rincón

Santiago started picking up the work made by Outreachy Intern, Enock Kashada (a big thanks to him!), to solve some long-standing issues in Salsa CI. Currently, the first job in a Salsa CI pipeline is the extract-source job, used to produce a debianize source tree of the project. This job was introduced to make it possible to build the projects on different architectures, on the subsequent build jobs. However, that extract-source approach is sub-optimal: not only it increases the execution time of the pipeline by some minutes, but also projects whose source tree is too large are not able to use the pipeline. The debianize source tree is passed as an artifact to the build jobs, and for those large projects, the size of their source tree exceeds the Salsa’s limits. This is specific issue is documented as issue #195, and the proposed solution is to get rid of the extract-source job, relying on sbuild in the very build job (see issue #296).

Switching to sbuild would also help to improve the build source job, solving issues such as #187 and #298.

The current work-in-progress is very preliminary, but it has already been possible to run the build (amd64), build-i386 and build-source job using sbuild with the unshare mode. The image on the right shows a pipeline that builds grep. All the test jobs use the artifacts of the new build job. There is a lot of remaining work, mainly making the integration with ccache work. This change could break some things, it will also be important to test how the new pipeline works with complex projects.

Also, thanks to Emmanuel Arias, we are proposing a Google Summer of Code 2024 project to improve Salsa CI. As part of the ongoing work in preparation for the GSoC 2024 project, Santiago has proposed a merge request to make more efficient how contributors can test their changes on the Salsa CI pipeline.

/usr-move, by Helmut Grohne

In January, we sent most of the moving patches for the set of packages involved with debootstrap. Notably missing is glibc, which turns out harder than anticipated via dumat, because it has Conflicts between different architectures, which dumat does not analyze.

Patches for diversion mitigations have been updated in a way to not exhibit any loss anymore.

The main change here is that packages which are being diverted now support the diverting packages in transitioning their diversions. We also supported a few packages with non-trivial changes such as netplan.io. dumat has been enhanced to better support derivatives such as Ubuntu.

Miscellaneous contributions

Python 3.12 migration trundles on. Stefano Rivera helped port several new packages to support 3.12.
Stefano updated the Sphinx configuration of DebConf Video Team’s documentation, which was broken by Sphinx 7.
Stefano published the videos from the Cambridge MiniDebConf to YouTube and PeerTube.
DebConf 24 planning has begun, and Stefano & Utkarsh have started work on this.
Utkarsh re-sponsored the upload of golang-github-prometheus-community-pgbouncer-exporter for Lena.
Colin Watson added Incus support to autopkgtest.
Colin discovered Perl::Critic and used it to tidy up some poor practices in several of his packages, including debconf.
Colin did some overdue debconf maintenance, mainly around tidying up error message handling in several places (1, 2, 3).
Colin figured out how to update the mirror size documentation in debmirror, last updated in 2010. It should now be much easier to keep it up to date regularly.
Colin issued a man-db buster update to clean up some irritations due to strict sandboxing.
Thorsten Alteholz adopted two more packages, magicfilter and ifhp, for the debian-printing team. Those packages are the last ones of the latest round of adoptions to preserve the old printing protocol within Debian. If you know of other packages that should be retained, please don’t hesitate to contact Thorsten.
Enrico participated in /usr-merge discussions with Helmut.
Helmut sent patches for 16 cross build failures.
Helmut supported Matthias Klose (not affiliated with Freexian) with adding -for-host support to gcc-defaults.
Helmut uploaded dput-ng enabling dcut migrate and merging two MRs of Ben Hutchings.
Santiago took part in the discussions relating to the EU Cyber Resilience Act (CRA) and the Debian public statement that was published last year. He participated in a meeting with Members of the European Parliament (MEPs), Marcel Kolaja and Karen Melchior, and their teams to clarify some points about the impact of the CRA and Debian and downstream projects, and the improvements in the last version of the proposed regulation.

Debian Contributions: LXD/Incus backend bug, /usr-merge updates, gcc-for-host, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Sat, 13 Jan 2024 00:00:00 +0000

LXD/Incus backend bug in autopkgtest by Stefano Rivera

While working on the Python 3.12 transition, Stefano repeatedly ran into a bug in autopkgtest when using LXD (or in the future Incus), that caused it to hang when running cython’s multi-hour autopkgtests. After some head-banging, the bug turned out to be fairly straightforward: LXD didn’t shut down on receiving a SIGTERM, so when a testsuite timed out, it would hang forever. A simple fix has been applied.

/usr-merge, by Helmut Grohne

Thanks to Christian Hofstaedtler and others, the effort is moving into a community effort and the work funded by Freexian becomes more difficult to separate from non-funded work. In particular, since the community fully handled all issues around lost udev rules, dh_installudev now installs rules to /usr.

The story around diversions took another detour. We learned that conflicts do not reliably prevent concurrent unpack and the reiterated mitigation for molly-guard triggered this. After a bit of back and forth and consultation with the developer mailing list, we concluded that avoiding the problematic behavior when using apt or an apt-based upgrader combined with a loss mitigation would be good enough. The involved packages bfh-container, molly-guard, progress-linux-container and systemd have since been uploaded to unstable and the matter seems finally solved except that it doesn’t quite work with sysvinit yet. The same approach is now being proposed for the diversions of zutils for gzip. We thank involved maintainers for their timely cooperation.

gcc-for-host, by Helmut Grohne

Since forever, it has been difficult to correctly express a toolchain build dependency. This can be seen in the Build-Depends of the linux source package for instance. While this has been solved for binutils a while back, the patches for gcc have been unfinished. With lots of constructive feedback from gcc package maintainer Matthias Klose, Helmut worked on finalizing and testing these patches. Patch stacks are now available for gcc-13 and gcc-14 and Matthias already included parts of them in test builds for Ubuntu noble. Finishing this work would enable us to resolve around 1000 cross build dependency satisfiability issues in unstable.

Miscellaneous contributions

Stefano continued work on the Python 3.12 transition, including uploads of cython, pycxx, numpy, python-greenlet, twisted, foolscap and dh-python.
Stefano reviewed and selected from a new round of DebConf 24 bids, as part of the DebConf Committee. Busan, South Korea was selected.
For debian-printing Thorsten uploaded hplip to unstable to fix a /usr-merge bug and cups to Bookworm to fix bugs related to printing in color.
Utkarsh helped newcomers in mentoring and reviewing their packaging; eg: golang-github-prometheus-community-pgbouncer-exporter.
Helmut sent patches for 42 cross build failures unrelated to the gcc-for-host work.
Helmut continues to maintain rebootstrap. In December, blt started depending on libjpeg and this poses a dependency loop. Ideally, Python would stop depending on blt. Also linux-libc-dev having become Multi-Arch: foreign poses non-trivial issues that are not fully resolved yet.
Enrico participated in /usr-merge discussions with Helmut.

Monthly report about Debian Long Term Support, December 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Fri, 12 Jan 2024 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In December, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 7.0h (out of 7.0h assigned and 7.0h from previous period), thus carrying over 7.0h to the next month.
Adrian Bunk did 16.0h (out of 26.25h assigned and 8.75h from previous period), thus carrying over 19.0h to the next month.
Bastien Roucariès did 16.0h (out of 16.0h assigned and 4.0h from previous period), thus carrying over 4.0h to the next month.
Ben Hutchings did 8.0h (out of 7.25h assigned and 16.75h from previous period), thus carrying over 16.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 8.0h (out of 26.75h assigned and 8.25h from previous period), thus carrying over 27.0h to the next month.
Guilhem Moulin did 25.0h (out of 18.0h assigned and 7.0h from previous period).
Holger Levsen did 5.5h (out of 5.5h assigned).
Jochen Sprickerhof did 0.0h (out of 0h assigned and 10.0h from previous period), thus carrying over 10.0h to the next month.
Lee Garrett did 0.0h (out of 25.75h assigned and 9.25h from previous period), thus carrying over 35.0h to the next month.
Markus Koschany did 35.0h (out of 35.0h assigned).
Roberto C. Sánchez did 9.5h (out of 5.5h assigned and 6.5h from previous period), thus carrying over 2.5h to the next month.
Santiago Ruano Rincón did 8.255h (out of 3.26h assigned and 12.745h from previous period), thus carrying over 7.75h to the next month.
Sean Whitton did 4.25h (out of 3.25h assigned and 6.75h from previous period), thus carrying over 5.75h to the next month.
Sylvain Beucler did 16.5h (out of 21.25h assigned and 13.75h from previous period), thus carrying over 18.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 10.25h (out of 12.0h assigned), thus carrying over 1.75h to the next month.
Utkarsh Gupta did 18.75h (out of 11.25h assigned and 13.5h from previous period), thus carrying over 6.0h to the next month.

Evolution of the situation

In December, we have released 29 DLAs.

A particularly notable update in December was prepared by LTS contributor Santiago Ruano Rincón for the openssh package. The updated produced DLA-3694-1 and included a fix for the Terrapin Attack (CVE-2023-48795), which was a rather serious flaw in the SSH protocol itself. The package bluez was the subject of another notable update by LTS contributor Chris Lamb, which resulted in DLA-3689-1 to address an insecure default configuration which allowed attackers to inject keyboard commands over Bluetooth without first authenticating.

The LTS team continues its efforts to have a positive impact beyond the boundaries of LTS. Several contributors worked on packages, preparing LTS updates, but also preparing patches or full updates which were uploaded to the unstable, stable, and oldstable distributions, including: Guilhem Moulin’s update of tinyxml (uploads to LTS and unstable and patches submitted to the security team for stable and oldstable); Guilhem Moulin’s update of xerces-c (uploads to LTS and unstable and patches submitted to the security team for oldstable); Thorsten Alteholz’s update of libde265 (uploads to LTS and stable and additional patches submitted to the maintainer for stable and oldstable); Thorsten Alteholz’s update of cjson (upload to LTS and patches submitted to the maintainer for stable and oldstable); and Tobias Frost’s update of opendkim (sponsor maintainer-prepared upload to LTS and additionally prepared updates for stable and oldstable).

Going beyond Debian and looking to the broader community, LTS contributor Bastien Roucariès was contacted by SUSE concerning an update he had prepared for zbar. He was able to assist by coordinating with the former organization of the original zbar author to secure for SUSE access to information concerning the exploits. This has enabled another distribution to benefit from the work done in support of LTS and from the assistance of Bastien in coordinating the access to information.

Finally, LTS contributor Santiago Ruano Rincón continued work relating to how updates for packages in statically-linked language ecosystems (e.g., Go, Rust, and others) are handled. The work is presently focused on more accurately and reliably identifying which packages are impacted in a given update scenario to enable notifications to be published so that users will be made aware of these situations as they occur. As the work continues, it will eventually result in improvements to Debian infrastructure so that the LTS team and Security team are able to manage updates of this nature in a more consistent way.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 100 months)
- Civil Infrastructure Platform (CIP) (for 68 months)
Gold sponsors:
- Roche Diagnostics International AG (for 111 months)
- Linode (for 105 months)
- Babiel GmbH (for 94 months)
- Plat’Home (for 94 months)
- University of Oxford (for 50 months)
- Deveryware (for 37 months)
- VyOS Inc (for 32 months)
- EDF SA (for 21 months)
Silver sponsors:
- Domeneshop AS (for 115 months)
- Nantes Métropole (for 109 months)
- Univention GmbH (for 101 months)
- Université Jean Monnet de St Etienne (for 101 months)
- Ribbon Communications, Inc. (for 95 months)
- Exonet B.V. (for 85 months)
- Leibniz Rechenzentrum (for 79 months)
- CINECA (for 68 months)
- Ministère de l’Europe et des Affaires Étrangères (for 62 months)
- Cloudways by DigitalOcean (for 52 months)
- Dinahosting SL (for 50 months)
- Bauer Xcel Media Deutschland KG (for 44 months)
- Platform.sh SAS (for 44 months)
- Moxa Inc. (for 38 months)
- sipgate GmbH (for 35 months)
- OVH US LLC (for 33 months)
- Tilburg University (for 33 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 25 months)
- Soliton Systems K.K. (for 22 months)
Bronze sponsors:
- Evolix (for 116 months)
- Seznam.cz, a.s. (for 116 months)
- Intevation GmbH (for 113 months)
- Linuxhotel GmbH (for 113 months)
- Daevel SARL (for 111 months)
- Bitfolk LTD (for 110 months)
- Megaspace Internet Services GmbH (for 110 months)
- Greenbone AG (for 109 months)
- NUMLOG (for 109 months)
- WinGo AG (for 109 months)
- Ecole Centrale de Nantes - LHEEA (for 105 months)
- Entr’ouvert (for 100 months)
- Adfinis AG (for 97 months)
- GNI MEDIA (for 92 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 92 months)
- Tesorion (for 92 months)
- Bearstech (for 83 months)
- LiHAS (for 83 months)
- Catalyst IT Ltd (for 78 months)
- Supagro (for 73 months)
- Demarcq SAS (for 72 months)
- Université Grenoble Alpes (for 58 months)
- TouchWeb SAS (for 50 months)
- SPiN AG (for 47 months)
- CoreFiling (for 42 months)
- Institut des sciences cognitives Marc Jeannerod (for 37 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 34 months)
- Tem Innovations GmbH (for 29 months)
- WordFinder.pro (for 28 months)
- CNRS DT INSU Résif (for 27 months)
- Alter Way (for 20 months)
- Institut Camille Jordan (for 9 months)

Monthly report about Debian Long Term Support, November 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Tue, 12 Dec 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Some notable fixes which were made in LTS during the month of November include the gnutls28 cryptographic library and the freerdp2 Remote Desktop Protocol client/server implementation. The gnutls28 update was prepared by LTS contributor Markus Koschany and dealt with a timing attack which could be used to compromise a cryptographic system, while the freerdp2 update was prepared by LTS contributor Tobias Frost and is the result of work spanning 3 months to deal with dozens of vulnerabilities.

In addition to the many ordinary LTS tasks which were completed (CVE triage, patch backports, package updates, etc), there were several contributions by LTS contributors for the benefit of Debian stable and old-stable releases, as well as for the benefit of upstream projects. LTS contributor Abhijith PA uploaded an update of the puma package to unstable in order to fix a vulnerability in that package while LTS contributor Thosten Alteholz sponsored an upload to unstable of libde265 and himself made corresponding uploads of libde265 to Debian stable and old-stable. LTS contributor Bastien Roucariès developed patches for vulnerabilities in zbar and audiofile which were then provided to the respective upstream projects. Updates to packages in Debian stable were made by Markus Koschany to deal with security vulnerabilities and by Chris Lamb to deal with some non-security bugs.

As always, the LTS strives to provide high quality updates to packages under the direct purview of the LTS team while also rendering assistance to maintainers, the stable security team, and upstream developers whenever practical.

Debian LTS contributors

In November, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 7.0h (out of 0h assigned and 14.0h from previous period), thus carrying over 7.0h to the next month.
Adrian Bunk did 15.0h (out of 14.0h assigned and 9.75h from previous period), thus carrying over 8.75h to the next month.
Anton Gladky did 10.0h (out of 9.5h assigned and 5.5h from previous period), thus carrying over 5.0h to the next month.
Bastien Roucariès did 16.0h (out of 18.25h assigned and 1.75h from previous period), thus carrying over 4.0h to the next month.
Ben Hutchings did 12.0h (out of 16.5h assigned and 12.25h from previous period), thus carrying over 16.75h to the next month.
Chris Lamb did 18.0h (out of 17.25h assigned and 0.75h from previous period).
Emilio Pozuelo Monfort did 15.5h (out of 23.5h assigned and 0.25h from previous period), thus carrying over 8.25h to the next month.
Guilhem Moulin did 13.0h (out of 12.0h assigned and 8.0h from previous period), thus carrying over 7.0h to the next month.
Lee Garrett did 14.5h (out of 16.75h assigned and 7.0h from previous period), thus carrying over 9.25h to the next month.
Markus Koschany did 30.0h (out of 30.0h assigned).
Ola Lundqvist did 6.5h (out of 8.25h assigned and 15.5h from previous period), thus carrying over 17.25h to the next month.
Roberto C. Sánchez did 5.5h (out of 12.0h assigned), thus carrying over 6.5h to the next month.
Santiago Ruano Rincón did 3.25h (out of 13.62h assigned and 2.375h from previous period), thus carrying over 12.745h to the next month.
Sean Whitton did 3.25h (out of 10.0h assigned), thus carrying over 6.75h to the next month.
Sylvain Beucler did 10.0h (out of 13.5h assigned and 10.25h from previous period), thus carrying over 13.75h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 12.0h (out of 12.0h assigned).
Utkarsh Gupta did 0.0h (out of 6.0h assigned and 17.75h from previous period), thus carrying over 23.75h to the next month.

Evolution of the situation

In November, we have released 35 DLAs.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 99 months)
- Civil Infrastructure Platform (CIP) (for 67 months)
Gold sponsors:
- Roche Diagnostics International AG (for 110 months)
- Linode (for 104 months)
- Babiel GmbH (for 93 months)
- Plat’Home (for 93 months)
- University of Oxford (for 49 months)
- Deveryware (for 36 months)
- VyOS Inc (for 31 months)
- EDF SA (for 20 months)
Silver sponsors:
- Domeneshop AS (for 114 months)
- Nantes Métropole (for 108 months)
- Univention GmbH (for 100 months)
- Université Jean Monnet de St Etienne (for 100 months)
- Ribbon Communications, Inc. (for 94 months)
- Exonet B.V. (for 84 months)
- Leibniz Rechenzentrum (for 78 months)
- CINECA (for 67 months)
- Ministère de l’Europe et des Affaires Étrangères (for 61 months)
- Cloudways Ltd (for 51 months)
- Dinahosting SL (for 49 months)
- Bauer Xcel Media Deutschland KG (for 43 months)
- Platform.sh SAS (for 43 months)
- Moxa Inc. (for 37 months)
- sipgate GmbH (for 34 months)
- OVH US LLC (for 32 months)
- Tilburg University (for 32 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 23 months)
- Soliton Systems K.K. (for 21 months)
Bronze sponsors:
- Evolix (for 115 months)
- Seznam.cz, a.s. (for 115 months)
- Intevation GmbH (for 112 months)
- Linuxhotel GmbH (for 112 months)
- Daevel SARL (for 110 months)
- Bitfolk LTD (for 109 months)
- Megaspace Internet Services GmbH (for 109 months)
- Greenbone AG (for 108 months)
- NUMLOG (for 108 months)
- WinGo AG (for 108 months)
- Ecole Centrale de Nantes - LHEEA (for 104 months)
- Entr’ouvert (for 99 months)
- Adfinis AG (for 96 months)
- GNI MEDIA (for 91 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 91 months)
- Tesorion (for 91 months)
- Bearstech (for 82 months)
- LiHAS (for 82 months)
- Catalyst IT Ltd (for 77 months)
- Supagro (for 72 months)
- Demarcq SAS (for 71 months)
- Université Grenoble Alpes (for 57 months)
- TouchWeb SAS (for 49 months)
- SPiN AG (for 46 months)
- CoreFiling (for 41 months)
- Institut des sciences cognitives Marc Jeannerod (for 36 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 33 months)
- Tem Innovations GmbH (for 27 months)
- WordFinder.pro (for 27 months)
- CNRS DT INSU Résif (for 26 months)
- Alter Way (for 19 months)
- Institut Camille Jordan (for 8 months)

Debian Contributions: Python 3.12 preparations, debian-printing, merged-/usr tranisition updates, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Sun, 10 Dec 2023 00:00:00 +0000

Preparing for Python 3.12 by Stefano Rivera

Stefano uploaded a few packages in preparation for Python 3.12, including pycxx and cython. Cython has a major new version (Cython 3), adding support for 3.12, but also bringing changes that many packages in Debian aren’t ready to build with, yet. Stefano uploaded it to Debian experimental and did an archive rebuild of affected packages, and some analysis of the result. Matthias Klose has since filed bugs for all of these issues.

debian-printing, by Thorsten Alteholz

This month Thorsten invested some of the previously obtained money to build his own printlab. At the moment it only consists of a dedicated computer with an USB printer attached. Due to its 64GB RAM and an SSD, building of debian-printing packages is much faster now. Over time other printers will be added and understanding bugs should be a lot easier now.

Also Thorsten again adopted two packages, namely mink and ink, and moved them to the debian-printing team.

Merged-/usr transition by Helmut Grohne, et al

The dumat analysis tool has been improved in quite some aspects. Beyond fixing false negative diagnostics, it now recognizes protective diversions used for mitigating Multi-Arch: same file loss. It was found that the proposed mitigation for ineffective diversions does not work as expected. Trying to fix it up resulted in more problems, some of which remain unsolved as of this writing. Initial work on moving shared libraries in the essential set has been done.

Meanwhile, the wider Debian community worked on fixing all known Multi-Arch: same file loss scenarios. This work is now being driven by Christian Hofstaedler and during the Mini DebConf in Cambridge, Chris Boot, Étienne Mollier, Miguel Landaeta, Samuel Henrique, and Utkarsh Gupta sent the other half of the necessary patches.

Miscellaneous contributions

Stefano merged patches to support loong64 and hurd-amd64 in re2.
For the Cambridge mini-conf, Stefano added a web player to the DebConf video streaming frontend, as the Cambridge miniconf didn’t have its own website to host the player.
Raphaël helped the upstream developers of hamster-time-tracker to prepare a new upstream release (the first in multiple years) and packaged that new release in Debian unstable.
Enrico joined Hemut in brainstorming some /usr-merge solutions.
Thorsten took care of RM-bugs to remove no longer needed packages from the Debian archive and closed about 50 of them.
Helmut ported the feature of mounting a fuse connection via /dev/fd/N from fuse3 to fuse2.
Helmut sent a number of patches simplifying unprivileged use of piuparts.
Roberto worked with Helmut to prepare the Shorewall package for the ongoing /usr-move transition.
Utkarsh also helped with the ongoing /usr-merge work by preparing patches for gitlab, libnfc, and net-tools.
Utkarsh, along with Helmut, brainstormed on fixing #961138, as this affects the whole archive and all the suites and not just R packages. Utkarsh intends to follow up on the bug in December.
Santiago organized a MiniDebConf in Uruguay. In total, nine people attended, including most of DDs in the surrounding area. Here’s a nicely written blog by Gunnar Wolf.
Santiago also worked on some issues on Salsa CI, fixed with some merge requests: #462, #463, and #466.

Debian Contributions: Preparing for Python 3.12, /usr-merge updates, invalid PEP-440 versions, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Thu, 23 Nov 2023 00:00:00 +0000

urllib3’s old security patch by Stefano Rivera

Stefano ran into a test-suite failure in a new Debian package (python-truststore), caused by Debian’s patch to urllib3 from a decade ago, making it enable TLS verification by default (remember those days!). Some analysis confirmed that this patch isn’t useful any more, and could be removed.

While working on the package, Stefano investigated the scope of the urllib3 2.x transition. It looks ready to start, not many packages are affected.

Preparing for Python 3.12 in dh-python by Stefano Rivera

We are preparing to start the Python 3.12 transition in Debian. Two of the upstream changes that are going to cause a lot of packages to break could be worked-around in dh-python, so we did:

Distutils is no longer shipped in the Python stdlib. Packages need to Build-Depend on python3-setuptools to get a (compatibility shim) distutils. Until that happens, dh-python will Depend on setuptools.
A failure to find any tests to execute will now make the unittest runner exit 5, like pytest does. This was our change, to test-suites that have failed to be automatically discovered. It will cause many packages to fail to build, so until they explicitly skip running test suites, dh-python will ignore these failures.

/usr-merge by Helmut Grohne

It has become clear that the planned changes to debhelper and systemd.pc cause more rc-bugs. Helmut researched these systematically and filed another stack of patches. At the time of this writing, the uploads would still cause about 40 rc-bugs. A new opt-in helper dh_movetousr has been developed and added to debhelper in trixie and unstable.

debian-printing, by Thorsten Alteholz

This month Thorsten adopted two packages, namely rlpr and lprng, and moved them to the debian-printing team. As part of this Thorsten could close eight bugs in the BTS.

Thorsten also uploaded a new upstream version of cups, which also meant that eleven bugs could be closed.

As package hannah-foo2zjs still depended on the deprecated policykit-1 package, Thorsten changed the dependency list accordingly and could close one RC bug by the following upload.

Invalid PEP-440 Versions in Python Packages by Stefano Rivera

Stefano investigated how many packages in Debian (typically Debian-native packages) recorded versions in their packaging metadata (egg-info directories) that weren’t valid PEP-440 Python versions. pip is starting to enforce that all versions on the system are valid.

Miscellaneous contributions

distro-info-data updates in Debian, due to the new Ubuntu release, by Stefano.
DebConf 23 bookkeeping continues, but is winding down. Stefano still spends a little time on it.
Utkarsh continues to monitor and help with reimbursements.
Helmut continues to maintain architecture bootstrap and accidentally broke pam briefly
Anton uploaded boost1.83 and started to prepare a transition to make boost1.83 as a default boost version.
Rejuntada Debian UY 2023, a MiniDebConf that will be held in Montevideo, from 9 to 11 November, mainly organized by Santiago.

Monthly report about Debian Long Term Support, October 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Mon, 13 Nov 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In October, 18 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 8.0h (out of 7.75h assigned and 10.0h from previous period), thus carrying over 9.75h to the next month.
Anton Gladky did 9.5h (out of 9.5h assigned and 5.5h from previous period), thus carrying over 5.5h to the next month.
Bastien Roucariès did 16.0h (out of 16.75h assigned and 1.0h from previous period), thus carrying over 1.75h to the next month.
Ben Hutchings did 8.0h (out of 17.75h assigned), thus carrying over 9.75h to the next month.
Chris Lamb did 17.0h (out of 17.75h assigned), thus carrying over 0.75h to the next month.
Emilio Pozuelo Monfort did 17.5h (out of 17.75h assigned), thus carrying over 0.25h to the next month.
Guilhem Moulin did 9.75h (out of 17.75h assigned), thus carrying over 8.0h to the next month.
Helmut Grohne did 1.5h (out of 10.0h assigned), thus carrying over 8.5h to the next month.
Lee Garrett did 10.75h (out of 17.75h assigned), thus carrying over 7.0h to the next month.
Markus Koschany did 30.0h (out of 30.0h assigned).
Ola Lundqvist did 4.0h (out of 0h assigned and 19.5h from previous period), thus carrying over 15.5h to the next month.
Roberto C. Sánchez did 12.0h (out of 5.0h assigned and 7.0h from previous period).
Santiago Ruano Rincón did 13.625h (out of 7.75h assigned and 8.25h from previous period), thus carrying over 2.375h to the next month.
Sean Whitton did 13.0h (out of 6.0h assigned and 7.0h from previous period).
Sylvain Beucler did 7.5h (out of 11.25h assigned and 6.5h from previous period), thus carrying over 10.25h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 16.0h (out of 9.25h assigned and 6.75h from previous period).
Utkarsh Gupta did 0.0h (out of 0.75h assigned and 17.0h from previous period), thus carrying over 17.75h to the next month.

Evolution of the situation

In October, we have released 49 DLAs.

Of particular note in the month of October, LTS contributor Chris Lamb issued DLA 3627-1 pertaining to Redis, the popular key-value database similar to Memcached, which was vulnerable to an authentication bypass vulnerability. Fixing this vulnerability involved dealing with a race condition that could allow another process an opportunity to establish an otherwise unauthorized connection. LTS contributor Markus Koschany was involved in the mitigation of CVE-2023-44487, which is a protocol-level vulnerability in the HTTP/2 protocol. The impacts within Debian involved multiple packages, across multiple releases, with multiple advisories being released (both DSA for stable and old-stable, and DLA for LTS). Markus reviewed patches and security updates prepared by other Debian developers, investigated reported regressions, provided patches for the aforementioned regressions, and issued several security updates as part of this.

Additionally, as MariaDB 10.3 (the version originally included with Debian buster) passed end-of-life earlier this year, LTS contributor Emilio Pozuelo Monfort has begun investigating the feasibility of backporting MariaDB 10.11. The work is in early stages, with much testing and analysis remaining before a final decision can be made, as this only one of several available potential courses of action concerning MariaDB.

Finally, LTS contributor Lee Garrett has invested considerable effort into the development the Functional Test Framework here. While so far only an initial version has been published, it already has several features which we intend to begin leveraging for testing of LTS packages. In particular, the FTF supports provisioning multiple VMs for the purposes of performing functional tests of network-facing services (e.g., file services, authentication, etc.). These tests are in addition to the various unit-level tests which are executed during package build time. Development work will continue on FTF and as it matures and begins to see wider use within LTS we expect to improve the quality of the updates we publish.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 98 months)
- Civil Infrastructure Platform (CIP) (for 66 months)
Gold sponsors:
- Roche Diagnostics International AG (for 109 months)
- Linode (for 103 months)
- Babiel GmbH (for 92 months)
- Plat’Home (for 92 months)
- University of Oxford (for 48 months)
- Deveryware (for 35 months)
- VyOS Inc (for 30 months)
- EDF SA (for 19 months)
Silver sponsors:
- Domeneshop AS (for 113 months)
- Nantes Métropole (for 107 months)
- Univention GmbH (for 99 months)
- Université Jean Monnet de St Etienne (for 99 months)
- Ribbon Communications, Inc. (for 93 months)
- Exonet B.V. (for 83 months)
- Leibniz Rechenzentrum (for 77 months)
- CINECA (for 66 months)
- Ministère de l’Europe et des Affaires Étrangères (for 60 months)
- Cloudways Ltd (for 50 months)
- Dinahosting SL (for 48 months)
- Bauer Xcel Media Deutschland KG (for 42 months)
- Platform.sh (for 42 months)
- Moxa Inc. (for 36 months)
- sipgate GmbH (for 33 months)
- OVH US LLC (for 31 months)
- Tilburg University (for 31 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 23 months)
- Soliton Systems K.K. (for 20 months)
Bronze sponsors:
- Evolix (for 114 months)
- Seznam.cz, a.s. (for 114 months)
- Intevation GmbH (for 111 months)
- Linuxhotel GmbH (for 111 months)
- Daevel SARL (for 109 months)
- Bitfolk LTD (for 108 months)
- Megaspace Internet Services GmbH (for 108 months)
- Greenbone AG (for 107 months)
- NUMLOG (for 107 months)
- WinGo AG (for 107 months)
- Ecole Centrale de Nantes - LHEEA (for 103 months)
- Entr’ouvert (for 98 months)
- Adfinis AG (for 95 months)
- GNI MEDIA (for 90 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 90 months)
- Tesorion (for 90 months)
- Bearstech (for 81 months)
- LiHAS (for 81 months)
- Catalyst IT Ltd (for 76 months)
- Supagro (for 71 months)
- Demarcq SAS (for 70 months)
- Université Grenoble Alpes (for 56 months)
- TouchWeb SAS (for 48 months)
- SPiN AG (for 45 months)
- CoreFiling (for 40 months)
- Institut des sciences cognitives Marc Jeannerod (for 35 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 32 months)
- Tem Innovations GmbH (for 27 months)
- WordFinder.pro (for 26 months)
- CNRS DT INSU Résif (for 25 months)
- Alter Way (for 18 months)
- Institut Camille Jordan (for 7 months)

Debian Contributions: Freexian meetup, debusine updates, lpr/lpd in Debian, and more! (by Utkarsh Gupta, Stefano Rivera)

Utkarsh Gupta, Stefano Rivera — Fri, 20 Oct 2023 00:00:00 +0000

Freexian Meetup, by Stefano Rivera, Utkarsh Gupta, et al.

During DebConf, Freexian organized a meetup for its collaborators and those interested in learning more about Freexian and its services. It was well received and many people interested in Freexian showed up.

Some developers who were interested in contributing to LTS came to get more details about joining the project. And some prospective customers came to get to know us and ask questions.

Sadly, the tragic loss of Abraham shook DebConf, both individually and structurally. The meetup got rescheduled to a small room without video coverage. With that, we still had a wholesome interaction and here’s a quick picture from the meetup taken by Utkarsh (which is also why he’s missing!).

Debusine, by Raphaël Hertzog, et al.

Freexian has been investing into debusine for a while, but development speed is about to increase dramatically thanks to funding from SovereignTechFund.de. Raphaël laid out the 5 milestones of the funding contract, and filed the issues for the first milestone. Together with Enrico and Stefano, they established a workflow for the expanded team.

Among the first steps of this milestone, Enrico started to work on a developer-friendly description of debusine that we can use when we reach out to the many Debian contributors that we will have to interact with. And Raphaël started the design work of the autopkgtest and lintian tasks, i.e. what’s the interface to schedule such tasks, what behavior and what associated options do we support?

At this point you might wonder what debusine is supposed to be… let us try to answer this: Debusine manages scheduling and distribution of Debian-related build and QA tasks to a network of worker machines. It also manages the resulting artifacts and provides the results in an easy to consume way.

We want to make it easy for Debian contributors to leverage all the great QA tools that Debian provides. We want to build the next generation of Debian’s build infrastructure, one that will continue to reliably do what it already does, but that will also enable distribution-wide experiments, custom package repositories and custom workflows with advanced package reviews.

If this all sounds interesting to you, don’t hesitate to watch the project on salsa.debian.org and to contribute.

lpr/lpd in Debian, by Thorsten Alteholz

During Debconf23, Till Kamppeter presented CPDB (Common Print Dialog Backend), a new way to handle print queues. After this talk it was discussed whether the old lpr/lpd based printing system could be abandoned in Debian or whether there is still demand for it.

So Thorsten asked on the debian-devel email list whether anybody uses it. Oddly enough, these old packages are still useful:

Within a small network it is easier to distribute a printcap file, than to properly configure cups clients.
One of the biggest manufacturers of WLAN router and DSL boxes only supports raw queues when attaching an USB printer to their hardware. Admittedly the CPDB still has problems with such raw queues.
The Pharos printing system at MIT is still lpd-based.

As a result, the lpr/lpd stuff is not yet ready to be abandoned and Thorsten will adopt the relevant packages (or rather move them under the umbrella of the debian-printing team). Though it is not planned to develop new features, those packages should at least have a maintainer. This month Thorsten adopted rlpr, an utility for lpd printing without using /etc/printcap. The next one he is working on is lprng, a lpr/lpd printer spooling system. If you know of any other package that is also needed and still maintained by the QA team, please tell Thorsten.

/usr-merge, by Helmut Grohne

Discussion about lifting the file move moratorium has been initiated with the CTTE and the release team. A formal lift is dependent on updating debootstrap in older suites though. A significant number of packages can automatically move their systemd unit files if dh_installsystemd and systemd.pc change their installation targets. Unfortunately, doing so makes some packages FTBFS and therefore patches have been filed. The analysis tool, dumat, has been enhanced to better understand which upgrade scenarios are considered supported to reduce false positive bug filings and gained a mode for local operation on a .changes file meant for inclusion in salsa-ci. The filing of bugs from dumat is still manual to improve the quality of reports.

Since September, the moratorium has been lifted.

Miscellaneous contributions

Raphaël updated Django’s backport in bullseye-backports to match the latest security release that was published in bookworm. Tracker.debian.org is still using that backport.
Helmut Grohne sent 13 patches for cross build failures.
Helmut Grohne performed a maintenance upload of debvm enabling its use in autopkgtests.
Helmut Grohne wrote an API-compatible reimplementation of autopkgtest-build-qemu. It is powered by mmdebstrap, therefore unprivileged, EFI-only and will soon be included in mmdebstrap.
Santiago continued the work regarding how to make it easier to (automatically) test reverse dependencies. An example of the ongoing work was presented during the Salsa CI BoF at DebConf 23.
In fact, omniorb-dfsg test pipelines as the above were used for the omniorb-dfsg 4.3.0 transition, verifying how the reverse dependencies (tango, pytango and omnievents) were built and how their autopkgtest jobs run with the to-be-uploaded omniorb-dfsg new release.
Utkarsh and Stefano attended and helped run DebConf 23. Also continued winding up DebConf 22 accounting.
Anton Gladky did some science team uploads to fix RC bugs.

Monthly report about Debian Long Term Support, September 2023 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Thu, 12 Oct 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In September, 21 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 10.0h (out of 0h assigned and 14.0h from previous period), thus carrying over 4.0h to the next month.
Adrian Bunk did 7.0h (out of 17.0h assigned), thus carrying over 10.0h to the next month.
Anton Gladky did 9.5h (out of 7.5h assigned and 7.5h from previous period), thus carrying over 5.5h to the next month.
Bastien Roucariès did 16.0h (out of 15.5h assigned and 1.5h from previous period), thus carrying over 1.0h to the next month.
Ben Hutchings did 17.0h (out of 17.0h assigned).
Chris Lamb did 17.0h (out of 17.0h assigned).
Emilio Pozuelo Monfort did 30.0h (out of 30.0h assigned).
Guilhem Moulin did 18.25h (out of 18.25h assigned).
Helmut Grohne did 10.0h (out of 10.0h assigned).
Lee Garrett did 17.0h (out of 16.5h assigned and 0.5h from previous period).
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 4.5h (out of 0h assigned and 24.0h from previous period), thus carrying over 19.5h to the next month.
Roberto C. Sánchez did 5.0h (out of 12.0h assigned), thus carrying over 7.0h to the next month.
Santiago Ruano Rincón did 7.75h (out of 16.0h assigned), thus carrying over 8.25h to the next month.
Sean Whitton did 7.0h (out of 7.0h assigned).
Sylvain Beucler did 10.5h (out of 17.0h assigned), thus carrying over 6.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 13.25h (out of 16.0h assigned), thus carrying over 2.75h to the next month.

Evolution of the situation

In September, we have released 44 DLAs.

The month of September was a busy month for the LTS Team.

A notable security issue fixed in September was the high-severity CVE-2023-4863, a heap buffer overflow that allowed remote attackers to perform an out-of-bounds memory write via a crafted WebP file. This CVE was covered by the three DLAs of different packages: firefox-esr, libwebp and thunderbird. The libwebp backported patch was sent to upstream, who adapted and applied it to the 0.6.1 branch.

It is also worth noting that LTS contributor Markus Koschany included in his work updates to packages in Debian Bullseye and Bookworm, that are under the umbrella of the Security Team: xrdp, jetty9 and mosquitto.

As every month, there was important behind-the-scenes work by the Front Desk staff, who triaged, analyzed and reviewed dozens of vulnerabilities, to decide if they warrant a security update. This is very important work, since we need to trade-off between the frequency of updates and the stability of the LTS release.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 97 months)
- Civil Infrastructure Platform (CIP) (for 65 months)
Gold sponsors:
- Roche Diagnostics International AG (for 108 months)
- Linode (for 102 months)
- Babiel GmbH (for 91 months)
- Plat’Home (for 91 months)
- University of Oxford (for 47 months)
- Deveryware (for 34 months)
- VyOS Inc (for 29 months)
- EDF SA (for 18 months)
Silver sponsors:
- Domeneshop AS (for 112 months)
- Nantes Métropole (for 106 months)
- Univention GmbH (for 98 months)
- Université Jean Monnet de St Etienne (for 98 months)
- Ribbon Communications, Inc. (for 92 months)
- Exonet B.V. (for 82 months)
- Leibniz Rechenzentrum (for 76 months)
- CINECA (for 65 months)
- Ministère de l’Europe et des Affaires Étrangères (for 59 months)
- Cloudways Ltd (for 49 months)
- Dinahosting SL (for 47 months)
- Bauer Xcel Media Deutschland KG (for 41 months)
- Platform.sh (for 41 months)
- Moxa Inc. (for 35 months)
- sipgate GmbH (for 32 months)
- OVH US LLC (for 30 months)
- Tilburg University (for 30 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 21 months)
- Soliton Systems K.K. (for 19 months)
Bronze sponsors:
- Evolix (for 113 months)
- Seznam.cz, a.s. (for 113 months)
- Linuxhotel GmbH (for 110 months)
- Intevation GmbH (for 109 months)
- Daevel SARL (for 108 months)
- Bitfolk LTD (for 107 months)
- Megaspace Internet Services GmbH (for 107 months)
- Greenbone AG (for 106 months)
- NUMLOG (for 106 months)
- WinGo AG (for 106 months)
- Ecole Centrale de Nantes - LHEEA (for 102 months)
- Entr’ouvert (for 97 months)
- Adfinis AG (for 94 months)
- GNI MEDIA (for 89 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 89 months)
- Tesorion (for 89 months)
- Bearstech (for 80 months)
- LiHAS (for 80 months)
- Catalyst IT Ltd (for 75 months)
- Supagro (for 70 months)
- Demarcq SAS (for 69 months)
- Université Grenoble Alpes (for 55 months)
- TouchWeb SAS (for 47 months)
- SPiN AG (for 44 months)
- CoreFiling (for 39 months)
- Institut des sciences cognitives Marc Jeannerod (for 34 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 31 months)
- Tem Innovations GmbH (for 25 months)
- WordFinder.pro (for 25 months)
- CNRS DT INSU Résif (for 24 months)
- Alter Way (for 17 months)
- Institut Camille Jordan (for 6 months)

Monthly report about Debian Long Term Support, August 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Tue, 12 Sep 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In August, 19 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 12.0h assigned and 2.0h from previous period), thus carrying over 14.0h to the next month.
Adrian Bunk did 18.5h (out of 18.5h assigned).
Anton Gladky did 7.5h (out of 5.0h assigned and 10.0h from previous period), thus carrying over 7.5h to the next month.
Bastien Roucariès did 17.0h (out of 15.5h assigned and 3.0h from previous period), thus carrying over 1.5h to the next month.
Ben Hutchings did 18.5h (out of 9.0h assigned and 9.5h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 18.5h (out of 18.25h assigned and 0.25h from previous period).
Guilhem Moulin did 24.0h (out of 22.5h assigned and 1.5h from previous period).
Jochen Sprickerhof did 2.5h (out of 8.5h assigned and 10.0h from previous period), thus carrying over 16.0h to the next month.
Lee Garrett did 18.0h (out of 9.25h assigned and 9.25h from previous period), thus carrying over 0.5h to the next month.
Markus Koschany did 28.5h (out of 28.5h assigned).
Ola Lundqvist did 0.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 24.0h to the next month.
Roberto C. Sánchez did 18.5h (out of 13.0h assigned and 5.5h from previous period).
Santiago Ruano Rincón did 18.5h (out of 18.25h assigned and 0.25h from previous period).
Sean Whitton did 7.0h (out of 10.0h assigned), thus carrying over 3.0h to the next month.
Sylvain Beucler did 18.5h (out of 9.75h assigned and 8.75h from previous period).
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 16.0h (out of 16.0h assigned).
Utkarsh Gupta did 12.25h (out of 0h assigned and 12.25h from previous period).

Evolution of the situation

In August, we have released 42 DLAs.

The month of August turned out to be a rather quiet month for the LTS team.

Three notable updates were to bouncycastle, openssl, and zabbix. In the case of bouncycastle a flaw allowed for the possibility of LDAP injection and the openssl update corrected a resource exhaustion bug that could result in a denial of service. Zabbix, while not widely used, was the subject of several vulnerabilities which while not individually severe did combine to result in the zabbix update being of particular note.

Apart from those, the LTS team continued the always ongoing work of triaging, investigating, and fixing vulnerabilities, as well as making contributions to the broader Debian and Free Software communities.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 96 months)
- Civil Infrastructure Platform (CIP) (for 64 months)
Gold sponsors:
- Roche Diagnostics International AG (for 107 months)
- Linode (for 101 months)
- Babiel GmbH (for 90 months)
- Plat’Home (for 90 months)
- University of Oxford (for 46 months)
- Deveryware (for 33 months)
- VyOS Inc (for 28 months)
- EDF SA (for 17 months)
Silver sponsors:
- Domeneshop AS (for 111 months)
- Nantes Métropole (for 105 months)
- Univention GmbH (for 97 months)
- Université Jean Monnet de St Etienne (for 97 months)
- Ribbon Communications, Inc. (for 91 months)
- Exonet B.V. (for 81 months)
- Leibniz Rechenzentrum (for 75 months)
- CINECA (for 64 months)
- Ministère de l’Europe et des Affaires Étrangères (for 58 months)
- Cloudways Ltd (for 48 months)
- Dinahosting SL (for 46 months)
- Bauer Xcel Media Deutschland KG (for 40 months)
- Platform.sh (for 40 months)
- Moxa Inc. (for 34 months)
- sipgate GmbH (for 31 months)
- OVH US LLC (for 29 months)
- Tilburg University (for 29 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 20 months)
- Soliton Systems K.K. (for 18 months)
Bronze sponsors:
- Evolix (for 112 months)
- Seznam.cz, a.s. (for 112 months)
- Linuxhotel GmbH (for 109 months)
- Intevation GmbH (for 108 months)
- Daevel SARL (for 107 months)
- Bitfolk LTD (for 106 months)
- Megaspace Internet Services GmbH (for 106 months)
- Greenbone AG (for 105 months)
- NUMLOG (for 105 months)
- WinGo AG (for 105 months)
- Ecole Centrale de Nantes - LHEEA (for 101 months)
- Entr’ouvert (for 96 months)
- Adfinis AG (for 93 months)
- GNI MEDIA (for 88 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 88 months)
- Tesorion (for 88 months)
- Bearstech (for 79 months)
- LiHAS (for 79 months)
- Catalyst IT Ltd (for 74 months)
- Supagro (for 69 months)
- Demarcq SAS (for 68 months)
- Université Grenoble Alpes (for 54 months)
- TouchWeb SAS (for 46 months)
- SPiN AG (for 43 months)
- CoreFiling (for 38 months)
- Institut des sciences cognitives Marc Jeannerod (for 33 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 30 months)
- Tem Innovations GmbH (for 24 months)
- WordFinder.pro (for 24 months)
- CNRS DT INSU Résif (for 23 months)
- Alter Way (for 16 months)
- Institut Camille Jordan (for 5 months)

Debian Contributions: /usr-merge updates, Salsa CI progress, DebConf23 lead-up, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Sun, 10 Sep 2023 00:00:00 +0000

/usr-merge work, by Helmut Grohne, et al.

Given that we now have consensus on moving forward by moving aliased files from / to /usr, we will also run into the problems that the file move moratorium was meant to prevent. The way forward is detecting them early and applying workarounds on a per-package basis. Said detection is now automated using the Debian Usr Merge Analysis Tool. As problems are reported to the bug tracking system, they are connected to the reports if properly usertagged. Bugs and patches for problem categories DEP17-P2 and DEP17-P6 have been filed.

After consensus has been reached on the bootstrapping matters, debootstrap has been changed to swap the initial unpack and merging to avoid unpack errors due to pre-existing links. This is a precondition for having base-files install the aliasing symbolic links eventually.

It was identified that the root filesystem used by the Debian installer is still unmerged and a change has been proposed.

debhelper was changed to recognize systemd units installed to /usr.

A discussion with the CTTE and release team on repealing the moratorium has been initiated.

Salsa CI work, by Santiago Ruano Rincón

August was a busy month in the Salsa CI world. Santiago reviewed and merged a bunch of MRs that have improved the project in different aspects:

The aptly job got two MRs from Philip Hands. With the first one, the aptly now can export a couple of variables in a dotenv file, and with the second, it can include packages from multiple artifact directories. These MRs bring the base to improve how to test reverse dependencies with Salsa CI. Santiago is working on documenting this.

As a result of the mass bug filing done in August, Salsa CI now includes a job to test how a package builds twice in a row. Thanks to the MRs of Sebastiaan Couwenberg and Johannes Schauer Marin Rodrigues.

Last but not least, Santiago helped Johannes Schauer Marin Rodrigues to complete the support for arm64-only pipelines.

DebConf23 lead-up, by Stefano Rivera

Stefano wears a few hats in the DebConf organization and in the lead up to the conference in mid-September, they’ve all been quite busy.

As one of the treasurers of DebConf 23, there has been a final budget update, and quite a few payments to coordinate from Debian’s Trusted Organizations. We try to close the books from the previous conference at the next one, so a push was made to get DebConf 22 account statements out of TOs and record them in the conference ledger.

As a website developer, we had a number of registration-related tasks, emailing attendees and trying to estimate numbers for food and accommodation.

As a conference committee member, the job was mostly taking calls and helping the local team to make decisions on urgent issues. For example, getting conference visas issued to attendees required getting political approval from the Indian government. We only discovered the full process for this too late to clear some complex cases, so this required some hard calls on skipping some countries from the application list, allowing everyone else to get visas in time. Unfortunate, but necessary.

Miscellaneous contributions

Raphaël Hertzog updated gnome-shell-extension-hamster to a new upstream git snapshot that is compatible with GNOME Shell 44 that was recently uploaded to Debian unstable/testing. This extension makes it easy to start/stop tracking time with Hamster Time Tracker. Very handy for consultants like us who are billing their work per hour.
Raphaël also updated zim to the latest upstream release (0.74.2). This is a “desktop wiki” that can be very useful as a note-taking tool to build your own personal knowledge base or even to manage your personal todo lists.
Utkarsh reviewed and sponsored some uploads from mentors.debian.net.
Utkarsh helped the local team and the bursary team with some more DebConf activities and helped finalize the data.
Thorsten tried to update package hplip. Unfortunately upstream added some new compressed files that need to appear uncompressed in the package. Even though this sounded like an easy task, which seemed to be already implemented in the current debian/rules, the new type of files broke this implementation and made the package no longer buildable. The problem has been solved and the upload will happen soon.
Helmut sent 7 patches for cross build failures. Since dpkg-buildflags now defaults to issue arm64-specific compiler flags, more care is needed to distinguish between build architecture flags and host architecture flags than previously.
Stefano pushed the final bit of the tox 4 transition over the line in Debian, allowing dh-python and tox 4 to migrate to testing. We got caught up in a few unusual bugs in tox and the way we run it in Debian package building (which had to change with tox 4). This resulted in a couple of patches upstream.
Stefano visited Haifa, Israel, to see the proposed DebConf 24 venue and meet with the local team. While the venue isn’t committed yet, we have high hopes for it.

Monthly report about Debian Long Term Support, July 2023 (by Santiago Ruano Rincón)

Santiago Ruano Rincón — Tue, 15 Aug 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In July, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 0h assigned and 2.0h from previous period), thus carrying over 2.0h to the next month.
Adrian Bunk did 24.75h (out of 18.25h assigned and 6.5h from previous period).
Anton Gladky did 5.0h (out of 5.0h assigned and 10.0h from previous period), thus carrying over 10.0h to the next month.
Bastien Roucariès did 17.0h (out of 17.0h assigned and 3.0h from previous period), thus carrying over 3.0h to the next month.
Ben Hutchings did 14.0h (out of 24.0h assigned), thus carrying over 9.5h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 24.0h (out of 24.75h assigned), thus carrying over 0.25h to the next month.
Guilhem Moulin did 23.25h (out of 24.75h assigned), thus carrying over 1.5h to the next month.
Jochen Sprickerhof did 10.0h (out of 20.0h assigned), thus carrying over 10.0h to the next month.
Lee Garrett did 16.0h (out of 9.75h assigned and 15.5h from previous period), thus carrying over 9.25h to the next month.
Markus Koschany did 24.75h (out of 24.75h assigned).
Ola Lundqvist did 0.0h (out of 13.0h assigned and 11.0h from previous period), thus carrying over 24.0h to the next month.
Roberto C. Sánchez did 19.25h (out of 14.75h assigned and 10.0h from previous period), thus carrying over 5.5h to the next month.
Santiago Ruano Rincón did 25.5h (out of 10.5h assigned and 15.25h from previous period), thus carrying over 0.25h to the next month.
Sylvain Beucler did 16.0h (out of 21.25h assigned and 3.5h from previous period), thus carrying over 8.75h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 16.0h (out of 16.0h assigned).
Utkarsh Gupta did 1.5h (out of 0h assigned and 13.75h from previous period), thus carrying over 12.25h to the next month.

Evolution of the situation

In July, we have released 35 DLAs.

LTS contributor Lee Garrett, has continued his hard work to prepare a testing framework for Samba, that can now provision bootable VMs with little effort, both for Debian and for Windows. This work included the introduction of a new package to Debian, rhsrvany, which allows turning any Windows program or script into a Windows service. As the Samba testing framework matures it will be possible to perform functional tests which cannot be performed with other available test mechanisms and aspects of this framework will be generalizable to other package ecosystems beyond Samba.

July included a notable security update of bind9 by LTS contributor Chris Lamb. This update addressed a potential denial of service attack in this critical network infrastructure component.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 95 months)
- Civil Infrastructure Platform (CIP) (for 63 months)
Gold sponsors:
- Roche Diagnostics International AG (for 106 months)
- Linode (for 100 months)
- Babiel GmbH (for 89 months)
- Plat’Home (for 89 months)
- University of Oxford (for 45 months)
- Deveryware (for 32 months)
- VyOS Inc (for 27 months)
- EDF SA (for 16 months)
Silver sponsors:
- Domeneshop AS (for 110 months)
- Nantes Métropole (for 104 months)
- Univention GmbH (for 96 months)
- Université Jean Monnet de St Etienne (for 96 months)
- Ribbon Communications, Inc. (for 90 months)
- Exonet B.V. (for 80 months)
- Leibniz Rechenzentrum (for 74 months)
- CINECA (for 63 months)
- Ministère de l’Europe et des Affaires Étrangères (for 57 months)
- Cloudways Ltd (for 47 months)
- Dinahosting SL (for 45 months)
- Bauer Xcel Media Deutschland KG (for 39 months)
- Platform.sh (for 39 months)
- Moxa Inc. (for 33 months)
- sipgate GmbH (for 30 months)
- OVH US LLC (for 28 months)
- Tilburg University (for 28 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 20 months)
- Soliton Systems K.K. (for 17 months)
Bronze sponsors:
- Evolix (for 111 months)
- Seznam.cz, a.s. (for 111 months)
- Intevation GmbH (for 108 months)
- Linuxhotel GmbH (for 108 months)
- Daevel SARL (for 106 months)
- Bitfolk LTD (for 105 months)
- Megaspace Internet Services GmbH (for 105 months)
- Greenbone AG (for 104 months)
- NUMLOG (for 104 months)
- WinGo AG (for 104 months)
- Ecole Centrale de Nantes - LHEEA (for 100 months)
- Entr’ouvert (for 95 months)
- Adfinis AG (for 92 months)
- GNI MEDIA (for 87 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 87 months)
- Tesorion (for 87 months)
- Bearstech (for 78 months)
- LiHAS (for 78 months)
- Catalyst IT Ltd (for 73 months)
- Supagro (for 68 months)
- Demarcq SAS (for 67 months)
- Université Grenoble Alpes (for 53 months)
- TouchWeb SAS (for 45 months)
- SPiN AG (for 42 months)
- CoreFiling (for 37 months)
- Institut des sciences cognitives Marc Jeannerod (for 32 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 29 months)
- Tem Innovations GmbH (for 24 months)
- WordFinder.pro (for 23 months)
- CNRS DT INSU Résif (for 22 months)
- Alter Way (for 15 months)
- Institut Camille Jordan (for 4 months)

Debian Contributions: PTS tracker, DebConf23 Bursary, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Thu, 10 Aug 2023 00:00:00 +0000

tracker.debian.org work by Raphaël Hertzog

Raphaël spent some time during his vacation to update distro-tracker to be fully compatible with Django 3.2 so that the codebase and the whole testsuite can run on Debian 12. There’s one exception though with the functional test suite that still needs further work to cope with the latest version of Selenium.

By dropping support of Django 2.2, Raphaël could also start to work toward support of Django 4.2 since Django helpfully emits deprecation warnings of things that will break in future versions. All the warnings have been fixed but the codebase still fails its testsuite in Django 4.2 because we have to get rid of the python3-django-jsonfield dependency (that is rightfully dead upstream since Django has native support nowadays). All the JSONField have been converted to use Django’s native field, but the migration system still requires that dependency at this point.

This will require either some fresh reboot of the migration history, or some other trickery to erase the jsonfield dependency from the history of migrations. If you have experience with that, don’t hesitate to share it (mail at hertzog@debian.org, or reach out to buxy on IRC).

At this point, tracker.debian.org runs with Django 3.2 on Debian 11 since Debian System Administrators are not yet ready to upgrade debian.org hosts to Debian 12.

DebConf 23 bursary work by Utkarsh Gupta

Utkarsh led the bursary team this year. The bursary team got a ton of requests this time. Rolling out the results in 4 batches, the bursary team catered over 165 bursary requests - which is superb!

The team managed to address all the requests and answered a bit over 120 emails in the process. With that, the bursaries are officially closed for DebConf 2023. The team also intends to roll out some of the statistics closer to DebConf.

Miscellaneous contributions

Stefano implemented meson support in pybuild, the tool for building Python packages in Debian against multiple Python versions.
Santiago did some work on Salsa CI to enhance the ARM support on the autopkgtest job and make Josch’s branch work. MR to come soon.
Helmut sent patches for 6 cross build failures.
Stefano has been preparing for DebConf 23: Working on the website, and assisting the local teams.
Stefano attended the DebConf Video team sprint in Paris, mostly looking at new hardware and software options for video capture and live-mixing. Full sprint report.

Monthly report about Debian Long Term Support, June 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Sat, 15 Jul 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In June, 17 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 12.0h (out of 6.0h assigned and 8.0h from previous period), thus carrying over 2.0h to the next month.
Adrian Bunk did 28.0h (out of 0h assigned and 34.5h from previous period), thus carrying over 6.5h to the next month.
Anton Gladky did 5.0h (out of 6.0h assigned and 9.0h from previous period), thus carrying over 10.0h to the next month.
Bastien Roucariès did 17.0h (out of 17.0h assigned and 3.0h from previous period), thus carrying over 3.0h to the next month.
Ben Hutchings did 24.0h (out of 16.5h assigned and 7.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 24.0h (out of 21.0h assigned and 2.5h from previous period).
Guilhem Moulin did 20.0h (out of 20.0h assigned).
Lee Garrett did 25.0h (out of 0h assigned and 40.5h from previous period), thus carrying over 15.5h to the next month.
Markus Koschany did 23.5h (out of 23.5h assigned).
Ola Lundqvist did 13.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 11.0h to the next month.
Roberto C. Sánchez did 13.5h (out of 9.75h assigned and 13.75h from previous period), thus carrying over 10.0h to the next month.
Santiago Ruano Rincón did 8.25h (out of 23.5h assigned), thus carrying over 15.25h to the next month.
Sylvain Beucler did 20.0h (out of 23.5h assigned), thus carrying over 3.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 16.0h (out of 16.0h assigned).
Utkarsh Gupta did 0.0h (out of 0h assigned and 25.5h from previous period), thus carrying over 25.5h to the next month.

Evolution of the situation

In June, we have released 40 DLAs.

Notable security updates in June included mariadb-10.3, openssl, and golang-go.crypto. The mariadb-10.3 package was synchronized with the latest upstream maintenance release, version 10.3.39. The openssl package was patched to correct several flaws with certificate validation and with object identifier parsing. Finally, the golang-go.crypto package was updated to address several vulnerabilities, and several associated Go packages were rebuilt in order to properly incorporate the update.

LTS contributor Sylvain has been hard at work with some behind-the-scenes improvements to internal tooling and documentation. His efforts are helping to improve the efficiency of all LTS contributors and also helping to improve the quality of their work, making our LTS updates more timely and of higher quality.

LTS contributor Lee Garrett began working on a testing framework specifically for Samba. Given the critical role which Samba plays in many deployments, the tremendous impact which regressions can have in those cases, and the unique testing requirements of Samba, this work will certainly result in increased confidence around our Samba updates for LTS.

LTS contributor Emilio Pozuelo Monfort has begun preparatory work for the upcoming Firefox ESR version 115 release. Firefox ESR (and the related Thunderbird ESR) requires special work to maintain up to date in LTS. Mozilla do not release individual patches for CVEs, and our policy is to incorporate new ESR releases from Mozilla into LTS. Most updates are minor updates, but once a year Mozilla will release a major update as they move to a new major version for ESR. The update to a new major ESR version entails many related updates to toolchain and other packages. The preparations that Emilio has begun will ensure that once the 115 ESR release is made, updated packages will be available in LTS with minimal delay.

Another highlight of behind-the-scenes work is our Front Desk personnel. While we often focus on the work which results in published package updates, much work is also involved in reviewing new vulnerabilities and triaging them (i.e., determining if they affect one or more packages in LTS and then determining the severity of those which are applicable). These intrepid contributors (Emilio Pozuelo Monfort, Markus Koschany, Ola Lundqvist, Sylvain Beucler, and Thorsten Alteholz for the month of June) reviewed dozens of vulnerabilities and made decisions about how those vulnerabilities should be dealt with.

Thanks to our sponsors

Platinum sponsors:
- TOSHIBA (for 94 months)
- Civil Infrastructure Platform (CIP) (for 62 months)
Gold sponsors:
- Roche Diagnostics International AG (for 105 months)
- Linode (for 99 months)
- Babiel GmbH (for 88 months)
- Plat’Home (for 88 months)
- University of Oxford (for 44 months)
- Deveryware (for 31 months)
- VyOS Inc (for 26 months)
- EDF SA (for 15 months)
Silver sponsors:
- Domeneshop AS (for 109 months)
- Nantes Métropole (for 103 months)
- Univention GmbH (for 95 months)
- Université Jean Monnet de St Etienne (for 95 months)
- Ribbon Communications, Inc. (for 89 months)
- Exonet B.V. (for 79 months)
- Leibniz Rechenzentrum (for 73 months)
- CINECA (for 62 months)
- Ministère de l’Europe et des Affaires Étrangères (for 56 months)
- Cloudways Ltd (for 46 months)
- Dinahosting SL (for 44 months)
- Bauer Xcel Media Deutschland KG (for 38 months)
- Platform.sh (for 38 months)
- Moxa Inc. (for 32 months)
- sipgate GmbH (for 29 months)
- OVH US LLC (for 27 months)
- Tilburg University (for 27 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 18 months)
- Soliton Systems K.K. (for 16 months)
Bronze sponsors:
- Evolix (for 110 months)
- Seznam.cz, a.s. (for 110 months)
- Intevation GmbH (for 107 months)
- Linuxhotel GmbH (for 107 months)
- Daevel SARL (for 105 months)
- Bitfolk LTD (for 104 months)
- Megaspace Internet Services GmbH (for 104 months)
- Greenbone AG (for 103 months)
- NUMLOG (for 103 months)
- WinGo AG (for 103 months)
- Ecole Centrale de Nantes - LHEEA (for 99 months)
- Entr’ouvert (for 94 months)
- Adfinis AG (for 91 months)
- GNI MEDIA (for 86 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 86 months)
- Tesorion (for 86 months)
- Bearstech (for 77 months)
- LiHAS (for 77 months)
- Catalyst IT Ltd (for 72 months)
- Supagro (for 67 months)
- Demarcq SAS (for 66 months)
- Université Grenoble Alpes (for 52 months)
- TouchWeb SAS (for 44 months)
- SPiN AG (for 41 months)
- CoreFiling (for 36 months)
- Institut des sciences cognitives Marc Jeannerod (for 31 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 28 months)
- Tem Innovations GmbH (for 22 months)
- WordFinder.pro (for 22 months)
- CNRS DT INSU Résif (for 21 months)
- Alter Way (for 14 months)
- Institut Camille Jordan (for 3 months)

Debian Contributions: /usr-merge updates, DebConf Bursary prep, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Wed, 12 Jul 2023 00:00:00 +0000

/usr-merge, by Helmut Grohne, et al

The work on /usr-merge continues from May. The lengthy discussion was condensed into a still lengthy rewrite of DEP17 listing all known problems and proposed mitigations. An initial consensus call did not resolve all questions, but we now have rough consensus on finalizing the transition without relying on major changes to dpkg. Other questions still have diverging opinions and some matters such as how to not break backports are still missing satisfying answers.

DebConf Bursary prep, by Utkarsh Gupta

DebCamp and DebConf is happening from 03rd September to 17th September in Kochi, India, and the DebConf Bursary team is gearing up for that. After extending the bursary deadline (catering to the requests coming in from various people), we’ve finally managed to clock over 260 bursary requests. The team is set up and we’re starting to review the applications. The team intends to roll out the result as soon as possible.

debci, by Helmut Grohne

As Freexian is working on deploying autopkgtests for the LTS and ELTS services, debci and autopkgtests were improved in Debian to better deal with derivatives (e.g. by better supporting external package signing keyrings). Other aspects that are not deployed on ci.debian.net such as the qemu backend were also improved. We express thanks to the relevant maintainers Antonio Terceiro, Paul Gevers and Simon McVittie for their timely reviews and merges of our changes.

Miscellaneous contributions

Following the release of Debian 12, Raphaël Hertzog updated tracker.debian.org to be aware of trixie. He also pushed some fixes to distro-tracker (the software powering tracker.debian.org) and released version 1.2.0 (since the former release was lacking fixes to run on Debian 12 bookworm).
Following the release of Debian 12, Helmut Grohne updated crossqa.debian.net systems. He also sent 7 patches for cross build failures and continued adapting rebootstrap to changes in unstable.
Santiago Ruano Rincón started to work on how to improve the robustness of Salsa CI’s pipeline for some jobs failing frequently.
Thorsten Alteholz did security updates of cpdb-libs in Unstable and Bookworm.
Stefano Rivera upgraded pixelfed.debian.social to bookworm.
Stefano started an re2 library transition, and started preparation for the next transition.
Helmut Grohne updated debvm in unstable releasing changes that accumulated during the freeze.
Stefano did some work on the website and infrastructure for DebConf 23.
Utkarsh Gupta helped review and fix open redmine bugs and fix them all in unstable.

Monthly report about Debian Long Term Support, May 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Wed, 14 Jun 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In May, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 6.0h (out of 6.0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
Anton Gladky did 6.0h (out of 8.0h assigned and 7.0h from previous period), thus carrying over 9.0h to the next month.
Bastien Roucariès did 17.0h (out of 17.0h assigned and 3.0h from previous period), thus carrying over 3.0h to the next month.
Ben Hutchings did 17.0h (out of 16.0h assigned and 8.0h from previous period), thus carrying over 7.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Daniel Leidert did 0.0h (out of 0h assigned and 12.0h from previous period), thus carrying over 12.0h to the next month.
Dominik George did 0.0h (out of 0h assigned and 20.34h from previous period), thus carrying over 20.34h to the next month.
Emilio Pozuelo Monfort did 32.0h (out of 18.5h assigned and 16.0h from previous period), thus carrying over 2.5h to the next month.
Guilhem Moulin did 20.0h (out of 8.5h assigned and 11.5h from previous period).
Holger Levsen did 0.0h (out of 0h assigned and 10.0h from previous period), thus carrying over 10.0h to the next month.
Lee Garrett did 0.0h (out of 0h assigned and 40.5h from previous period), thus carrying over 40.5h to the next month.
Markus Koschany did 34.5h (out of 34.5h assigned).
Roberto C. Sánchez did 18.25h (out of 20.5h assigned and 11.5h from previous period), thus carrying over 13.75h to the next month.
Scarlett Moore did 20.0h (out of 20.0h assigned).
Sylvain Beucler did 34.5h (out of 29.0h assigned and 5.5h from previous period).
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 16.0h (out of 15.0h assigned and 1.0h from previous period).
Utkarsh Gupta did 5.5h (out of 5.0h assigned and 26.0h from previous period), thus carrying over 25.5h to the next month.

Evolution of the situation

In May, we have released 34 DLAs.

Several of the DLAs constituted notable security updates to LTS during the month of May. Of particular note were the linux (4.19) and linux-5.10 packages, both of which addressed a considerable number of CVEs. Additionally, the postgresql-11 package was updated by synchronizing it with the 11.20 release from upstream.

Notable non-security updates were made to the distro-info-data database and the timezone database. The distro-info-data package was updated with the final expected release date of Debian 12, made aware of Debian 14 and Ubuntu 23.10, and was updated with the latest EOL dates for Ubuntu releases. The tzdata and libdatetime-timezone-perl packages were updated with the 2023c timezone database. The changes in these packages ensure that in addition to the latest security updates LTS users also have the latest information concerning Debian and Ubuntu support windows, as well as the latest timezone data for accurate worldwide timekeeping.

LTS contributor Anton implemented an improvement to the Debian Security Tracker “Unfixed vulnerabilities in unstable without a filed bug” view, allowing for more effective management of CVEs which do not yet have a corresponding bug entry in the Debian BTS.

LTS contributor Sylvain concluded an audit of obsolete packages still supported in LTS to ensure that new CVEs are properly associated. In this case, a package being obsolete means that it is no longer associated with a Debian release for which the Debian Security Team has direct responsibility. When this occurs, it is the responsibility of the LTS team to ensure that incoming CVEs are properly associated to packages which exist only in LTS.

Finally, LTS contributors also contributed several updates to packages in unstable/testing/stable to fix CVEs. This helps package maintainers, addresses CVEs in current and future Debian releases, and ensures that the CVEs do not remain open for an extended period of time only for the LTS team to be required to deal with them much later in the future.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 93 months)
- Civil Infrastructure Platform (CIP) (for 61 months)
Gold sponsors:
- Roche Diagnostics International AG (for 104 months)
- Linode (for 98 months)
- Babiel GmbH (for 87 months)
- Plat’Home (for 87 months)
- University of Oxford (for 43 months)
- Deveryware (for 30 months)
- VyOS Inc (for 25 months)
- EDF SA (for 14 months)
Silver sponsors:
- Domeneshop AS (for 108 months)
- Nantes Métropole (for 102 months)
- Univention GmbH (for 94 months)
- Université Jean Monnet de St Etienne (for 94 months)
- Ribbon Communications, Inc. (for 88 months)
- Exonet B.V. (for 78 months)
- Leibniz Rechenzentrum (for 72 months)
- CINECA (for 61 months)
- Ministère de l’Europe et des Affaires Étrangères (for 55 months)
- Cloudways Ltd (for 45 months)
- Dinahosting SL (for 43 months)
- Bauer Xcel Media Deutschland KG (for 37 months)
- Platform.sh (for 37 months)
- Moxa Inc. (for 31 months)
- sipgate GmbH (for 28 months)
- OVH US LLC (for 26 months)
- Tilburg University (for 26 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 17 months)
- Soliton Systems K.K. (for 15 months)
Bronze sponsors:
- Evolix (for 109 months)
- Seznam.cz, a.s. (for 109 months)
- Linuxhotel GmbH (for 106 months)
- Intevation GmbH (for 105 months)
- Daevel SARL (for 104 months)
- Bitfolk LTD (for 103 months)
- Megaspace Internet Services GmbH (for 103 months)
- Greenbone AG (for 102 months)
- NUMLOG (for 102 months)
- WinGo AG (for 102 months)
- Ecole Centrale de Nantes - LHEEA (for 98 months)
- Entr’ouvert (for 93 months)
- Adfinis AG (for 90 months)
- GNI MEDIA (for 85 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 85 months)
- Tesorion (for 85 months)
- Bearstech (for 76 months)
- LiHAS (for 76 months)
- Catalyst IT Ltd (for 71 months)
- Supagro (for 66 months)
- Demarcq SAS (for 65 months)
- Université Grenoble Alpes (for 51 months)
- TouchWeb SAS (for 43 months)
- SPiN AG (for 40 months)
- CoreFiling (for 35 months)
- Institut des sciences cognitives Marc Jeannerod (for 30 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 27 months)
- Tem Innovations GmbH (for 21 months)
- WordFinder.pro (for 21 months)
- CNRS DT INSU Résif (for 20 months)
- Alter Way (for 13 months)
- Institut Camille Jordan

Debian Contributions: /usr-merge updates, tox 4 transition, and more! (by Utkarsh Gupta, Stefano Rivera)

Utkarsh Gupta, Stefano Rivera — Sat, 10 Jun 2023 00:00:00 +0000

/usr-merge, by Helmut Grohne, et al

Towards the end of April, the discussion on DEP 17 on debian-devel@l.d.o initiated by Helmut Grohne took off, trying to deal with the fact that while Debian bookworm has a merged /usr, files are still being distributed to / and /usr in Debian binary packages, and moving them currently has some risk of breakage. Most participants of the discussion agreed that files should be moved, and there are several competing design ideas for doing it safely.

Most of the time was spent understanding the practical implications of lifting the moratorium and moving all the files from / to /usr in a coordinated effort. With help from Emilio Pozuelo Monfort, Enrico Zini, and Raphael Hertzog, Helmut Grohne performed extensive analysis of the various aspects, including quantitative analysis of the original file move problem, analysis of effects on dpkg-divert, dpkg-statoverride, and update-alternatives, analysis of effects on filesystem bootstrapping tools. Most of the problematic cases spawned plausible workarounds, such as turning Breaks into Conflicts in selected cases or adding protective diversions for the symbolic links that enable aliasing.

Towards the end of May, Andreas Beckmann reported a new failure scenario which may cause shared resources to inadvertently disappear, such as directories and even regular files in case of Multi-Arch packages, and our work on analyzing these problems and proposing mitigations is on-going.

While the quantitative analysis is funded by Freexian, we wouldn’t be here without the extensive feedback and ideas of many voluntary contributors from multiple areas of Debian, which are too many to name here. Thank you.

Preparing for the tox 4 transition, by Stefano Rivera

While Debian was in freeze for the bookworm release, tox 4 has landed in Debian experimental, and some packages are starting to require it, upstream. It has some backwards-incompatible behavior that breaks many packages using tox through pybuild. So Stefano had to make some changes to pybuild and to many packages that run build-time tests with tox. The easy bits of this transition are now completed in git / experimental, but a few packages that integrate deeply into tox need upstream work.

Debian Printing, by Thorsten Alteholz

Just before the release of Bookworm, lots of QA tools were used to inspect packages. One of these tools found a systemd service file in a wrong directory. So, Thorsten did another upload of package lprint to correct this.

Thanks a lot to all the hardworking people who run such tools and file bugs.

Thorsten also participated in discussions about the new Common Printing Dialog Backends (CPDB) that will be introduced in Trixie and hopefully can replace the current printing architecture in Forky.

Miscellaneous contributions

DebConf 23 preparations by Stefano Rivera. Some work on the website, video team planning, accounting, and team documentation.
Utkarsh Gupta started to prep the work on the bursary team’s side for DC23.
Stefano spun up a website for the Hamburg mini-DebConf so that the video team could have a machine-readable schedule and a place to stream video from the event.
Santiago Ruano Rincón reviewed and sponsored four python packages of a prospective Debian member.
Helmut Grohne supported Timo Roehling and Jochen Sprickerhof to improve cross building in 15 ROS packages.
Helmut Grohne supported Jochen Sprickerhof with diagnosing an e2fsprogs RC bug.
Helmut Grohne continued to maintain rebootstrap and located an issue with lto in gcc-13.
Anton Gladky fixed some RC-Bugs and uploaded a new stravalib python library.

Monthly report about Debian Long Term Support, April 2023 (by Roberto C. Sánchez)

Roberto C. Sánchez — Tue, 16 May 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In April, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 6.0h (out of 0h assigned and 14.0h from previous period), thus carrying over 8.0h to the next month.
Adrian Bunk did 18.0h (out of 16.5h assigned and 24.0h from previous period), thus carrying over 22.5h to the next month.
Anton Gladky did 8.0h (out of 9.5h assigned and 5.5h from previous period), thus carrying over 7.0h to the next month.
Bastien Roucariès did 17.0h (out of 17.0h assigned and 3.0h from previous period), thus carrying over 3.0h to the next month.
Ben Hutchings did 16.0h (out of 12.0h assigned and 12.0h from previous period), thus carrying over 8.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 0.0h (out of 0h assigned and 20.34h from previous period), thus carrying over 20.34h to the next month.
Emilio Pozuelo Monfort did 4.5h (out of 11.0h assigned and 9.5h from previous period), thus carrying over 16.0h to the next month.
Guilhem Moulin did 8.5h (out of 8.0h assigned and 12.0h from previous period), thus carrying over 11.5h to the next month.
Helmut Grohne did 5.0h (out of 2.5h assigned and 7.5h from previous period), thus carrying over 5.0h to the next month.
Lee Garrett did 0.0h (out of 31.5h assigned and 9.0h from previous period), thus carrying over 40.5h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 12.5h (out of 0h assigned and 24.0h from previous period), thus carrying over 11.5h to the next month.
Roberto C. Sánchez did 8.5h (out of 4.75h assigned and 15.25h from previous period), thus carrying over 11.5h to the next month.
Stefano Rivera did 1.0h (out of 0h assigned and 28.0h from previous period), thus carrying over 27.0h to the next month.
Sylvain Beucler did 35.0h (out of 40.5h assigned), thus carrying over 5.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Tobias Frost did 15.0h (out of 15.0h assigned and 1.0h from previous period), thus carrying over 1.0h to the next month.
Utkarsh Gupta did 3.5h (out of 11.0h assigned and 18.5h from previous period), thus carrying over 26.0h to the next month.

Evolution of the situation

In April, we have released 35 DLAs.

The LTS team would like to welcome our newest sponsor, Institut Camille Jordan, a French research lab. Thanks to the support of the many LTS sponsors, the entire Debian community benefits from direct security updates, as well as indirect improvements and collaboration with other members of the Debian community.

As part of improving the efficiency of our work and the quality of the security updates we produce, the LTS has continued improving our workflow. Improvements include more consistent tagging of release versions in Git and broader use of continuous integration (CI) to ensure packages are tested thoroughly and consistently. Sponsors and users can rest assured that we work continuously to maintain and improve the already high quality of the work that we do.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 92 months)
- Civil Infrastructure Platform (CIP) (for 60 months)
Gold sponsors:
- Roche Diagnostics International AG (for 103 months)
- Linode (for 97 months)
- Babiel GmbH (for 86 months)
- Plat’Home (for 86 months)
- University of Oxford (for 42 months)
- Deveryware (for 29 months)
- VyOS Inc (for 24 months)
- EDF SA (for 13 months)
Silver sponsors:
- Domeneshop AS (for 107 months)
- Nantes Métropole (for 101 months)
- Univention GmbH (for 93 months)
- Université Jean Monnet de St Etienne (for 93 months)
- Ribbon Communications, Inc. (for 87 months)
- Exonet B.V. (for 77 months)
- Leibniz Rechenzentrum (for 71 months)
- CINECA (for 60 months)
- Ministère de l’Europe et des Affaires Étrangères (for 54 months)
- Cloudways Ltd (for 43 months)
- Dinahosting SL (for 41 months)
- Bauer Xcel Media Deutschland KG (for 36 months)
- Platform.sh (for 36 months)
- Moxa Inc. (for 30 months)
- sipgate GmbH (for 27 months)
- OVH US LLC (for 25 months)
- Tilburg University (for 25 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 16 months)
- Soliton Systems K.K. (for 14 months)
Bronze sponsors:
- Evolix (for 108 months)
- Seznam.cz, a.s. (for 108 months)
- Linuxhotel GmbH (for 105 months)
- Intevation GmbH (for 104 months)
- Daevel SARL (for 103 months)
- Bitfolk LTD (for 102 months)
- Megaspace Internet Services GmbH (for 102 months)
- Greenbone AG (for 101 months)
- NUMLOG (for 101 months)
- WinGo AG (for 100 months)
- Ecole Centrale de Nantes - LHEEA (for 97 months)
- Entr’ouvert (for 92 months)
- Adfinis AG (for 89 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 84 months)
- Tesorion (for 84 months)
- GNI MEDIA (for 83 months)
- Bearstech (for 75 months)
- LiHAS (for 75 months)
- Catalyst IT Ltd (for 70 months)
- Supagro (for 65 months)
- Demarcq SAS (for 64 months)
- Université Grenoble Alpes (for 50 months)
- TouchWeb SAS (for 42 months)
- SPiN AG (for 38 months)
- CoreFiling (for 34 months)
- Institut des sciences cognitives Marc Jeannerod (for 29 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 26 months)
- Tem Innovations GmbH (for 20 months)
- WordFinder.pro (for 20 months)
- CNRS DT INSU Résif (for 19 months)
- Alter Way (for 11 months)
- Institut Camille Jordan

Debian Contributions: DEP-17, Debian Reimbursements Web App, and more! (by Utkarsh Gupta, Stefano Rivera)

Utkarsh Gupta, Stefano Rivera — Wed, 10 May 2023 00:00:00 +0000

DEP-17 progress, by Helmut and Emilio

We posted a proposal for modifying dpkg to better cope with directory aliasing. After an initial period of silence, the discussion took off, but was mostly diverted to a competing proposal by Luca Boccassi: Do not change dpkg at all, but still move all files affected by aliasing to their canonical location and thus removing the bad effects of aliasing. We facilitated this discussion and performed extensive analysis of this and competing proposals highlighting resulting problems and proposing solutions or workarounds. We performed a detailed analysis of how aliasing affects usage of dpkg-divert, dpkg-statoverride and update-alternatives. Details are available on the debian-dpkg mailinglist thread.

Debian Reimbursements Web App Progress, by Stefano Rivera

In a project funded by Freexian’s Project Funding initiative, Stefano made some more progress on the Debian Reimbursements Web App. The full workflow can now be exercised, completing the first milestone of the project, the Working Prototype.

DebConf Bursary Team, by Utkarsh Gupta

Utkarsh started to prep the bursary team work, gearing up for DebConf, happening in India in September 2023. To learn more about the bursaries team, head to https://wiki.debian.org/Teams/DebConf/Bursaries. For learning how to apply for bursaries, visit https://debconf23.debconf.org/about/bursaries.

Miscellaneous contributions

Stefano attended several DebConf planning meetings, and did some work on the DebConf 23 website.
Stefano updated distro-info-data to include the release date of Debian bullseye, and added the next Ubuntu release, Mantic Minotour. This required a round of updates to all the stable releases, LTS, and ELTS.
Helmut sent patches for 13 cross build failures and filed 104 RC bugs for missing Breaks and Replaces.

Debian Contributions: Debian Developer Survey Results, DebConf updates, and more! (by Utkarsh Gupta)

Utkarsh Gupta — Wed, 12 Apr 2023 00:00:00 +0000

Results of the Debian Developer Survey, by Roberto C. Sánchez

In 2022, Freexian polled Debian Developers about the usage of money in Debian. More than 200 Debian Developers graciously participated, providing useful and constructive answers. Roberto and Utkarsh have worked on reviewing this feedback and summarizing it in a report recently published and announced to the project.

DebConf 23 Website, by Stefano Rivera

In preparation for DebConf 23, Stefano did some work on the DebConf website’s registration system. To support an expected large number of local registration requests, and a limited venue size, Stefano added a review system for registration requests.

There was also some infrastructure work for the website framework. We use the same framework for miniconfs and DebConf, but without the full registration system. Since last DebConf, we have migrated from a pure-JS toolchain for the static assets, to django-compressor, to be friendlier to contributors and have a simpler dependency setup. This required some updates in the full-DebConf registration system that hadn’t been noticed yet in miniDebConfs. Finally, with Utkarsh, we started to wind up the DebConf 22 travel bursary reimbursement process.

Debian Reimbursements Web App Progress, by Stefano Rivera

In a project funded by Freexian’s Project Funding initiative, Stefano made some more progress on the Debian Reimbursements Web App. The first rough implementation core request lifecycle is almost complete. Receipts can be collected and itemized, and the request can be submitted for a reimbursement request.

Debian Printing, by Thorsten Alteholz

Due to the upcoming release, only bug fixing uploads are allowed in this part of the release cycle and Thorsten did uploads of three Debian Printing packages.

The upload of hplip was rather straightforward and five bugs could be closed.

cups-filters suddenly started to FTBFS and thus got an RC bug. It failed due to a compile error in a header file of some dependency. Luckily the maintainer of that dependency knew that his package now needed c++17, so the fix was to just remove an old compile flag that forced the compiler to use c++0x. This flag was once progressive but nowadays it is more of a hindrance than a help.

The third package upload was for cups, which got some translation updates. Unfortunately this was the most tricky one as some translations did not appear in the binary packages. After debugging for some time, it turned out that the handling of links did not work properly. Now the version in Bookworm will be the cups version with the most translated man pages ever.

Miscellaneous contributions

Stefano Rivera updated a few Python modules in the Debian Python Team, to the latest upstream versions.
Stefano Rivera reviewed the current patch series applied to Python 3.12, as an Arch package maintainer had noticed that we dropped a patch by mistake, and reinstated it.
Anton Gladky prepared an upload of newer version (9.2.6) of vtk library and uploaded it into the experimental due to a freeze. VTK is the visualization kit - a library used mostly for scientific and engineering applications to visualize complex objects. Transition of dependent packages is planned on “after-release” phase.
Helmut Grohne, in the continual effort to improve Debian’s cross-build support, provided 22 cross-build patches to packages in the archive.

Monthly report about Debian Long Term Support, March 2023 (by Anton Gladky)

Anton Gladky — Wed, 12 Apr 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In March, 18 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 0h assigned and 14.0h from previous period), thus carrying over 14.0h to the next month.
Adrian Bunk did 5.5h (out of 19.25h assigned and 10.25h from previous period), thus carrying over 24.0h to the next month.
Anton Gladky did 8.5h (out of 8.75h assigned and 5.25h from previous period), thus carrying over 5.5h to the next month.
Bastien Roucariès did 17.0h (out of 20.0h assigned), thus carrying over 3.0h to the next month.
Ben Hutchings did 12.0h (out of 8.0h assigned and 4.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 3.66h (out of 0h assigned and 24.0h from previous period), thus carrying over 20.34h to the next month.
Emilio Pozuelo Monfort did 20.0h (out of 20.75h assigned and 8.75h from previous period), thus carrying over 9.5h to the next month.
Guilhem Moulin did 8.0h (out of 20.0h assigned), thus carrying over 12.0h to the next month.
Helmut Grohne did 2.5h (out of 5.0h assigned and 5.0h from previous period), thus carrying over 7.5h to the next month.
Holger Levsen did 0.0h (out of 9.0h assigned and 1.0h from previous period), thus carrying over 10.0h to the next month.
Lee Garrett did 20.5h (out of 24.0h assigned and 5.5h from previous period), thus carrying over 9.0h to the next month.
Markus Koschany did 29.5h (out of 29.5h assigned).
Ola Lundqvist did 0.0h (out of 11.5h assigned and 12.5h from previous period), thus carrying over 24.0h to the next month.
Roberto C. Sánchez did 2.25h (out of 2.5h assigned and 27.0h from previous period), thus carrying over 27.25h to the next month.
Sylvain Beucler did 29.5h (out of 29.25h assigned and 0.25h from previous period).
Thorsten Alteholz did 14.0h (out of 8.0h assigned and 6.0h from previous period).
Tobias Frost did 15.0h (out of 16.0h assigned), thus carrying over 1.0h to the next month.
Utkarsh Gupta did 11.0h (out of 21.5h assigned and 8.0h from previous period), thus carrying over 18.5h to the next month.

Evolution of the situation

In March, we have released 34 DLAs.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 91 months)
- Civil Infrastructure Platform (CIP) (for 59 months)
Gold sponsors:
- Roche Diagnostics International AG (for 102 months)
- Linode (for 96 months)
- Babiel GmbH (for 85 months)
- Plat’Home (for 85 months)
- University of Oxford (for 41 months)
- Deveryware (for 28 months)
- VyOS Inc (for 23 months)
- EDF SA (for 12 months)
Silver sponsors:
- Domeneshop AS (for 106 months)
- Nantes Métropole (for 100 months)
- Univention GmbH (for 92 months)
- Université Jean Monnet de St Etienne (for 92 months)
- Ribbon Communications, Inc. (for 86 months)
- Exonet B.V. (for 76 months)
- Leibniz Rechenzentrum (for 70 months)
- CINECA (for 59 months)
- Ministère de l’Europe et des Affaires Étrangères (for 53 months)
- Cloudways Ltd (for 42 months)
- Dinahosting SL (for 40 months)
- Bauer Xcel Media Deutschland KG (for 35 months)
- Platform.sh (for 35 months)
- Moxa Inc. (for 29 months)
- sipgate GmbH (for 26 months)
- OVH US LLC (for 24 months)
- Tilburg University (for 24 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 15 months)
- Soliton Systems K.K. (for 13 months)
Bronze sponsors:
- Evolix (for 107 months)
- Seznam.cz, a.s. (for 107 months)
- Linuxhotel GmbH (for 104 months)
- Intevation GmbH (for 103 months)
- Daevel SARL (for 102 months)
- Bitfolk LTD (for 101 months)
- Megaspace Internet Services GmbH (for 101 months)
- Greenbone AG (for 100 months)
- NUMLOG (for 100 months)
- WinGo AG (for 99 months)
- Ecole Centrale de Nantes - LHEEA (for 96 months)
- Entr’ouvert (for 91 months)
- Adfinis AG (for 88 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 83 months)
- Tesorion (for 83 months)
- GNI MEDIA (for 82 months)
- Bearstech (for 74 months)
- LiHAS (for 74 months)
- Catalyst IT Ltd (for 69 months)
- Supagro (for 64 months)
- Demarcq SAS (for 63 months)
- Université Grenoble Alpes (for 49 months)
- TouchWeb SAS (for 41 months)
- SPiN AG (for 37 months)
- CoreFiling (for 33 months)
- Institut des sciences cognitives Marc Jeannerod (for 28 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 25 months)
- Tem Innovations GmbH (for 19 months)
- WordFinder.pro (for 19 months)
- CNRS DT INSU Résif (for 18 months)
- Alter Way (for 10 months)
- Institut Camille Jordan

Monthly report about Debian Long Term Support, February 2023 (by LTS Team)

LTS Team — Mon, 20 Mar 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In February, 15 contributors have been paid to work on Debian LTS, their reports are available:

Adrian Bunk did 22.0h (out of 32.25h assigned), thus carrying over 10.25h to the next month.
Anton Gladky did 9.75h (out of 11.5h assigned and 3.5h from previous period), thus carrying over 5.25h to the next month.
Ben Hutchings did 8.0h (out of 8.0h assigned and 16.0h from previous period), thus carrying over 16.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 26.25h (out of 0h assigned and 35.0h from previous period), thus carrying over 8.75h to the next month.
Guilhem Moulin did 20.0h (out of 20.0h assigned).
Helmut Grohne did 5.0h (out of 5.0h assigned and 5.0h from previous period), thus carrying over 5.0h to the next month.
Lee Garrett did 26.75h (out of 19.75h assigned and 12.5h from previous period), thus carrying over 5.5h to the next month.
Markus Koschany did 32.25h (out of 32.25h assigned).
Ola Lundqvist did 11.5h (out of 12.5h assigned and 11.5h from previous period), thus carrying over 12.5h to the next month.
Roberto C. Sánchez did 5.0h (out of 9.5h assigned and 22.5h from previous period), thus carrying over 27.0h to the next month.
Sylvain Beucler did 32.0h (out of 17.25h assigned and 15.0h from previous period), thus carrying over 0.25h to the next month.
Thorsten Alteholz did 8.0h (out of 14.0h assigned), thus carrying over 6.0h to the next month.
Tobias Frost did 16.0h (out of 16.0h assigned).
Utkarsh Gupta did 24.25h (out of 49.25h assigned), thus carrying over 8.0h to the next month.

Evolution of the situation

In February, we have released 44 DLAs, which resolved 156 CVEs. We are glad to welcome some new contributors who will hopefully help us fix CVEs in the supported release even faster.

However, we also experienced some setbacks as a few sponsors have stopped (or decreased) their support. If your company ever hesitated to sponsor Debian LTS, now might be a good time to join to ensure that we can continue this important work without having to scale down on the number of packages that we are able to support.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 90 months)
- Civil Infrastructure Platform (CIP) (for 58 months)
Gold sponsors:
- Roche Diagnostics International AG (for 101 months)
- Linode (for 95 months)
- Babiel GmbH (for 84 months)
- Plat’Home (for 84 months)
- University of Oxford (for 40 months)
- Deveryware (for 27 months)
- VyOS Inc (for 22 months)
- EDF SA (for 11 months)
Silver sponsors:
- Domeneshop AS (for 105 months)
- Nantes Métropole (for 100 months)
- Univention GmbH (for 91 months)
- Université Jean Monnet de St Etienne (for 91 months)
- Ribbon Communications, Inc. (for 85 months)
- Exonet B.V. (for 75 months)
- Leibniz Rechenzentrum (for 69 months)
- CINECA (for 58 months)
- Ministère de l’Europe et des Affaires Étrangères (for 52 months)
- Cloudways Ltd (for 42 months)
- Dinahosting SL (for 40 months)
- Bauer Xcel Media Deutschland KG (for 34 months)
- Platform.sh (for 34 months)
- Moxa Inc. (for 28 months)
- sipgate GmbH (for 25 months)
- OVH US LLC (for 23 months)
- Tilburg University (for 23 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 15 months)
- Soliton Systems K.K. (for 12 months)
Bronze sponsors:
- Evolix (for 106 months)
- Seznam.cz, a.s. (for 106 months)
- Intevation GmbH (for 103 months)
- Linuxhotel GmbH (for 103 months)
- Daevel SARL (for 101 months)
- Bitfolk LTD (for 100 months)
- Megaspace Internet Services GmbH (for 100 months)
- NUMLOG (for 100 months)
- Greenbone AG (for 99 months)
- WinGo AG (for 99 months)
- Ecole Centrale de Nantes - LHEEA (for 95 months)
- Entr’ouvert (for 90 months)
- Adfinis AG (for 87 months)
- GNI MEDIA (for 82 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 82 months)
- Tesorion (for 82 months)
- Bearstech (for 73 months)
- LiHAS (for 73 months)
- Catalyst IT Ltd (for 68 months)
- Supagro (for 63 months)
- Demarcq SAS (for 62 months)
- Université Grenoble Alpes (for 48 months)
- TouchWeb SAS (for 40 months)
- SPiN AG (for 37 months)
- CoreFiling (for 32 months)
- Institut des sciences cognitives Marc Jeannerod (for 27 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 24 months)
- Tem Innovations GmbH (for 19 months)
- WordFinder.pro (for 18 months)
- CNRS DT INSU Résif (for 17 months)
- Alter Way (for 10 months)

Debian Contributions: Core python package, Redmine backports, and more! (by Utkarsh Gupta, Stefano Rivera)

Utkarsh Gupta, Stefano Rivera — Wed, 15 Mar 2023 00:00:00 +0000

Core Python Packages, by Stefano Rivera

Just before the freeze, pip added support for PEP-668. This is a scheme devised by Debian with other distributions and the Python Packaging Authority, to allow distributors to mark Python installations as being managed by a distribution package manager. When this EXTERNALLY-MANAGED flag is present, installers like pip will refuse to install packages outside a virtual environment. This protects users from breaking unrelated software on their systems, when installing packages with pip or similar tools. Stefano quickly got this version of pip into the archive, marked Debian’s Python interpreters as EXTERNALLY-MANAGED, and worked with the upstream to add a mechanism to allow users to override the restriction. Debian bookworm will likely be the first distro release to implement this change.

The transition from Python 3.10 to 3.11 was one of the last to complete before the bookworm freeze (as 3.11 only released at the end of October 2022). Stefano helped port some Python packages to 3.11, in January, and also kicked off the final transition to remove Python 3.10 support.

Stefano did a big round of bug triage in the cPython interpreter (and related) packages, applying some provided patches, and fixing some long-standing minor bugs in the packaging.

To allow Debian packages to more accurately reflect upstream-specified dependencies that only apply under specific Python interpreter versions, in the future, Stefano added more metadata to the python3 binary package.

Python’s unittest runner would successfully exit with 0 passed tests, if it couldn’t find any tests. This means that configuration / layout changes can cause test failures to go unnoticed, because the tests aren’t being run any more in Debian packages. Stefano proposed a change to Python 3.12 to change this behavior and treat 0 tests as a kind of failure.

debvm, by Helmut Grohne

With support from Johannes Schauer Marin Rodrigues, and Jochen Sprickerhof, Helmut Grohne wrote debvm, a tool for quickly creating and running Debian virtual machine images for various architectures and Debian and Ubuntu releases. This is meant for development and testing purposes and has already identified a number of bugs in e.g. fakechroot (#1029490), Linux (#1029270), and runit (#1028181).

Rails 6 and Redmine 5 available in bullseye-backports, by Utkarsh Gupta

Bullseye users can now upgrade to the latest 6.1 branch of Rails, v6.1.7, and the latest Redmine version, v5.0.4. The Ruby team received numerous requests to backport the latest version of Rails and Redmine, especially since there was no redmine shipped in the bullseye release itself. So this is big news for all users as we’ve not only successfully backported both the packages, but also fixed all the CVEs and RC bugs in the process!

This work was sponsored by Entrouvert.

Patches metadata in the Package Tracker, by Raphaël Hertzog

Building on the great Ultimate Debian Database work of Lucas Nussbaum and on his suggestion, Raphaël enhanced the Debian Package Tracker to display action items when the patches metadata indicate that some patches were not forwarded upstream, or when the metadata were invalid. One can now also browse the patches metadata from the “Links” panel on the right.

Fixed kernel bug that broke debian-installer on computers with Mediatek wifi devices, by Helmut Grohne

As part of our regular work on Kali Linux for OffSec, they funded Helmut’s work to fix the MT7921e driver. When being loaded without firmware available, it would not register itself, but upon module release it would unregister itself causing a kernel oops. This was commonly observed in Kali Linux when reloading the module to add firmware. Helmut Grohne identified the cause and sent a patch, a different variant of which is now heading into Linux and available from Kali Linux.

Printing in Debian, by Thorsten Alteholz

There are about 40 packages in Debian that take care of sending output to printers, scan documents, or even send documents to fax machines. In the light of the upcoming/already ongoing freeze, these packages had to be updated to the latest version and bugs had to be fixed. Basically this applies to large packages like cups, cups-filters, hplip but also the smaller ones that shouldn’t be neglected. All in all Thorsten uploaded 13 packages with new upstream versions or improved packaging and could resolve 14 bugs. Further triaging led to 35 bugs that could be closed, either because they were already fixed and not closed in an earlier upload or they could not be reproduced with current software versions.

There is also work to do to prepare for the future. Historically, printing on Linux required finding a PPD file for your printer and finding some software that is able to render your documents with this PPD. These days, driverless printing is becoming more common and the use of PPD files has decreased.

In the upcoming version 3.0 of cups, PPD files are no longer supported and so called printer applications need to be used. In order not to lose the ability to print documents, this big transition needs to be carefully planned. This started in the beginning of 2023 and will hopefully be finished with the release of Debian Trixie. More information can be found in this Debian Printing Wiki article. In preparation for this transition Thorsten created three new packages.

Yade update, by Anton Gladky

Last month, Anton updated the yade package to the newest 2023.02a version, which includes new features.

Yade is a software package for discrete element method (DEM) simulations, which are widely used in scientific and engineering fields for the simulation of granular systems. Yade is an open-source project that is being used worldwide for different tasks, such as geomechanics, civil engineering, mining, and materials science.

The Yade package in Debian supports different precision levels for its simulations. This means that researchers and engineers can select the needed precision level without recompiling the package, saving time and effort.

Miscellaneous contributions

Helmut Grohne continues to improve cross building (mostly Qt) and architecture bootstrap (mostly loong64 and musl).

Monthly report about Debian Long Term Support, January 2023 (by Anton Gladky)

Anton Gladky — Tue, 21 Feb 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering. This is the first monthly report in 2023.

Debian LTS contributors

In January, 17 contributors have been paid to work on Debian LTS. which is possibly the highest number of active contributors per month! Their reports are available:

Abhijith PA did 0.0h (out of 3.0h assigned and 11.0h from previous period), thus carrying over 14.0h to the next month.
Adrian Bunk did 26.25h (out of 26.25h assigned).
Anton Gladky did 11.5h (out of 8.0h assigned and 7.0h from previous period), thus carrying over 3.5h to the next month.
Ben Hutchings did 8.0h (out of 24.0h assigned), thus carrying over 16.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Emilio Pozuelo Monfort did 8.0h (out of 0h assigned and 43.0h from previous period), thus carrying over 35.0h to the next month.
Guilhem Moulin did 20.0h (out of 17.5h assigned and 2.5h from previous period).
Helmut Grohne did 10.0h (out of 15.0h assigned), thus carrying over 5.0h to the next month.
Lee Garrett did 7.5h (out of 20.0h assigned), thus carrying over 12.5h to the next month.
Markus Koschany did 26.25h (out of 26.25h assigned).
Ola Lundqvist did 4.5h (out of 10.0h assigned and 6.0h from previous period), thus carrying over 11.5h to the next month.
Roberto C. Sánchez did 3.75h (out of 18.75h assigned and 7.5h from previous period), thus carrying over 22.5h to the next month.
Stefano Rivera did 4.5h (out of 0h assigned and 32.5h from previous period), thus carrying over 28.0h to the next month.
Sylvain Beucler did 23.5h (out of 0h assigned and 38.5h from previous period), thus carrying over 15.0h to the next month.
Thorsten Alteholz did 14.0h (out of 10.0h assigned and 4.0h from previous period).
Tobias Frost did 19.0h (out of 19.0h assigned).
Utkarsh Gupta did 43.25h (out of 26.25h assigned and 17.0h from previous period).

Evolution of the situation

Furthermore, we released 46 DLAs in January, which resolved 146 CVEs. We are working diligently to reduce the number of packages listed in dla-needed.txt, and currently, we have 55 packages listed.

We are constantly growing and seeking new contributors. If you are a Debian Developer and want to join the LTS team, please contact us.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 89 months)
- GitHub (for 80 months)
- Civil Infrastructure Platform (CIP) (for 57 months)
Gold sponsors:
- Roche Diagnostics International AG (for 100 months)
- Linode (for 94 months)
- Babiel GmbH (for 83 months)
- Plat’Home (for 83 months)
- University of Oxford (for 39 months)
- Deveryware (for 26 months)
- VyOS Inc (for 21 months)
- EDF SA (for 10 months)
Silver sponsors:
- Domeneshop AS (for 105 months)
- Nantes Métropole (for 99 months)
- Univention GmbH (for 90 months)
- Université Jean Monnet de St Etienne (for 90 months)
- Ribbon Communications, Inc. (for 84 months)
- Exonet B.V. (for 74 months)
- Leibniz Rechenzentrum (for 68 months)
- CINECA (for 57 months)
- Ministère de l’Europe et des Affaires Étrangères (for 52 months)
- Cloudways Ltd (for 41 months)
- Dinahosting SL (for 39 months)
- Bauer Xcel Media Deutschland KG (for 33 months)
- Platform.sh (for 33 months)
- MOXA INC. (for 27 months)
- sipgate GmbH (for 24 months)
- Tilburg University (for 23 months)
- OVH US LLC (for 22 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 14 months)
- Soliton Systems K.K. (for 11 months)
Bronze sponsors:
- Evolix (for 105 months)
- Seznam.cz, a.s. (for 105 months)
- Intevation GmbH (for 102 months)
- Linuxhotel GmbH (for 102 months)
- Daevel SARL (for 101 months)
- Bitfolk LTD (for 99 months)
- Megaspace Internet Services GmbH (for 99 months)
- NUMLOG (for 99 months)
- Greenbone Networks GmbH (for 98 months)
- WinGo AG (for 98 months)
- Ecole Centrale de Nantes - LHEEA (for 94 months)
- Entr’ouvert (for 89 months)
- Adfinis AG (for 87 months)
- GNI MEDIA (for 81 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 81 months)
- Tesorion (for 81 months)
- Bearstech (for 73 months)
- LiHAS (for 72 months)
- Catalyst IT Ltd (for 67 months)
- Supagro (for 62 months)
- Demarcq SAS (for 61 months)
- Université Grenoble Alpes (for 47 months)
- TouchWeb SAS (for 39 months)
- SPiN AG (for 36 months)
- CoreFiling (for 31 months)
- Institut des sciences cognitives Marc Jeannerod (for 26 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 23 months)
- Tem Innovations GmbH (for 18 months)
- WordFinder.pro (for 17 months)
- CNRS DT INSU Résif (for 16 months)
- Alter Way (for 9 months)

Monthly report about Debian Long Term Support, December 2022 (by Anton Gladky)

Anton Gladky — Mon, 16 Jan 2023 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In December, 17 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 3.0h (out of 0h assigned and 14.0h from previous period), thus carrying over 11.0h to the next month.
Anton Gladky did 8.0h (out of 6.0h assigned and 9.0h from previous period), thus carrying over 7.0h to the next month.
Ben Hutchings did 24.0h (out of 9.0h assigned and 15.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 0.0h (out of 10.0h assigned and 14.0h from previous period), thus carrying over 24.0h to the next month.
Emilio Pozuelo Monfort did 8.0h in December, 8.0h in November (out of 1.5h assigned and 49.5h from previous period), thus carrying over 43.0h to the next month.
Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
Guilhem Moulin did 17.5h (out of 20.0h assigned), thus carrying over 2.5h to the next month.
Helmut Grohne did 15.0h (out of 15.0h assigned, 2.5h were taken from the extra-budget and worked on).
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 10.0h (out of 7.5h assigned and 8.5h from previous period), thus carrying over 6.0h to the next month.
Roberto C. Sánchez did 24.5h (out of 20.25h assigned and 11.75h from previous period), thus carrying over 7.5h to the next month.
Stefano Rivera did 2.5h (out of 20.5h assigned and 14.5h from previous period), thus carrying over 32.5h to the next month.
Sylvain Beucler did 20.5h (out of 37.0h assigned and 22.0h from previous period), thus carrying over 38.5h to the next month.
Thorsten Alteholz did 10.0h (out of 14.0h assigned), thus carrying over 4.0h to the next month.
Tobias Frost did 16.0h (out of 16.0h assigned).
Utkarsh Gupta did 51.5h (out of 42.5h assigned and 9.0h from previous period).

Evolution of the situation

In December, we have released 47 DLAs, closing 232 CVEs. In the same year, in total we released 394 DLAs, closing 1450 CVEs.

We are constantly growing and seeking new contributors. If you are a Debian Developer and want to join the LTS team, please contact us.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 88 months)
- GitHub (for 79 months)
- Civil Infrastructure Platform (CIP) (for 56 months)
Gold sponsors:
- Roche Diagnostics International AG (for 99 months)
- Linode (for 93 months)
- Babiel GmbH (for 82 months)
- Plat’Home (for 82 months)
- University of Oxford (for 38 months)
- Deveryware (for 25 months)
- VyOS Inc (for 20 months)
- EDF SA (for 9 months)
Silver sponsors:
- Domeneshop AS (for 103 months)
- Nantes Métropole (for 97 months)
- Univention GmbH (for 89 months)
- Université Jean Monnet de St Etienne (for 89 months)
- Ribbon Communications, Inc. (for 83 months)
- Exonet B.V. (for 73 months)
- Leibniz Rechenzentrum (for 67 months)
- CINECA (for 56 months)
- Ministère de l’Europe et des Affaires Étrangères (for 50 months)
- Cloudways Ltd (for 40 months)
- Dinahosting SL (for 38 months)
- Bauer Xcel Media Deutschland KG (for 32 months)
- Platform.sh (for 32 months)
- MOXA INC. (for 26 months)
- sipgate GmbH (for 23 months)
- OVH US LLC (for 21 months)
- Tilburg University (for 21 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 12 months)
- Soliton Systems K.K. (for 10 months)
Bronze sponsors:
- Evolix (for 104 months)
- Seznam.cz, a.s. (for 104 months)
- Intevation GmbH (for 101 months)
- Linuxhotel GmbH (for 101 months)
- Daevel SARL (for 99 months)
- Bitfolk LTD (for 98 months)
- Megaspace Internet Services GmbH (for 98 months)
- Greenbone Networks GmbH (for 97 months)
- NUMLOG (for 97 months)
- WinGo AG (for 97 months)
- Ecole Centrale de Nantes - LHEEA (for 93 months)
- Entr’ouvert (for 88 months)
- Adfinis AG (for 85 months)
- GNI MEDIA (for 80 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 80 months)
- Tesorion (for 80 months)
- Bearstech (for 71 months)
- LiHAS (for 71 months)
- Catalyst IT Ltd (for 66 months)
- Supagro (for 61 months)
- Demarcq SAS (for 60 months)
- Université Grenoble Alpes (for 46 months)
- TouchWeb SAS (for 38 months)
- SPiN AG (for 35 months)
- CoreFiling (for 30 months)
- Institut des sciences cognitives Marc Jeannerod (for 25 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 22 months)
- Tem Innovations GmbH (for 16 months)
- WordFinder.pro (for 16 months)
- CNRS DT INSU Résif (for 15 months)
- Alter Way (for 8 months)

Recent improvements to Tryton's Debian Packaging (by Mathias Behrle and Raphaël Hertzog)

Mathias Behrle and Raphaël Hertzog — Tue, 20 Dec 2022 00:00:00 +0000

Foreword

Freexian has been using Tryton for a few years to handle its invoicing and accounting. We have thus also been using the Debian packages maintained by Mathias Behrle and we have been funding some of his work because maintaining an ERP with more than 50 source packages was too much for him to handle alone on his free time.

When Mathias discovered our Project Funding initiative, it was quite natural for him to consider applying to be able to bring some much needed improvements to Tryton’s Debian packaging. He’s running his own consulting company (MBSolutions) so it’s easy for him to invoice Freexian to get the money for the funded projects.

What follows is Mathias Behrle’s description of the projects that he submitted and of the work that he achieved.

If you want to contact him, you can reach out to mathiasb@m9s.biz or mbehrle@debian.org. You can also follow him on Mastodon.

Report

In January 2022 I applied for two projects in the Freexian Project Funding Initiative.

Tryton Project 1
- The starting point of this project was Debian Bug #998319: tryton-server should provide a ready-to-use production-grade server config.
  
  To address this problem instead of only providing configuration snippets the idea was to provide a full featured guided setup of a Tryton production environment, thus eliminating the risks of trial and error for the system administrator.
Tryton Project 2
- The goal of this project was to complete the available Tryton modules in Debian main with the latest set available from tryton.org and to automate the task of creating new Debian packages from Tryton modules as much as possible.

Accomplishments

As the result of Task 1, several new packages emerged:

tryton-server-postgresql provides the guided setup of a PostgreSQL database backend.
tryton-server-uwsgi provides the installation and configuration of a robust WSGI server on top of tryton-server.
tryton-server-nginx provides the configuration of a scalable web frontend to the uwsgi server, including the optional setup of secure access by Letsencrypt certificates.
tryton-server-all-in-one puts it all together to provide a fully functional Tryton production environment, including a database filled with basic static data. With the installation of this package a robust and secure production grade setup is possible from scratch, all configuration leg work is done in the background.

The work was thoroughly reviewed by Neil Williams. Thanks go to him for his detailed feedback providing very valuable information from the view of a fresh Tryton user getting in first contact with the software. A cordial thank you as well goes to the translation teams providing initial reviews and translations for the configuration questions.

The efforts of Task 1 were completed with Task 2:

A Tryton specific version of PyPi2deb was created to help in the preparation of new Debian packages for new Tryton modules.
All missing Tryton modules for the current series were packaged for Debian.

On top of those two planned projects, I completed an additional task: the packaging of the Tryton Web Client.

The Web Client is a quite important feature to access a Tryton server with the browser and even a crucial requirement for some companies. Unfortunately the packaging of the Web Client for Debian was problematic from the beginning. tryton-sao requires exact versions of JavaScript libraries that are almost never guaranteed to be available in the different targeted Debian releases. Therefore a package with vendored libraries has been created and will hopefully soon hit the Debian main archive. The package is already available from the Tryton Backport Mirror for the usually supported Debian releases.

Summary

I am very pleased that the Tryton suite in Debian has gained full coverage of Tryton modules and a user-friendly installation. The completion of the project represents a huge step forward in the state-of-the-art deployment of a production grade Tryton environment. Without the monetary support of Freexian’s project funding the realization of this project wouldn’t have been possible in this way and to this extent.

Monthly report about Debian Long Term Support, November 2022 (by Anton Gladky)

Anton Gladky — Sun, 18 Dec 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In November, 15 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.0h (out of 14.0h assigned), thus carrying over 14.0h to the next month.
Anton Gladky did 6.0h (out of 15.0h assigned), thus carrying over 9.0h to the next month.
Ben Hutchings did 9.0h (out of 24.0h assigned), thus carrying over 15.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 10.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 14.0h to the next month.
Emilio Pozuelo Monfort did 0.0h (out of 38.0h assigned and 19.5h from previous period), thus carrying over 57.5h to the next month.
Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
Helmut Grohne did 17.5h (out of 20.0h assigned).
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 7.5h (out of 11.0h assigned and 5.0h from previous period), thus carrying over 8.5h to the next month.
Roberto C. Sánchez did 20.25h (out of 0.75h assigned and 31.25h from previous period), thus carrying over 11.75h to the next month.
Stefano Rivera did 2.5h (out of 0h assigned and 17.0h from previous period), thus carrying over 14.5h to the next month.
Sylvain Beucler did 35.5h (out of 23.0h assigned and 34.5h from previous period), thus carrying over 22.0h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Utkarsh Gupta did 41.0h (out of 32.5h assigned and 25.0h from previous period), thus carrying over 16.5h to the next month.

Evolution of the situation

In November, we released 43 DLAs, fixing 183 CVEs. We currently have 63 packages in dla-needed.txt that are waiting for updates, which is 19 fewer than the previous month.

We’re excited to announce that two Debian Developers Tobias Frost and Guilhem Moulin, have completed the on-boarding process and will begin contributing to LTS as of December 2022. Welcome aboard!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 87 months)
- GitHub (for 78 months)
- Civil Infrastructure Platform (CIP) (for 55 months)
Gold sponsors:
- Roche Diagnostics International AG (for 98 months)
- Linode (for 92 months)
- Babiel GmbH (for 81 months)
- Plat’Home (for 81 months)
- University of Oxford (for 37 months)
- Deveryware (for 24 months)
- VyOS Inc (for 19 months)
- EDF SA (for 8 months)
Silver sponsors:
- Domeneshop AS (for 102 months)
- Nantes Métropole (for 96 months)
- Univention GmbH (for 88 months)
- Université Jean Monnet de St Etienne (for 88 months)
- Ribbon Communications, Inc. (for 82 months)
- Exonet B.V. (for 72 months)
- Leibniz Rechenzentrum (for 66 months)
- CINECA (for 55 months)
- Ministère de l’Europe et des Affaires Étrangères (for 49 months)
- Cloudways Ltd (for 39 months)
- Dinahosting SL (for 37 months)
- Bauer Xcel Media Deutschland KG (for 31 months)
- Platform.sh (for 31 months)
- MOXA INC. (for 25 months)
- sipgate GmbH (for 22 months)
- OVH US LLC (for 20 months)
- Tilburg University (for 20 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 12 months)
- Soliton Systems K.K. (for 9 months)
Bronze sponsors:
- Evolix (for 103 months)
- Seznam.cz, a.s. (for 103 months)
- Intevation GmbH (for 100 months)
- Linuxhotel GmbH (for 100 months)
- Daevel SARL (for 98 months)
- Bitfolk LTD (for 97 months)
- Megaspace Internet Services GmbH (for 97 months)
- Greenbone Networks GmbH (for 96 months)
- NUMLOG (for 96 months)
- WinGo AG (for 96 months)
- Ecole Centrale de Nantes - LHEEA (for 92 months)
- Entr’ouvert (for 87 months)
- Adfinis AG (for 84 months)
- GNI MEDIA (for 79 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 79 months)
- Tesorion (for 79 months)
- Bearstech (for 70 months)
- LiHAS (for 70 months)
- Catalyst IT Ltd (for 65 months)
- Supagro (for 60 months)
- Demarcq SAS (for 59 months)
- Université Grenoble Alpes (for 45 months)
- TouchWeb SAS (for 37 months)
- SPiN AG (for 34 months)
- CoreFiling (for 29 months)
- Institut des sciences cognitives Marc Jeannerod (for 24 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 21 months)
- Tem Innovations GmbH (for 16 months)
- WordFinder.pro (for 15 months)
- CNRS DT INSU Résif (for 14 months)
- Alter Way (for 7 months)

Monthly report about Debian Long Term Support, October 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Sat, 19 Nov 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian LTS contributors

In October, 15 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 2.0h assigned and 12.0h from previous period).
Anton Gladky did 20.0h (out of 19.0h assigned and 1.0h from previous period).
Ben Hutchings did 9.0h (out of 0h assigned and 9.0h from previous period).
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 0.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 24.0h to the next month.
Emilio Pozuelo Monfort did 40.5h (out of 58.0h assigned and 2.0h from previous period), thus carrying over 19.5h to the next month.
Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
Helmut Grohne did 15.0h (out of 15.0h assigned).
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 7.0h (out of 12.0h assigned), thus carrying over 5.0h to the next month.
Roberto C. Sánchez did 0.75h (out of 1.0h assigned and 31.0h from previous period), thus carrying over 31.25h to the next month.
Stefano Rivera did 12.5h (out of 9.0h assigned and 26.0h from previous period), thus carrying over 22.5h to the next month.
Sylvain Beucler did 25.5h (out of 31.5h assigned and 28.5h from previous period), thus carrying over 34.5h to the next month.
Thorsten Alteholz did 14.0h (out of 14.0h assigned).
Utkarsh Gupta did 35.0h (out of 38.0h assigned and 22.0h from previous period), thus carrying over 25.0h to the next month.

Evolution of the situation

In October, we have released 42 DLAs, closing 106 CVEs. At the moment we have 82 packages in dla-needed.txt, waiting for update.

We are continuously working on updating our infrastructure, trying to document all of our changes in the git-repo. Most of packages there are having continuous integration (CI) pipelines.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 86 months)
- GitHub (for 77 months)
- Civil Infrastructure Platform (CIP) (for 54 months)
Gold sponsors:
- Roche Diagnostics International AG (for 97 months)
- Linode (for 91 months)
- Babiel GmbH (for 80 months)
- Plat’Home (for 80 months)
- University of Oxford (for 36 months)
- Deveryware (for 23 months)
- VyOS Inc (for 18 months)
- EDF SA (for 7 months)
Silver sponsors:
- Domeneshop AS (for 101 months)
- Nantes Métropole (for 95 months)
- Univention GmbH (for 87 months)
- Université Jean Monnet de St Etienne (for 87 months)
- Ribbon Communications, Inc. (for 81 months)
- Exonet B.V. (for 71 months)
- Leibniz Rechenzentrum (for 65 months)
- CINECA (for 54 months)
- Ministère de l’Europe et des Affaires Étrangères (for 48 months)
- Cloudways Ltd (for 38 months)
- Dinahosting SL (for 36 months)
- Bauer Xcel Media Deutschland KG (for 30 months)
- Platform.sh (for 30 months)
- Moxa Intelligence Co., Ltd. (for 24 months)
- sipgate GmbH (for 21 months)
- OVH US LLC (for 19 months)
- Tilburg University (for 19 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 11 months)
- Soliton Systems K.K. (for 8 months)
Bronze sponsors:
- Evolix (for 102 months)
- Seznam.cz, a.s. (for 102 months)
- Intevation GmbH (for 99 months)
- Linuxhotel GmbH (for 99 months)
- Daevel SARL (for 97 months)
- Bitfolk LTD (for 96 months)
- Megaspace Internet Services GmbH (for 96 months)
- Greenbone Networks GmbH (for 95 months)
- NUMLOG (for 95 months)
- WinGo AG (for 95 months)
- Ecole Centrale de Nantes - LHEEA (for 91 months)
- Entr’ouvert (for 86 months)
- Adfinis AG (for 83 months)
- GNI MEDIA (for 78 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 78 months)
- Tesorion (for 78 months)
- Bearstech (for 69 months)
- LiHAS (for 69 months)
- Catalyst IT Ltd (for 64 months)
- Supagro (for 59 months)
- Demarcq SAS (for 58 months)
- Université Grenoble Alpes (for 44 months)
- TouchWeb SAS (for 36 months)
- SPiN AG (for 33 months)
- CoreFiling (for 28 months)
- Institut des sciences cognitives Marc Jeannerod (for 23 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 20 months)
- Tem Innovations GmbH (for 15 months)
- WordFinder.pro (for 14 months)
- CNRS DT INSU Résif (for 13 months)
- Alter Way (for 6 months)

Monthly report about Debian Long Term Support, September 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Thu, 20 Oct 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

We still have two projects (1, 2) in the pipeline currently. The Tryton project moved to the second part. The Gradle project is also in work, in discussion with corresponding Debian team.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article".

Debian LTS contributors

In September, 14 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 2.0h (out of 14.0h assigned), thus carrying over 12.0h to the next month.
Anton Gladky did 19.0h (out of 20.0h assigned), thus carrying over 1.0h to the next month.
Ben Hutchings did 16.0h (out of 17.0h assigned and 8.0h from previous period), thus carrying over 9.0h to the next month.
Chris Lamb did 18.0h (out of 18.0h assigned).
Dominik George did 0.0h (out of 0h assigned and 24.0h from previous period), thus carrying over 24.0h to the next month.
Emilio Pozuelo Monfort did 58.0h (out of 49.25h assigned and 10.75h from previous period), thus carrying over 2.0h to the next month.
Enrico Zini did 0.0h (out of 0h assigned and 8.0h from previous period), thus carrying over 8.0h to the next month.
Markus Koschany did 40.0h (out of 40.0h assigned).
Ola Lundqvist did 16.0h (out of 4.0h assigned and 12.0h from previous period).
Roberto C. Sánchez did 1.0h (out of 2.75h assigned and 29.25h from previous period), thus carrying over 31.0h to the next month.
Stefano Rivera did 12.5h (out of 0h assigned and 26.0h from previous period), thus carrying over 13.5h to the next month.
Sylvain Beucler did 31.5h (out of 18.75h assigned and 41.25h from previous period), thus carrying over 28.5h to the next month.
Thorsten Alteholz did 14.0h (out of 1.0h assigned and 13.0h from previous period).
Utkarsh Gupta did 38.0h (out of 14.25h assigned and 45.75h from previous period), thus carrying over 22.0h to the next month.

Evolution of the situation

In September, we have released 42 DLAs.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 85 months)
- GitHub (for 76 months)
- Civil Infrastructure Platform (CIP) (for 53 months)
Gold sponsors:
- Roche Diagnostics International AG (for 96 months)
- Linode (for 90 months)
- Babiel GmbH (for 79 months)
- Plat’Home (for 79 months)
- University of Oxford (for 35 months)
- Deveryware (for 22 months)
- VyOS Inc (for 17 months)
- EDF SA (for 6 months)
Silver sponsors:
- The Positive Internet Company (for 101 months)
- Domeneshop AS (for 100 months)
- Nantes Métropole (for 94 months)
- Univention GmbH (for 86 months)
- Université Jean Monnet de St Etienne (for 86 months)
- Ribbon Communications, Inc. (for 80 months)
- Exonet B.V. (for 70 months)
- Leibniz Rechenzentrum (for 64 months)
- CINECA (for 53 months)
- Ministère de l’Europe et des Affaires Étrangères (for 47 months)
- Cloudways Ltd (for 37 months)
- Dinahosting SL (for 35 months)
- Bauer Xcel Media Deutschland KG (for 29 months)
- Platform.sh (for 29 months)
- Moxa Intelligence Co., Ltd. (for 23 months)
- sipgate GmbH (for 20 months)
- OVH US LLC (for 18 months)
- Tilburg University (for 18 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 10 months)
- Soliton Systems K.K. (for 7 months)
Bronze sponsors:
- Evolix (for 101 months)
- Seznam.cz, a.s. (for 101 months)
- Intevation GmbH (for 98 months)
- Linuxhotel GmbH (for 98 months)
- Daevel SARL (for 96 months)
- Bitfolk LTD (for 95 months)
- Megaspace Internet Services GmbH (for 95 months)
- Greenbone Networks GmbH (for 94 months)
- NUMLOG (for 94 months)
- WinGo AG (for 94 months)
- Ecole Centrale de Nantes - LHEEA (for 90 months)
- Entr’ouvert (for 85 months)
- Adfinis AG (for 82 months)
- GNI MEDIA (for 77 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 77 months)
- Tesorion (for 77 months)
- Bearstech (for 68 months)
- LiHAS (for 68 months)
- Catalyst IT Ltd (for 63 months)
- Supagro (for 58 months)
- Demarcq SAS (for 57 months)
- Université Grenoble Alpes (for 43 months)
- TouchWeb SAS (for 35 months)
- SPiN AG (for 32 months)
- CoreFiling (for 27 months)
- Institut des sciences cognitives Marc Jeannerod (for 22 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 19 months)
- Tem Innovations GmbH (for 14 months)
- WordFinder.pro (for 13 months)
- CNRS DT INSU Résif (for 12 months)
- Alter Way (for 5 months)

Monthly report about Debian Long Term Support, August 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 19 Sep 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

We still have two projects (1, 2) in the pipeline currently.

The tryton project completed a first important milestone and moved onto a second one. The gradle one is still in work.

We are also using this money to complete the analysis of the Debian developer survey that we ran earlier this year. We’re making good progress on this and it will hopefully be published in the next one or two months.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In August, 16 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.00h (out of 0.00h assigned and 14.00h from previous period).
Andreas Rönnquist did 0.00h (out of 14.50h assigned and 10.50h from previous period, thus carrying over 25.00h to the next month).
Anton Gladky did 20.00h (out of 18.00h assigned and 2.00h from previous period).
Ben Hutchings did 14.00h (out of 0.00h assigned and 21.00h from previous period, thus carrying over 7.00h to the next month).
Chris Lamb did 18.00h (out of 18.00h assigned).
Dominik George did 0.00h (out of 1.83h assigned and 22.17h from previous period, thus carrying over 24.00h to the next month).
Emilio Pozuelo Monfort did 49.00h (out of 96.00h assigned).
Enrico Zini did 0.00h (out of 0.00h assigned and 8.00h from previous period, thus carrying over 8.00h to the next month).
Holger Levsen did 3.00h (out of 3.00h assigned).
Markus Koschany did 40.00h (out of 40.00h assigned).
Ola Lundqvist did 0.00h (out of 8.00h assigned and 4.00h from previous period, thus carrying over 12.00h to the next month).
Roberto C. Sánchez did 2.75h (out of 14.25h assigned and 17.75h from previous period, thus carrying over 29.25h to the next month).
Stefano Rivera did 0.00h (out of 8.00h assigned and 27.00h from previous period, thus carrying over 35.00h to the next month).
Sylvain Beucler did 18.50h (out of 27.50h assigned and 32.25h from previous period, thus carrying over 41.25h to the next month).
Thorsten Alteholz did 17.00h (out of 14.25h assigned and 15.75h from previous period, thus carrying over 13.00h to the next month).
Utkarsh Gupta did 14.00h (out of 24.00h assigned and 35.75h from previous period, thus carrying over 45.75h to the next month).

Evolution of the situation

In August, we have released 23 DLAs. August was the first month, were we fully started to work on Debian Buster as LTS release!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 84 months)
- GitHub (for 75 months)
- Civil Infrastructure Platform (CIP) (for 52 months)
Gold sponsors:
- Roche Diagnostics International AG (for 95 months)
- Linode (for 89 months)
- Babiel GmbH (for 78 months)
- Plat’Home (for 78 months)
- University of Oxford (for 34 months)
- Deveryware (for 21 months)
- VyOS Inc (for 16 months)
- EDF SA (for 5 months)
Silver sponsors:
- The Positive Internet Company (for 100 months)
- Domeneshop AS (for 99 months)
- Nantes Métropole (for 93 months)
- Univention GmbH (for 85 months)
- Université Jean Monnet de St Etienne (for 85 months)
- Ribbon Communications, Inc. (for 79 months)
- Exonet B.V. (for 69 months)
- Leibniz Rechenzentrum (for 63 months)
- CINECA (for 52 months)
- Ministère de l’Europe et des Affaires Étrangères (for 46 months)
- Cloudways Ltd (for 36 months)
- Dinahosting SL (for 34 months)
- Bauer Xcel Media Deutschland KG (for 28 months)
- Platform.sh (for 28 months)
- Moxa Intelligence Co., Ltd. (for 22 months)
- sipgate GmbH (for 19 months)
- OVH US LLC (for 17 months)
- Tilburg University (for 17 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 8 months)
- Soliton Systems K.K. (for 6 months)
Bronze sponsors:
- Evolix (for 100 months)
- Seznam.cz, a.s. (for 100 months)
- Intevation GmbH (for 97 months)
- Linuxhotel GmbH (for 97 months)
- Daevel SARL (for 95 months)
- Bitfolk LTD (for 94 months)
- Megaspace Internet Services GmbH (for 94 months)
- Greenbone Networks GmbH (for 93 months)
- NUMLOG (for 93 months)
- WinGo AG (for 93 months)
- Ecole Centrale de Nantes - LHEEA (for 89 months)
- Entr’ouvert (for 84 months)
- Adfinis AG (for 81 months)
- GNI MEDIA (for 76 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 76 months)
- Tesorion (for 76 months)
- Bearstech (for 67 months)
- LiHAS (for 67 months)
- Catalyst IT Ltd (for 62 months)
- Supagro (for 57 months)
- Demarcq SAS (for 56 months)
- Université Grenoble Alpes (for 42 months)
- TouchWeb SAS (for 34 months)
- SPiN AG (for 31 months)
- CoreFiling (for 26 months)
- Institut des sciences cognitives Marc Jeannerod (for 21 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 18 months)
- Tem Innovations GmbH (for 12 months)
- WordFinder.pro (for 12 months)
- CNRS DT INSU Résif (for 11 months)
- Alter Way (for 4 months)

Monthly report about Debian Long Term Support, July 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Wed, 31 Aug 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

No any major updates on running projects. Two 1, 2 projects are in the pipeline now.

Tryton project is in a review phase. Gradle projects is still fighting in work.

In July, we put aside 2389 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In July, 14 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 0.00h (out of 14.00h assigned, thus carrying over 14.00h to the next month).
Andreas Rönnquist did 0.00h (out of 0.00h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
Anton Gladky did 23.00h (out of 25.00h assigned, thus carrying over 2.00h to the next month).
Ben Hutchings did 3.00h (out of 24.00h assigned, thus carrying over 21.00h to the next month).
Dominik George did 0.00h (out of 0.00h assigned and 22.17h from previous period, thus carrying over 22.17h to the next month).
Emilio Pozuelo Monfort did 72.00h (out of 35.75h assigned).
Enrico Zini did 0.00h (out of 0.00h assigned and 8.00h from previous period, thus carrying over 8.00h to the next month).
Markus Koschany did 35.75h (out of 35.75h assigned).
Ola Lundqvist did 8.00h (out of 0.00h assigned and 12.00h from previous period, thus carrying over 4.00h to the next month).
Roberto C. Sánchez did 14.25h (out of 29.25h assigned and 2.75h from previous period, thus carrying over 17.75h to the next month).
Stefano Rivera did 8.00h (out of 6.25h assigned and 20.75h from previous period, thus carrying over 19.00h to the next month).
Sylvain Beucler did 3.50h (out of 35.75h assigned, thus carrying over 32.25h to the next month).
Thorsten Alteholz did 20.00h (out of 35.75h assigned).
Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 35.75 available hours, thus carrying them over to the next month).

Evolution of the situation

In July, we have released 3 DLAs. July was the period, when the Debian Stretch had already ELTS status, but Debian Buster was still in the hands of security team. Many member of LTS used this time to update internal infrastructure, documentation and some internal tickets. Now we are ready to take the next release in our hands: Buster!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 83 months)
- GitHub (for 74 months)
- Civil Infrastructure Platform (CIP) (for 51 months)
Gold sponsors:
- Roche Diagnostics International AG (for 94 months)
- Linode (for 88 months)
- Babiel GmbH (for 78 months)
- Plat’Home (for 77 months)
- University of Oxford (for 33 months)
- Deveryware (for 20 months)
- VyOS Inc (for 15 months)
- EDF SA (for 4 months)
Silver sponsors:
- Domeneshop AS (for 99 months)
- The Positive Internet Company (for 99 months)
- Nantes Métropole (for 93 months)
- Université Jean Monnet de St Etienne (for 85 months)
- Univention GmbH (for 84 months)
- Ribbon Communications, Inc. (for 78 months)
- Exonet B.V. (for 68 months)
- Leibniz Rechenzentrum (for 62 months)
- CINECA (for 52 months)
- Ministère de l’Europe et des Affaires Étrangères (for 46 months)
- Cloudways Ltd (for 35 months)
- Dinahosting SL (for 33 months)
- Bauer Xcel Media Deutschland KG (for 27 months)
- Platform.sh (for 27 months)
- Moxa Intelligence Co., Ltd. (for 21 months)
- sipgate GmbH (for 18 months)
- Tilburg University (for 17 months)
- OVH US LLC (for 16 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 8 months)
- Soliton Systems K.K. (for 5 months)
Bronze sponsors:
- Evolix (for 99 months)
- Seznam.cz, a.s. (for 99 months)
- Intevation GmbH (for 96 months)
- Linuxhotel GmbH (for 96 months)
- Daevel SARL (for 95 months)
- Bitfolk LTD (for 93 months)
- Greenbone Networks GmbH (for 93 months)
- Megaspace Internet Services GmbH (for 93 months)
- NUMLOG (for 93 months)
- WinGo AG (for 92 months)
- Ecole Centrale de Nantes - LHEEA (for 88 months)
- Entr’ouvert (for 83 months)
- Adfinis AG (for 81 months)
- GNI MEDIA (for 75 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 75 months)
- Tesorion (for 75 months)
- Bearstech (for 67 months)
- LiHAS (for 67 months)
- Catalyst IT Ltd (for 61 months)
- Supagro (for 57 months)
- Demarcq SAS (for 55 months)
- Université Grenoble Alpes (for 41 months)
- TouchWeb SAS (for 33 months)
- SPiN AG (for 30 months)
- CoreFiling (for 26 months)
- Institut des sciences cognitives Marc Jeannerod (for 20 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 17 months)
- Tem Innovations GmbH (for 12 months)
- WordFinder.pro (for 11 months)
- CNRS DT INSU Résif (for 10 months)
- Alter Way (for 3 months)

Monthly report about Debian Long Term Support, June 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Tue, 26 Jul 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

No any major updates on running projects. Two 1, 2 projects are in the pipeline now. Tryton project is in a review phase. Gradle projects is still fighting in work.

In June, we put aside 2254 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In June, 15 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.00h (out of 14.00h assigned).
Andreas Rönnquist did 14.50h (out of 14.50h assigned and 10.50h from previous period, thus carrying over 10.50h to the next month).
Anton Gladky did 16.00h (out of 16.00h assigned).
Ben Hutchings did 16.00h (out of 0.00h assigned and 16.00h from previous period).
Chris Lamb did 18.00h (out of 18.00h assigned).
Dominik George did 1.83h (out of 6.00h assigned and 18.00h from previous period, thus carrying over 22.17h to the next month).
Emilio Pozuelo Monfort did 30.25h (out of 9.25h assigned and 21.00h from previous period).
Enrico Zini did 8.00h (out of 9.50h assigned and 6.50h from previous period, thus carrying over 8.00h to the next month).
Markus Koschany did 30.25h (out of 30.25h assigned).
Ola Lundqvist did nothing (out of 12.00 available hours, thus carrying them over to the next month).
Roberto C. Sánchez did 27.50h (out of 11.75h assigned and 18.50h from previous period, thus carrying over 2.75h to the next month).
Stefano Rivera did 8.00h (out of 30.25h assigned, thus carrying over 20.75h to the next month).
Sylvain Beucler did 30.25h (out of 13.75h assigned and 16.50h from previous period).
Thorsten Alteholz did 30.25h (out of 30.25h assigned).
Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 30.25 available hours, thus carrying them over to the next month).

Evolution of the situation

In June we released 27 DLAs.

This is a special month, where we have two releases (stretch and jessie) as ELTS and NO release as LTS. Buster is still handled by the security team and will probably be given in LTS hands at the beginning of the August. During this month we are updating the infrastructure, documentation and improve our internal processes to switch to a new release.

Many developers have just returned back from Debconf22, hold in Prizren, Kosovo! Many (E)LTS members could meet face-to-face and discuss some technical and social topics! Also LTS-BoF took place, where the project was introduced (link to video).

Thanks to our sponsors

Sponsors that joined recently are in bold. We are pleased to welcome AlterWay where their support of Debian is publicly acknowledged at the higher level, see this French quote of Alterway’s CEO.

Platinum sponsors:
- TOSHIBA (for 82 months)
- GitHub (for 73 months)
- Civil Infrastructure Platform (CIP) (for 50 months)
Gold sponsors:
- Roche Diagnostics International AG (for 93 months)
- Linode (for 87 months)
- Babiel GmbH (for 76 months)
- Plat’Home (for 76 months)
- University of Oxford (for 32 months)
- Deveryware (for 19 months)
- VyOS Inc (for 14 months)
- EDF SA (for 3 months)
Silver sponsors:
- Domeneshop AS (for 98 months)
- The Positive Internet Company (for 98 months)
- Nantes Métropole (for 92 months)
- Univention GmbH (for 83 months)
- Université Jean Monnet de St Etienne (for 83 months)
- Ribbon Communications, Inc. (for 77 months)
- Exonet B.V. (for 67 months)
- Leibniz Rechenzentrum (for 61 months)
- CINECA (for 50 months)
- Ministère de l’Europe et des Affaires Étrangères (for 45 months)
- Cloudways Ltd (for 34 months)
- Dinahosting SL (for 32 months)
- Bauer Xcel Media Deutschland KG (for 26 months)
- Platform.sh (for 26 months)
- Moxa Intelligence Co., Ltd. (for 20 months)
- sipgate GmbH (for 17 months)
- Tilburg University (for 16 months)
- OVH US LLC (for 15 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 7 months)
- Soliton Systems K.K. (for 4 months)
Bronze sponsors:
- Evolix (for 98 months)
- Seznam.cz, a.s. (for 98 months)
- Intevation GmbH (for 95 months)
- Linuxhotel GmbH (for 95 months)
- Daevel SARL (for 94 months)
- Bitfolk LTD (for 92 months)
- Megaspace Internet Services GmbH (for 92 months)
- NUMLOG (for 92 months)
- Greenbone Networks GmbH (for 91 months)
- WinGo AG (for 91 months)
- Ecole Centrale de Nantes - LHEEA (for 87 months)
- Entr’ouvert (for 82 months)
- Adfinis AG (for 80 months)
- GNI MEDIA (for 74 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 74 months)
- Tesorion (for 74 months)
- Bearstech (for 66 months)
- LiHAS (for 65 months)
- Catalyst IT Ltd (for 60 months)
- Supagro (for 55 months)
- Demarcq SAS (for 54 months)
- Université Grenoble Alpes (for 40 months)
- TouchWeb SAS (for 32 months)
- SPiN AG (for 29 months)
- CoreFiling (for 24 months)
- Institut des sciences cognitives Marc Jeannerod (for 19 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 16 months)
- Tem Innovations GmbH (for 11 months)
- WordFinder.pro (for 10 months)
- CNRS DT INSU Résif (for 9 months)
- Alter Way

Monthly report about Debian Long Term Support, May 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Thu, 23 Jun 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Two [1, 2] projects are in the pipeline now. Tryton project is in a final phase. Gradle projects is fighting with technical difficulties.

In May, we put aside 2233 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In May, 14 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 14h assigned).
Andreas Rönnquist did 14.5h (out of 25.0h assigned), thus carrying over 10.5h to June.
Anton Gladky did 19h (out of 19h assigned).
Ben Hutchings did 8h (out of 11h assigned and 13h from April), thus carrying over 16h to June.
Chris Lamb did 18h (out of 18h assigned).
Dominik George did 2h (out of 20.0h assigned), thus carrying over 18h to June.
Enrico Zini did 9.5h (out of 16.0h assigned), thus carrying over 6.5h to June.
Emilio Pozuelo Monfort did 28h (out of 13.75h assigned and 35.25h from April), thus carrying over 21h to June.
Markus Koschany did 40h (out of 40h assigned).
Roberto C. Sánchez did 13.5h (out of 32h assigned), thus carrying over 18.5h to June.
Sylvain Beucler did 23.5h (out of 20h assigned and 20h from April), thus carrying over 16.5h to June.
Stefano Rivera did 5h in April and 14h in May (out of 17.5h assigned), thus anticipating 1.5h for June.
Thorsten Alteholz did 40h (out of 40h assigned).
Utkarsh Gupta did 35h (out of 19h assigned and 30h from April), thus carrying over 14h to June.

Evolution of the situation

In May we released 49 DLAs. The security tracker currently lists 71 packages with a known CVE and the dla-needed.txt file has 65 packages needing an update.

The number of paid contributors increased significantly, we are pleased to welcome our latest team members: Andreas Rönnquist, Dominik George, Enrico Zini and Stefano Rivera.

It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org. We are preparing to overtake Debian 10 Buster for the next two years and to make this process as smooth as possible.

But Freexian and its team of paid Debian contributors will continue to maintain Debian 9 going forward for the customers of the Extended LTS offer. If you have Debian 9 servers to keep secure, it’s time to subscribe!

You might not have noticed, but Freexian formalized a mission statement where we explain that our purpose is to help improve Debian. For this, we want to fund work time for the Debian developers that recently joined Freexian as collaborators. The Extended LTS and the PHP LTS offers are built following a model that will help us to achieve this if we manage to have enough customers for those offers. So consider subscribing: you help your organization but you also help Debian!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 81 months)
- GitHub (for 72 months)
- Civil Infrastructure Platform (CIP) (for 49 months)
Gold sponsors:
- Roche Diagnostics International AG (for 92 months)
- Linode (for 86 months)
- Babiel GmbH (for 75 months)
- Plat’Home (for 75 months)
- University of Oxford (for 31 months)
- Deveryware (for 18 months)
- VyOS Inc (for 13 months)
- EDF SA
Silver sponsors:
- The Positive Internet Company (for 97 months)
- Domeneshop AS (for 96 months)
- Nantes Métropole (for 90 months)
- Univention GmbH (for 82 months)
- Université Jean Monnet de St Etienne (for 82 months)
- Ribbon Communications, Inc. (for 76 months)
- Exonet B.V. (for 66 months)
- Leibniz Rechenzentrum (for 60 months)
- CINECA (for 49 months)
- Ministère de l’Europe et des Affaires Étrangères (for 43 months)
- Cloudways Ltd (for 33 months)
- Dinahosting SL (for 31 months)
- Bauer Xcel Media Deutschland KG (for 25 months)
- Platform.sh (for 25 months)
- Moxa Intelligence Co., Ltd. (for 19 months)
- sipgate GmbH (for 16 months)
- OVH US LLC (for 14 months)
- Tilburg University (for 14 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 6 months)
- Telecats BV (for 4 months)
- Soliton Systems K.K. (for 3 months)
Bronze sponsors:
- Evolix (for 97 months)
- Seznam.cz, a.s. (for 97 months)
- Intevation GmbH (for 94 months)
- Linuxhotel GmbH (for 94 months)
- Daevel SARL (for 92 months)
- Bitfolk LTD (for 91 months)
- Megaspace Internet Services GmbH (for 91 months)
- Greenbone Networks GmbH (for 90 months)
- NUMLOG (for 90 months)
- WinGo AG (for 90 months)
- Ecole Centrale de Nantes - LHEEA (for 86 months)
- Entr’ouvert (for 81 months)
- Adfinis AG (for 78 months)
- GNI MEDIA (for 73 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 73 months)
- Tesorion (for 73 months)
- Bearstech (for 64 months)
- LiHAS (for 64 months)
- People Doc (for 61 months)
- Catalyst IT Ltd (for 59 months)
- Supagro (for 54 months)
- Demarcq SAS (for 53 months)
- Université Grenoble Alpes (for 39 months)
- TouchWeb SAS (for 31 months)
- SPiN AG (for 28 months)
- CoreFiling (for 23 months)
- Institut des sciences cognitives Marc Jeannerod (for 18 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 15 months)
- Tem Innovations GmbH (for 10 months)
- WordFinder.pro (for 9 months)
- CNRS DT INSU Résif (for 8 months)
- Alter Way

Monthly report about Debian Long Term Support, April 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Fri, 03 Jun 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Two projects are currently in the pipeline: Gradle enterprise and Tryton update. Progress is quite slow on the Gradle one, there are technical difficulties. The tryton one was stalled because the developer had not enough time but seems to progress smoothly in the last weeks.

In April, we put aside 2635 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In April, 11 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14h out of 14h assigned
Anton Gladky did 20h out of 20h assigned
Ben Hutchings did 11h out of 16h assigned and 8h from March, thus carrying over 13h to May
Chris Lamb did 18h out of 18h assigned
Emilio Pozuelo Monfort did 18h (out of 53.25h assigned), thus carrying over 35.25h to May
Jeremiah Foster did 9.5h out of 13.5h assigned, thus carrying over 4h to May
Markus Koschany did 40 out of 40h assigned
Roberto C. Sánchez did 18h carried out from March
Sylvain Beucler did 20h out of 14.5h assigned and 25.5h from March, thus carrying over 20h to May
Thorsten Alteholz did 40h out of 40h assigned
Utkarsh Gupta did 23.25h out of 51.5h assigned and 1.75h from March, thus carrying over 30h to May

Evolution of the situation

In April we released 21 DLAs and we were glad to welcome a new customer with Alter Way.

The security tracker currently lists 72 packages with a known CVE and the dla-needed.txt file has 71 packages needing an update.

It is worth pointing out that we are getting close to the end of the LTS period for Debian 9. After June 30th, no new security updates will be made available on security.debian.org.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 80 months)
- GitHub (for 71 months)
- Civil Infrastructure Platform (CIP) (for 48 months)
Gold sponsors:
- Roche Diagnostics International AG (for 91 months)
- Linode (for 85 months)
- Babiel GmbH (for 75 months)
- Plat’Home (for 74 months)
- University of Oxford (for 30 months)
- Deveryware (for 17 months)
- VyOS Inc (for 12 months)
- EDF SA
Silver sponsors:
- The Positive Internet Company (for 97 months)
- Domeneshop AS (for 96 months)
- Nantes Métropole (for 90 months)
- Université Jean Monnet de St Etienne (for 82 months)
- Univention GmbH (for 81 months)
- Ribbon Communications, Inc. (for 75 months)
- Exonet B.V. (for 65 months)
- Leibniz Rechenzentrum (for 59 months)
- CINECA (for 49 months)
- Ministère de l’Europe et des Affaires Étrangères (for 43 months)
- Cloudways Ltd (for 32 months)
- Dinahosting SL (for 30 months)
- Bauer Xcel Media Deutschland KG (for 24 months)
- Platform.sh (for 24 months)
- Moxa Intelligence Co., Ltd. (for 18 months)
- sipgate GmbH (for 15 months)
- Tilburg University (for 14 months)
- OVH US LLC (for 13 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 5 months)
- Telecats BV (for 3 months)
- Soliton Systems K.K.
Bronze sponsors:
- Evolix (for 96 months)
- Seznam.cz, a.s. (for 96 months)
- Intevation GmbH (for 93 months)
- Linuxhotel GmbH (for 93 months)
- Daevel SARL (for 92 months)
- Bitfolk LTD (for 91 months)
- Megaspace Internet Services GmbH (for 91 months)
- Greenbone Networks GmbH (for 90 months)
- NUMLOG (for 90 months)
- WinGo AG (for 89 months)
- Ecole Centrale de Nantes - LHEEA (for 85 months)
- Entr’ouvert (for 80 months)
- Adfinis AG (for 78 months)
- GNI MEDIA (for 72 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 72 months)
- Tesorion (for 72 months)
- Bearstech (for 64 months)
- LiHAS (for 64 months)
- People Doc (for 60 months)
- Catalyst IT Ltd (for 58 months)
- Supagro (for 54 months)
- Demarcq SAS (for 52 months)
- Université Grenoble Alpes (for 38 months)
- TouchWeb SAS (for 30 months)
- SPiN AG (for 27 months)
- CoreFiling (for 23 months)
- Institut des sciences cognitives Marc Jeannerod (for 17 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 14 months)
- Tem Innovations GmbH (for 9 months)
- WordFinder.pro (for 8 months)
- CNRS DT INSU Résif (for 7 months)
- Alter Way

Monthly report about Debian Long Term Support, March 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Thu, 28 Apr 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

There was no new activity in Debian project funding in the two existing projects. However, there was a survey run with hundreds of Debian Developers and Debian contributors. The survey results are being collated and we will use the anonymized data to further develop the Freexian project funding initiative.

We are preparing to more broadly announce additional support for Debian 8 Jessie and Debian 9 Stretch. Now, Debian 8 can be supported until June 2025 and Debian 9 until June 2027. More information on ELTS support is available.

In March € 2250 was put aside to fund Debian projects.

Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In March, 11 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Raphaël if you are if you are interested in participating.

Abhijith PA did 12.0h out of 12h assigned.
Anton Gladky did 20h out of 20h assigned.
Ben Hutchings did 16h out of 24h assigned.
Chris Lamb did 18h out of 18h assigned.
Emilio Pozuelo Monfort did 59.5h out of 59.5h assigned.
Jeremiah Foster did 13.5 out of 20h assigned.
Markus Koschany did 40h out of 40h assigned.
Roberto C. Sánchez did 14h out of 32h assigned, carrying over 18h
Sylvain Beucler did 14.5h out of 40h assigned, carrying over 25.5h
Thorsten Alteholz did 40h out of 40h assigned.
Utkarsh Gupta did 57.75h out of 59.5h assigned, carrying over 1.75 hours.

Evolution of the situation

In March we released 42 DLAs.

The security tracker currently lists 81 packages with a known CVE and the dla-needed.txt file has 52 packages needing an update.

We’re glad to welcome a few new sponsors such as Électricité de France (Gold sponsor), Telecats BV and Soliton Systems.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 79 months)
- GitHub (for 70 months)
- Civil Infrastructure Platform (CIP) (for 47 months)
Gold sponsors:
- Roche Diagnostics International AG (for 90 months)
- Linode (for 84 months)
- Babiel GmbH (for 73 months)
- Plat’Home (for 73 months)
- University of Oxford (for 29 months)
- Deveryware (for 16 months)
- VyOS Inc (for 11 months)
- EDF SA
Silver sponsors:
- Domeneshop AS (for 95 months)
- The Positive Internet Company (for 95 months)
- Nantes Métropole (for 89 months)
- Univention GmbH (for 80 months)
- Université Jean Monnet de St Etienne (for 80 months)
- Ribbon Communications, Inc. (for 74 months)
- Exonet B.V. (for 64 months)
- Leibniz Rechenzentrum (for 58 months)
- CINECA (for 47 months)
- Ministère de l’Europe et des Affaires Étrangères (for 42 months)
- Cloudways Ltd (for 31 months)
- Dinahosting SL (for 29 months)
- Bauer Xcel Media Deutschland KG (for 23 months)
- Platform.sh (for 23 months)
- Moxa Intelligence Co., Ltd. (for 17 months)
- sipgate GmbH (for 14 months)
- Tilburg University (for 13 months)
- OVH US LLC (for 12 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 4 months)
- Telecats BV
- Soliton Systems K.K.
Bronze sponsors:
- Evolix (for 95 months)
- Seznam.cz, a.s. (for 95 months)
- Intevation GmbH (for 92 months)
- Linuxhotel GmbH (for 92 months)
- Daevel SARL (for 91 months)
- Bitfolk LTD (for 89 months)
- Megaspace Internet Services GmbH (for 89 months)
- NUMLOG (for 89 months)
- Greenbone Networks GmbH (for 88 months)
- WinGo AG (for 88 months)
- Ecole Centrale de Nantes - LHEEA (for 84 months)
- Entr’ouvert (for 79 months)
- Adfinis AG (for 77 months)
- GNI MEDIA (for 71 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 71 months)
- Tesorion (for 71 months)
- Bearstech (for 63 months)
- LiHAS (for 62 months)
- People Doc (for 59 months)
- Catalyst IT Ltd (for 57 months)
- Supagro (for 52 months)
- Demarcq SAS (for 51 months)
- Université Grenoble Alpes (for 37 months)
- TouchWeb SAS (for 29 months)
- SPiN AG (for 26 months)
- CoreFiling (for 22 months)
- Institut des sciences cognitives Marc Jeannerod (for 16 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 13 months)
- Tem Innovations GmbH (for 8 months)
- WordFinder.pro (for 7 months)
- CNRS DT INSU Résif (for 6 months)

Monthly report about Debian Long Term Support, February 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Thu, 17 Mar 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In February Raphaël and the LTS worked on a survey of Debian developers meant to solicit ideas for improvements in the Debian project at large. You can see the results of the initial discussion here in the list of ideas of which there are already over 30.

The full survey is due to be emailed to Debian Developers shortly.

In February € 2250 was put aside to fund Debian projects.

Debian LTS contributors

In February, 12 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Raphaël if you are if you are interested in participating.

Abhijith PA did 10h out of 10h available.
Anton Gladky did 20h out of 20h available.
Ben Hutchings did 16h out of 16h available.
Chris Lamb did 18h out of 18h available.
Emilio Pozuelo Monfort did 42.75h out of 42.75h available.
Jeremiah Foster worked 20 hours out of 20 available on LTS administration and 2.9 hours on funded projects.
Markus Koschany did 30h (out of 40h available), thus carrying over 10h to March.
Roberto C. Sánchez did 12h out of 12h available.
Sylvain Beucler did 13h (out of 40h available), thus carrying over 27h to March.
Thorsten Alteholz did 40h out of 40h available.
Utkarsh Gupta did 15.75h (out of 42.75h available), thus carrying over 27h to March.

Evolution of the situation

In February we released 24 DLAs.

The security tracker currently lists 61 packages with a known CVE and the dla-needed.txt file has 26 packages needing an update.

You can find out more about the Debian LTS project via the following video:

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 78 months)
- GitHub (for 68 months)
- Civil Infrastructure Platform (CIP) (for 46 months)
Gold sponsors:
- Roche Diagnostics International AG (for 89 months)
- Linode (for 83 months)
- Babiel GmbH (for 72 months)
- Plat’Home (for 71 months)
- University of Oxford (for 28 months)
- Deveryware (for 15 months)
- VyOS Inc (for 10 months)
Silver sponsors:
- The Positive Internet Company (for 94 months)
- Domeneshop AS (for 93 months)
- Nantes Métropole (for 87 months)
- Univention GmbH (for 79 months)
- Université Jean Monnet de St Etienne (for 79 months)
- Ribbon Communications, Inc. (for 73 months)
- Exonet B.V. (for 63 months)
- Leibniz Rechenzentrum (for 57 months)
- CINECA (for 46 months)
- Ministère de l’Europe et des Affaires Étrangères (for 40 months)
- Cloudways Ltd (for 29 months)
- Dinahosting SL (for 27 months)
- Platform.sh (for 22 months)
- Bauer Xcel Media Deutschland KG (for 21 months)
- Moxa Intelligence Co., Ltd. (for 16 months)
- sipgate GmbH (for 13 months)
- OVH US LLC (for 11 months)
- Tilburg University (for 11 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH
- Telecats BV
- Soliton Systems K.K.
Bronze sponsors:
- Evolix (for 94 months)
- Seznam.cz, a.s. (for 94 months)
- Linuxhotel GmbH (for 91 months)
- Intevation GmbH (for 90 months)
- Daevel SARL (for 89 months)
- Bitfolk LTD (for 88 months)
- Megaspace Internet Services GmbH (for 88 months)
- Greenbone Networks GmbH (for 87 months)
- NUMLOG (for 87 months)
- WinGo AG (for 86 months)
- Ecole Centrale de Nantes - LHEEA (for 83 months)
- Entr’ouvert (for 78 months)
- Adfinis AG (for 75 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 70 months)
- Tesorion (for 70 months)
- GNI MEDIA (for 69 months)
- Bearstech (for 61 months)
- LiHAS (for 61 months)
- People Doc (for 57 months)
- Catalyst IT Ltd (for 56 months)
- Supagro (for 51 months)
- Demarcq SAS (for 50 months)
- Université Grenoble Alpes (for 36 months)
- TouchWeb SAS (for 28 months)
- SPiN AG (for 24 months)
- CoreFiling (for 20 months)
- Institut des sciences cognitives Marc Jeannerod (for 15 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 11 months)
- Tem Innovations GmbH (for 6 months)
- WordFinder.pro (for 6 months)
- CNRS DT INSU Résif (for 4 months)

Monthly report about Debian Long Term Support, January 2022 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 21 Feb 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In January we saw a new funded project proposed. The project is meant to bring in a number of changes to the Tryton modules and packages in Debian. Tryton, a full featured, entirely open source business software platform, is supported by its own foundation. You can track the current status of all our funded projects at its dedicated web page.

Folks continue to add to the Grow Your Ideas project page, that’s great.

In January € 2550 was put aside to fund Debian projects.

We continue to looking forward to hearing about Debian project proposals from various Debian stakeholders. This month has seen work on a survey that will go out to Debian Developers to gather feedback on what they think should be the priorities for funding in the project. Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In January, 13 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah or Raphaël.

Abhijith Pa worked 5 hours out of 5 available.
Anton Gladky worked 12 hours out of 12 available.
Ben Hutchings worked 16 hours out of 24 available and carried over 8 for February.
Chris Lamb worked 18 hours out of 18 available.
Emilio Pozuelo Monfort worked 55 hours out of 58.25 available and carried over 3.25 for February
Jeremiah Foster worked 20 hours out of 20 available on LTS administration and 8.3 hours on funded projects.
Lee Garrett didn’t spend any hours in January and carries over 39.25 hours to February
Markus Koschany worked 34 hours out of 40 available and carried over 6 for February.
Ola Lundqvist reported via email that they didn’t spend any hours in January and carries over 11 from December for a total of 12 hours for February.
Roberto C. Sanchez worked 9 hours out of 32 available and carried over 23 for February
Sylvain Beucler worked 22 hours out of 40 available and carried over 14 for February
Thorsten Alteholz worked 40 hours out of 40 available.
Utkarsh Gupta worked 58.25 hours out of 58.25 available.

Evolution of the situation

In January we released 34 DLAs.

The security tracker currently lists 39 packages with a known CVE and the dla-needed.txt file has 20 packages still needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 77 months)
- GitHub (for 68 months)
- Civil Infrastructure Platform (CIP) (for 45 months)
Gold sponsors:
- Roche Diagnostics International AG (for 88 months)
- Linode (for 82 months)
- Babiel GmbH (for 71 months)
- Plat’Home (for 71 months)
- University of Oxford (for 27 months)
- Deveryware (for 14 months)
- VyOS Inc (for 9 months)
Silver sponsors:
- The Positive Internet Company (for 93 months)
- Domeneshop AS (for 92 months)
- Nantes Métropole (for 86 months)
- Univention GmbH (for 78 months)
- Université Jean Monnet de St Etienne (for 78 months)
- Ribbon Communications, Inc. (for 72 months)
- Exonet B.V. (for 62 months)
- Leibniz Rechenzentrum (for 56 months)
- CINECA (for 45 months)
- Ministère de l’Europe et des Affaires Étrangères (for 39 months)
- Cloudways Ltd (for 29 months)
- Dinahosting SL (for 27 months)
- Bauer Xcel Media Deutschland KG (for 21 months)
- Platform.sh (for 21 months)
- Moxa Intelligence Co., Ltd. (for 15 months)
- sipgate GmbH (for 12 months)
- OVH US LLC (for 10 months)
- Tilburg University (for 10 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH
- Telecats BV
Bronze sponsors:
- Evolix (for 93 months)
- Seznam.cz, a.s. (for 93 months)
- Intevation GmbH (for 90 months)
- Linuxhotel GmbH (for 90 months)
- Daevel SARL (for 88 months)
- Bitfolk LTD (for 87 months)
- Megaspace Internet Services GmbH (for 87 months)
- Greenbone Networks GmbH (for 86 months)
- NUMLOG (for 86 months)
- WinGo AG (for 86 months)
- Ecole Centrale de Nantes - LHEEA (for 82 months)
- Entr’ouvert (for 77 months)
- Adfinis AG (for 74 months)
- GNI MEDIA (for 69 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 69 months)
- Tesorion (for 69 months)
- Bearstech (for 60 months)
- LiHAS (for 60 months)
- People Doc (for 57 months)
- Catalyst IT Ltd (for 55 months)
- Supagro (for 50 months)
- Demarcq SAS (for 49 months)
- Université Grenoble Alpes (for 35 months)
- TouchWeb SAS (for 27 months)
- SPiN AG (for 24 months)
- CoreFiling (for 19 months)
- Institut des sciences cognitives Marc Jeannerod (for 14 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 11 months)
- Tem Innovations GmbH (for 6 months)
- WordFinder.pro (for 5 months)
- CNRS DT INSU Résif (for 4 months)

Monthly report about Debian Long Term Support, December 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 17 Jan 2022 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

The gradle packaging proposal work estimation is now complete. The next steps for this project is regular packaging and engineering work with regular reports.

In December € 2175 was put aside to fund Debian projects.

The work on the Debian developer survey has resulted in an initial draft which has been reviewed by paid LTS contributors. The next steps are wider review from the Debian project. Expect something soon on debian-project@lists.debian.org…

Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In December 14 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah if you are interested in participating.

Abhijith PA worked 3h in December out of 8h available.
Adrian Bunk worked 70h and 45min in December
Anton Gladky did 12 hours for LTS in December.
Ben Hutchings worked 16h in December.
Chris Lamb worked 18h for LTS in December.
Emilio Pozuelo Monfort worked 41.5 hours hours for LTS in December.
Jeremiah Foster worked 29 hours on administrative duties for the LTS team and on managing the “project funding” initiative.
Lee Garrett worked 11.75h for LTS in December.
Markus Koschany worked 24 hours for LTS in December (out of 30h available).
Ola Lundqvist worked 4 hours in December (out of 15h available).
Roberto C. Sanchez worked 22 hours in December (out of 32h available).
Sylvain Beucler worked 14h in December (out of 40.5h available).
Thorsten Alteholz worked 40h in December.
Utkarsh Gupta worked 40 hours on LTS and 5h on preparing the survey.

Evolution of the situation

In December we released 40 DLAs.

The security tracker currently lists 36 packages with a known CVE and the dla-needed.txt file has 32 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 76 months)
- GitHub (for 67 months)
- Civil Infrastructure Platform (CIP) (for 44 months)
Gold sponsors:
- Roche Diagnostics International AG (for 87 months)
- Linode (for 81 months)
- Babiel GmbH (for 70 months)
- Plat’Home (for 70 months)
- University of Oxford (for 26 months)
- Deveryware (for 13 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 92 months)
- Domeneshop AS (for 91 months)
- Nantes Métropole (for 85 months)
- Univention GmbH (for 77 months)
- Université Jean Monnet de St Etienne (for 77 months)
- Ribbon Communications, Inc. (for 71 months)
- Exonet B.V. (for 61 months)
- Leibniz Rechenzentrum (for 55 months)
- CINECA (for 44 months)
- Ministère de l’Europe et des Affaires Étrangères (for 38 months)
- Cloudways Ltd (for 27 months)
- Dinahosting SL (for 25 months)
- Bauer Xcel Media Deutschland KG (for 20 months)
- Platform.sh (for 20 months)
- Moxa Intelligence Co., Ltd. (for 14 months)
- sipgate GmbH (for 11 months)
- OVH US LLC (for 9 months)
- Tilburg University (for 9 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH
Bronze sponsors:
- Evolix (for 92 months)
- Seznam.cz, a.s. (for 92 months)
- Linuxhotel GmbH (for 89 months)
- Intevation GmbH (for 88 months)
- Daevel SARL (for 87 months)
- Bitfolk LTD (for 86 months)
- Megaspace Internet Services GmbH (for 86 months)
- Greenbone Networks GmbH (for 85 months)
- NUMLOG (for 85 months)
- WinGo AG (for 84 months)
- Ecole Centrale de Nantes - LHEEA (for 81 months)
- Entr’ouvert (for 76 months)
- Adfinis AG (for 73 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 68 months)
- Tesorion (for 68 months)
- GNI MEDIA (for 67 months)
- Bearstech (for 59 months)
- LiHAS (for 59 months)
- People Doc (for 55 months)
- Catalyst IT Ltd (for 54 months)
- Supagro (for 49 months)
- Demarcq SAS (for 48 months)
- Université Grenoble Alpes (for 34 months)
- TouchWeb SAS (for 26 months)
- SPiN AG (for 22 months)
- CoreFiling (for 18 months)
- Institut des sciences cognitives Marc Jeannerod (for 13 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 10 months)
- Tem Innovations GmbH (for 4 months)
- WordFinder.pro (for 4 months)
- CNRS DT INSU Résif (for 3 months)

Monthly report about Debian Long Term Support, November 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Thu, 16 Dec 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Our project funding work continues with an active bid on the work of packaging a recent gradle in Debian. This month the bidder has been estimating the scope of the entire project.
The Grow Your Ideas project page also has some ambitious initiatives that may evolve into a funded project. The project ideas on that page range from a new wiki for Debian, a more efficient reimbursement process, and the implementation of PPAs for Debian.
In November € 2625 was put aside to fund Debian projects.

Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In November 13 contributors were paid to work on Debian LTS, their reports are available below. If you’re interested in participating in the LTS or ELTS teams, we welcome participation from the Debian community. Simply get in touch with Jeremiah if you are interested in participating.

Adrian Bunk did 62h out of 56h assigned for November and 6h from October.
Anton Gladky did 12h out of 12h assigned.
Ben Hutchings did 20h (out of 16h available, thus anticipating 4h from December).
Chris Lamb did 18h out of 18h assigned.
Holger Levsen gave back 3h (out of 3h assigned).
Jeremiah Foster is coordinating/managing the LTS team did 29h (out of 10h assigned and 10h from October for LTS administration), and spent 9 hours on Projects funded directly through the project funding program.
Lee Garrett did 9 hours out 60 assigned and carried over 51h into December
Markus Koschany did 30h out of 30h assigned.
Neil Williams did 1.5h (out of 11.5h assigned and 28.5h from October). He gave back the remaining hours.
Roberto C. Sánchez did 31.5h (out of 32h assigned), thus carrying over .5h to December.
Sylvain Beucler did 21.5h (out of 62h assigned), thus carrying over 40.5h to December.
Thorsten Alteholz did 40h (out of 40h assigned).
Utkarsh Gupta did 30 (out of 40h assigned), thus carrying over 10h to December.

Evolution of the situation

In November we released 31 DLAs.

The security tracker currently lists 23 packages with a known CVE and the dla-needed.txt file has 16 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 75 months)
- GitHub (for 65 months)
- Civil Infrastructure Platform (CIP) (for 43 months)
Gold sponsors:
- Roche Diagnostics International AG (for 86 months)
- Linode (for 80 months)
- Babiel GmbH (for 69 months)
- Plat’Home (for 68 months)
- University of Oxford (for 25 months)
- Deveryware (for 12 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 91 months)
- Domeneshop AS (for 90 months)
- Nantes Métropole (for 84 months)
- Univention GmbH (for 76 months)
- Université Jean Monnet de St Etienne (for 76 months)
- Ribbon Communications, Inc. (for 70 months)
- Exonet B.V. (for 59 months)
- Leibniz Rechenzentrum (for 54 months)
- CINECA (for 43 months)
- Ministère de l’Europe et des Affaires Étrangères (for 37 months)
- Cloudways Ltd (for 26 months)
- Dinahosting SL (for 24 months)
- Platform.sh (for 19 months)
- Bauer Xcel Media Deutschland KG (for 18 months)
- Moxa Intelligence Co., Ltd. (for 13 months)
- sipgate GmbH (for 10 months)
- OVH US LLC (for 8 months)
- Tilburg University (for 8 months)
Bronze sponsors:
- Evolix (for 91 months)
- Seznam.cz, a.s. (for 91 months)
- Linuxhotel GmbH (for 88 months)
- Intevation GmbH (for 87 months)
- Daevel SARL (for 86 months)
- Bitfolk LTD (for 85 months)
- Megaspace Internet Services GmbH (for 85 months)
- Greenbone Networks GmbH (for 84 months)
- NUMLOG (for 84 months)
- WinGo AG (for 83 months)
- Ecole Centrale de Nantes - LHEEA (for 80 months)
- Entr’ouvert (for 75 months)
- Adfinis AG (for 72 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 67 months)
- Tesorion (for 67 months)
- GNI MEDIA (for 66 months)
- Bearstech (for 58 months)
- LiHAS (for 58 months)
- People Doc (for 54 months)
- Catalyst IT Ltd (for 53 months)
- Supagro (for 48 months)
- Demarcq SAS (for 47 months)
- Université Grenoble Alpes (for 33 months)
- TouchWeb SAS (for 25 months)
- SPiN AG (for 21 months)
- CoreFiling (for 17 months)
- Institut des sciences cognitives Marc Jeannerod (for 12 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 8 months)
- Tem Innovations GmbH (for 3 months)
- WordFinder.pro (for 3 months)
- CNRS DT INSU Résif

Monthly report about Debian Long Term Support, October 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Wed, 17 Nov 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Our project funding work continues with an active bid on the work of packaging gradle in Debian. The next steps are reviewing the bid and formal approval.
In October 2,475 EUR was put aside to fund Debian projects.

We’re looking forward to receiving more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In October 12 contributors were paid to work on Debian LTS, their reports are available below.

Adrian Bunk did 40.5h in October (out of 28.5h assigned and 18h remaining, thus keeping 6h for November).
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 14.75h in October (out of 2h assigned and 28h remaining, thus keeping 15.25h for November).
Chris Lamb did 18h (out of 18h assigned).
Holger Levsen did 1h (out of 12h assigned, but gave back the remaining 11h).
Jeremiah Foster worked 20h (out of 20h assigned and 10h remaining, thus keeping 10h for November).
Markus Koschany did 28.5h (out of 28.5h assigned).
Ola Lundqvist did 5h (out of 5h assigned).
Roberto C. Sánchez did 28.5h (out of 28.5h assigned).
Sylvain Beucler did 23.5h (out of 28.5h assigned, but gave back the remaining 5h).
Thorsten Alteholz did 28.5h (out of 28.5h assigned).
Utkarsh Gupta did 28.5h (out of 28.5h assigned).

Evolution of the situation

In October we released 34 DLAs.

Also, we would like to remark once again that we are constantly looking for new contributors. Please contact Jeremiah if you are interested!

The security tracker currently lists 37 packages with a known CVE and the dla-needed.txt file has 22 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 74 months)
- GitHub (for 64 months)
- Civil Infrastructure Platform (CIP) (for 42 months)
Gold sponsors:
- Roche Diagnostics International AG (for 85 months)
- Linode (for 79 months)
- Babiel GmbH (for 68 months)
- Plat’Home (for 67 months)
- University of Oxford (for 24 months)
- Deveryware (for 11 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 90 months)
- Domeneshop AS (for 89 months)
- Nantes Métropole (for 83 months)
- Univention GmbH (for 75 months)
- Université Jean Monnet de St Etienne (for 75 months)
- Ribbon Communications, Inc. (for 69 months)
- Exonet B.V. (for 59 months)
- Leibniz Rechenzentrum (for 53 months)
- CINECA (for 42 months)
- Ministère de l’Europe et des Affaires Étrangères (for 36 months)
- Cloudways Ltd (for 25 months)
- Dinahosting SL (for 23 months)
- Platform.sh (for 18 months)
- Bauer Xcel Media Deutschland KG (for 17 months)
- Moxa Intelligence Co., Ltd. (for 12 months)
- sipgate GmbH (for 9 months)
- OVH US LLC (for 7 months)
- Tilburg University (for 7 months)
Bronze sponsors:
- Evolix (for 90 months)
- Seznam.cz, a.s. (for 90 months)
- Linuxhotel GmbH (for 87 months)
- Intevation GmbH (for 86 months)
- Daevel SARL (for 85 months)
- Bitfolk LTD (for 84 months)
- Megaspace Internet Services GmbH (for 84 months)
- Greenbone Networks GmbH (for 83 months)
- NUMLOG (for 83 months)
- WinGo AG (for 82 months)
- Ecole Centrale de Nantes - LHEEA (for 79 months)
- Entr’ouvert (for 74 months)
- Adfinis AG (for 71 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 66 months)
- Tesorion (for 66 months)
- GNI MEDIA (for 65 months)
- Bearstech (for 57 months)
- LiHAS (for 57 months)
- People Doc (for 53 months)
- Catalyst IT Ltd (for 52 months)
- Supagro (for 47 months)
- Demarcq SAS (for 46 months)
- Université Grenoble Alpes (for 32 months)
- TouchWeb SAS (for 24 months)
- SPiN AG (for 20 months)
- CoreFiling (for 16 months)
- Institut des sciences cognitives Marc Jeannerod (for 11 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 7 months)
- Tem Innovations GmbH
- WordFinder.pro
- CNRS DT INSU Résif

Monthly report about Debian Long Term Support, September 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Tue, 19 Oct 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

Folks from the LTS team, along with members of the Debian Android Tools team and Phil Morrel, have proposed work on the Java build tool, gradle, which is currently blocked due to the need to build with a plugin not available in Debian. The LTS team reviewed the project submission and it has been approved. After approval we’ve created a Request for Bids which is active now.

You’ll hear more about this through official Debian channels, but in the meantime, if you feel you can help with this project, please submit a bid. Thanks!

This September, Freexian set aside 2550 EUR to fund Debian projects.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In September, 15 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA has returned hours and marked themselves inactive, at least for the time being. He did 0h out of 14h, carried over 14h and returned 28h.
Adrian Bunk did 19.5h (out of 24.75h assigned and 12.75 from August), carrying over 18h to October.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 2h (out of 12.75h assigned and 19.25h from August), thus carrying over 30h to October.
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 5.5h assigned plus 74.5h from August), thus is carrying over 80h for October.
Holger Levsen did 3h (out of 12h assigned) and gave back 9h and carried over 3h.
Jeremiah Foster worked 10 hours (out of 20h assigned) on LTS work, carrying over 10h.
Lee Garrett did not report back about their work so we assume they did nothing (out of 24.75h assigned and 23.75 from August), thus is carrying over 48.50h for October.
Markus Koschany did 43.5h (out of 24.75h assigned and 18.75h from August)
Neil Williams did 24.5h (out of 24.75h assigned)
Roberto C. Sánchez did 6h (out of 24.75h assigned and gave back 18.75h)
Sylvain Beucler did 27h (out of 24.75h assigned).
Thorsten Alteholz did 24.75h (out of 24.75h assigned).
Utkarsh Gupta did 24.75h (out of 24.75h assigned) but did not publish his report yet.
Ola Lundqvist did 2 hours (out of 21h carried over from previous months), and is thus carrying 19h for October.

Evolution of the situation

In September we released 30 DLAs. September was also the second month of Jeremiah coordinating LTS contributors.

Also, we would like say that we are always looking for new contributors to LTS. Please contact Jeremiah if you are interested!

The security tracker currently lists 33 packages with a known CVE and the dla-needed.txt file has 26 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 73 months)
- GitHub (for 64 months)
- Civil Infrastructure Platform (CIP) (for 41 months)
Gold sponsors:
- Roche Diagnostics International AG (for 84 months)
- Linode (for 78 months)
- Babiel GmbH (for 67 months)
- Plat’Home (for 67 months)
- University of Oxford (for 23 months)
- Deveryware (for 10 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 89 months)
- Domeneshop AS (for 88 months)
- Nantes Métropole (for 82 months)
- Univention GmbH (for 74 months)
- Université Jean Monnet de St Etienne (for 74 months)
- Ribbon Communications, Inc. (for 68 months)
- Exonet B.V. (for 58 months)
- Leibniz Rechenzentrum (for 52 months)
- CINECA (for 41 months)
- Ministère de l’Europe et des Affaires Étrangères (for 35 months)
- Cloudways Ltd (for 24 months)
- Dinahosting SL (for 22 months)
- Bauer Xcel Media Deutschland KG (for 17 months)
- Platform.sh (for 17 months)
- Moxa Intelligence Co., Ltd. (for 11 months)
- sipgate GmbH (for 8 months)
- OVH US LLC (for 6 months)
- Tilburg University (for 6 months)
Bronze sponsors:
- Evolix (for 89 months)
- Seznam.cz, a.s. (for 89 months)
- Linuxhotel GmbH (for 86 months)
- Intevation GmbH (for 85 months)
- Daevel SARL (for 84 months)
- Bitfolk LTD (for 83 months)
- Megaspace Internet Services GmbH (for 83 months)
- Greenbone Networks GmbH (for 82 months)
- NUMLOG (for 82 months)
- WinGo AG (for 81 months)
- Ecole Centrale de Nantes - LHEEA (for 78 months)
- Entr’ouvert (for 73 months)
- Adfinis AG (for 70 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 65 months)
- Tesorion (for 65 months)
- GNI MEDIA (for 64 months)
- Bearstech (for 56 months)
- LiHAS (for 56 months)
- People Doc (for 52 months)
- Catalyst IT Ltd (for 51 months)
- Demarcq SAS (for 45 months)
- Université Grenoble Alpes (for 31 months)
- TouchWeb SAS (for 23 months)
- SPiN AG (for 19 months)
- CoreFiling (for 15 months)
- Institut des sciences cognitives Marc Jeannerod (for 10 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 7 months)
- Tem Innovations GmbH
- WordFinder.pro

Monthly report about Debian Long Term Support, August 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 04 Oct 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In August, we put aside 2460 EUR to fund Debian projects. We received a new project proposal that got approved and there’s an associated bid request if you feel like proposing yourself to implement this project.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In August, 14 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 4.0h (out of 14h assigned and 5h from August), thus carrying over 15h to September.
Adrian Bunk did 11h (out of 23.75h assigned), thus carrying over 12.75h to September.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 1.25h (out of 13.25h assigned and 6h from August), thus carrying over 18h to September.
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 23.75h assigned plus 50.75h from August), thus is carrying over 74.5h for September.
Holger Levsen did 3h (out of 12h assigned) to help coordinate the team, and gave back the remaining hours.
Lee Garrett did nothing (out of 23.75h assigned), thus is carrying over 23.75h for September.
Markus Koschany did 35h (out of 23.75h assigned and 30h from August), thus carrying over 18.75h to September.
Neil Williams did 24h (out of 23.75h assigned), thus anticipating 0.25h of October.
Roberto C. Sánchez did 22.25h (out of 23.75h assigned), thus carrying over 1.5h to September.
Sylvain Beucler did 21.5h (out of 23.75h assigned), thus carrying over 2.25h to September.
Thorsten Alteholz did 23.75h (out of 23.75h assigned).
Utkarsh Gupta did 23.75h (out of 23.75h assigned).

Evolution of the situation

In August we released 30 DLAs.

This is the first month of Jeremiah coordinating LTS contributors. We would like to thank Holger Levsen for his work on this role up to now.

Also, we would like to remark once again that we are constantly looking for new contributors. Please contact Jeremiah if you are interested!

The security tracker currently lists 73 packages with a known CVE and the dla-needed.txt file has 29 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 72 months)
- GitHub (for 63 months)
- Civil Infrastructure Platform (CIP) (for 40 months)
Gold sponsors:
- Roche Diagnostics International AG (for 83 months)
- Linode (for 77 months)
- Babiel GmbH (for 67 months)
- Plat’Home (for 66 months)
- University of Oxford (for 22 months)
- Deveryware (for 9 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 89 months)
- Domeneshop AS (for 88 months)
- Nantes Métropole (for 82 months)
- Université Jean Monnet de St Etienne (for 74 months)
- Univention GmbH (for 73 months)
- Ribbon Communications, Inc. (for 67 months)
- Exonet B.V. (for 57 months)
- Leibniz Rechenzentrum (for 51 months)
- CINECA (for 41 months)
- Ministère de l’Europe et des Affaires Étrangères (for 35 months)
- Cloudways Ltd (for 24 months)
- Dinahosting SL (for 22 months)
- Bauer Xcel Media Deutschland KG (for 16 months)
- Platform.sh (for 16 months)
- Moxa Intelligence Co., Ltd. (for 10 months)
- sipgate GmbH (for 7 months)
- Tilburg University (for 6 months)
- OVH US LLC (for 5 months)
Bronze sponsors:
- Evolix (for 88 months)
- Seznam.cz, a.s. (for 88 months)
- Intevation GmbH (for 85 months)
- Linuxhotel GmbH (for 85 months)
- Daevel SARL (for 84 months)
- Bitfolk LTD (for 83 months)
- Greenbone Networks GmbH (for 82 months)
- Megaspace Internet Services GmbH (for 82 months)
- NUMLOG (for 82 months)
- WinGo AG (for 81 months)
- Ecole Centrale de Nantes - LHEEA (for 77 months)
- Entr’ouvert (for 72 months)
- Adfinis AG (for 70 months)
- GNI MEDIA (for 64 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 64 months)
- Tesorion (for 64 months)
- Bearstech (for 56 months)
- LiHAS (for 56 months)
- People Doc (for 52 months)
- Catalyst IT Ltd (for 50 months)
- Demarcq SAS (for 44 months)
- Université Grenoble Alpes (for 30 months)
- TouchWeb SAS (for 22 months)
- SPiN AG (for 19 months)
- CoreFiling (for 15 months)
- Institut des sciences cognitives Marc Jeannerod (for 9 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 6 months)
- Tem Innovations GmbH
- WordFinder.pro

Monthly report about Debian Long Term Support, July 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Wed, 25 Aug 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In July, we put aside 2400 EUR to fund Debian projects. We haven’t received proposals of projects to fund in the last months, so we have scheduled a discussion during Debconf to try to to figure out why that is and how we can fix that. Join us on August 26th at 16:00 UTC on this link.

We are pleased to announce that Jeremiah Foster will help out to make this initiative a success : he can help Debian members to come up with solid proposals, he can look for people willing to do the work once the project has been formalized and approved, and he will make sure that the project implementation keeps on track when the actual work has begun.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In July, 12 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 5.0h (out of 7h assigned and 3h remaining), thus carrying over 5h to August.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 12.75h (out of 16h assigned and 2.75h from June), thus carrying over 6h to August.
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 39.75h assigned plus 11h from June), thus is carrying over 50.75h for August.
Holger Levsen’s work was coordinating/managing the LTS team, he did 3.5h (out of 12h assigned) and gave back 8.5h to the pool.
Markus Koschany did 30h (out of 30h assigned and 30h from June), thus carrying over 30h to August.
Ola Lundqvist did nothing (out of 12h assigned plus 20h from June), thus is carrying over 32h for August.
Roberto C. Sánchez did 13.5h (out of 32h assigned and 20h from June), and gave back 38.5h to the pool.
Sylvain Beucler did 30h (out of 30h assigned).
Thorsten Alteholz did 30h (out of 30h assigned).
Utkarsh Gupta did 39.75h (out of 39.75h assigned).

Evolution of the situation

In July we released 30 DLAs. Also we were glad to welcome Neil Williams and Lee Garrett who became active contributors.

The security tracker currently lists 63 packages with a known CVE and the dla-needed.txt file has 17 packages needing an update.

We would like to thank Holger Levsen for the years of work where he managed/coordinated the paid LTS contributors. Jeremiah Foster will take over his duties.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 71 months)
- GitHub (for 62 months)
- Civil Infrastructure Platform (CIP) (for 39 months)
Gold sponsors:
- Roche Diagnostics International AG (for 82 months)
- Linode (for 76 months)
- Babiel GmbH (for 65 months)
- Plat’Home (for 65 months)
- University of Oxford (for 21 months)
- Deveryware (for 8 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 87 months)
- Domeneshop AS (for 86 months)
- Nantes Métropole (for 80 months)
- Univention GmbH (for 72 months)
- Université Jean Monnet de St Etienne (for 72 months)
- Ribbon Communications, Inc. (for 66 months)
- Exonet B.V. (for 56 months)
- Leibniz Rechenzentrum (for 50 months)
- CINECA (for 39 months)
- Ministère de l’Europe et des Affaires Étrangères (for 33 months)
- Cloudways Ltd (for 23 months)
- Dinahosting SL (for 21 months)
- Bauer Xcel Media Deutschland KG (for 15 months)
- Platform.sh (for 15 months)
- Moxa Intelligence Co., Ltd. (for 9 months)
- sipgate GmbH (for 6 months)
- OVH US LLC (for 4 months)
- Tilburg University (for 4 months)
Bronze sponsors:
- Evolix (for 87 months)
- Seznam.cz, a.s. (for 87 months)
- Intevation GmbH (for 84 months)
- Linuxhotel GmbH (for 84 months)
- Daevel SARL (for 82 months)
- Bitfolk LTD (for 81 months)
- Megaspace Internet Services GmbH (for 81 months)
- Greenbone Networks GmbH (for 80 months)
- NUMLOG (for 80 months)
- WinGo AG (for 80 months)
- Ecole Centrale de Nantes - LHEEA (for 76 months)
- Entr’ouvert (for 71 months)
- Adfinis AG (for 68 months)
- GNI MEDIA (for 63 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 63 months)
- Tesorion (for 63 months)
- Bearstech (for 54 months)
- LiHAS (for 54 months)
- People Doc (for 51 months)
- Catalyst IT Ltd (for 49 months)
- Demarcq SAS (for 43 months)
- Université Grenoble Alpes (for 29 months)
- TouchWeb SAS (for 21 months)
- SPiN AG (for 18 months)
- CoreFiling (for 13 months)
- Institut des sciences cognitives Marc Jeannerod (for 8 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 5 months)

Monthly report about Debian Long Term Support, June 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Sat, 17 Jul 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In June, we put aside 5775 EUR to fund Debian projects for which we’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In June, 12 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 18.0h (out of 14h assigned and 19h from May), thus carrying over 15h to July.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 13.25h (out of 14h assigned and 2h from May), thus carrying over 2.75h to July.
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did 29h (out of 40h assigned), thus carrying over 11h to July.
Holger Levsen’s work was coordinating/managing the LTS team, he did 3.5h (out of 12h assigned) and gave back 8.5h to the pool.
Markus Koschany did 29.75h (out of 30h assigned plus 29.75h from May), thus carrying over 30h for July.
Ola Lundqvist did 10h (out of 12h assigned and 4.5h from May), thus carrying over 6.5h to July.
Roberto C. Sánchez did 12h (out of 32h assigned), thus carrying over 20h to July.
Sylvain Beucler did 30h (out of 30h assigned).
Thorsten Alteholz did 30h (out of 30h assigned).
Utkarsh Gupta did not report back about their work so we assume they did nothing (out of 40h assigned), thus is carrying over 40h for July.

Evolution of the situation

In June we released 30 DLAs. As already written last month we are looking for a Debian LTS project manager and team coordinator.
Finally, we would like to remark once again that we are constantly looking for new contributors. Please contact Holger if you are interested!

The security tracker currently lists 41 packages with a known CVE and the dla-needed.txt file has 23 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 70 months)
- GitHub (for 60 months)
- Civil Infrastructure Platform (CIP) (for 38 months)
Gold sponsors:
- Roche Diagnostics International AG (for 81 months)
- Linode (for 75 months)
- Babiel GmbH (for 64 months)
- Plat’Home (for 63 months)
- University of Oxford (for 20 months)
- Deveryware (for 7 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 86 months)
- Domeneshop AS (for 85 months)
- Nantes Métropole (for 79 months)
- Univention GmbH (for 71 months)
- Université Jean Monnet de St Etienne (for 71 months)
- Ribbon Communications, Inc. (for 65 months)
- Exonet B.V. (for 54 months)
- Leibniz Rechenzentrum (for 48 months)
- CINECA (for 38 months)
- Ministère de l’Europe et des Affaires Étrangères (for 32 months)
- Cloudways Ltd (for 21 months)
- Dinahosting SL (for 19 months)
- Platform.sh (for 14 months)
- Bauer Xcel Media Deutschland KG (for 13 months)
- Moxa Intelligence Co., Ltd. (for 7 months)
- sipgate GmbH (for 5 months)
- OVH US LLC (for 3 months)
- Tilburg University (for 3 months)
Bronze sponsors:
- Seznam.cz, a.s. (for 86 months)
- Evolix (for 85 months)
- Linuxhotel GmbH (for 83 months)
- Intevation GmbH (for 82 months)
- Daevel SARL (for 81 months)
- Bitfolk LTD (for 80 months)
- Megaspace Internet Services GmbH (for 80 months)
- Greenbone Networks GmbH (for 79 months)
- NUMLOG (for 79 months)
- WinGo AG (for 78 months)
- Ecole Centrale de Nantes - LHEEA (for 75 months)
- Entr’ouvert (for 70 months)
- Adfinis AG (for 67 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 62 months)
- Tesorion (for 62 months)
- GNI MEDIA (for 61 months)
- Bearstech (for 53 months)
- LiHAS (for 53 months)
- People Doc (for 49 months)
- Catalyst IT Ltd (for 47 months)
- Demarcq SAS (for 41 months)
- Université Grenoble Alpes (for 28 months)
- TouchWeb SAS (for 20 months)
- SPiN AG (for 16 months)
- CoreFiling (for 12 months)
- Institut des sciences cognitives Marc Jeannerod (for 7 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 3 months)

Monthly report about Debian Long Term Support, May 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Tue, 15 Jun 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In May, we again put aside 2100 EUR to fund Debian projects. There was no proposals for new projects received, thus we’re looking forward to receive more projects from various Debian teams! Please do not hesitate to submit a proposal, if there is a project that could benefit from the funding!

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In May, 12 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 7.0h (out of 14h assigned and 12h from April), thus carrying over 19h to June.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 16h (out of 13.5h assigned plus 4.5h from April), thus is carrying over 2h for June.
Chris Lamb did 18h (out of 18h assigned).
Holger Levsen’s work was coordinating/managing the LTS team, he did 5.5h and gave back 6.5h to the pool.
Markus Koschany did 15h (out of 29.75h assigned and 15h from April), thus carrying over 29.75h to June.
Ola Lundqvist did 12h (out of 12h assigned and 4.5h from April), thus carrying over 4.5h to June.
Roberto C. Sánchez did 7.5h (out of 27.5h assigned and 27h from April), and gave back 47h to the pool.
Sylvain Beucler did 29.75h (out of 29.75h assigned).
Thorsten Alteholz did 29.75h (out of 29.75h assigned).
Utkarsh Gupta did 29.75h (out of 29.75h assigned).

Evolution of the situation

In May we released 33 DLAs and mostly skipped our public IRC meeting and the end of the month. In June we’ll have another team meeting using video as lined out on our LTS meeting page. Also, two months ago we announced that Holger would step back from his coordinator role and today we are announcing that he is back for the time being, until a new coordinator is found. Finally, we would like to remark once again that we are constantly looking for new contributors. Please contact Holger if you are interested!

The security tracker currently lists 41 packages with a known CVE and the dla-needed.txt file has 21 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 69 months)
- GitHub (for 59 months)
- Civil Infrastructure Platform (CIP) (for 37 months)
Gold sponsors:
- Blablacar (for 84 months)
- Roche Diagnostics International AG (for 80 months)
- Linode (for 74 months)
- Babiel GmbH (for 63 months)
- Plat’Home (for 62 months)
- University of Oxford (for 19 months)
- Deveryware (for 6 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 85 months)
- Domeneshop AS (for 84 months)
- Nantes Métropole (for 78 months)
- Univention GmbH (for 70 months)
- Université Jean Monnet de St Etienne (for 70 months)
- Ribbon Communications, Inc. (for 64 months)
- Exonet B.V. (for 53 months)
- Leibniz Rechenzentrum (for 47 months)
- CINECA (for 37 months)
- Ministère de l’Europe et des Affaires Étrangères (for 31 months)
- Cloudways Ltd (for 20 months)
- Dinahosting SL (for 18 months)
- Platform.sh (for 13 months)
- Bauer Xcel Media Deutschland KG (for 12 months)
- Moxa Intelligence Co., Ltd. (for 6 months)
- sipgate GmbH (for 4 months)
- OVH US LLC
- Tilburg University
Bronze sponsors:
- Seznam.cz, a.s. (for 85 months)
- Evolix (for 84 months)
- Linuxhotel GmbH (for 82 months)
- Intevation GmbH (for 81 months)
- Daevel SARL (for 80 months)
- Bitfolk LTD (for 79 months)
- Megaspace Internet Services GmbH (for 79 months)
- Greenbone Networks GmbH (for 78 months)
- NUMLOG (for 78 months)
- WinGo AG (for 77 months)
- Ecole Centrale de Nantes - LHEEA (for 73 months)
- Entr’ouvert (for 69 months)
- Adfinis AG (for 66 months)
- Tesorion (for 61 months)
- GNI MEDIA (for 60 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 60 months)
- Bearstech (for 52 months)
- LiHAS (for 52 months)
- People Doc (for 48 months)
- Catalyst IT Ltd (for 46 months)
- Demarcq SAS (for 40 months)
- Université Grenoble Alpes (for 26 months)
- TouchWeb SAS (for 18 months)
- SPiN AG (for 15 months)
- CoreFiling (for 11 months)
- Institut des sciences cognitives Marc Jeannerod (for 6 months)
- Observatoire des Sciences de l’Univers de Grenoble

Monthly report about Debian Long Term Support, April 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Fri, 28 May 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In April, we put aside 5775 EUR to fund Debian projects. There was no proposals for new projects received, thus we’re looking forward to receive more projects from various Debian teams! Please do not hesitate to submit a proposal, if there is a project that could benefit from the funding!

Debian LTS contributors

In April, 11 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 14.0h (out of 14h assigned and 12h from March), thus carrying over 12h to May.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 14h (out of 16h assigned and 2.5h from March), thus carrying over 4.5h to May.
Chris Lamb did 18h (out of 18h assigned).
Holger Levsen’s work was coordinating/managing the LTS team, he did 10h (out of 12h assigned), and gave 2h back to the pool.
Markus Koschany did 15.0h (out of 30h assigned), thus carrying over 15h to May.
Ola Lundqvist did 7.5h (out of 12h assigned), thus carrying over 4.5h to May.
Roberto C. Sánchez did 9.5h (out of 32h assigned and 4.5h from March), thus carrying over 27h to May.
Sylvain Beucler did 30h (out of 30h assigned).
Thorsten Alteholz did 30h (out of 30h assigned).
Utkarsh Gupta did 60h (out of 60h assigned).

Evolution of the situation

In April we released 33 DLAs and held a LTS team meeting using video conferencing.

The security tracker currently lists 53 packages with a known CVE and the dla-needed.txt file has 26 packages needing an update.

We are please to welcome VyOS as a new gold sponsor!

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 68 months)
- GitHub (for 59 months)
- Civil Infrastructure Platform (CIP) (for 36 months)
Gold sponsors:
- Blablacar (for 83 months)
- Roche Diagnostics International AG (for 79 months)
- Linode (for 73 months)
- Babiel GmbH (for 62 months)
- Plat’Home (for 62 months)
- University of Oxford (for 18 months)
- Deveryware (for 5 months)
- VyOS
Silver sponsors:
- The Positive Internet Company (for 84 months)
- Domeneshop AS (for 83 months)
- Nantes Métropole (for 77 months)
- Univention GmbH (for 69 months)
- Université Jean Monnet de St Etienne (for 69 months)
- Ribbon Communications, Inc. (for 63 months)
- Exonet B.V. (for 53 months)
- Leibniz Rechenzentrum (for 47 months)
- CINECA (for 36 months)
- Ministère de l’Europe et des Affaires Étrangères (for 30 months)
- Cloudways Ltd (for 20 months)
- Dinahosting SL (for 18 months)
- Bauer Xcel Media Deutschland KG (for 12 months)
- Platform.sh (for 12 months)
- Moxa Intelligence Co., Ltd. (for 6 months)
- sipgate GmbH (for 3 months)
- OVH US LLC
- Tilburg University
Bronze sponsors:
- Evolix (for 84 months)
- Seznam.cz, a.s. (for 84 months)
- Intevation GmbH (for 81 months)
- Linuxhotel GmbH (for 81 months)
- Daevel SARL (for 79 months)
- Bitfolk LTD (for 78 months)
- Megaspace Internet Services GmbH (for 78 months)
- Greenbone Networks GmbH (for 77 months)
- NUMLOG (for 77 months)
- WinGo AG (for 77 months)
- Ecole Centrale de Nantes - LHEEA (for 73 months)
- Entr’ouvert (for 68 months)
- Adfinis AG (for 65 months)
- GNI MEDIA (for 60 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 60 months)
- Tesorion (for 60 months)
- Bearstech (for 51 months)
- LiHAS (for 51 months)
- People Doc (for 48 months)
- Catalyst IT Ltd (for 46 months)
- Supagro (for 41 months)
- Demarcq SAS (for 40 months)
- Université Grenoble Alpes (for 26 months)
- TouchWeb SAS (for 18 months)
- SPiN AG (for 15 months)
- CoreFiling (for 10 months)
- Institut des sciences cognitives Marc Jeannerod (for 5 months)
- Observatoire des Sciences de l’Univers de Grenoble

Monthly report about Debian Long Term Support, March 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Fri, 30 Apr 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In March, we put aside 3225 EUR to fund Debian projects but sadly nobody picked up anything, so this one of the many reasons Raphael posted as series of blog posts titled “Challenging times for Freexian”, posted in 4 author: Raphaël Hertzog parts on the last two days of March and the first two of April. [Part one, two, three and four]

So we’re still looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article!

Debian LTS contributors

In March, 11 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 9.0h (out of 9h assigned and 12h from February), thus carrying over 12h to April.
Anton Gladky did 12h (out of 12h assigned).
Ben Hutchings did 25.75h (out of 16h assigned and 12.25h from February), thus carrying over 2.5h to April.
Chris Lamb did 18h (out of 18h assigned).
Holger Levsen did 6h coordinating/managing the LTS team.
Markus Koschany did 30h (out of 30h assigned).
Ola Lundqvist did 6.h (out of 10h from February).
Roberto C. Sánchez did 9h (out of 32h assigned and 21.5h from February) and gave 40h back, thus carrying over 4.5h to April.
Sylvain Beucler did 30h (out of 30h assigned).
Thorsten Alteholz did 30h (out of 30h assigned).
Utkarsh Gupta did 60h (out of 60h assigned).

Evolution of the situation

In March we released 28 DLAs and held our second LTS team meeting for 2021 on IRC, with the next public IRC meeting coming up at the end of May.

At that meeting Holger announced that after 2.5 years he wanted to step back from his role helping Raphaël in coordinating/managing the LTS team. We would like to thank Holger for his continuous work on Debian LTS (which goes back to 2014) and are happy to report that we already found a successor which we will introduce in the upcoming April report from Freexian.

Finally, we would like to remark once again that we are constantly looking for new contributors. For a last time, please contact Holger if you are interested!

The security tracker currently lists 42 packages with a known CVE and the dla-needed.txt file has 28 packages needing an update.

We are also pleased to report that we got 4 new sponsors over the last 2 months : thanks to sipgate GmbH, OVH US LLC, Tilburg University and Observatoire des Sciences de l’Univers de Grenoble !

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 67 months)
- GitHub (for 58 months)
- Civil Infrastructure Platform (CIP) (for 35 months)
Gold sponsors:
- Blablacar (for 82 months)
- Roche Diagnostics International AG (for 78 months)
- Linode (for 72 months)
- Babiel GmbH (for 61 months)
- Plat’Home (for 61 months)
- University of Oxford (for 17 months)
- Deveryware (for 4 months)
Silver sponsors:
- The Positive Internet Company (for 83 months)
- Domeneshop AS (for 82 months)
- Nantes Métropole (for 77 months)
- Univention GmbH (for 68 months)
- Université Jean Monnet de St Etienne (for 68 months)
- Ribbon Communications, Inc. (for 62 months)
- Exonet B.V. (for 52 months)
- Leibniz Rechenzentrum (for 46 months)
- CINECA (for 35 months)
- Ministère de l’Europe et des Affaires Étrangères (for 30 months)
- Cloudways Ltd (for 19 months)
- Dinahosting SL (for 17 months)
- Bauer Xcel Media Deutschland KG (for 11 months)
- Platform.sh (for 11 months)
- Moxa Intelligence Co., Ltd. (for 5 months)
- sipgate GmbH
- OVH US LLC
- Tilburg University
Bronze sponsors:
- Evolix (for 83 months)
- Seznam.cz, a.s. (for 83 months)
- Intevation GmbH (for 80 months)
- Linuxhotel GmbH (for 80 months)
- Daevel SARL (for 78 months)
- Bitfolk LTD (for 77 months)
- Megaspace Internet Services GmbH (for 77 months)
- NUMLOG (for 77 months)
- Greenbone Networks GmbH (for 76 months)
- WinGo AG (for 76 months)
- Ecole Centrale de Nantes - LHEEA (for 72 months)
- Entr’ouvert (for 67 months)
- Adfinis AG (for 65 months)
- GNI MEDIA (for 59 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 59 months)
- Tesorion (for 59 months)
- Bearstech (for 50 months)
- LiHAS (for 50 months)
- People Doc (for 47 months)
- Catalyst IT Ltd (for 45 months)
- Supagro (for 40 months)
- Demarcq SAS (for 39 months)
- Université Grenoble Alpes (for 25 months)
- TouchWeb SAS (for 17 months)
- SPiN AG (for 14 months)
- CoreFiling (for 9 months)
- Institut des sciences cognitives Marc Jeannerod (for 4 months)
- Observatoire des Sciences de l’Univers de Grenoble

Monthly report about Debian Long Term Support, February 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 22 Mar 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In February, we put aside 5475 EUR to fund Debian projects. The first project from this initiative was finished and thus Carles Pina was able to issue the first invoice!

We are looking forward to receive more projects from various Debian teams and contributors. Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In February, 12 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 19.0h (out of 7h assigned and 12h from January).
Ben Hutchings did 19h (out of 16h assigned and 15.25h from January), thus carrying over 12.25h to March.
Brian May did 10h (out of 10h assigned).
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did not report back about their work so for now we assume they did nothing (out of 28h assigned plus 35.5h from January), thus is carrying over 63.5h for March.
Holger Levsen did 6h coordinating/managing the LTS team.
Markus Koschany did 23.25h (out of 23.25h assigned).
Ola Lundqvist did 7h (out of 12h assigned and 10h from January) and gave back 5h, thus carrying over 10h to March.
Roberto C. Sánchez did 10.5h (out of 32h assigned), thus carrying over 21.5h to March.
Sylvain Beucler did 30h (out of 30h assigned).
Thorsten Alteholz did 30h (out of 30h assigned).
Utkarsh Gupta did 60h (out of 60h assigned).

Evolution of the situation

In February we released 28 DLAs (including one regression update) and we held an internal team meeting using video chat.
Finally, as every month we would like to remark once again that we are constantly looking for new contributors. Please contact Holger if you are interested!

The security tracker currently lists 46 packages with a known CVE and the dla-needed.txt file has 34 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 66 months)
- GitHub (for 56 months)
- Civil Infrastructure Platform (CIP) (for 34 months)
Gold sponsors:
- Blablacar (for 81 months)
- Roche Diagnostics International AG (for 77 months)
- Linode (for 71 months)
- Babiel GmbH (for 60 months)
- Plat’Home (for 59 months)
- University of Oxford (for 16 months)
- Deveryware (for 3 months)
Silver sponsors:
- The Positive Internet Company (for 82 months)
- Domeneshop AS (for 81 months)
- Nantes Métropole (for 75 months)
- Univention GmbH (for 67 months)
- Université Jean Monnet de St Etienne (for 67 months)
- Ribbon Communications, Inc. (for 61 months)
- Exonet B.V. (for 51 months)
- Leibniz Rechenzentrum (for 45 months)
- CINECA (for 34 months)
- Ministère de l’Europe et des Affaires Étrangères (for 28 months)
- Cloudways Ltd (for 17 months)
- Dinahosting SL (for 15 months)
- Platform.sh (for 10 months)
- Bauer Xcel Media Deutschland KG (for 9 months)
- Moxa Intelligence Co., Ltd. (for 4 months)
- sipgate GmbH
Bronze sponsors:
- Evolix (for 82 months)
- Seznam.cz, a.s. (for 82 months)
- Linuxhotel GmbH (for 79 months)
- Intevation GmbH (for 78 months)
- Daevel SARL (for 77 months)
- Bitfolk LTD (for 76 months)
- Megaspace Internet Services GmbH (for 76 months)
- Greenbone Networks GmbH (for 75 months)
- NUMLOG (for 75 months)
- WinGo AG (for 74 months)
- Ecole Centrale de Nantes - LHEEA (for 71 months)
- Entr’ouvert (for 66 months)
- Adfinis AG (for 63 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 58 months)
- Tesorion (for 58 months)
- GNI MEDIA (for 57 months)
- Bearstech (for 49 months)
- LiHAS (for 49 months)
- People Doc (for 45 months)
- Catalyst IT Ltd (for 44 months)
- Supagro (for 39 months)
- Demarcq SAS (for 38 months)
- Université Grenoble Alpes (for 24 months)
- TouchWeb SAS (for 16 months)
- SPiN AG (for 12 months)
- CoreFiling (for 8 months)
- Institut des sciences cognitives Marc Jeannerod (for 3 months)

Monthly report about Debian Long Term Support, January 2021 (by Raphaël Hertzog)

Raphaël Hertzog — Mon, 15 Feb 2021 00:00:00 +0000

Like each month, have a look at the work funded by Freexian’s Debian LTS offering.

Debian project funding

In January, we put aside 2175 EUR to fund Debian projects. As part of this Carles Pina i Estany started to work on better no-dsa support for the PTS which recently resulted in two merge requests which will hopefully be deployed soon.

We’re looking forward to receive more projects from various Debian teams! Learn more about the rationale behind this initiative in this article.

Debian LTS contributors

In January, 13 contributors have been paid to work on Debian LTS, their reports are available:

Abhijith PA did 9.0h (out of 14h assigned and 7h from December), thus carrying over 12h to February.
Adrian Bunk did 14h (out of 26h assigned), thus carrying over 12h to February, which he then gave back.
Ben Hutchings did 0.25h (out of 7h assigned and 8.5h from December), thus carrying over 15.25h to February.
Brian May did 10h (out of 10h assigned).
Chris Lamb did 18h (out of 18h assigned).
Emilio Pozuelo Monfort did not report back about their work so we assume they did nothing (out of 26h assigned plus 9.5h from December), thus is carrying over 35.5h for February.
Holger Levsen did 6.5h coordinating/managing the LTS team..
Markus Koschany did 36.75h (out of 26h assigned and 10.75h from December).
Ola Lundqvist did 2.5h (out of 10.5h assigned and 11.5h from December) and gave back 9.5 hours, thus carrying over 10h to February.
Roberto C. Sánchez did 6h (out of 26h assigned), thus carrying over 20h to February, which he then gave back.
Sylvain Beucler did 26h (out of 26h assigned).
Thorsten Alteholz did 26h (out of 26h assigned).
Utkarsh Gupta did 26h (out of 26h assigned).

Evolution of the situation

In January we released 28 DLAs and held our first LTS team meeting for 2021 on IRC, with the next public IRC meeting coming up at the end of March. During that meeting Utkarsh shared that after he rolled out the python-certbot update (on December 8th 2020) the maintainer told him: “I just checked with Let’s Encrypt, and the stats show that you just saved 142,500 people from having their certificates start failing next month. I didn’t know LTS was still that used!”

Finally, we would like to welcome sipgate GmbH as a new silver sponsor. Also remember that we are constantly looking for new contributors. Please contact Holger if you are interested.

The security tracker currently lists 43 packages with a known CVE and the dla-needed.txt file has 23 packages needing an update.

Thanks to our sponsors

Sponsors that joined recently are in bold.

Platinum sponsors:
- TOSHIBA (for 65 months)
- GitHub (for 55 months)
- Civil Infrastructure Platform (CIP) (for 33 months)
Gold sponsors:
- Blablacar (for 80 months)
- Roche Diagnostics International AG (for 76 months)
- Linode (for 70 months)
- Babiel GmbH (for 59 months)
- Plat’Home (for 58 months)
- University of Oxford (for 15 months)
- Deveryware
Silver sponsors:
- The Positive Internet Company (for 81 months)
- Domeneshop AS (for 80 months)
- Nantes Métropole (for 74 months)
- Univention GmbH (for 66 months)
- Université Jean Monnet de St Etienne (for 66 months)
- Ribbon Communications, Inc. (for 60 months)
- Exonet B.V. (for 49 months)
- Leibniz Rechenzentrum (for 43 months)
- CINECA (for 33 months)
- Ministère de l’Europe et des Affaires Étrangères (for 27 months)
- Cloudways Ltd (for 16 months)
- Dinahosting SL (for 14 months)
- Platform.sh (for 9 months)
- Bauer Xcel Media Deutschland KG (for 8 months)
- Moxa Intelligence Co., Ltd.
- sipgate GmbH
Bronze sponsors:
- Seznam.cz, a.s. (for 81 months)
- Evolix (for 80 months)
- Linuxhotel GmbH (for 78 months)
- Intevation GmbH (for 77 months)
- Daevel SARL (for 76 months)
- Bitfolk LTD (for 75 months)
- Megaspace Internet Services GmbH (for 75 months)
- Greenbone Networks GmbH (for 74 months)
- NUMLOG (for 74 months)
- WinGo AG (for 73 months)
- Ecole Centrale de Nantes - LHEEA (for 69 months)
- Entr’ouvert (for 65 months)
- Adfinis AG (for 62 months)
- Tesorion (for 57 months)
- GNI MEDIA (for 56 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 56 months)
- Bearstech (for 48 months)
- LiHAS (for 48 months)
- People Doc (for 44 months)
- Catalyst IT Ltd (for 42 months)
- Supagro (for 38 months)
- Demarcq SAS (for 36 months)
- Université Grenoble Alpes (for 22 months)
- TouchWeb SAS (for 14 months)
- SPiN AG (for 11 months)
- CoreFiling (for 7 months)
- Institut des sciences cognitives Marc Jeannerod

Planet-Debian on Freexian

Debian Contributions: Go default compatibility, Trimming build-essential, Python upstream engagement and more! (by Anupa Ann Joseph)

Debian Contributions: 2026-05

Go default compatibility, by Helmut Grohne

Trimming build-essential, by Helmut Grohne

Python upstream engagement, by Stefano Rivera

Miscellaneous contributions

Debian Contributions: Detecting undeclared file conflicts, contributors.debian.org mini-sprint, security-tracker performance and more! (by Anupa Ann Joseph)

Debian Contributions: 2026-04

Undeclared file conflicts, by Helmut Grohne

contributors.debian.org mini-sprint, by Enrico Zini

MiniDebConf Campinas, by Lucas Kanashiro, Santiago Ruano Rincón and Antonio Terceiro

security-tracker performance, by Helmut Grohne and Emilio Pozuelo Monfort

dput-ng data loss bug, by Colin Watson

Miscellaneous contributions

Debusine workflow performance issues (by Colin Watson)

Data model

Causes

Fixes

Workflow orchestration

Expiry

Whole-workflow locking

Scheduling

Worker refactoring

Database write volume

Current state

Monthly report about Debian Long Term Support, April 2026 (by Thorsten Alteholz)

Activity summary

Individual Debian LTS contributor reports

Thanks to our sponsors

Monthly report about Debian Long Term Support, March 2026 (by Santiago Ruano Rincón)

Activity summary

Individual Debian LTS contributor reports

Thanks to our sponsors

Debian Contributions: Debusine projects in GSoC, Debian CI updates, Salsa CI maintenance and more! (by Anupa Ann Joseph)

Debian Contributions: 2026-03

Debusine projects in Google’s Summer of Code

Debian CI: incus backend and upgrade to Bootstrap 5, by Antonio Terceiro

Salsa CI maintenance by Santiago Ruano Rincón et al.

Miscellaneous contributions

Monthly report about Debian Long Term Support, February 2026 (by Thorsten Alteholz)

Activity summary

Individual Debian LTS contributor reports

Thanks to our sponsors

Regression Tracking in Debusine (by Stefano Rivera)

Regression Tracking

Using regression tracking now

Debian Contributions: Opening DebConf 26 Registration, Debian CI improvements and more! (by Anupa Ann Joseph)

Debian Contributions: 2026-02

DebConf 26 Registration, by Stefano Rivera, Antonio Terceiro, and Santiago Ruano Rincón

Debian CI improvements, by Antonio Terceiro

Miscellaneous contributions

Monthly report about Debian Long Term Support, January 2026 (by Santiago Ruano Rincón)

Activity summary

Individual Debian LTS contributor reports

Thanks to our sponsors

Debian Contributions: cross building, rebootstrap updates, Refresh of the patch tagging guidelines and more! (by Anupa Ann Joseph)

Debian Contributions: 2026-01

cross building, by Helmut Grohne

rebootstrap, by Helmut Grohne

Refresh of the patch tagging guidelines, by Raphaël Hertzog

Miscellaneous contributions

Writing a new worker task for Debusine (by Carles Pina i Estany)

Overview of tasks

Defining the inputs of the task

Add the new Reprotest artifact data class

Create the new Task class

Resolving inputs: input fields and dynamic data

fetch_input method

configure_for_execution method

_cmdline method

_cmdline_as_root method

task_result method

upload_artifacts method

Execution example

What is left to do?

Monthly report about Debian Long Term Support, December 2025 (by Santiago Ruano Rincón)

Activity summary

Individual Debian LTS contributor reports

Thanks to our sponsors

Add the new `Reprotest` artifact data class

`fetch_input` method

`configure_for_execution` method

`_cmdline` method

`_cmdline_as_root` method

`task_result` method

`upload_artifacts` method

Preparing for `setup.py install` deprecation, by Colin Watson