Debian News

Freexian’s report about Debian Long Term Support, February 2018

March 16, 2018 by Raphaël Hertzog

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In February, about 196 work hours have been dispatched among 12 paid contributors. Their reports are available:

Abhijith PA did 8 hours.
Antoine Beaupré did 7.25h (out of 4h allocated + 3.25h remaining).
Ben Hutchings did 13 hours (out of 15h allocated, thus keeping 2 extra hours for March).
Brian May did 10 hours.
Chris Lamb did 18 hours.
Emilio Pozuelo Monfort did 2 hours only due to personal issues (out of 23.75 hours allocated + 10.5 hours remaining, he gave back the remaining 32.25 hours).
Hugo Lefeuvre did 1.5 hours (out of 23.75 hours allocated, thus keeping 22.25 extra hours for March).
Markus Koschany did 23.75 hours.
Ola Lundqvist did 9 hours (out of 14 hours allocated, thus keeping 5 extra hours for March).
Roberto C. Sanchez did 27.5 hours (out of 23.75 hours allocated + 3.75 hours remaining).
Santiago Ruano Rincón did 6 hours (out of 8 hours allocated, thus keeping 2 extra hours for March).
Thorsten Alteholz did 23.75 hours.

Evolution of the situation

The number of sponsored hours did not change but a new platinum sponsor is about to join our project.

The security tracker currently lists 60 packages with a known CVE and the dla-needed.txt file 33. The number of open issues increased significantly and we seem to be behind in terms of CVE triaging.

Thanks to our sponsors

New sponsors are in bold.

Platinum sponsors:

TOSHIBA (for 29 months)
GitHub (for 20 months)

Gold sponsors:

The Positive Internet (for 45 months)
Blablacar (for 44 months)
Linode (for 34 months)
Babiel GmbH (for 23 months)
Plat’Home (for 23 months)

Silver sponsors:

Domeneshop AS (for 44 months)
Université Lille 3 (for 44 months)
Trollweb Solutions (for 42 months)
Nantes Métropole (for 38 months)
Dalenys (for 35 months)
Univention GmbH (for 30 months)
Université Jean Monnet de St Etienne (for 30 months)
Ribbon Communications, Inc. (for 24 months)
maxcluster GmbH (for 18 months)
Exonet B.V. (for 14 months)
Leibniz Rechenzentrum (for 8 months)
Vente-privee.com (for 5 months)

Bronze sponsors:

David Ayers – IntarS Austria (for 45 months)
Evolix (for 45 months)
Offensive Security (for 45 months)
Seznam.cz, a.s. (for 45 months)
Freeside Internet Service (for 44 months)
MyTux (for 44 months)
Intevation GmbH (for 42 months)
Linuxhotel GmbH (for 42 months)
Daevel SARL (for 40 months)
Bitfolk LTD (for 39 months)
Megaspace Internet Services GmbH (for 39 months)
Greenbone Networks GmbH (for 38 months)
NUMLOG (for 38 months)
WinGo AG (for 38 months)
Ecole Centrale de Nantes – LHEEA (for 34 months)

Individual reports

In Ja

Sig-I/O (for 31 months)
Entr’ouvert (for 29 months)
Adfinis SyGroup AG (for 26 months)
GNI MEDIA (for 21 months)
Laboratoire LEGI – UMR 5519 / CNRS (for 21 months)
Quarantainenet BV (for 21 months)
RHX Srl (for 18 months)
Bearstech (for 12 months)
LiHAS (for 12 months)
People Doc (for 9 months)
Catalyst IT Ltd (for 7 months)
Supagro
Demarcq SAS

My Free Software Activities in February 2018

March 6, 2018 by Raphaël Hertzog

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donors (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it’s one of the best ways to find volunteers to work with me on projects that matter to me.

Distro Tracker

Since we switched to salsa, and with the arrival of prospective GSOC students interested to work on distro-tracker this summer, I have been rather active on this project as can be seen in the project’s activity summary. Among the most important changes we can note:

The documentation and code coverage analysis is updated on each push.
Unit tests, functional tests and style checks (flake8) are run on each push but also on merge requests, allowing contributors to have quick feedback on their code. Implemented with this Gitlab CI configuration.
Multiple bug fixes (more of it). Update code to use python3-gpg instead of deprecated python3-gpgme (I had to coordinate with DSA to get the new package installed).
More unit tests for team related code. Still a work in progress but I made multiple reviews already.

Debian Live

I created the live-team on salsa.debian.org to prepare for the move of the various Debian live repositories. The move itself has been done by Steve McIntyre. In the discussion, we also concluded that the live-images source package can go away. I thus filed its removal request.

Then I spent a whole day reviewing all the pending patches. I merged most of them and left comments on the remaining ones:

Merged #885453 cleaning up double slashes in some paths.
Merged #885466 allowing to set upperdir tmpfs mount point size.
Merged #885455 switching back the live-boot initrd to use busybox’s wget as it supports https now.
Merged #886328 simplifying the mount points handling by using /run/live instead of /lib/live/mount.
Merged #886337 adding options to build smaller initrd by disabling some features.
Merged #866009 fixing a race condition between live-config and systemd-tmpfiles-setup.
Reviewed #884355 implementing new hooks in live-boot’s initrd. Not ready for merge yet.
Reviewed #884553 implementing cross-architecture linux flavour selection. Not ready for merge yet.
Merged #891206 fixing a regression with local mirrors.
Merged #867539 lowering the process priority of mksquasfs to avoid rendering the machine completely unresponsive during this step.
Merged #885692 adding UEFI support for ARM64.
Merged #847919 simplifying the bootstrap of foreign architectures.
Merged #868559 fixing fuse mounts by switching back to klibc’s mount.
Wrote a patch to fix verify-checksums option in live-boot (see #856482).

I released a new version of live-config but wanted some external testing before releasing the new live-boot. This did not happen yet unfortunately.

Debian LTS

I started a discussion on debian-devel about how we could handle the extension of the LTS program that some LTS sponsors are asking us to do.

The response have been rather mixed so far. It is unlikely that wheezy will be kept on the official mirror after its official EOL date but it’s not clear whether it would be possible to host the wheezy updates on some other debian.org server for longer.

Debian Handbook

I moved the git repository of the book to salsa and released a new version in unstable to fix two recent bugs: #888575 asking us to implement some parallel building to speed the build and #888578 informing us that a recent debhelper update broke the build process due to the presence of a build directory in the source package.

Debian Packaging

I moved all my remaining packages to salsa.debian.org and used the opportunity to clean them up:

dh-linktree, ftplib, gnome-shell-timer (fixed #891305 later), logidee-tools, publican, publican-debian, vboot-utils, rozofs
Some also got a new upstream release for the same price: tcpdf, lpctools, elastalert, notmuch-addrlookup.
I orphaned tcpdf in #889731 and I asked for the removal of feed2omb in #742601.
I updated django-modeltranslation to 0.12.2 to fix FTBFS bug #834667 (I submitted an upstream pull request at the same time).

Dolibarr. As a sponsor of dolibarr I filed its removal request and then I started a debian-devel discussion because we should be able to provide such applications to our users even though its development practice does not conform to some of our policies.

Bash. I uploaded a bash NMU (4.4.18-1.1) to fix a regression introduced by the PIE-enabled build (see #889869). I filed an upstream bug against bash but it turns out it’s actually a bug in qemu-user that really ought to be fixed. I reported the bug to qemu upstream but it hasn’t gotten much traction.

pkg-security team. I sponsored many updates over the month: rhash 1.3.5-1, medusa 2.2-5, hashcat, dnsrecon, btscanner, wfuzz 2.2.9, pixiewps 1.4.2-1, inetsim (new from kali). I also made a new upload of sslsniff with the OpenSSL 1.1 patch contributed by Hilko Bengen.

Debian bug reports

I filed a few bug reports:

#889814: lintian: Improve long description of epoch-change-without-comment
#889816: lintian: Complain when epoch has been bumped but upstream version did not go backwards
#890594: devscripts: Implement a salsa-configure script to configure salsa.debian.org project repositories
#890700 and #890701 about missing Vcs-Git fields to siridb-server and libcleri
#891301: lintian: privacy-breach-generic should not complain about <link rel=”generator”> and others

Misc contributions

Saltstack formulas. I pushed misc fixes to the munin-formula, the samba-formula and the openssh-formula. I submitted two other pull requests: on samba-formula and on users-formula.

QA’s carnivore database. I fixed a bug in a carnivore script that was spewing error messages about duplicate uids. This database links together multiple identifiers (emails, GPG key ids, LDAP entry, etc.) for the same Debian contributor.

Thanks

See you next month for a new summary of my activities.

Time to Join Extended Long Term Support for Debian 7 Wheezy

February 20, 2018 by Raphaël Hertzog

Debian 7 Wheezy LTS period ends on May 31st and some companies asked Freexian if they could get security support past this date. Since about half of the current team of paid LTS contributors is willing to continue to provide security updates for Wheezy, I have started to work on making this possible.

I just initiated a discussion on debian-devel with multiple Debian teams to see whether it is possible to continue to use debian.org infrastructure to host the wheezy security updates that would be prepared in this extended LTS period.

From the sponsor side, this extended LTS will not work like the regular LTS. It is unrealistic to continue to support all packages and all architectures so only the packages/architectures requested by sponsors will be supported. The amount invoiced to each sponsor will be directly related to the package list that they ask us to support. We made an estimation (based on history) of how much it costs to support each package and we split that cost between all the sponsors that are requesting support for this package. That cost is re-evaluated quarterly and will likely increase over time as sponsors are stopping their support (when they finished to migrate all their machines for example).

This extended LTS will also have some restrictions in terms of packages that we can support. For instance, we will no longer support the linux kernel from wheezy, you will have to switch to the kernel used in jessie (or maybe we will maintain a backport ourselves in wheezy). It is also not yet clear whether we can support OpenJDK since upstream support of version 7 stops at the end of June. And switching to OpenJDK 8 is likely non-trivial. There are likely other unsupportable packages too.

Anyway, if your company needs wheezy security support past end of May, now is the time to worry about it. Please send us a mail with the list of source packages that you would like to see supported. The more companies get involved, the less it will cost to each of them. Our plans are to gather the required data from interested companies in the next few weeks and make a first estimation of the price they will have to pay for the first quarter by mid-march. Then they confirm that they are OK with the offer and we will emit invoices in April so that they can be paid before end of May.

Note however that we decided that it would not be possible to sponsor extended wheezy support (and thus influence which packages are supported) if you are not among the regular LTS sponsors (at bronze level at least). Extended LTS would not be possible without the regular LTS so if you need the former, you have to support the latter too.

Freexian’s report about Debian Long Term Support, January 2018

February 19, 2018 by Raphaël Hertzog

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In January, about 160 work hours have been dispatched among 11 paid contributors. Their reports are available:

Antoine Beaupré did 13h (out of 4h allocated + 12.25h remaining, thus keeping 3.25h for February).
Ben Hutchings did 23 hours (out of 15h allocated + 8 remaining hours).
Brian May did 10 hours.
Chris Lamb did 18 hours.
Emilio Pozuelo Monfort did 9 hours (out of 18.25 hours allocated + 1.25 hours remaining, thus keeping 10.5 hours for February).
Guido Günther did 6 hours (out of 8h allocated, thus keeping 2h for February).
Hugo Lefeuvre did 18.25 hours.
Markus Koschany did 18.25 hours.
Ola Lundqvist did 14 hours.
Roberto C. Sanchez did 14.5 hours (out of 18.25 hours allocated, thus keeping 3.75 extra hours for February).
Thorsten Alteholz did 18.25 hours.

Evolution of the situation

The number of sponsored hours increased slightly at 187 hours per month. It would be nice if the slow growth could continue as the amount of work seems to be slowly growing too.

The security tracker currently lists 23 packages with a known CVE and the dla-needed.txt file 23 too. The number of open issues seems to be stable compared to last month which is a good sign.

Thanks to our sponsors

New sponsors are in bold.

Platinum sponsors:

TOSHIBA (for 28 months)
GitHub (for 19 months)

Gold sponsors:

The Positive Internet (for 44 months)
Blablacar (for 43 months)
Linode (for 33 months)
Babiel GmbH (for 22 months)
Plat’Home (for 22 months)

Silver sponsors:

Domeneshop AS (for 44 months)
Université Lille 3 (for 43 months)
Trollweb Solutions (for 41 months)
Nantes Métropole (for 38 months)
Dalenys (for 34 months)
Univention GmbH (for 29 months)
Université Jean Monnet de St Etienne (for 29 months)
Sonus Networks (for 23 months)
maxcluster GmbH (for 17 months)
Exonet B.V. (for 13 months)
Leibniz Rechenzentrum (for 7 months)
Vente-privee.com (for 4 months)

Bronze sponsors:

David Ayers – IntarS Austria (for 44 months)
Evolix (for 44 months)
Offensive Security (for 44 months)
Seznam.cz, a.s. (for 44 months)
Freeside Internet Service (for 43 months)
MyTux (for 43 months)
Intevation GmbH (for 41 months)
Linuxhotel GmbH (for 41 months)
Daevel SARL (for 40 months)
Bitfolk LTD (for 38 months)
Megaspace Internet Services GmbH (for 38 months)
NUMLOG (for 38 months)
Greenbone Networks GmbH (for 37 months)
WinGo AG (for 37 months)
Ecole Centrale de Nantes – LHEEA (for 33 months)
Sig-I/O (for 31 months)
Entr’ouvert (for 28 months)
Adfinis SyGroup AG (for 26 months)
GNI MEDIA (for 20 months)
Laboratoire LEGI – UMR 5519 / CNRS (for 20 months)
Quarantainenet BV (for 20 months)
RHX Srl (for 17 months)
Bearstech (for 12 months)
LiHAS (for 12 months)
People Doc (for 8 months)
Catalyst IT Ltd (for 6 months)
Supagro
Demarcq SAS

« Previous Page
1
…
3
4
5
6
7
…
54
Next Page »

Individual reports

Evolution of the situation

Thanks to our sponsors

Individual reports

Distro Tracker

Debian Live

Debian LTS

Debian Handbook

Debian Packaging

Debian bug reports

Misc contributions

Thanks

Individual reports

Evolution of the situation

Thanks to our sponsors

Tags

Recent Posts