News – Page 35

Freexian’s report about Debian Long Term Support, May 2015

June 15, 2015 by Raphaël Hertzog

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In May, 66.25 work hours have been dispatched among 8 paid contributors. Their reports are available:

Ben Hutchings did 10.5 hours.
Guido Günther did 6 hours (of 8 assigned, he will catch up the remaining hours over June).
Holger Levsen did 2 hours (of 5 hours assigned, the remaining hours have been dispatched to other contributors).
Mike Gabriel did 8 hours.
Raphaël Hertzog did 10.25 hours.
Santiago Ruano Rincón did 10.25 hours.
Scott Kitterman did 4 hours.
Thorsten Alteholz did 10.25 hours.

Evolution of the situation

June has seen a nice increase in terms of sponsored hours (73.50 hours per month) and July shall continue this trend. All the sponsors that are with us since day 0 have just renewed their support (after the first year): many thanks to David Ayers – IntarS Austria, Domeneshop AS, Evolix, Offensive Security and Seznam.cz, a.s. !

Our first milestone of funding the equivalent of a half-time position in now within reach, we only need 9 more hours of sponsored work per month. At the current rate, that makes 2 or 3 new “average” sponsors.

In terms of security updates waiting to be handled, the situation continued to improve: the dla-needed.txt file lists 19 packages awaiting an update (9 less than last month), the list of open vulnerabilities in Squeeze shows about 36 affected packages in total (24 less than last month).

If we keep getting more support, we will be in a good position to extend the coverage that we will offer for Wheezy LTS (notably for virtualization related packages) and we will also be able to consider switching to MySQL 5.5 for Squeeze LTS since MySQL 5.1 is no longer supported upstream (and other similar requests that tend to pop up as more and more software reach their upstream end-of-life).

Thanks to our sponsors

The new sponsors of the month are in bold.

Gold sponsors:

Linode LLC
The Positive Internet

Silver sponsors:

Bronze sponsors:

My Free Software Activities in May 2015

June 3, 2015 by Raphaël Hertzog

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donators (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it’s one of the best ways to find volunteers to work with me on projects that matter to me.

Debian LTS

This month I have been paid to work 10.25 hours on Debian LTS. In that time I did the following:

CVE triage: I pushed 28 commits to the security tracker.
Reviewed an exactimage update and an imagemagick update (prepared by their respective maintainers).
Prepared and released DLA-229-1 on libnokogiri-ruby fixing one CVE.
Prepared and released DLA-230-1 on eglibc fixing one CVE.

Other Debian work

Package Tracker. The Debian system administrators upgraded the machine hosting tracker.debian.org to jessie and I dealt with the fallout. Fixing the Apache configuration was easy but DACS also broke and I had to disable it (thus breaking login via sso.debian.org). Fortunately Enrico Zini and Martin Zobel-Helas debugged the problem and restored it.

Sponsorship. I sponsored a dolibarr upload and many tryton-modules-* uploads to bring Tryton 3.6 to Debian (and granted DM rights on the newly introduced packages to Matthias Behrle who is maintaining those packages).

Misc stuff. I discussed multiple feature requests with Dmitry Smirnov for dh-linktree.

Packaging. I uploaded a new upstream version of cpputest. I did that twice actually because the first version had failing tests (see #784674). I also filed #784959 on blhc because I saw what looked like a false positive report for a missing hardening flag.

I uploaded Django 1.8 to experimental. This is a major upstream release and shall ideally only be uploaded to sid after having reported problems on reverse dependencies. I doubt we will have the time to do this…

I started working on Publican 4.3.0 but the test suite fails and it’s not even the fault of publican for once. It’s a bug in libxml apparently.

Thanks

See you next month for a new summary of my activities.

Freexian’s report about Debian Long Term Support, April 2015

May 18, 2015 by Raphaël Hertzog

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In April, 81.75 work hours have been dispatched among 5 paid contributors (20.75 hours where unused hours of Ben and Holger that were re-dispatched to other contributors). Their reports are available:

Ben Hutchings did 16 hours.
Holger Levsen did 3 hours (of 5 hours assigned).
Mike Gabriel did 8 hours.
Raphaël Hertzog did 26.25 hours.
Thorsten Alteholz did 26.5 hours.

Evolution of the situation

May has seen a small increase in terms of sponsored hours (66.25 hours per month) and June is going to do even better with at least a new gold sponsor. We will have no problems sustaining the increased workload it implies since three Debian developers joined the team of contributors paid by Freexian (Antoine Beaupré, Santiago Ruano Rincón, Scott Kitterman).

The Jessie release probably shed some light on the Debian LTS project since we announced that Jessie will benefit from 5 years of support. Let’s hope that the trend will continue in the following months and that we reach our first milestone of funding the equivalent of a half-time position.

In terms of security updates waiting to be handled, the situation is a bit contrasted: the dla-needed.txt file lists 28 packages awaiting an update (12 less than last month), the list of open vulnerabilities in Squeeze shows about 60 affected packages in total (4 more than last month). The extra hours helped to make a good stride in the packages awaiting an update but there are many new vulnerabilities waiting to be triaged.

Thanks to our sponsors

The new sponsors of the month are in bold.

Gold sponsors:

The Positive Internet

Silver sponsors:

Bronze sponsors:

My Free Software Activities in April 2015

May 5, 2015 by Raphaël Hertzog

Debian LTS

This month I have been paid to work 26.25 hours on Debian LTS. In that time I did the following:

CVE triage: I pushed 52 commits to the security tracker. I finished a new helper script (bin/lts-cve-triage.py) that builds on the JSON output that Holger implemented recently. It helps to triage more quickly some issues based on the triaging work already done by the Debian Security team.
I filed #783005 to clarify the situation of libhtp and suricata in unstable (discovered this problem while triaging issues affecting those packages).
I reviewed and sponsored DLA-197-1 for Nguyen Cong fixing 5 CVE on libvncserver.
I released DLA-199-1 fixing one CVE on libx11. I also used codesearch.debian.net to identify all packages that had to be rebuilt with the fixed macro and uploaded them all (there was 11 of them).
I sponsored DLA-207-1 for James McCoy fixing 7 CVE on subversion.
I released DLA-210-1 fixing 5 CVE on qt4-x11.
I released DLA-213-1 fixing 7 CVE on openjdk-6.
I released DLA-214-1 fixing 1 CVE on libxml-libxml-perl.
I released DLA-215-1 fixing 1 CVE on libjson-ruby. This backport was non-trivial but luckily included some non-regression tests.
I filed #783800 about the security-tracker not handling correctly squeeze-lts/non-free.

Now, still related to Debian LTS, but on unpaid hours I did quite a few other things:

I wrote a talk on Debian LTS that I gave during the Mini-DebConf in Lyon. I took quite some time to collect some statistics about the last 10 months of work within the team.
I helped to draft a press release announcing our plans for Wheezy LTS and seeking more help at the same time.
I ensured that the Jessie press release will include a sentence saying that it would be supported for 5 years too.

Other Debian work

Feature request in update-alternatives. After a discussion with Josselin Mouette during the Mini-DebConf in Lyon, I filed #782493 to request the possibility to override at a system-wide level the default priority of alternatives recorded in update-alternatives. This would make it easier for derivatives to make different choices than Debian.

Sponsored a dnsjava NMU. This NMU introcuded a new upstream version which is needed by jitsi. And I also notified the MIA team that the dnsjava maintainers have disappeared.

python-crcmod bug fix and uploads to *-backports. A member of the Google Cloud team wanted this package (with its C extension) to be available to Wheezy users so I NMUed the package in unstable (to fix #782379) and prepared backports for wheezy-backports and jessie-backports (the latter only once the release team rejected a fix in jessie proper, see #782766).

Old and new PTS updates for Jessies’s release. I took care to update tracker.debian.org and packages.qa.debian.org to take into account Jessie’s release (which, most notably, introduced the “oldoldstable” suite as the new name for Squeeze until its end of life).

Received thanks with pleasure. This is not something that I did but I enjoyed reading so many spontaneous thanks in response to Guillem’s terse and thankless notification of me stepping down from dpkg maintenance. I love the Debian community. Thank you.

Thanks

See you next month for a new summary of my activities.

Individual reports

Evolution of the situation

Thanks to our sponsors

Debian LTS

Other Debian work

Thanks

Individual reports

Evolution of the situation

Thanks to our sponsors

Debian LTS

Other Debian work

Thanks

Tags

Recent Posts