apt-get install debian-wizard

Time to Join Extended Long Term Support for Debian 7 Wheezy

February 20, 2018 by Raphaël Hertzog Leave a Comment

Debian 7 Wheezy LTS period ends on May 31st and some companies asked Freexian if they could get security support past this date. Since about half of the current team of paid LTS contributors is willing to continue to provide security updates for Wheezy, I have started to work on making this possible.

I just initiated a discussion on debian-devel with multiple Debian teams to see whether it is possible to continue to use debian.org infrastructure to host the wheezy security updates that would be prepared in this extended LTS period.

From the sponsor side, this extended LTS will not work like the regular LTS. It is unrealistic to continue to support all packages and all architectures so only the packages/architectures requested by sponsors will be supported. The amount invoiced to each sponsor will be directly related to the package list that they ask us to support. We made an estimation (based on history) of how much it costs to support each package and we split that cost between all the sponsors that are requesting support for this package. That cost is re-evaluated quarterly and will likely increase over time as sponsors are stopping their support (when they finished to migrate all their machines for example).

This extended LTS will also have some restrictions in terms of packages that we can support. For instance, we will no longer support the linux kernel from wheezy, you will have to switch to the kernel used in jessie (or maybe we will maintain a backport ourselves in wheezy). It is also not yet clear whether we can support OpenJDK since upstream support of version 7 stops at the end of June. And switching to OpenJDK 8 is likely non-trivial. There are likely other unsupportable packages too.

Anyway, if your company needs wheezy security support past end of May, now is the time to worry about it. Please send us a mail with the list of source packages that you would like to see supported. The more companies get involved, the less it will cost to each of them. Our plans are to gather the required data from interested companies in the next few weeks and make a first estimation of the price they will have to pay for the first quarter by mid-march. Then they confirm that they are OK with the offer and we will emit invoices in April so that they can be paid before end of May.

Note however that we decided that it would not be possible to sponsor extended wheezy support (and thus influence which packages are supported) if you are not among the regular LTS sponsors (at bronze level at least). Extended LTS would not be possible without the regular LTS so if you need the former, you have to support the latter too.

Freexian’s report about Debian Long Term Support, January 2018

February 19, 2018 by Raphaël Hertzog Leave a Comment

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In January, about 160 work hours have been dispatched among 11 paid contributors. Their reports are available:

Antoine Beaupré did 13h (out of 4h allocated + 12.25h remaining, thus keeping 3.25h for February).
Ben Hutchings did 23 hours (out of 15h allocated + 8 remaining hours).
Brian May did 10 hours.
Chris Lamb did 18 hours.
Emilio Pozuelo Monfort did 9 hours (out of 18.25 hours allocated + 1.25 hours remaining, thus keeping 10.5 hours for February).
Guido Günther did 6 hours (out of 8h allocated, thus keeping 2h for February).
Hugo Lefeuvre did 18.25 hours.
Markus Koschany did 18.25 hours.
Ola Lundqvist did 14 hours.
Roberto C. Sanchez did 14.5 hours (out of 18.25 hours allocated, thus keeping 3.75 extra hours for February).
Thorsten Alteholz did 18.25 hours.

Evolution of the situation

The number of sponsored hours increased slightly at 187 hours per month. It would be nice if the slow growth could continue as the amount of work seems to be slowly growing too.

The security tracker currently lists 23 packages with a known CVE and the dla-needed.txt file 23 too. The number of open issues seems to be stable compared to last month which is a good sign.

Thanks to our sponsors

New sponsors are in bold.

Platinum sponsors:

TOSHIBA (for 28 months)
GitHub (for 19 months)

Gold sponsors:

The Positive Internet (for 44 months)
Blablacar (for 43 months)
Linode (for 33 months)
Babiel GmbH (for 22 months)
Plat’Home (for 22 months)

Silver sponsors:

Domeneshop AS (for 44 months)
Université Lille 3 (for 43 months)
Trollweb Solutions (for 41 months)
Nantes Métropole (for 38 months)
Dalenys (for 34 months)
Univention GmbH (for 29 months)
Université Jean Monnet de St Etienne (for 29 months)
Sonus Networks (for 23 months)
maxcluster GmbH (for 17 months)
Exonet B.V. (for 13 months)
Leibniz Rechenzentrum (for 7 months)
Vente-privee.com (for 4 months)

Bronze sponsors:

David Ayers – IntarS Austria (for 44 months)
Evolix (for 44 months)
Offensive Security (for 44 months)
Seznam.cz, a.s. (for 44 months)
Freeside Internet Service (for 43 months)
MyTux (for 43 months)
Intevation GmbH (for 41 months)
Linuxhotel GmbH (for 41 months)
Daevel SARL (for 40 months)
Bitfolk LTD (for 38 months)
Megaspace Internet Services GmbH (for 38 months)
NUMLOG (for 38 months)
Greenbone Networks GmbH (for 37 months)
WinGo AG (for 37 months)
Ecole Centrale de Nantes – LHEEA (for 33 months)
Sig-I/O (for 31 months)
Entr’ouvert (for 28 months)
Adfinis SyGroup AG (for 26 months)
GNI MEDIA (for 20 months)
Laboratoire LEGI – UMR 5519 / CNRS (for 20 months)
Quarantainenet BV (for 20 months)
RHX Srl (for 17 months)
Bearstech (for 12 months)
LiHAS (for 12 months)
People Doc (for 8 months)
Catalyst IT Ltd (for 6 months)
Supagro
Demarcq SAS

My Free Software Activities in January 2018

February 1, 2018 by Raphaël Hertzog Leave a Comment

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donors (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it’s one of the best ways to find volunteers to work with me on projects that matter to me.

Debian LTS

While I continue to manage the administrative side of Debian LTS, I’m taking a break of the technical work (i.e. preparing and releasing security updates). The hope is that it will help me focus more on my book which (still) needs to be updated for stretch. In truth, this did not happen in January but I hope to do better in the upcoming months.

Salsa and related

The switch to salsa.debian.org is a major event in our community. Last month I started with the QA team and the distro-tracker repository as an experiment. This month I took this opportunity to bring to fruition a merge between the pkg-security team and the forensics team that I already proposed in the past and that we postponed because it was deemed busy work for no gains. Now that both teams had to migrate anyway, it was easier to migrate everything at once under a single project.

All our repositories are now managed under the same team in salsa: https://salsa.debian.org/pkg-security-team/ But for the mailing list we are still waiting for the new list to be created on lists.debian.org (#888136).

As part of this work, I contributed some fixes to the scripts maintained by Mehdi Dogguy. I also filed a wishlist request for a new script to make it easy to share repositories with the Debian group.

With the expected demise of alioth mailing lists, there’s some interest in getting the Debian package tracker to host the official maintainer email. As the central hub for most emails related to packages, it seems natural indeed. We made some progress lately on making it possible to use @packages.debian.org emails (with the downside of receiving duplicate emails currently) but that’s not an really an option when you maintain many packages and want to see them grouped under the same maintainer email. Furthermore it doesn’t allow for automatic association of a package to its maintainer team. So I implemented a team+slug@tracker.debian.org email that works for each team registered on the package tracker and that will automatically associate the package to its team. The email is just a black hole for now (not really a problem as most automatic emails are already received through another email) but I expect to forward non-automatic mails to team members to make it useful as a way to discuss between team members.

The package tracker also learned to recognize commit mails generated by GitLab and it will now forward them to the source package whose name is matching the name of the GitLab project that generated them (see #886114).

Misc Debian stuff

Distro Tracker. I got my two first merge requests which I reviewed and merged. One adds native HTML support to toggle action items (i.e. without javascript on recent browsers) and the other improves some of the messages shown by the vcswatch integration. In #886450, we discussed how to better filter build failure mails sent by the build daemons. New headers have been added.

Bug reports and patches. I forwarded and/or got moving a couple of bugs that we encountered in Kali (glibc: new data brought to #820826, raspi3-firmware: #887062, glibc: tracking down #886506 to a glibc regression affecting busybox, gr-fcdproplus: #888853 new watch file, gjs: upstream bug #33). I also needed a new feature in live-build so I filed #888507 which I implemented almost immediately (but released only in Kali because it’s not documented yet and can possibly be improved a bit further).

While doing my yearly accounting, I opened an issue on tryton and pushed a fix after approval. While running unit tests on distro-tracker, I got an unexpected warning that seems to be caused by virtualenv (see upstream issue #1120).

Debian Packaging. I uploaded zim 0.68~rc1-1 to experimental.

Thanks

See you next month for a new summary of my activities.

Freexian’s report about Debian Long Term Support, December 2017

January 12, 2018 by Raphaël Hertzog Leave a Comment

A Debian LTS logo Like each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In December, about 142 work hours have been dispatched among 12 paid contributors. Their reports are available:

Antoine Beaupré did nothing (out of 4h allocated + 8.25h remaining, thus keeping 12.25h for January). He intends to catch up in January.
Ben Hutchings did 6 hours (out of 14h allocated, thus keeping 8 extra hours for January).
Brian May did 10 hours.
Chris Lamb did 14 hours.
Emilio Pozuelo Monfort did 26.5 hours (out of 14 hours allocated + 13.75 hours remaining, thus keeping 1.25 hours for January).
Guido Günther did 13.5 hours (out of 11h allocated + 2.5 extra hours).
Hugo Lefeuvre did 14 hours.
Markus Koschany did 14 hours.
Ola Lundqvist did 7 hours.
Raphaël Hertzog did 13 hours (out of 12h allocated + 2 extra hours, the remaining hour has been given back to the pool).
Roberto C. Sanchez did 19 hours (out of 14 hours allocated + 5 hours remaining).
Thorsten Alteholz did 14 hours.

Evolution of the situation

The number of sponsored hours did not change at 183 hours per month. It would be nice if we could continue to find new sponsors as the amount of work seems to be slowly growing too.

The security tracker currently lists 21 packages with a known CVE and the dla-needed.txt file 16 (we’re a bit behind in CVE triaging apparently). Both numbers show a significant drop compared to last month. Yet the number of DLA released was not larger than usual (30), instead it looks like December brought us fewer new security vulnerabilities to handle and at the same time we used this opportunity to handle lower priorities packages that were kept on the side for multiple months.

Thanks to our sponsors

New sponsors are in bold (none this month).

Platinum sponsors:

TOSHIBA (for 27 months)
GitHub (for 18 months)

Gold sponsors:

The Positive Internet (for 43 months)
Blablacar (for 42 months)
Linode (for 32 months)
Babiel GmbH (for 21 months)
Plat’Home (for 21 months)

Silver sponsors:

Domeneshop AS (for 42 months)
Université Lille 3 (for 42 months)
Trollweb Solutions (for 40 months)
Nantes Métropole (for 36 months)
Dalenys (for 33 months)
Univention GmbH (for 28 months)
Université Jean Monnet de St Etienne (for 28 months)
Sonus Networks (for 22 months)
maxcluster GmbH (for 16 months)
Exonet B.V. (for 12 months)
Leibniz Rechenzentrum (for 6 months)
Vente-privee.com (for 3 months)

Bronze sponsors:

David Ayers – IntarS Austria (for 43 months)
Evolix (for 43 months)
Offensive Security (for 43 months)
Seznam.cz, a.s. (for 43 months)
Freeside Internet Service (for 42 months)
MyTux (for 42 months)
Intevation GmbH (for 40 months)
Linuxhotel GmbH (for 40 months)
Daevel SARL (for 38 months)
Bitfolk LTD (for 37 months)
Megaspace Internet Services GmbH (for 37 months)
Greenbone Networks GmbH (for 36 months)
NUMLOG (for 36 months)
WinGo AG (for 36 months)
Ecole Centrale de Nantes – LHEEA (for 32 months)
Sig-I/O (for 29 months)
Entr’ouvert (for 27 months)
Adfinis SyGroup AG (for 24 months)
GNI MEDIA (for 19 months)
Laboratoire LEGI – UMR 5519 / CNRS (for 19 months)
Quarantainenet BV (for 19 months)
RHX Srl (for 16 months)
Bearstech (for 10 months)
LiHAS (for 10 months)
People Doc (for 7 months)
Catalyst IT Ltd (for 5 months)

Individual reports

Evolution of the situation

Thanks to our sponsors

Debian LTS

Salsa and related

Misc Debian stuff

Thanks

Individual reports

Evolution of the situation

Thanks to our sponsors

Tags

Recent Posts