My Free Software Activities in July 2015

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donators (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it’s one of the best ways to find volunteers to work with me on projects that matter to me.

Debian LTS

This month I have been paid to work 15 hours on Debian LTS. In that time I did the following:

  • Finished the work on tracker.debian.org to make it display detailed security status on each supported release (example).
  • Prepared and released DLA-261-2 fixing a regression in the aptdaemon security update (happening only when you have python 2.5 installed).
  • Prepared and released DLA-272-1 fixing 3 CVE in python-django.
  • Prepared and released DLA-286-1 fixing 1 CVE in squid3. The patch was rather hard to backport. Thankfully upstream was very helpful, he reviewed and tested my patch.
  • Did one week of “LTS Frontdesk” with CVE triaging. I pushed 19 commits to the security tracker.

Kali Linux / Debian Stretch work

kaliKali Linux wants to experiment something close to Debian Constantly Usable Testing: we have a kali-rolling release that is based on Debian Testing and we want to take a new snapshot every 4 months (in order to have 3 releases per year).

More specifically we have a kali-dev repository which is exactly Debian Stretch + our own Kali packages (the kali package take precedence) updated 4 times a day, just like testing is. And we have a britney2 setup that generates kali-rolling out of kali-dev (without any requirement in terms of delay/RC bugs, it just ensures that dependencies are not broken), also 4 times a day.

We have jenkins job that ensures that our metapackages are installable in kali-dev (and kali-rolling) and that we can build our ISO images. When things break, I have to fix them and I try to fix them on the Debian side first. So here are some examples of stuff I did in response to various failures:

  • Reported #791588 on texinfo. It was missing a versioned dependency on tex-common and migrated too early. The package was uninstallable in testing for a few days.
  • Reported #791591 on pinba-engine-mysql-5.5: package was uninstallable (had to be rebuilt). It appeared on output files of our britney instance.
  • I made a non-maintainer upload (NMU) of chkrootkit to fix two RC bugs so that the package can go back to testing. The package is installed by our metapackages.
  • Reported #791647: debtags no longer supports “debtags update –local” (a feature that went away but that is used by Kali).
  • I made a NMU of debtags to fix a release critical bug (#791561 debtags: Missing dependency on python3-apt and python3-debian). kali-debtags was uninstallable because it calls debtags in its postinst.
  • Reported #791874 on python-guess-language: Please add a python 2 library package. We have that package in Kali and when I tried to sync it from Debian I broke something else in Kali which depends on the Python 2 version of the package.
  • I made a NMU of tcpick to fix a build failure with GCC5 so that the package could go back to testing (it’s part of our metapackages).
  • I requested a bin-NMU of jemalloc and a give-back of hiredis on powerpc in #792246 to fix #788591 (hiredis build failure on powerpc). I also downgraded the severity of #784768 to important so that the package could go back to testing. Hiredis is a dependency of OpenVAS and we need the package in testing.

If you analyze this list, you will see that a large part of the issues we had come down to package getting removed from testing due to RC bugs. We should be able to anticipate those issues and monitor the packages that have an impact on Kali. We will probably add new jenkins job that installs all the metapackages and then run how-can-i-help -s testing-autorm --old… I just submitted #794238 as a wishlist against how-can-i-help.

At the same time, there are bugs that make it into testing and that I fix / work around on the Kali side. But those fixes / work around might be more useful if they were pushed to testing via testing-proposed-updates. I tried to see whether other derivatives had similar needs to see if derivatives could join their efforts at this level but it does not look like so for now.

Last but not least, bugs reported on the Kali side also resulted in Debian improvements:

  • I reported #793360 on apt: APT::Never-MarkAuto-Sections not working as advertised. And I submitted a patch.
  • I orphaned dnswalk and made a QA upload to fix its only bug.
  • We wanted a newer version of the nvidia drivers. I filed #793079 requesting the new upstream release and the maintainer quickly uploaded it to experimental. I imported it on the Kali side but discovered that it was not working on i386 so I submitted #793160 with a patch.
  • I noticed that Kali build daemons tend to accumulate many /dev/shm mounts and tracked this down to schroot. I reported it as #793081.

Other Debian work

Sponsorship. I sponsored multiple packages for Daniel Stender who is packaging prospector, a software that I requested earlier (through RFP bug). So I reviewed and uploaded python-requirements-detector, python-setoptconf, pylint-celery and pylint-common. During a review I also discovered a nice bug in dh-python (#793609a comment in the middle of a Build-Depends could break a package). I also sponsored an upload of notmuch-addrlookup (new package requested by a Freexian customer).

Packaging. I uploaded python-django 1.7.9 in unstable and 1.8.3 in experimental to fix security issues. I uploaded a new upstream release of ditaa through a non-maintainer upload (again at the request of a Freexian customer).

Distro Tracker. Beside the work to integrate detailed security status, I fixed the code to be compatible with Django 1.8 and modified the tox configuration to ensure that the test suite is regularly run against Django 1.8. I also merged multiple patches of Christophe Siraut (cf #784151 and #754413).

Thanks

See you next month for a new summary of my activities.

Freexian’s report about Debian Long Term Support, June 2015

A Debian LTS logoLike each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In June, 73.50 work hours have been dispatched among 7 paid contributors. Their reports are available:

Evolution of the situation

July has seen a nice increase in terms of sponsored hours (79.50 hours per month) but the trend is unlikely to continue for the next month, worse it might be negative. While most sponsors who joined us last year in July will renew their support, there are a few where I have no confirmation yet. Many thanks to those who confirmed early: Université Lille 3, MyTux.

Our first milestone of funding the equivalent of a half-time position is unlikely to be reached before DebConf or even this summer. If you want to prove me wrong, it’s time to get in touch with your management and convince your company to contribute a small amount.

In terms of security updates waiting to be handled, the situation is similar to last month: the dla-needed.txt file lists 24 packages awaiting an update (5 more than last month), the list of open vulnerabilities in Squeeze shows about 33 affected packages in total (3 less than last month).

Thanks to our sponsors

There are no new sponsors this month. But I decided to include the number of months that the sponsor has been with us. Since we value long-lasting relations, it seemed quite natural to add this.

My Free Software Activities in June 2015

My monthly report covers a large part of what I have been doing in the free software world. I write it for my donators (thanks to them!) but also for the wider Debian community because it can give ideas to newcomers and it’s one of the best ways to find volunteers to work with me on projects that matter to me.

Debian LTS

This month I have been paid to work 14.5 hours on Debian LTS. In that time I did the following:

  • CVE triage: I pushed 24 commits to the security tracker. I also setup a rotation with other paid contributors. That way this task doesn’t rely on me exclusively.
  • Reviewed a libapache-mod-jk update and sent DLA-240-1.
  • Prepared and released DLA-257-1 on libwmf fixing one CVE.
  • Reviewed a shibboleth-sp2 update and sent DLA-259-1. Lacking a proper test setup, the tests done were minimal.
  • Prepared and released DLA-260-1 on hostapd fixing one CVE.
  • Prepared and released DLA-261-1 on aptdaemon fixing one CVE.
  • I started to work on a wishlist bug for tracker.debian.org: displaying open security issues in stable releases is important to catch the attention of package maintainers. Right now it only displays something when security issues are open in unstable.

Other Debian work

Distro Tracker. I fixed a few issues that were affecting the tracker: SSL access to the BTS soap interface was not working due to changes in the way SSL certificates are managed on Debian machines (see #787410 for details of a similar problem), and the bugs panel disappeared for a while (see #787163). I also merged some minor changes from Christophe Siraut and James McCoy.

The Debian Administrator’s Handbook. After some exchanges with Osamu Osuaki of the debian-doc team, we agreed to host a copy of my (DFSG-free) book on debian.org so that it can be better promoted to newcomers who are discovering Debian. It’s over there. I made some changes to the official package (notably integrating all available translations) to make this possible.

Packaging. I uploaded two new release of publican to unstable (4.3.0 and 4.3.1), although I had to cheat by building them in stretch due to a build failure in unstable caused by a libxml2 regression (see #766884). I fixed two small bug reported against the package: a badly documented license (#787993) and a request to replace the dependency on perlmagick to libimage-magick-perl (#789223).

I uploaded zim 0.63 and a new gnome-shell-timer for GNOME 3.16 compatibility.
And I sponsored python-requirements-detector (#789497) as a prerequisite for prospector (a package that I requested some time ago in #781165). I also took care of a stable update of python-reportlab (#787806) at the request of a customer.

Kali related contributions. In Kali, we rely heavily on reprepro to manage our archive. It works rather well for us but over time we identified some annoying issues. I just reported some of them:

  • It should be able to keep unreferenced files for a few days before deleting theme (#788105).
  • It should be possible to clone a distribution in a single command (#788843).
  • It should be possible to rename a distribution in a single command (#788846).

live-build is another important tool for us and when we started using new codenames for our releases, we re-discovered some problems and this time we submitted a bug report with some suggestion to make it more generic (#789800) and committed a small fix to avoid a stupid failure when the release is unknown to live-build.

Misc stuff

Hardware support issue. I have some problems to get some USB disks detected during boot of my Intel NUC, so I sent a bug report to the linux USB developers. It’s a weird issue and rather annoying as it means that my private NAS stops working after each reboot (until I powercycle the external disk enclosure).

My websites. You might have noticed some changes on raphaelhertzog.com and raphaelhertzog.fr. I have deployed new themes that should be mobile-friendly and I also deployed proper https support with free certificates from wosign.com (until letsencrypt.org is ready for general usage). Same goes for the freexian.com webpage hosting our Debian LTS sponsorship offer.

Thanks

See you next month for a new summary of my activities.

Freexian’s report about Debian Long Term Support, May 2015

A Debian LTS logoLike each month, here comes a report about the work of paid contributors to Debian LTS.

Individual reports

In May, 66.25 work hours have been dispatched among 8 paid contributors. Their reports are available:

Evolution of the situation

June has seen a nice increase in terms of sponsored hours (73.50 hours per month) and July shall continue this trend. All the sponsors that are with us since day 0 have just renewed their support (after the first year): many thanks to David Ayers – IntarS Austria, Domeneshop AS, Evolix, Offensive Security and Seznam.cz, a.s. !

Our first milestone of funding the equivalent of a half-time position in now within reach, we only need 9 more hours of sponsored work per month. At the current rate, that makes 2 or 3 new “average” sponsors.

In terms of security updates waiting to be handled, the situation continued to improve: the dla-needed.txt file lists 19 packages awaiting an update (9 less than last month), the list of open vulnerabilities in Squeeze shows about 36 affected packages in total (24 less than last month).

If we keep getting more support, we will be in a good position to extend the coverage that we will offer for Wheezy LTS (notably for virtualization related packages) and we will also be able to consider switching to MySQL 5.5 for Squeeze LTS since MySQL 5.1 is no longer supported upstream (and other similar requests that tend to pop up as more and more software reach their upstream end-of-life).

Thanks to our sponsors

The new sponsors of the month are in bold.