Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.
Debian Games
- I used this month to polish some of my team-maintained packages and to slightly improve the debian packaging in openyahtzee, monopd, opencity, pangzero, powermanga, ri-li, tecnoballz, whichwayisup, atanks, ufoai and dreamchess.
- I fixed RC bug #915453 in supertuxkart.
- I released a new version of debian-games, a collection of metapackages to ease the installation of games in Debian. I plan to do another update in January. This one will then almost be the final state for Buster but there is usually another last minor update during deep freeze to include even the latest changes.
- I also packaged a new upstream version of enemylines3, which was merely a bug fix release though. Nevertheless I could drop two Debian patches. Yeah.
Debian Java
- I guess it's fair to say that we are on the finishing straight now. Netbeans 10 was finally released on December 27th and I try to make little steps each day to complete the update still in time for Buster.
- I fixed an RC bug in activemq caused by obsolete symlinks (#916777) and another RC issue in syncany. (#916609)
- New upstream versions this month: easymock, intellij-annotations, libpdfbox2-java, okio, libokhttp-java, jackson-dataformat-xml, pdfsam, libsambox-java, libsejda-java, libsejda-io-java.
- I also packaged the latest stable version of jackrabbit, however it turned out that it would make davmail unusable (#917174) which is why I later decided to revert this change again. Although the real issue here is that davmail should be updated by upstream to use a more current version of jackrabbit (and httpclient #917175), there was no compelling reason to remove davmail from testing.
- I prepared a security update for c3p0 (#917257, CVE-2018-20433) and uploaded it to unstable, Jessie (DLA-1621-1) and Stretch (#917560).
Misc
- I updated osmo, tofrodos and iftop and applied a patch by Andreas Henriksson for wbar to fix a reproducibility issue on merged-usr systems.
- The browser extension privacybadger was updated to version 2018.12.17.
- I prepared a security update of libarchive for Stretch released as DSA-4360-1.
- I reported a FTBFS that got recently fixed in moria. (#916030)
NMU
- I NMUed three games to fix open RC bugs: gltron (#897760), mudlet (#907159) and zatacka (#891778 patch by Bernhard Übelacker).
Debian LTS
This was my thirty-fourth month as a paid contributor and I have been paid to work 30 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:
- From 17.12.2018 until 06.01.2019 I was in charge of our LTS frontdesk. I investigated and triaged CVE in graphiscmagick, sqlite3, libvncserver, pspp, yara, terminology, sssd, libarchive, freecol, rabbitmq-server, hoteldruid, libraw, nagios3, gnupg2, igraph, python3.4, radare2, imagemagick, tar, poppler, tcpreplay, libcaca, binutils, liblas, mxml, jasper, aria2, systemd, libpff, libsixel, libspring-security-2.0-java, nasm, yaml-cpp and yaml-cpp0.3.
- DLA-1630-1. I triaged and investigated 39 CVE in libav. Later I issued a security update for libav fixing 14 of them.
- DLA-1612-1. Issued a security update for libarchive fixing 2 CVE.
- DLA-1615-1. Issued a security update for nagios3 fixing 5 CVE.
- DLA-1616-1. Issued a security update for libextractor fixing 2 CVE.
- DLA-1628-1. Issued a security update for jasper fixing 8 CVE (announced 9). It turned out that CVE-2018-19139 has not been fixed yet.
ELTS
Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my seventh month and I have been paid to work 15 hours on ELTS.
- I was in charge of our ELTS frontdesk from 17.12.2018 until 06.01.2019 and I triaged CVE in libarchive, gnutls26, rabbitmq-server, binutils, wget, tar, krb5, jasper and systemd.
- ELA-72-1. Issued a security update for jasper fixing 5 CVE. I analyzed the remaining open issues, prepared patches myself and forwarded them upstream.
- ELA-73-1. Issued a security update for libcaca fixing 4 CVE.
- ELA-74-1. Issued a security update for sqlite3 fixing 3 CVE.
Thanks for reading and see you next time.