Tag: English

Welcome to gambaru.de. Here is my monthly report (+ the first week in February) that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

• Again Reiner Herrman did a very good job with updating some of the most famous FOSS games in Debian. I reviewed and sponsored supertux 0.6.1.1, supertuxkart 1.1 and love 11.3, also several updates to fix build failures with the latest version of scons in Debian. Reiner Herrmann, Moritz Mühlenhoff and Phil Wyett contributed patches to fix release critical bugs in netpanzer, boswars, btanks, and xboxdrv.
• I packaged new upstream versions of minetest 5.1.1, empire 1.15 and bullet 2.89.
• I backported freeciv 2.6.1 to buster-backports and
• applied a patch by Asher Gordon to fix a teleporter bug in berusky2. He also submitted another patch to address even more bugs and I hope to review and upload a new revision soon.

Debian Java

• This month I packaged new releases of libpdfbox2-java, undertow, easymock, lombok-patcher, libtwelvemonkeys-java, wildfly-common and checkstyle (CVE-2019-10782).
• I requested the removal of libxmlrpc3-java from Debian and prepared DSA-4619-1 to fix CVE-2019-17570.
• I fixed CVE-2019-17571 in apache-log4j1.2 and intend to address the same problem in Buster and Stretch soon.

Misc

• As the maintainer I requested the removal of pyblosxom, a web blog engine written in Python 2. Unfortunately pyblosxom is no longer actively maintained and the port to Python 3 has never been finished. I thought it would be better to remove the package now since we have a couple of good alternatives like Hugo or Jekyll.
• I packaged new upstream versions of wabt and privacybadger.

Debian LTS

This was my 47. month as a paid contributor and I have been paid to work 15 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

• DLA-2065-1. Issued a security update for apache-log4j1.2 fixing 1 CVE.
• DLA-2077-1. Issued a security update for tomcat7 fixing 2 CVE.
• DLA-2078-1. Issued a security update for libxmlrpc3-java fixing 1 CVE.
• DLA-2097-1. Issued a security update for ppp fixing 1 CVE.
• DLA-2098-1. Issued a security update for ipmitool fixing 1 CVE.
• DLA-2099-1. Issued a security update for checkstyle fixing 1 CVE.

ELTS

Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my twentieth month and I have been paid to work 10 hours on ELTS.

• ELA-208-1. Issued a security update for tomcat7 fixing 2 CVE.
• ELA-209-1. Issued a security update for linux fixing 41 CVE.
• Investigated CVE-2019-17023 in nss which is needed to build and run OpenJDK 7. I found that the vulnerability did not affect this version of nss because of the incomplete and experimental support for TLS 1.3.

Thanks for reading and see you next time.

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

• I started the month by backporting the latest version of minetest to buster-backports.
• New versions of Springlobby, the single and multiplayer lobby for the Spring RTS engine, and Freeciv (now at 2.6.1) were packaged.
• I had to remove python-pygccxml as a build-dependency from spring because of the Python 2 removal and there was also another unrelated build failure that got fixed as well.
• I also released a new version of the debian-games metapackages. A considerable number of games were removed from Debian in the past months, in parts due to the ongoing Python 2 removal but also because of inactive maintainers or upstreams. There were also some new games though. Check out the 3.1 changelog for more information. As a consequence of our Python 2 goal, the development metapackage for Python 2 is gone now.

Debian Java

• This month I packaged new releases of jboss-logging-tools, jackson-databind, jackson-jr, jackson-dataformat-xml and qdox2.
• I prepared a security update of tomcat8 for Stretch released as DSA 4596-1. Thanks to Peter Hurtenbach for his help with testing the package.

Misc

• The imlib2 image library was updated to version 1.6.1 and now supports the webp image format.
• I backported the Thunderbird addon dispmua to Buster and Stretch because the new Thunderbird ESR version had made it unusable.
• I also updated binaryen, a compiler and library for WebAssembly and asked upstream if they could relax the build-dependency on Git which they did.

Debian LTS

This was my 46. month as a paid contributor and I have been paid to work 16,5 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

From 23.12.2019 until 05.01.2020 I was in charge of our LTS frontdesk. I investigated and triaged CVE in sudo, shiro, waitress, sa-exim, imagemagick, nss, apache-log4j1.2, sqlite3, lemonldap-ng, libsixel, graphicsmagick, debian-lan-config, xerces-c, libpodofo, vim, pure-ftpd, gthumb, opencv, jackson-databind, pillow, fontforge, collabtive, libhibernate-validator-java, lucene-solr and gpac.

• DLA-2051-1. Issued a security update for intel-microcode fixing 2 CVE.
• DLA-2058-1. Issued a security update for nss fixing 1 CVE.
• DLA-2062-1. Issued a security update for sa-exim fixing 1 CVE.
• I prepared a security update for tomcat7 by updating to the latest upstream release in the 7.x series. It is pending review by Mike Gabriel at the moment.

ELTS

Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my nineteenth month and I have been assigned to work 15 hours on ELTS.

• I was in charge of our ELTS frontdesk from 23.12.2019 until 05.01.2020 and I triaged CVE in sqlite3, libxml2 and nss.
• ELA-200-2. Issued a security update for intel-microcode.
• Worked on tomcat7, CVE-2019-12418 and CVE-2019-17563, and finished the patches prepared by Mike Gabriel. We have discovered some unrelated test failures and are currently investigating the root cause of them.
• Worked on nss, which is required to build OpenJDK 7 and also needed at runtime for the SunEC security provider. I am currently investigating CVE-2019-17023 which has been assigned only a few days ago.
• ELA-206-1. Issued a security update for apache-log4j1.2 fixing 1 CVE.

Thanks for reading and see you next time.

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

• Simon Schmeisser prepared a new upstream version of Ogre 1.12, a 3D object-oriented graphics rendering engine. I reviewed his work and gave some advice but he hasn't had the time to work on the package again.
• Auralquiz failed to build from source related to phonon4qt5. (#943870)
• I packaged a new upstream Git snapshot of Berusky2, a 3D logic game with bugs (lalala). Asher Gordon and Bernhard Übelacker prepared patches to fix crashes which partially surfaced because of the switch to GCC 9.
• Drascula, the evil vampire adventure game, didn't want to start anymore and needed an update because of an engine change in ScummVM 2.10.
• After I had updated armagetronad, the tron-like lightcycle game, a relocation error appeared due to changes in GCC 9 and prevented the game from starting. Thanks to boffi and Bernhard Übelacker we could identify the correct patch to address the problem.
• After more than six years upstream released a new version of burgerspace again, a neat clone of burgertime, and its corresponding flatzebra library.
• I packaged Minetest 5.1.0 and intend to backport this version to stable-backports soon.
• Last but not least I decided to package the latest released version of caveexpress, which has a rather odd version number and contains only minor changes but I had to do it. 🙂

Debian Java

• This month I packaged new releases of jboss-modules, intellij-annotations, easymock, undertow, activemq and jboss-xnio.
• In order to let easymock migrate to testing I had to rebuild junit5, apiguardian, opentest4j and univocity-parsers and do source-only uploads. Currently all newly introduced packages to Debian have to be uploaded with all binaries included. Once the package has been approved, it is stuck in unstable and can't migrate to testing and needs another source-only rebuild. I believe we should find a better way to reduce this kind of make-work when there is actually nothing to improve from the initial upload.
• I have been working on a security update for Tomcat 8 in Stretch and hope to finish it soon.

Misc

• As usual I updated some Firefox addons and packaged new upstream releases for privacybadger, https-everywhere and dispmua. The latter is actually a Thunderbird addon and displays what kind of email software (MUA) your correspondent uses (which can tell you a lot about someone's personality 😉 ) I intend to prepare a stretch/buster-pu for it too.

Debian LTS

This was my 45. month as a paid contributor and I have been paid to work 24,5 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

• DLA-1996-1. Issued a security update for libapache2-mod-auth-openidc fixing 1 CVE.
• DLA-2023-1. Issued a security update for openjdk-7 fixing 16 CVE.
• DLA-2027-1. Issued a security update for jruby fixing 4 CVE.
• DLA-2028-1. Issued a security update for squid3 fixing 4 CVE.
• DLA-2030-1. Issued a security update for jackson-databind fixing 2 CVE.

ELTS

Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my eightteenth month and I have been assigned to work 15 hours on ELTS.

• I was in charge of our ELTS frontdesk from 25.11.2019 until 01.12.2019 and I triaged CVE in jetty, gnupg, rabbitmq-server, netkit-telnet and nss.
• ELA-190-1. Issued a security update for linux fixing 2 CVE.
• ELA-199-1. Issued a security update for intel-microcode fixing 2 CVE.
• ELA-200-1. Issued a security update for openjdk-7 fixing 16 CVE. In order to improve the test coverage, I investigated together with Roberto Sanchez how to backport and use autopkgtests for OpenJDK 7. The idea is to catch changes in OpenJDK that are actually a regression in Debian but may not be an actual test failure. The previous release suddenly required to build the SunEC security provider in order to provide the same cryptographic classes to users as before and hopefully an autopkgtest is able to find such a regression earlier. The tests are currently not integrated in the package and only available locally but the intention is to make them available with the next security update.

Thanks for reading and see you next time.

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

• Python 3 ports: I reviewed and sponsored krank and solarwolf for Reiner Herrmann. Thanks to his diligent work two more Python games were ported to Python 3. He also packaged a new upstream release of hyperrogue and improved the build system. Less memory is required to build hyperrogue now and some buildd are thankful for that.
• The bullet transition got finally approved and completed successfully.
• I uploaded a new version of pygame-sdl2 to experimental which supports Python 3 now. However the library is still exclusively needed for renpy but upstream hasn't finished the porting work to Python 3 yet. Hopefully this will be done next year. That means the new version of renpy which I also packaged this month still depends on Python 2.
• I fixed two bugs in Freeciv, the famous strategy game, by replacing fonts-noto-cjk with fonts-unfonts-core. (#934588) The latter fonts looks apparently better on ordinary screens. The second one was simple to fix, I just had to remove an unneeded Python 2 build-dependency. (#936553)
• The strategy game asc, a neat clone of Battle Isle 2, also needed some attention this month. I had to replace libwxgtk3.0-dev with libwxgtk3.0-gtk3-dev. (#943439)
• I did a QA upload of open-invaders because the maintainer email address was bouncing. The game needs a new maintainer.

Debian Java

• A new version of libhibernate-validator-java broke pdfsam in unstable. Fortunately the library couldn't migrate to testing before the bug was reported. I haven't completely figured out yet how to address this in pdfsam.
• I also packaged new upstream versions of jackson-jr, jackson-dataformat-xml, jackson-datatype-joda, jboss-xnio and objenesis.
• I prepared a security update of jackson-databind for Stretch and Buster released as DSA-4542-1.

Misc

• I packaged a new version of privacybadger, and backported ublock-origin  to Stretch and Buster because the addon was incompatible with the latest Firefox ESR release.

Debian LTS

This was my 44. month as a paid contributor and I have been paid to work 22,75 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

• From 14.10.2019 until 20.10.2019 and from 28.10.2019 until 03.11.2019 I was in charge of our LTS frontdesk. I investigated and triaged CVE in wordpress, ncurses, opencv, pillow, poppler, golang, gdal, lz4, python-reportlab, ruby-haml, vips, rdesktop, modsecurity-crs, zabbix, polarssl and tika.
• DLA-1960-1. Issued a security update for wordpress fixing 7 CVE.
• DLA-1966-1. Issued a security update for aspell fixing 1 CVE.
• DLA-1973-1. Issued a security update for libxslt fixing 1 CVE.
• DLA-1978-1. Issued a security update for python-ecdsa fixing 2 CVE.
• DLA-1982-1. Issued a security update for openafs fixing 2 CVE.
• I triaged 17 CVE in libgig and forwarded the result upstream. After the investigation I decided to mark these issues as no-dsa because all in all the security risk was low. (#931309)

ELTS

Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my seventeenth month and I have been assigned to work 15 hours on ELTS plus five hours from September. I used 8 of them for the following:

• ELA-185-1. Issued a security update for libxslt fixing 1 CVE.
• ELA-186-1. Issued a security update for libssh2 fixing 1 CVE.
• ELA-187-1. Issued a security update for cpio fixing 1 CVE. The update was prepared by Ola Lundqvist.
• ELA-188-1. Issued a security update for djvulibre fixing 1 CVE.
• I worked on OpenJDK 7. I contacted upstream and asked for a new IcedTea release on which we rely for packaging new upstream releases of OpenJDK. The release is still delayed.

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Java, Games and LTS topics, this might be interesting for you.

Debian Games

• Reiner Herrmann investigated a build failure of supertuxkart on several architectures and prepared an update to link against libatomic. I reviewed and sponsored the new revision which allowed supertuxkart 1.0 to migrate to testing.
• Python 3 ports: Reiner also ported bouncy, a game for small kids, to Python3 which I reviewed and uploaded to unstable.
• Myself upgraded atomix to version 3.34.0 as requested although it is unlikely that you will find a major difference to the previous version.

Debian Java

• This month I packaged new upstream releases of robocode, libsambox-java, libsejda-java, pdfsam, undertow, jboss-threads, libpdfbox2-java, lombok-patcher and jackson-databind.
• I became the new uploader of jackson-databind because the package was unmaintained and it is frequently affected by CVE, e.g. #940498. I intend to implement a way to use a whitelist for Debian to address the reoccurring security vulnerabilities instead of a blacklist which will always be incomplete.
• I fixed bug #933715 in javahelper to fix a build failure whenever someone used the little obscure virtual dependency debhelper-compat.
• I reviewed a new package, yetus, from Lucas Kanashiro and gave some packaging advice.
• I prepared a buster-pu for lucene-solr to fix #933854 and #933857.

Misc

• I packaged new upstream releases of ublock-origin and privacybadger, two popular Firefox/Chromium addons and
• packaged a new upstream release of wabt, the WebAssembly Binary Toolkit.

Debian LTS

This was my 43. month as a paid contributor and I have been paid to work 23,75 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

• From 11.09.2019 until 15.09.2019 I was in charge of our LTS frontdesk. I investigated and triaged CVE in libonig, bird, curl, openssl, wpa, httpie, asterisk, wireshark and libsixel.
• DLA-1922-1. Issued a security update for wpa fixing 1 CVE.
• DLA-1932-1. Issued a security update for openssl fixing 2 CVE.
• DLA-1900-2. Issued a regression update for apache fixing 1 CVE.
• DLA-1943-1. Issued a security update for jackson-databind fixing 4 CVE.
• DLA-1954-1. Issued a security update for lucene-solr fixing 1 CVE. I triaged CVE-2019-12401 and marked Jessie as not-affected because we use the system libraries of woodstox in Debian.
• DLA-1955-1. Issued a security update for tcpdump fixing 24 CVE by backporting the latest upstream release to Jessie. I discovered several test failures but after more investigation I came to the conclusion that the test cases were simply created with a newer version of libpcap which causes the test failures with Jessie's older version.

ELTS

Extended Long Term Support (ELTS) is a project led by Freexian to further extend the lifetime of Debian releases. It is not an official Debian project but all Debian users benefit from it without cost. The current ELTS release is Debian 7 "Wheezy". This was my sixteenth month and I have been assigned to work 15 hours on ELTS plus five hours from August. I used 15 of them for the following:

• I was in charge of our ELTS frontdesk from 30.09.2019 until 06.10.2019 and I triaged CVE in tcpdump. There were no reports of other security vulnerabilities for supported packages in this week.
• ELA-163-1. Issued a security update for curl fixing 1 CVE.
• ELA-171-1. Issued a security update for openssl fixing 2 CVE.
• ELA-172-1. Issued a security update for linux fixing 23 CVE.
• ELA-174-1. Issued a security update for tcpdump fixing 24 CVE.