Tag: English

Posted on

My Free Software Activities in October 2016

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Android, Java, Games and LTS topics, this might be interesting for you.

Debian Android

Debian Games

  • I fixed RC bugs in lordsawar (#839323) and doomsday (#839338).
  • I packaged new upstream releases of atanks, lordsawar, blockattack and peg-e.
  • I completed the Bullet transition (#839243). Bullet 2.85 has also been released this month but it is now too late for Stretch because the transition freeze is already on the 5th of November. I expect more point releases a la 2.85.x during the coming weeks and I intend to provide an updated package in experimental soon.
  • I did some cleanups, package upgrades and bug fixes for box2d and redeclipse (apparently redeclipse-server requires the -data package to be present now).
  • I uploaded Redeclipse 1.5.6 to jessie-backports in the hope that more players will be able to connect to the multiplayer servers. Unfortunately network compatibility breaks rather frequently.
  • I applied a patch from Gianfranco Costamagna to address an Multiarch installation issue (#841824) in FreeOrion.

Debian Java

Debian LTS

This was my eight month as a paid contributor and I have been paid to work 13 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

  • From 10. October until 17. October I was in charge of our LTS frontdesk. I triaged bugs in libgd2, graphicsmagick, libxrender, mupdf, libxfixes, guile-2.0, glance, inspircd, libxi, libxv, libxst, spip, libxml2, libarchive and jasper.
  • DLA-648-1. Issued a security update for c-ares fixing 1 CVE.
  • DLA-664-1. Issued a security update for libxrender fixing 2 CVE.
  • DLA-666-1. Issued a security update for guile-2.0 fixing 2 CVE.
  • DLA-667-1. Issued a security update for libxv fixing 1 CVE.
  • DLA-668-1. Issued a security update for libass fixing 2 CVE. I triaged CVE-2016-7970 and marked the version in Wheezy as not affected.
  • DLA-673-1. Issued a security update for kdepimlibs fixing 1 CVE.

Non-maintainer uploads

  • I fixed various RC bugs in gnudoq and xsok which are not maintained by the Games Team. The following games are available in Stretch again: gnudoq (#817296, #817484), xsok (#817738) and I also worked on four more bug fixes to improve the game's desktop integration and internationalization support.
  • I fixed another RC bug in trackballs (#831119) but while I was working on the update I discovered that the game frequently segfaults which makes it kind of unplayable (#839788). I haven't found a solution yet but I suspect the switch to guile-2.0 and related patches introduced this behavior.

QA

  • I uploaded a new revision of criticalmass and applied a patch from Adrian Bunk to fix #811816, a FTBFS.
  • I triaged an RC bug for raptor2 (#824735) and the issue could be closed after the bug reporter confirmed that raptor2 built fine again.
Posted on

My Free Software Activities in September 2016

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Android, Java, Games and LTS topics, this might be interesting for you.

Debian Android

Debian Games

  • I packaged a new upstream release of hyperrogue, a rogue-like game settled in a non-euclidian world, fixing one RC bug (#811991). I uploaded two more revisions later that addressed  build failures on arm64 and hppa.
  • I fixed more RC bugs (build failures with GCC-6) in torus-trooper (#835712) and fife (#811858).
  • I packaged new upstream releases of pygame-sdl2, renpy, freeorion, netrek-client-cow, redeclipse, redeclipse-data, hitori, atomix, adonthell and adonthell-data.
  • I updated gtkballs and fixed a documentation bug (#820588) but also a /usr/share/locale issue that prevented the actual use of the translations.
  • I raised the severity of #797998 to grave in unknown-horizons because the game cannot be started currently. In order to fix this issue I packaged a new build-dependency, fifechan, which is currently awaiting approval by the FTP team. As soon as fifechan got accepted I will upload new upstream releases of fife and unknown-horizons.
  • I released debian-games 1.5, a Debian blend and collection of games metapackages.
  • Hardening-wrapper has been deprecated for some time and this issue became release critical now. I updated cookietool, alex4 and netrek-client-cow to use dpkg-buildflags instead.
  • Together with Russel Coker I packaged a new upstream release of warzone2100. This package would benefit from a new regular uploader. If you are interested in it, please get involved. (Same story for hyperrogue, redeclipse, renpy and unknown-horizons and many other games.)
  • I started a new Bullet transition (#839243). The package is currently waiting in the NEW queue and I hope to complete this work in October.
  • I triaged #838199 and reassigned the issue to fonts-roboto. Initially I prepared an NMU but eventually the maintainer uploaded a new revision himself. It is now possible to install the hinted and unhinted versions of fonts-roboto together which also resolved former installation problems with kodi and freeorion.

Debian Java

  • I packaged new upstream releases of undertow, activemq and jackrabbit.
  • I fixed RC bugs in libphonenumber (#836768), wagon2 (#837022) and activemq (#839244).
  • I updated syncany in experimental and simplified the packaging a little. Unfortunately upstream has been on hiatus for the past year and we haven't seen new releases in the meantime. Nevertheless give it a try, even though it is still alpha software, it's an useful cloud-storage and synchronization tool.
  • I sponsored a new upstream release of freeplane for Felix Natter.
  • I prepared and uploaded security updates for jackrabbit and zookeeper in Jessie.

Debian LTS

This was my eight month as a paid contributor and I have been paid to work 12,25 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

  • From 12. September until 19. September I was in charge of our LTS frontdesk. I triaged bugs in tiff3, mysql-5.5, curl, dropbear, mantis, icu, dwarfutils, jackrabbit, zendframework, zookeeper and graphicsmagick. For the latter I skimmed through all commits since the last version to identify the patches that fix the recent issues in graphicsmagick. I also answered questions on the mailing list and contacted Diego Biurrun again about his progress with libav. It is now anticipated that Hugo Lefeuvre and Diego will issue a new libav security release this month.
  • I reviewed and tested a patch by Raphaël Hertzog for roundcube.
  • DLA-629-1. Issued a security update for jackrabbit fixing 1 CVE.
  • DLA-630-1. Issued a security update for zookeeper fixing 1 CVE.
  • DLA-633-1. Issued a security update for wordpress fixing 7 CVE. This one also required backports of certain functions from newer releases and a database upgrade that required careful testing.
  • I also issued DLA-622-1 and DLA-623-1, two security issues that I already mentioned last month. It was discovered that Debian's versions of Tomcat were vulnerable to a root privilege escalation issue. However it was also necessary that another exploit, for instance in a web application, could be used to gain write access as the tomcat user. Former security issues were already fixed and new ones are not known. Nevertheless since a zero-day exploit could not be ruled out, the issue was embargoed for a month to give other distributions time to fix this issue as well. You can read more about this topic at legalhackers.com.

Non-maintainer uploads

Misc

  • I packaged a new upstream release of MediathekView.
  • I uploaded a new revision of xarchiver and applied a patch from Helmut Grohne that made it possible to cross-build the package.
Posted on

My Free Software Activities in August 2016

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you're interested in Android, Java, Games and LTS topics, this might be interesting for you.

Debian Android

Debian Games

  • I started the month with package updates for foobillardplus, tuxpuck, etw, cube2, cube2-data and neverball.
  • I released a new revision of triplane to fix a reproducible build issue.
  • I packaged a new upstream release of springlobby.
  • I fixed GCC-6 FTBFS bugs in stormbaancoureur and love and updated both packages to use modern Debian helpers (stormbaancoureur needed it badly).
  • I invested some time to package Liquidwar 6 (#680023) and attached my preliminary work to the bug report. Liquidwar 6 has been in the works for a long time now and is a complete rewrite of the original Liquidwar game. The graphics are much more polished and dozens of new levels are available. I didn't complete my work on Liquidwar 6 because, at least on my system, the game constantly consumes 100% CPU time. Network modus isn't finished yet and it still depends on SDL 1. Nowadays I'm only interested in SDL 2 (or similar) games though because I think the library is more future-proof and SDL 1 will probably become a burden for future maintainers.
  • In the second half of the month I fixed a couple of RC bugs again caused by the Boost 1.61 transition and yes still more GCC-6 bugs : libclaw (GCC-6 and Boost 1.61 issues, new upstream release), freeorion (Boost 1.61 FTBFS, #833773. This one was arguably a regression in Boost 1.61 and I filed #833794 because of it), pokerth (GCC-6 RC bugs. I also took the opportunity to implement systemd support for pokerth-server and I modified the package to run the server as the _pokerth system user out-of-the-box.), 0ad (missing build-dependency on python).
  • Even music packages can pile up bug reports, so I went ahead and updated fretsonfire-songs-muldjord and fretsonfire-songs-sectoid.
  • In the last days of August 2016 I packaged a new upstream release of redeclipse and redeclipse-data, a first-person shooter. The older version was network-incompatible and long unsupported.

Debian Java

Debian LTS

This was my seventh month as a paid contributor and I have been paid to work 14,75 hours on Debian LTS, a project started by Raphaël Hertzog. In that time I did the following:

  • From 01. August to 07. August I was in charge of our LTS frontdesk. I triaged CVEs in wordpress, mysql-5.5, libsys-syslog-perl, libspring-java, curl and squid and answered questions on the debian-lts mailing list.
  • DLA-586-1. Issued a security update for curl fixing 2 CVE.
  • DLA-585-1. Announced the security update for firefox-esr which was prepared by Mike Hommey.
  • I was involved in an embargoed security issue that currently affects two source packages in Wheezy. The update will be released on 15. September 2016 and will be coordinated with Debian's Security Team and other distributions. I will add more information next month.
  • DLA-610-1. I spent most of the time this month on triaging and fixing security issues in tiff3, a library providing support for the Tagged Image File Format (TIFF). 99 source packages currently build-depend on this library in Wheezy. In total I triaged 35 CVEs and fixed 23 of them. I could confirm that CVE-2015-1547, CVE-2016-5322, CVE-2016-5314, CVE-2016-5315, CVE-2016-5316, CVE-2016-5317 and CVE-2016-5320 were duplicates of other CVEs fixed in this update. The update hardened the library and fixed possible denial-of-service (application crash) and arbitrary code execution issues. I tested whenever possible against the provided reproducers (malicious tiff images). The tiff3 package now includes all currently available patches. Most of the current open vulnerabilities do not directly affect end-users since no binary package has been provided for the tiff tools in Wheezy. However they can still pose a threat to people who build these tools from source manually. Though the majority of users should not be affected. It is also unlikely that the remaining issues will be fixed by tiff's upstream developers since they decided to remove the affected applications from newer releases but again most of them can't be exploited since the tools are not built by default in this version.

Non-maintainer uploads

  • I did a NMU for pacman fixing one GCC-6 RC bug.

QA

  • I packaged a new upstream release of pygccxml and worked around a RC bug that threatened to remove spring. For similar reasons I filed #835121 against castxml that got quickly fixed by Gert Wollny.
Posted on

My Free Software Activities in July 2016

Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian.

Debian Android

Debian Games

  • This month GCC-6 bugs became release critical. I fixed and triaged those kind of bugs in games like supertransball2, berusky2, freeorion, bloboats, armagetronad and megaglest.
  • I packaged new upstream releases of scorched3d, bzflag, spring, springlobby, freeorion, freeciv and extremetuxracer.
  • Freeciv, one of the best strategy games ever by the way, also got a new binary package freeciv-client-gtk3. This package will eventually become the new default client to play the game in the future. You are welcome to test it.
  • I packaged a new upstream release of adonthell and adonthell-data. This game is built with Python 3 and SDL 2 now and also uses the latest version of swig to generate its sources. We will probably see only one other future upstream release of adonthell because the main developer has decided to move on after more than 15 years of development.
  • I fixed another RC bug in minetest, updated whichwayisup for this release cycle and moved the package to Git.

Debian Java

Debian LTS

This was my sixth month as a paid contributor and I have been paid to work 14,7 hours on Debian LTS. In that time I did the following:

  • DLA-554-1. I spent most of the time this month on completing my work on libarchive. I issued DLA-554-1 and fixed 18 CVE plus another issue which was later assigned CVE-2016-6250.
  • DLA-555-1. Issued a security update for python-django fixing 1 CVE.
  • DLA-561-1. Issued a security update for uclibc fixing 3 CVE.
  • DLA-562-1. Issued a security update for gosa fixing 1 CVE. I could triage another open CVE as not-affected after confirming that the issue had already been fixed two years ago.
  • DLA-568-1. Issued a security update for wordpress fixing 6 CVE. I decided to go ahead with this update because I could not find any regressions. Unfortunately this wasn't true for my intended fix for CVE-2015-8834. The database upgrade did not succeed hence I decided to postpone the fix for CVE-2015-8834 until we can narrow down the issue.
  • DLA-576-1. Issued a security update for libdbd-mysql-perl fixing 2 CVE.
  • From 04. July to 10. July I was in charge of our LTS frontdesk. I triaged CVEs in librsvg, bind9, trn, pdns and drupal7 and answered questions on the debian-lts mailing list.

Misc and QA

  • I fixed another GCC-6 bug in wbar, a light and fast launch bar.
  • Childsplay and gvrng were orphaned last month. I updated both of them, fixed the RC-bug in childsplay (non-free font) and moved the packages to the Debian QA Group.
Posted on

My Free Software Activities in June 2016

My monthly report covers what I have been doing for Debian. I write it for Debian's Long Term Support sponsors but also for the wider free software community in the hope that it might inspire people to get more involved with Debian or free software in general.

Debian Android

Debian Games

  • I packaged CaveExpress and CavePacker for Debian. CaveExpress is a remake of the old Amiga classic Ugh! In this game you control a pedal-powered flying machine and pick up packages from your clients. An interesting aspect of CaveExpress is its physics-based gameplay. The packages must be delivered to a collection point and their movement is quite realistic thanks to the excellent Box2d physics engine. The other game, CavePacker, based on the same engine as CaveExpress is a Sokoban-like game. Both games feature dozens of levels and if you have nothing better to do, you should definitely check them out.
  • This month I also packaged a new upstream release of Netpanzer. Apparently there is new upstream activity.
  • Blockattack 2.0 was released and is now available in Debian.
  • I also updated the following packages: kball, pathogen, ceferino, slimevolley, pangzero and airstrike.
  • I adopted abe, berusky and berusky-data, updated the packages to use modern debian helpers and also packaged version 1.7 of berusky, a great Sokoban-like game by the way.
  • June also saw a new release of debian-games, several metapackages that make it much easier to install a subset of games or even the finest.
  • I sponsored RC-bug fixes for parsec47, tumiki-fighters, mu-cade and tatan all prepared by Peter De Wachter who keeps our D (yes, that's a language) games alive. But we will face more issues in the post Stretch future. Apparently the D language people intend to remove parts of their API and of course all our D-based games are affected. Peter has announced more information about that. I think all these games are pretty unique and real gems. If you know a little D and want to help out, please get involved.

Debian Java

Debian LTS

This was my fifth month as a paid contributor and I have been paid to work 19,75 hours on Debian LTS. In that time I did the following:

  • DLA-501-1. Salvatore Bonaccorso from Debian's Security Team discovered that the original fix for CVE-2015-7552 (DLA-450-1) was incomplete. I prepared and uploaded a new revision of gdk-pixbuf and issued the DLA.
  • DLA-502-1. Issued a security update for graphicsmagick fixing 1 CVE.
  • DLA-504-1. Issued a security update for libxstream-java fixing 1 CVE which was prepared by Emmanuel Bourg.
  • DLA-505-1. Issued a security update for libpdfbox-java fixing 1 CVE.
  • DLA-508-1. Issued a security update for expat fixing 2 CVE.
  • DLA-511-1. Issued a security update for libtorrent-rasterbar fixing 1 CVE.
  • DLA-526-1. Issued a security update for mysql-connector-java fixing 1 CVE. I also prepared the update for Jessie which is still pending to be reviewed by the Security Team.
  • DLA-528-1. Issued a security update for libcommons-fileupload-java fixing 1 CVE.
  • DLA-529-1. Issued a security update for tomcat7 fixing 1 CVE.
  • DLA-530-1. As previously announced I switched the default Java implementation from OpenJDK 6 to OpenJDK 7.
  • DLA-537-1. Issued a security update for roundcube fixing 1 CVE. I triaged CVE-2016-5103, CVE-2015-2180 and CVE-2015-2181 and marked them as "not-vulnerable".
  • I triaged 22 CVEs for libarchive and marked two of them as "not-vulnerable". You can find my preliminary work for libarchive on the wheezy branch in Debian's git repository. I expect a security update very soon.
  • From 13 June to 19. June I was responsible for Wheezy's LTS frontdesk. It was a rather calm week on the debian-lts mailing list and in our IRC channel. I triaged CVE-2016-4970 (netty), CVE-2016-3189 (bzip2), CVE-2016-1621 (libvpx) and CVE-2016-4493, CVE-2016-4492, CVE-2016-4491, CVE-2016-4490, CVE-2016-4489, CVE-2016-4488, CVE-2016-4487, CVE-2016-2226 which were all minor issues in developer tools or in the gcc toolchain.
  • I commented on Ola's question about open security issues in phpmyadmin.

QA uploads

  • I fixed pygccxml that threatened to remove spring.
  • I completely overhauled gl-117, fixed four bugs and closed two obsolete ones. gl-117 always reminds me a little of the Falcon series from the early 90ies.
Posted on

My Free Software Activities in May 2016

My monthly report covers what I have been doing for Debian. I write it for Debian's Long Term Support sponsors but also for the wider free software community in the hope that it might inspire people to get more involved with Debian or free software in general.

Debian LTS

This was my  fourth month as a paid contributor and I have been paid to work 30 hours on Debian LTS. During this month I worked on the following things:

  • DLA-460-1. Issued a security update for file fixing 1 CVE.
  • DLA-461-1. Issued a security update for nagios3 fixing 1 CVE.
  • From 2 May until 8 May I managed the LTS frontdesk and triaged CVEs in ikiwiki, jansson, libuser, librsvg, roundcube, ocaml, wpa and sogo. I reviewed a security update of icu for Roberto C. Sánchez. I also reviewed the security update of ikiwiki prepared by Simon McVittie and took care of the announcement which resulted in DLA-463-1.
  • DLA-468-1. I fixed two serious issues in the libuser library that allowed a normal user to gain root privileges and to corrupt /etc/passwd.
  • DLA-449-2. I issued a regression update for botan1.10's reverse dependencies, monotone and softhsm. Both packages had to be rebuilt in Wheezy. I also prepared the no-change rebuilds for all reverse-dependencies in Jessie. (DSA-3565-2)
  • DLA-471-1. Issued a security update for jansson fixing 1 CVE.
  • DLA-473-1. Issued a security update for wpa fixing 2 CVE.
  • DLA-475-1. Issued a security update for python-tornado fixing 1 CVE.
  • DLA-483-1. Issued a security update for expat fixing 1 CVE.
  • DLA-484-1. Issued a security update for graphicsmagick fixing 8 CVE. Graphicsmagick is a fork of Imagemagick and also affected by vulnerabilities commonly known as ImageTragick. It is likely that we will see more CVEs in the near future.
  • DLA-488-1. Issued a security update for xymon fixing 4 CVE. I marked CVE-2016-2057 as not-affected in Wheezy.
  • DLA-490-1. Issued a security update for bozohttpd fixing 2 CVE.
  • Misc: I sent a short news update to bits.debian.org and debian-lts-announce which was released on 2 June and announced the now official support of armel and armhf for Wheezy LTS.
  • I sent a DLA announcement for Icedove. The security update was prepared by Christoph Goehre. (DLA-472-1)

Debian Android

  • I packaged a new version of apktool. This tool has several issues at the moment. The most important one is the missing basic framework resource files which are needed for decoding apk files. They are not part of the source tarball release so we need to find other ways to make them available in Debian. Chirayu Desai, one of the GSoC students 2016, already came up with a good proposal.
  • We had our first GSoC meetings.

Debian Java

  • I fixed an RC bug in gradle-jflex-plugin due to an incompatibility with Gradle >= 2.12.
  • I clarified licenses and updated debian/copyright for Netbeans. I also removed some files from the original tarball with possibly controversial licenses.
  • I packaged new upstream releases of hsqldb and objenesis and updated fontchooser.
  • I sponsored libmnemonicsetter-java for Felix Natter.
  • I prepared a security update for Tomcat 8 which still awaits  approval by the Security Team.
  • I spent too much time with trying to upgrade libnetlib-java. In the end I came to the conclusion that it is not worth the effort.

Debian Games

  • I fixed a long standing RC bug in warzone2100 and another bug in fretsonfire.
  • I packaged new upstream releases of springlobby, freeorion and freeciv. This fixed the lags in FreeOrion which were seemingly introduced by an X server update. I also uploaded the latest versions of FreeCiv and Minetest to jessie-backports.

Misc

  • Xarchiver crashed when someone attempted to cancel the extraction procedure with the Thunar plugin. (#822115) I fixed the issue in Sid, Stretch and Jessie.
Posted on

My Free Software Activities in April 2016

My monthly report covers what I have been doing for Debian. I write it for Debian's Long Term Support sponsors but also for the wider free software community in the hope that it might inspire people to get more involved with Debian or free software in general.

Debian LTS

This was my third month as a paid contributor and I have been paid to work 16 hours on Debian LTS. During this month I worked on the following things:

  • DSA-3552-1: I finished my work on Tomcat 7 which I started back in March. Debian's Security Team eventually reviewed the package and issued DSA-3552-1. This update fixed 9 CVEs in Wheezy and 7 CVEs in Jessie.
  • DSA-3541-1: My security update for roundcube (Wheezy) fixing 1 CVE was issued by the Security Team.
  • DLA-449-1. I worked on botan1.10, a C++ library which provides support for many common cryptographic operations and fixed 7 CVEs in Wheezy. I also sent an updated package for Jessie to the Security Team and they issued DSA-3565-1 for it. For Jessie 6 CVEs could be closed.  I am currently investigating a possible regression (#823297) that might require a rebuild of monotone.
  • DLA-450-1. I prepared an update for gdk-pixbuf fixing 1 CVE. While I was working on this issue I discovered that Debian's fix for CVE-2015-7674 was incomplete and thus I added another patch to prevent possible heap-based overflows in pixops/pixops.c. Thanks to SUSE's Security Team for their initial work on this issue.
  • DLA-451-1. I backported and tested a security update for OpenJDK-7 fixing 7 CVEs. Thanks to Matthias Klose and Tiago Stürmer Daitx for their initial work.
  • DLA-452-1. I fixed a bug in smarty3 (Wheezy), a template engine for PHP, that allowed remote attackers to bypass the secure mode restrictions and to execute arbitrary PHP code.
  • I triaged CVE-2015-7496 in GDM3 and marked this issue as <not affected> in Wheezy because the vulnerable code was neither present nor was the issue reproducible.
  • I triaged two more CVEs in Swift, CVE-2016-0738 and CVE-2016-0737 and marked both CVEs as fixed in Wheezy because the vulnerable code was not present. I also had a closer look at Xymon. This package appears to be partly affected by the open security issues and needs further investigation.
  • The security support for Wheezy was handed over to the LTS team on 26 April 2016. I drafted an official announcement which was published on debian.org and debian-lts-announce. Before I started a call for review on debian-lts. Thanks for all the feedback and especially for the reviews from the English language team.
  • Making OpenJDK 7 the default-java implementation in Wheezy-LTS. I uploaded a new revision of java-common with the sole intention to increase the user awareness for our intended switch to OpenJDK 7 as the default Java implementation. Moreover I updated 14 Java packages in Wheezy that strictly depended on openjdk-6-jre or openjdk-6-jdk. The requirements were relaxed so that users will be able to install OpenJDK 7 now without the need for installing the unsupported OpenJDK 6 too. Three Java packages are still pending due to a bug in Debian's archive software that will hopefully be resolved soon. I think we could have uploaded those packages sooner but the Release Team did not deem these issues to be important enough. (#819247)

Debian Android

  • apktool and libsmali-java. I packaged the latest upstream release of Apktool, 2.1.0. Smali is now a dependency of Apktool and no longer included in the official tarballs. That's the reason why I decided to package libsmali-java.
  • I will be a Mentor for Google Summer of Code again together with Hans-Christoph Steiner. I presume this year will be quite exciting and we will try to package more Android software for Debian.

Debian Java

Debian Games

Misc

  • gimp-dimage-color. I asked the ftp team to remove gimp-dimage-color because it has not been updated in the past seven years and it is also not part of Debian stable.
  • I reviewed and sponsored python-adventure for Ben Finney.
  • I also reviewed freecell-solver for Shlomi Fish on debian-mentors but the package was eventually uploaded by the actual package maintainer.
Posted on

My Free Software Activities in March 2016

My monthly report covers what I have been doing for Debian. I write it for Debian's Long Term Support sponsors but also for the wider free software community in the hope that it might inspire people to get more involved with Debian or free software in general.

Debian LTS

This was my second month as a paid contributor and I have been paid to work 14,25 hours on Debian LTS. During this month I worked on the following things:

  • DSA-3530-1: I finished the work on Tomcat 6 which I started last month and closely worked together with Debian's Security Team who reviewed the package and eventually issued DSA-3530-1. This update fixed 18 CVEs in Wheezy and Jessie.
  • DSA-3524-1: Prepared security updates for ActiveMQ (Wheezy and Jessie) fixing one CVE.
  • Tomcat 7.  Prepared security updates for Tomcat 7 fixing 9 CVEs in Wheezy and 7 CVEs in Jessie. I asked for reviews and testing on the debian-java mailing list and I intend to finish the work in April.
  • DSA-3537-1:  Prepared security updates for imlib2 fixing 3 CVEs in Wheezy and Jessie.
  • DSA-3538-1:  Prepared security updates for libebml fixing 3 CVEs in Wheezy and Jessie.
  • DSA-3539-1:  Prepared security updates for srtp fixing 1 CVE in Wheezy and Jessie.
  • roundcube. Prepared a security update for roundcube (Wheezy) fixing 1 CVE. Review by the Security Team is still pending. I expect a DSA in April.
  • optipng. Prepared and uploaded a security update for optipng to Wheezy fixing 1 CVE.
  • Making OpenJDK 7 the default-java implementation in Wheezy-LTS: March was also the month to prepare for the next LTS release on 2016-04-26. I worked several hours on the transition to OpenJDK 7 which will be supported for the whole LTS release cycle.  I identified eighteen Java packages in Wheezy whose runtime dependencies must be updated to ensure that they will not pull in OpenJDK 6 by default but they will still work with OpenJDK 7. I updated the java-common package to make OpenJDK 7 the default-java implementation. I filed bug #819247 against release.debian.org and asked the Release Team to include the updated Java packages in the last point release for Wheezy. This issue is pending now and I expect that those packages will either be uploaded as part of the next point update for Wheezy or at the beginning of Wheezy-LTS. I will continue to work on this task in April and provide a backport of java-common for testing purposes and upload no-change updates of Tomcat 6/7, Jetty and java-common to Wheezy-LTS with NEWS files that inform users about the switch to OpenJDK 7. The goal is to switch default-java to OpenJDK 7 on 2016-06-26.

Debian Android

  • android-platform-tools-base. I uploaded a new revision because I could eventually reenable the Lint module since lombok-ast got accepted into Debian which I had packaged one week before.
  • apktool. Thanks to Chirayu Desai, who discovered a free public-domain implementation of the Little Endian data input stream class, I could fix apktool, close #819191 and sync this version with Ubuntu.
  • android-platform-build. I sponsored a new revision for Kai-Chung.

Debian Java

  • qdwizard. I sponsored qdwizard (ITP: #816426) prepared by Felix Natter, a new dependency for Jajuk, an advanced jukebox and music organizer.
  • netbeans. I tightened the dependency on Java 8 because Netbeans did not work correctly with Java 7. (#816758, #817152)
  • I triaged the following RC bugs for jpathwatch (#816998),  velocity (#814679), lwjgl (#814167)
  • activemq. I spent several hours on upgrading ActiveMQ, a Java message broker, to the latest upstream release 5.13.2 and closed two RC bugs (#809733, #808636) and another bug (#770455). All files under /etc/activemq will be properly removed on purge now. In addition this update required an update of uima-as that build-depends on libactivemq-java and while I was at it I did some spring cleaning and updated the related activemq-protobuf and activemq-activeio packages as well.
  • uima-as. I updated uima-as and fixed an activemq related RC bug.
  • undertow and jboss. I packaged new upstream releases of undertow, jboss-modules, jboss-jdeparser2 and jboss-xnio.

Debian Games

  • renpy. I packaged the latest upstream releases 6.99.9 and 6.99.10 of python-pygame-sdl2 and renpy, a framework for developing visual novel games.
  • spring. I packaged the latest release 101 of spring, a modern full-3D RTS game engine.
  • freesweep. I updated the whole Freesweep package, a minesweeper game for the console, to use modern Debian helpers and technologies. In this process I fixed four outstanding bugs.
  • atomix. I packaged the latest stable release of Atomix, a puzzle game.
  • teg. I did another spring cleaning and updated teg, a strategy game like Risk.
  • hitori. Packaged new upstream release 3.20.0.
  • nikwi. Fixed bug #791966 and added arm64 to nikwi's supported architectures.
  • dopewars. Fixed FTBFS bug #819619.
  • zaz. Fixed three bugs and triaged the remaining ones in zaz, a 3D arcade action puzzle game.

Non-maintainer uploads

  • mtpaint. Fixed RC bug (#803286), so that mtpaint could migrate to testing again.
  • pinball. Fixed FTBFS (#816108) and another build failure when building with dpkg-buildpackage -A (#806093). I also discovered that /var/games/pinball is correctly removed on purge nowadays and closed #443493.
  • jcc. I NMUed jcc and fixed two RC bugs because it was one the packages that blocked the removal of OpenJDK 7 from Debian.

QA uploads

  • piespy. I did a QA upload for piespy because it was one of the packages that blocked the removal of OpenJDK 7 from Debian.

Misc

  • yics. I requested the removal of yics because this chess client was defunct without the Yahoo chess servers which closed down in 2014. (#814360)
  • smc. I tried to fix #812096, a FTBFS, and updated outdated CEGUI includes but I soon realized that more porting work had to be done and it would be best to package the lastest upstream release instead.
Posted on

My Free Software Activities in February 2016

My monthly report covers what I have been doing for Debian. I write it for Debian's Long Term Support sponsors but also for the wider free software community in the hope that it might inspire people to get more involved with Debian or free software in general.

Debian LTS

This was my first month as a paid contributor and I have been paid to work 11,25 hours on Debian LTS. During this month I worked on the following things:

  • Released DLA-410-1 for OpenJDK 6 fixing eight CVEs.
  • Released DLA-418-1 for WordPress fixing two CVEs.
  • Released DLA-422-1 for python-imaging fixing one CVE and a second buffer overflow in PcdDecode.c. I also helped to fix these issues in Wheezy and Jessie and sent the patches to Debian's Security Team. This resulted in the release of DSA-3499-1.
  • Released DLA-435-1 for Tomcat 6 fixing six CVEs.
  • Released DLA-441-1 for pcre3 fixing one security vulnerability. A CVE had not been assigned but this issue is also known as ZDI-CAN-3452.
  • Released DLA-443-1 for bsh fixing one CVE. I fixed this issue for all versions of bsh. A DSA is still pending.
  • Since February was also the last month of support for Debian 6 "Squeeze" I looked for packages that had been fixed in Squeeze but not in Wheezy. I discovered that Lighttpd was still affected by CVE-2014-3566 aka the "POODLE" attack. Although SSLv3 could be disabled it was still enabled by default. After consulting the Debian Security Team we disabled SSLv3 by default and released DSA-3489-1
  • Backported versions 6.0.41 and 6.0.45 of Tomcat 6 to fix all open security vulnerabilities in Wheezy. At the moment I am waiting for the green light from the Security Team.

Debian Android

I have been paid by the Guardian Project to package apktool and android-platform-tools-base. Apktool is a tool for reverse engineering Android apk files while android-platform-tools-base includes the Android Gradle Plugin and several tools and libraries for developing Android software. Unfortunately I discovered that LEDataInputStream.java in apktool was covered by a non-free license. I had to remove this class and thus the tool is currently broken. I am aware of this and I reported this issue to upstream as #1166. I hope I can resolve this problem together with them this month. In order to package the software above I also had to package the following build-dependencies: gradle-jflex-plugin, intellij-annotations and lombok-patcher. I am still working on getting lombok-ast into Debian for which the lombok-* packages were a precondition. These packages were non-trivial because ivyplusplus, lombok and lombok-patcher depend on each other. In addition they failed to build with OpenJDK 8 due to the use of older classes from OpenJDK's tools.jar.  I fixed ivyplusplus and lombok which were both broken and updated proguard, trove3 and jflex to simplify the packaging of android-platform-tools-base and apktool by providing Maven artifacts.

Debian Java

  • libjide-oss-java. Packaged new upstream release 3.6.13+dfsg-1.
  • Netbeans. Packaged Netbeans 8.1+dfsg2-1. I could finally fix the HTML 5 parser runtime error (#809256) because libhtml5parser-java, which I had packaged last month, got accepted into Debian. I also fixed a FTBFS due to a change in svnclientadapter.
  • jgit. I disabled the tests as a workaround to fix a FTBFS. (#812643) I intend to package the latest upstream release in the near future. I hope it does not break as many reverse-dependencies as usual.
  • libslf4j-java. Updated the package to fix a Netbeans runtime error.
  • tomcat6. Packaged new upstream release 6.0.45+dfsg-1.

Debian Games

  • simutrans, simutrans-pak64, simutrans-pak128.britain. I sponsored new upstream releases of simutrans which were prepared by Jörg Frings-Fürst.
  • extremetuxracer. I packaged the latest upstream release 0.7.1. Eventually I decided to upload this version to unstable and to replace the 0.4 series because upstream ships the extra courses too now. They were once part of tuxracer-extras and had to be converted to a new data format. Since tuxracer-extras was obsolete, I requested its removal from Debian. (#814604)
  • freeciv. Packaged version 2.5.3 that fixed two bugs in FreeCiv's Qt client. (#813107, #813218) I also backported this version to Debian Jessie.
  • debian-games. I released the latest version of the Debian Games Blend. I recommended four new games: edgar, a 2D platformer, ufoai, a squad-based tactical strategy game, zoom-player, a player for Z-Code stories or games and endless-sky, a space exploration and combat game. The Free Software Foundation recently interviewed Michael Zahniser, the developer of endless-sky, because he uses the GPL for his work.
  • corsix-th. I sponsored corsix-th, an open source clone of Theme Hospital. This package was prepared by Alexandre Detiste. You still need the original game data from Theme Hospital to play the game. That is the reason why I had to upload it to contrib. If you own a copy of the game yourself, you can use game-data-packager to create a Debian package for the data.

Misc

  • osmo. Osmo's internal backup feature was broken on i386 systems. In fact it always produced the same empty file with seize 50 byte. I reported this issue upstream and Maxim Gordienko provided a patch. This issue (#813414) was fixed in version 0.2.14-4. I also uploaded a fixed version for Jessie after I got the permission from the Debian Release Team.  (#815469)