Re: fatal: Unable to create '/srv/scratch/qa.debian.org/vcswatch/.../shallow.lock': No space left on device

2022-07-27 Thread Christoph Berg
Re: Domenico Andreoli
>   fatal: Unable to create 
> '/srv/scratch/qa.debian.org/vcswatch/g/golang-github-flowstack-go-jsonschema/shallow.lock':
>  No space left on device
> 
> Some machine needs maintenance due to a full disk.

Hi,

adsb added more space to the partition, and I triggered a re-run of
all 800 affected packages. There are now no "no space left on device"
errors left in vcswatch.

Thanks for spotting,
Christoph



libxslt: some CVEs not fixed in debian buster

2022-07-27 Thread Akira Shibakawa
Hi,
CVE-2019-5815 and CVE-2021-30560 are vulnerabilities of libxslt
included in chromium source code as third-party code.
And not only chromium but also libxslt upstream has already fixed them.
https://gitlab.gnome.org/GNOME/libxslt/-/commit/08b62c258
https://gitlab.gnome.org/GNOME/libxslt/-/commit/50f9c9cd3

Because libxslt in debian buster is older than the fixed version in
upstream, these bugs are still present in debian buster.
Is there any plans to fix them in debian buster ?
(I am wonder why these CVEs are linked to only chromium, not libxslt.)



Re: adduser default for sgid home directories

2022-07-27 Thread Wouter Verhelst
On Mon, Jul 25, 2022 at 07:06:59PM +0200, Marc Haber wrote:
> I don't like the idea of messing with old NEWS entries at all.

I'm trying to understand why you feel this way.

A NEWS.Debian entry is not aimed towards developers; it is meant as
documentation shown to the user when upgrading. Having apt-listchanges
tell you "We changed X to Y" immediately followed by "Oh actually, we
changed Y to Z" (or "Y back to X", as the case may be) is quite
confusing in that context, and could therefore be counterproductive.

I feel that NEWS.Debian should always be edited in such a way that
expected upgrade paths show our users the information they would need to
keep things running, and not (much) more than that. This means that if
the information in a NEWS.Debian file has become outdated, it should be
updated so that users upgrading from the package version they are
running get the most relevant information for their situation.

If people need to investigate how a package changed over time, then
there are other tools (debian/changelog, snapshot.debian.org, and a git
log if one is available) to achieve this. I don't think NEWS.Debian is
the right place to keep that type of information.

Am I missing something?

> In this case, an exception might be warranted, but we need to have the
> long explanation somewhere in the package for the next round of this
> issue that is expected in the 2030ies.

It absolutely makes sense to document decisions for future people
looking at the problem, but I'm not convinced that a long explanation
for historic decisions belongs in the NEWS.Debian file. The changelog
would seem to be a more appropriate location, or perhaps a
debian/README.why-we-do-things-this-way file could be created. Of
course, a NEWS.Debian entry should still contain the bits of information
that are relevant for the user who's upgrading the package, possibly
duplicating information if necessary.

Thanks,

-- 
 w@uter.{be,co.za}
wouter@{grep.be,fosdem.org,debian.org}



Bug#1016130: ITP: asdf -- multiple language runtime version manager

2022-07-27 Thread matt
Package: wnpp
Severity: wishlist
Owner: Matt Barry 
X-Debbugs-Cc: debian-devel@lists.debian.org

* Package name: asdf
  Version : 0.10.2
  Upstream Author : Akash Manohar J
* URL : https://asdf-vm.org
* License : MIT
  Programming Lang: Bash
  Description : multiple language runtime version manager

asdf is a CLI tool that can manage multiple language runtime
versions on a per-project basis. It is like gvm, nvm, rbenv
and pyenv (and more) all in one! Simply install your language's
plugin!