Debian LTS

August marked the sixteenth month I contributed to Debian LTS under the Freexian umbrella. I spent 9 hours (of allocated 8) mostly on Rails related CVEs which resulted in DLA-603-1 and DLA-604-1 fixing 6 CVEs and marking others as not affecting the packages. The hardest part was proper testing since the split packages in Wheezy don't allow to run the upstream test suite as is. There's still CVE-2016-0753 which I need to check if it affects activerecord or activesupport.

Additionally I had one relatively quiet week of LTS frontdesk work triaging 10 CVEs.

Other Debian stuff

• I uploaded git-buildpackage 0.8.2 to experimental and 0.8.3 to unstable. The later bringing all the enhanements and bugfixes since Debconf 16 to sid and testing.
• The usual bunch of libvirt related uploads

Debian LTS

July marked the fifteenth month I contributed to Debian LTS under the Freexian umbrella. As usual I spent the 8 hours working on these LTS things:

• Updated QEMU and QEMU-KVM packages to fix CVE-2016-5403, CVE-2016-4439, CVE-2016-4020, CVE-2016-2857 and CVE-2015-5239 resulting in DLA-573-1 and DLA-574-1
• Updated icedove to 45.2.0 fixing CVE-2016-2818 resulting in DLA-574-1
• Reviewed and uploaded xen 4.1.6.lts1-1. The update itself was prepared by Bastian Blank.
• The little bit of remaining time I spent on further work the ruby-active{model,record}-3.2 and ruby-actionpack-3.2 (aka rails) CVEs. Although I have fixes for most of the CVEs already there are still some left where I'm not yet clear if the packages are affected.
• Added some trivial autopkgtest for qemu-img (#832982) (on non LTS time)

Other Debian stuff

• Fixed CVE-2016-5008 by uploading libvirt 2.0.0 to sid and 1.2.9-9+deb8u3 to stable-p-u
• Uploaded libvirt 2.1.0~rc1 to experimental
• Uploaded libvirt-python 2.0.0 to sid
• Uploaded libosinfo 0.3.1 to sid preparing for the upcoming upstream package split
• Uploaded virt-manager 1.4.0 to sid
• Uploaded network-manager-iodine 1.2.0 to sid
• Uploaded cups-pk-helper 0.2.6 to sid
• Triaged apparmor related bugs in libvirt most notably the one affecting hotplugging of disks (#805002) which turned out to be rooted in the kernel not reloading profiles properly.
• Uploaded git-buildpackage 0.8.0, 0.8.1 to experimental adding additional tarball support to gbp import-orig among other things

Debian LTS

June marked the fourteenth month I contributed to Debian LTS under the Freexian umbrella. I spent the 8 hours working on these LTS things:

• Reviewed and tested libxml2 2.8.0+dfsg1-7+wheezy6

• Fixed #825508 in mozilla-devscripts to prepare for the Icedove update resulting in DLA-518-1.

• Rebased the proposed Wheezy Icedove update against the Jessie version and uploaded resulting in DLA-519-1.

• Sent out the DLA-521-1 for Iceweasel, the upload was all done by Mike Hommey.

• Rebuilt enigmail with the fixed mozilla-devscripts so it can still be used in Wheezy, resulting in DLA-523-1.

• continue to work on updates for CVE-2016-0753 for ruby-active{record,support}-3.2 - not yet finished.

• Looked into open qemu-kvm and qemu CVEs marking CVE-2015-8666 as no-dsa and fixing CVE-2016-3710 and CVE-2016-3712 via DLA-540-1 and DLA-539-1.

Other Debian stuff

Besides the usual bunch of libvirt* uploads I addressed several bugs in git-buildpackage, upload pending.

Debian LTS

May marked the thirteenth month I contributed to Debian LTS under the Freexian umbrella. I spent the 17.25 hours working on these LTS things:

• Fixed CVE-2014-7210 in pdns resulting in DLA-492-1
• Fixed the build failure of Icedove on armhf resulting in DLA 472-2
• Forward ported our nss, nspr enhancements to to the current versions in testing to continue the discussion on the same nss and nspr versions in all suites including some ABI compliance research (thanks abi-compliance-tester!), resulting in 824872.
• Backported Icedve 45 and Enigmail to wheezy to check if we can continue to support it - we can with a minor tweaks. Upload will happen in June.
• While at that added some autpkgtests for Icedove 45 resulting in 809723 (already applied).
• Released DLA-498-1 for ruby-active-model-3.2 to address CVE-2016-0753.
• Reviewed the Updates of ruby-active-record-3.2 for CVE-2015-7577 and eglibc.

Other Debian stuff

• Uploaded libvirt 1.3.4 to sid, 1.3.5~rc1 to experimental
• Uploaded libosinfo 0.3.0 to sid
• Uploaded git-buildpackage 0.7.4 to sid including experimental multiple tarball support for gbp buildpackage

Debian LTS

April marked the twelfth month I contributed to Debian LTS under the Freexian umbrella. I only spent 2 hours (instead of expected 11,25) working on LTS things:

• Uploaded gtk+3.0 to wheezy-proposed-updates to fix CVE-2013-7447 (#818090).
• Further work on figuring out how to support Xen and QEMU in Wheezy LTS including writing up a summary and a interview with one prospective company
• Prepared a patch for Jessie's nss to fix CVE-2016-1950, CVE-2016-1979, CVE-2016-1978, CVE-2016-1938 based on Antiones work for Wheezy. This is currently pending review by the security team.
• Started to look into CVE-2014-7210 in pdns

The missing hours will be caught up during May - hopefully also by working on a QEMU/libvirt update in Wheezy should there be any interest - so I've you're relying on QEMU/KVM in wheezy now would be a good time to comment on it.

Other Debian things

• Attended the 9th Debian Groupware Meeting in the LinuxHotel in Essen resulting in a new upload of calypso to unstable.
• Uploded libvirt and python-libvirt 1.3.3, virt-sandbox 0.5.1+git20151113-3 and virt-manager 1.3.2-3 to unstable and libvirt 1.3.4~rc1 to experimental

Debian LTS

March was the eleventh month I contributed to Debian LTS under the Freexian umbrella. In total I spent 13 hours (of allocated 11.00 + 5.25h from last month) working on preparing for wheezy-lts:

• Uploaded aptdaemon to {old-,}stable-proposed-updates (#818006, #818007)
• Fix CVE-2012-6700, CVE-2012-6769 CVE-2012-6768, in Wheezy's dhcpcd resulting in DSA-3534
• Reach out to Debian's Xen and KVM maintainers, Xen's community manager and several company to asses LTS maintainability
• Research and propose a possible way forward for QEMU and libvirt
• Upload a backport of libvirt to wheezy-backports for that
• Prepare a fix for Wheezy's gtk+3.0 for CVE-2013-7447 (#818090) and propose it for oldstable-p-u (#819362)
• Looked into Wheezy's lxc and CVE-2015-1335 specifically and marking it as no-dsa after discussion with the security-team.
• Make bin/support-ended.py support EOL dates
• Review Antiones nss work for Wheezy and work on the corresponding update for Jessie in order (to be finished this month).

Other Debian things

• Uploaded several libvirt related packages like ruby-libvirt 0.6.0, libvirt-glib 0.2.3 and libvirt-sandbox 0.5.1+git20151113, libvirt 1.3.3~rc1
• Uploaded git-buildpackage 0.7.3
• Preparations for the 9th Debian Groupware Meeting

More sandboxing

When working on untrusted code or data it's impossible to predict what happens when one does a:

bundle install --path=vendor

or

npm install

Does this phone out your private SSH and GPG keys? Does a

evince Downloads/justdownloaded.pdf

try to exploit the PDF viewer? While you can run stuff in separate virtual machines this can get cumbersome. libvirt-sandbox to the rescue! It allows to sandbox applications using libvirt's virtualization drivers. It took us a couple of years (The ITP is from 2012) but we finally have it in Debian's NEW queue. When libvirt-sandbox creates a sandbox it uses your root filesystem mounted read only by default so you have access to all installed programs (this can be changed with the --root option though). It can use either libvirt's QEMU or LXC drivers. We're using the later in the examples below:

So in order to make sure the above bundler call has no access to your $HOME you can use:

sudo virt-sandbox \
   -m ram:/tmp=10M \
   -m ram:$HOME=10M \
   -m ram:/var/run/screen=1M \
   -m host-bind:/path/to/your/ruby-stuff=/path/to/your/ruby-stuff \
   -c lxc:/// \
   -S $USER \
   -n rubydev-sandbox \
   -N dhcp,source=default \
   /bin/bash

This will make your $HOME unaccessible by mounting a tmpfs over it and using separate network, ipc, mount, pid and utc namespaces allowing you to invoke bundler with less worries. /path/to/your/ruby-stuff is bind mounted read-write into the sandbox so you can change files there. Bundler can fetch new gems using libvirt's default network connection.

And for the PDF case:

sudo virt-sandbox \
  -m ram:$HOME=10M \
  -m ram:/dev/shm=10M \
  -m host-bind:$HOME/Downloads=$HOME/Downloads \
  -c lxc:/// \
  -S $USER \
  -n evince-sandbox \
  --env="DISPLAY=:0" \
  --env="XAUTHORITY=$XAUTHORITY" \
  /usr/bin/evince Downloads/justdownloaded.pdf

Note that the above example shares /tmp with the sandbox in order to give it access to the X11 socket. A better isolation can probably be achieved using xpra or xvnc but I haven't looked into this yet.

Besides the command line program virt-sandbox there's also the library libvirt-sandbox which makes it simpler to build new sandboxing applications. We're not yet shipping virt-sandbox-service (a tool to provision sandboxed system services) in the Debian packages since it's RPM distro specific. Help on porting this to Debian is greatly appreciated.

Debian LTS

February was the tenth month I contributed to Debian LTS under the Freexian umbrella. In total I spent 7 hours (of allocated 11.15 hours) working on squeeze-lts:

• Triage of 17 CVEs for squeeze-lts. I misread the calendar and thought I was on front-desk duty for a couple of days. Fortunately no duplicate work was done.

• Prepared and released DLA-427-1 for nss fixing CVE-2016-1938 after checking that nss is not affected by CVE-2015-7575 since MD5 signatures never got disabled - another good reason why we should have the same nss in all suites.

… and to make sure we have fewer issues that are fixed in squeeze-lts but affect wheezy …

• I prepared patches for CVE-2015-8036 and CVE-2015-5291 for polarssl for jessie including some autpkgtests (wheezy already happened in January) resulting in DSA-3468-1.

• Prepared patches for CVE-2015-1323 affecting apt-daemon (789162) for jessie and wheezy waiting for a review.

On non LTS time I cooked up a script to make it simpler to check if a package has security support in a certain release.

Now that squeeze-lts is history I'd like to thank the Debian Security Team for their help and answers to all the questions related to security tracker, DSAs, DLAs and whatnot. I'm looking forward to wheezy-lts now…

Other Debian stuff

• Uploaded libvirt-python 1.3.1 to unstable.
• Uploaded virt-manager 1.3.2 to experimental.
• Uploaded libvirt 1.3.2-2 to unstable dropping the libvirt-bin transitional package after NMUing gnome-boxes and virt-goodies to remove the dependency.
• Uploaded whatmaps to experimental switching to Python3

Debian LTS

January was the ninth month I contributed to Debian LTS under the Freexian umbrella. In total I spent 13 hours working on:

• LTS Frontdesk duties like the triaging of 34 CVEs. That was about twice as much CVEs coming as during December's frontdesk work.

• I looked into what needs to be done DLA wise when we move from Squeeze to Wheezy. For that I added a script do find discrepancies between Squeeze LTS and Wheezy.

• I uploaded giflib to squeeze-lts(DLA-389-1), wheezy(#812363) and jessie(#812362) proposed updates.

• I forward ported the fix for CVE-2015-5291 for polarssl to Wheezy adding autopkgtests on the way (#812420) (forward port to Jessie happend in February)

• I forward ported a patch for freetype fixing CVE-2014-9674 to wheezy(DSA-3461-1) - Jessie being not affected.

• Finally I added some basic autopkgtests to icu (#813338).

There was no progress on using the same nss in all suites. This will continue in February as does the Squeeze-lts Wheezy forward porting.

Other Debian stuff

• I uploaded libvirt 1.3.1~rc1 and 1.3.1~rc2 to experimental and 1.3.1 final to unstable.
• Released git-buildpackage 0.7.2

Debian LTS

December was the eighth month I contributed to Debian LTS under the Freexian umbrella. It was a bit of a funny month since most of the time most open CVEs were already taken care of by other team members (which is nice) but it resulted in me not releasing a single DLA which feels weird.

Nevertheless in total I spent nine hours working on:

• LTS Frontdesk duties like the triaging of 16 CVEs and patch reviews (which actually found an error reassuring me that spending time on this is useful).

• Finding a fix for CVE-2015-7555 in giflib. I did not release a DLA yet since I hoped upstream would comment if this is the proper fix.

• nss/nspr:

  • Discussion on using the same nss in all suites continued.
  • I did further upgrade test for nss focusing on Java this time (which is a heavy user of nss for its certificate handling).
  • Enabled the internal testsuite of nspr as well since nss and nspr often get updated in lockstep. This resulted in 809723 and upstream bugs 1236333, 1236334, 1236244 (which were already merged thanks to Wan-Teh Chang). The current modifications are available here. Overall the test suite needs more cleanups but it's already useful as is.

On unpaid time I introduced some usertags for tracking our non DLA related activities (although it seems I'm currently the only user).

Other Debian stuff

• I uploaded libvirt 1.3.0~rc1 and 1.3.0~rc2 to experimental and 1.3.0 final to unstable.
• I uploaded libvirt-python 1.3.0 with newly added autopkg tests
• Filed bugs reminding that libvirt-bin is a transitional package that will be dropped soon.

• Finally released gbp 0.7.1 with lots of changes most of these where already mentioned in the December installment of this post but there's more:

  • git-pbuilder updates to 1.37 and 1.38
  • fixes for 791759 and 766350,
  • doc updates including the addition of the patch queue handling

  Still looking for time to finish gbp import-orig's rollback support.

• I added a function to link to the Debian BTS to my emacs config to ease writing these kind of posts.

Debian LTS

November was the seventh month I contributed to Debian LTS under the Freexian umbrella. In total I spent ten hours working on:

• krb5: Released DLA-340-1 after applying a fix to the work done in October.

• nss: Provided patches for CVE-2015-7181 and CVE-2015-7182 for squeeze, wheezy and jessie and released DLA-354-1 for squeeze-lts for that.

  Since nss is subject to frequent security updates I wanted to spend less time doing "did I break the whole thing" testing so I added some autopkg tests that do basic certificate handling and make sure we can link a simple binary against the dev package (#806207).

  We also discussed using the same nss version in all suites on the debian-lts list. To test that path I worked on creating backports for Jessie/Wheezy/Squeeze of the current sid version. So far I tested the general feasibility and some simple upgrades.

  To be able to detect breackage more easily I enabled the internal test suite resulting in #806639. I also filed #806634 to ease backporting in the future. Packages are collected here with the sources in this (temporary) git repo. Work on this will continue in December.

Other Debian stuff

• There was no git-buildpackge upload in November but the git repository already collected some fixes and new features like building RPMs in clean chroots using mock. Patches for this were provided by Tzafrir Cohen. I've been hoping we get #775118 fixed in mock so it becomes actually useful in Debian before uploading a new gbp version.

  There's also now an example for README.source for gbp managed source packages. I'd be nice to have patches to further improve this.

  The main reason for not uploading new gbp yet is that I said at Debconf that I'll improve error recovery in gbp import-orig with the next or next next upload and that would be 0.7.1 latest. I did no get around to continue on this since Debconf though.

• I supplied a patch for pbuilder's #802800 to allow building with -g
• Uploaded libvirt 1.2.21 to unstable.

Debian LTS

October was the sixth month I contributed to Debian LTS under the Freexian umbrella. In total I spent four hours working on:

• krb5: I applied patches for CVE-2015-2697 and CVE-2015-2695. The DLA-340-1 was released on November though since one of the patches was incomplete.

Besides that I did CVE triaging of 16 CVEs to check if and how they affect oldoldstable security as part of my LTS front desk work.

I also added some very basic indentation support to our CVE/list Emacs major-mode on non LTS time.

Other Debian stuff

• I've released git-buildpackage 0.7.0 with lots of updates, most notably more complete rpm support, a git-pbuilder update and documentation updates. This release has patches from 9 different contributors, thanks a lot!

• Uploaded libvirt 1.2.21~rc1 to experimental, submitted a patch to fix running autopkg tests in pbuilder (#802379) and fixed RC bug #802281 in Icedove.

• I've updated cl2vcs, a CGI to link commit IDs in the debian/changelog to the VCS, to 0.0.4 fixing some bugs that showed up after I updated the hosting machine to Jessie as well as support for the [commitid1,commitd2,commit3,...] format when grouping commits. (SSL certificate of the server is CAcert signed)

• At Halloween five Debian aficionados met for Hacking Erpel 1 (aka HEPL1) in Erpel (link goes to German Wikipedia) between Bonn and Koblenz. Some details are here. We're aiming for more of these events on a more frequent basis (HEPL0 being back in 2013) so if you're somewhere from that area and want to join us next time just subscribe to the new mailing list (in German, SSL certificate of the server is CAcert signed).

Debian LTS

September was the fifth month I contributed to Debian LTS under the Freexian umbrella. In total I spent eight hours working on:

• glibc: I fixed four security issues resulting in DLA-316-1 mostly by backporting fixes from current Git. This involved some issues that didn't have a CVE assigned yet. Salvatore gave a nice summary on how to handle these.

• nss: The backport of the fixes for CVE-2015-2721 and CVE-2015-2730 resulted in DLA-315-1.

Besides that I did CVE triaging of 9 CVEs to check if and how they affect oldoldstable security as part of my LTS front desk work.

Other Debian work

I finally sent out the summary of the 8th Debian Groupware Meeting we had in the Linuxhotel earlier this year and gave a short talk about Debian at the Zarafa Tour in the Netherlands.

Debian LTS

August was the fourth month I contributed to Debian LTS under the Freexian umbrella. In total I spent four hours working on:

• pykerberors: Fixed a regression in DLA-265-1 affecting the default parameters of checkPassword(). This resulted in DLA-265-2.

• wordpress: Craig Small updated wordpress to fix CVE-2015-2213 CVE-2015-5622 CVE-2015-5731 CVE-2015-5732 and CVE-2015-5734. I did some testing and released DLA-294-1.

Besides that I did CVE triaging of 9 CVEs to check if and how they affect oldoldstable security as part of my LTS front desk work.

Debconf 15 was a great opportunity to meet some of the other LTS contributors in person and to work on some of my packages:

Git-buildpackage

git-buildpackage gained buildpackage-rpm based on the work by Markus Lehtonnen and merging of mock support is hopefully around the corner.

Debconf had two gbp skill shares hosted by dkg and a BoF by myself. A summary is here. Integration with dgit as (discussed with Ian) looks doable and I have parts of that on my todo list as well.

Among other things gbp import-orig gained a --merge-mode option so you can replace the upstream branches verbatim on your packaging branch but keep the contents of the debian/ directory.

Libvirt

I prepared an update for libvirt in Jessie fixing a crasher bug, QEMU error reporting. apparmor support now works out of the box in Jessie (thanks to intrigeri and Felix Geyer for that).

Speaking of apparmor I learned enough at Debconf to use this now by default so we hopefully see less breackage in this area when new libvirt versions hit the archive. The bug count wen't down quiet a bit and we have a new version of virt-manager in unstable now as well.

As usual I prepared the RC candidates of libvirt 1.2.19 in experimental and 1.2.19 final is now in unstable.

July was the third month I contributed to Debian LTS under the Freexian umbrella. In total I spent eight hours working on:

• lighttpd: Fixed CVE-2014-3566 by adding a option to disable SSLv3 (ssl.use-sslv3) compatible with the option added to newer versions. This resulted in DLA-282-1.

• nss: research on CVE-2015-2730 and CVE-2015-2721. Work on the former is still ongoing since the bug#1125025 referenced in the mozilla advisory has restricted access and I did not manage to get it opened yet. I found commits in uptream's mercurial that reference the bug though and the comitter was nice enough to answer questions.

  The backported changes for CVE-2015-2721 involve lots of changes to the internal state machine when accepting SSL connections so I'm currently looking into backporting the test suite for that on non LTS time.

Besides that I did CVE triaging of 11 CVEs to check if and how they affect oldoldstable security as part of my LTS front desk work.

June was the second month I contributed to Debian LTS under the Freexian umbrella. In total I spent ten hours working on:

• libwmf: research on CVE-2015-4588 and CVE-2015-0848. This resulted in DLA-253-1. RedHat's Bug#1227243 was a great resource here.

• librack-ruby: research on CVE-2015-3225. This resulted in DLA-254-1.

Besides that I did CVE triaging of 17 CVEs to check if and how they affect oldoldstable security. The information provided by the Security team on these issues in data/CVE/list is an awesome help here. So I tried to be as verbose when triaging CVEs that weren't looked at for Wheezy or Jessie yet.

On non LTS time I patched our lts-cve-triage tool to allow to skip packages that are already in dla-needed.txt. This avoids wasting time on CVEs that were already triaged.

May was the first month I started to contribute to Debian LTS under the Freexian umbrella. In total I spent six hours working on:

• dulwich: research on CVE-2015-0838, CVE-2014-9706. This resulted in DLA-231-1.

• mercurial: research on CVE-2014-9462, CVE-2014-9390 with Javi Merino. This resulted in DLA-237-1.

• mongodb: research on CVE-2015-1609. It turned out that we're not affected, the code did the check correctly in earlier versions but lost it then.

My current work flow looks like

• Find a package to work on via

  https://security-tracker.debian.org/tracker/status/release/oldoldstable

• Look at the details, via the security tracker, e.g.

  https://security-tracker.debian.org/tracker/source-package/mercurial

• Get the sources

  #!/bin/sh -e
  PKG="$1"
  gbp import-dscs --debsnap "${PKG}"
  cd "${PKG}"
  git checkout -b debian/squeeze-lts debian/$(rmadison -s squeeze -a amd64 "${PKG}" | awk '/squeeze/ { print $3 }'  | sed -s -e 's/:/%/' -e 's/~/_/')
  gbp pq import
  

Now I have an already patched source tree to add the backported patches to. Especially in cases where the Jessie version is already fixed this makes it rather quick to get an idea what the affected versions are and to see how the code evolved over time.

In order for this to work properly I made (on non LTS time) some improvements to gbp:

• git-pbuilder now knows about LTS so it can create chroots like:

  DIST=squeeze-lts git-pbuilder create
  

• gbp buildpackage is now clever enough to figure out the distribution to build for from the current branch name if you adhere to DEP14. So in case you're building from a git branch named debian/squeeze-lts it will automatically pass DIST=squeeze-lts to git-pbuilder. This needs

  [buildpackge]
  dist=DEP14
  

  in gbp.conf.

• gbp pq now tries harder to preserve patch names. While having patch names adhere to what git am writes out is nice but renaming patches just leads to too much noise when importing and exporting from existing packages (#761161). gbp pq still needs to improve in preserving DEP-3 header information though (#785274).

I have released whatmaps 0.0.9 a tool to check which processes map shared objects of a certain package. It can integrate into apt to automatically restart services after a security upgrade.

This release fixes the integration with recent systemd (as in Debian Jessie), makes logging more consistent and eases integration into downstream distributions. It's available in Debian Sid and Jessie and will show up in Wheezy-backports soon.

This blog is flattr enabled.

The seventh Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. We had one remote hacker from NYC which brings the number of attendants up to 9. This is a short summary of what happened during the weekend:

• We decided to abandon Iceowl (based on the standalone calendar sunbird) since Mozilla started to actively remove the code. Unfortunately this leaves us without a proper GUI stand alone calendar client with GSSAPI support.

• The icedove package got a major cleanup including the switch from CDBS to dh and the removal of the rebranding logic. This will hopefully allow us to better keep in sync with upstream. Carsten's git repo usually carries the most up to date version and a automated build of these version is in the works.

• The sogo connector extension for icedove got uploaded and tested including a wiki page

• The Groupware Page got updated

• We discussed the possibility of caldav/carddav servers in Debian using autopkgtest. This resulted in caldav-tester being packaged. It's currently waiting for an updated dependency before it can be uploaded.

• Based on that we added minimal autopkg tests to calypso. The later also gained GSSAPI support.

• OpenChange got updated in experimental (now moved to sid) and got a debug package. There were also some upstream improvements to ease provisioning.

• Dovecot's installation of the Sieve ext_programs was fixed

• SOPE and SOGo got updated to the latest upstream versions

• The SOGo-OpenChange plugin got build against the OpenChange package in experimental

• Giraffe (aka Zarafa packaging) made nice progress including the switch to free artwork and further renaming of the services. For Details on the current state check the wiki page.

• Due to the warm spring we had two nice barbecues for lunch.

Since we had a nice mix of first time Debian contributors, Debian Maintainers and Debian Developers we had lots of room for discussion and co-working which made this an exciting weekend.

One of the replies to the post about Debian's last groupware meeting was from Patrick Ohly of syncevolution fame pointing out that syncevolution already implements calendar autodetection for CalDAV calendars as described in draft-daboo-srv-caldav-10.

While looking at the code I noticed that there's a backend for the N900s calendar by Ove Kåven as well.

When I tried Ove's latest package on my N900 it lead to an immediate crash when doing a:

syncevolution --print-items target-config@webdav calendar

According to Patrick the bug was supposed to be fixed in recent versions so I set up scratchbox and built a newer git snapshot for maemo (sources). This wouldn't crash but didn't show up any items either. It turned out to be a minor bug in calypso returning no content type for REPORT queries which resulted in libneon discarding the whole reply (now already fixed in calypso upstream).

With this out of the way setting up synchronisation is quiet simple:

# Configuration
CALDAV_SERVER=192.168.0.10
syncevolution --configure username=<username> password=<password> \
              calendar/backend=caldav calendar/database=https://${CALDAV_SERVER}:5233/private/my_calendar \
              target-config@webdav calendar
syncevolution --configure --template SyncEvolution_Client sync=none syncURL=local://@webdav username= password= webdav
syncevolution --configure sync=two-way backend=calendar webdav calendar

You should then be able to print the items on the local (N900) and from the remote (CalDAV server) end:

# This lists the current calendar items on the server
syncevolution --print-items target-config@webdav calendar
# This lists the current calendar items on the N900
syncevolution --print-items @default calendar

And from there on sync away:

# initial slow sync
syncevolution --sync slow webdav
# from there on
syncevolution webdav

The syncevolution source code has great documentation about debugging problems (e.g. src/backends/webdav/README). So check that in case you run into problems. The tl;dr version is

SYNCEVOLUTION_DEBUG=1 src/syncevolution loglevel=10 --print-items target-config@webdav calendar

to debug CalDAV related problems. In case you need to run syncevoluton from source be sure to set these beforehand:

export SYNCEVOLUTION_TEMPLATE_DIR=$PWD/src/templates/
export SYNCEVOLUTION_XML_CONFIG_DIR=$PWD/src/syncevo/configs/

On the CalDAV side I used current Calypso git which (with some additional minor fixes) now also interoperates nicely with Iceowl/Icowl-Extension aka Sunbird/Lightning on the desktop side. There's also an ITP for it. So it'll hopefully end up in Debian soon.

Update: in order to do ssl verification with syncevolution/libneon you have to put the CAs certificate to /etc/ssl/certs on the N900 and do a

c_rehash /etc/ssl/certs

otherwise syncevolution won't ve able to verify the server's certificate.

The sixth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. We had one remote hacker from NYC which brings the number of attendants up to nine - an all time high! This is a short summary of what happened during the weekend:

• Sogo 2.0.5 got uploaded to unstable and work on OpenChange support is advancing.

• D-push (the rebranded version of z-push) got split and restructured to better handle different backends. An update in experimental is pending.

• Giraffe's git (the rebranded version of zaraffa) got updated to 7.1. There's some more work needed to get this into the archive though.

• There's been progress on getting Kolab3 into Debian starting with libkolabxml 0.8.4 and libkolab 0.4.2 (also needed by kde-pim).

• mozilla-devscripts now handles Iceowl as well so packaging calendaring extensions like this one becomes even more useful.

• Icedove and Iceowl bugsquashing. New versions were uploaded to unstable and experimental. The bug count trends look quiet promising but we really need help for #658664.

• We did some davmail <-> iceowl/icedove interop testing.

• The Groupware Page got updated

• We had some discussions about calendar and addressbook detection and autoconfiguration. For CalDAV/CardDAV there's a specification available already but there seems to be no client implementation in Debian so we started to work on it.

• We had a nice barbecue enjoying the first warm days.

Running Debian on the WeTab with GNOME Shell without an external keyboard works pretty nicely. The on screen keyboard - if enabled via the accessibility menu - folds out automatically in the shell itself within text input fields. To have this within GTK+3/GTK+2 applications you need libcaribou-gtk3-module and libcaribou-gtk-module installed. For other cases I stitched together a small extension that puts a keyboard "Button" prominently into the middle of the panel. Clicking/touching it will fold it out, clicking again will hide it again. You can fetch it from

git clone git://honk.sigxcpu.org/git/gnome-shell-oskb-extension.git ~/.local/share/gnome-shell/extensions/OnScreenKeyboardButton@sigxcpu.org

and activate it via

 gsettings set org.gnome.shell enabled-extensions "['OnScreenKeyboardButton@sigxcpu.org']"

For kinetic scrolling in Iceweasel I'm currently using Grab and Drag which is not yet packaged for Debian.

Thanks to the Debian's GNOME packaging team gnome-shell 3.6 is already available in experimental.

This blog is flattr enabled.

Interactively installing Debian virtual machines with virt-install without having to download anything in advance can already be done by pointing it to a Debian mirror via --location. But you can also add files to the initrd after downloading using --initrd-inject. Upstreams intended use is for kickstart files but we can also feed it a preseed.cfg to automate the whole installation:

virt-install --connect=qemu:///system \
             --location=http://ftp.us.debian.org/debian/dists/stable/main/installer\-i386 \
             --initrd-inject=/path/to/preseed.cfg \
             --extra-args="auto" \
             --name d-i --ram=512 \
             --disk=pool=default,size=5,format=qcow2,bus=virtio

preseed.cfg is a regular preseed file (as described in the Debian Wiki) in your local filesystem. I'm using this one for Squeeze and Wheezy VMs. It must be named preseed.cfg in order for d-i to pick it up from the initrd. This also works for URLs like qemu+ssh://<remotehost>/system/ since virt-install uses libvirt's streaming API to upload the kernel and modified initrd to the remote host.

In case you're running this on an i386 you'll need this fix which already sits in experimental.

This blog is flattr enabled.

This went out to d-d-a already but I figured that this might be of interest here too:

The fifth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. Eight persons attended which is an all time high! This is a short summary of what happened during the weekend:

• We pushed a ESR (extended support release) version of icedove including l10n and the calendaring extension to unstable. By cherry-picking lots of build-fixes from iceweasel we made the testing transition getting rid of the old 3.X version.

• Since iceowl (the standalone calendar) is not maintained upstream anymore we're keeping it in experimental only for now. A new version got uploaded including updated l10n.

• A new upstream version of evolution-mapi was upload to sid fixing an FTBFS.

• d-push 1.5.8 (the rebranded version of z-push) got uploaded to unstable including translation updates and adaption to php 5.4.0.

• Lots of progress was made on packaging SOGo and related components and it's now quiet close to an upload to sid.

• Work on OpenChange included looking into using the version in Debian for SOGo packaging as well as fixing Samba4 issues that broke (among other things) the OpenChange build.

• Progress was made on packaging Zarafa ZCP for Debian (rebranded as giraffe). The packages are working but rebranding is not yet complete.

• About 60 evolution bugs where either closed or commented on.

• As usual the Groupware page got updated.

• The meetings 5th anniversary was celebrated with a barbecue.

I've started uploading snapshots of git-buildpackage to experimental recently. Here's a short list of what changed over the version in wheezy and sid:

• git-buildpackage now has a --git-pristine-tar-commit option that commits a tarball right back to the pristine-tar branch if it's not already there. This makes tracking upstream git and dfsg-clean source handling easier.
• git-buildpackage's --git-upstream-tree now accepts a tree directly without the need to use --git-upstream-branch.
• git-buildpackage's --git-export now parses the exported changelog instead of the working copy. This way we automatically pick up the correct tarballs, branches, etc. reducing the number of options needed.
• Jan Čapek added a --git-postexport hook to allow to mangle the source after exporting it.
• gbp-pull and gbp-fetch now support shallow clones thanks to Markus Lehtonen.
• gbp-pull got a speed up by skipping the checkout for fast-forward. This makes updating large source trees less time consuming.
• git-import-orig and git-import-dsc can now import into bare repositories.
• Russ Allbery updated git-pbuilder to 1.27.
• gbp-pq should be easier to use thanks to the --force and --switch options. It also handles patches without descriptions more robustly.
• The test coverage of the internal test suite increased quiet a bit. We're now generating coverage information during the build in build/cover.
• We're now generating apidocs which also serves as usage examples.

This blog is flattr enabled.

Debian's libvirt in unstable finally passes the Technology Compatibility Kit (libvirt-tck) for qemu:///system:

Files=59, Tests=1579, 315 wallclock secs ( 0.77 usr  1.02 sys + 31.40 cusr 10.14 csys = 43.33 CPU)
Result: PASS

We're running libvirt's internal test suite since 0.9.0 but this doesn't launch any real virtual machines to check things like suspend, resume, snapshotting, migration and it doesn't create storage pools and volumes or networks. This means a lot of testing was done manually with each release.

libvirt-tck provides a framework to perform these kinds of integration testing between libvirt and it's drivers, comes with hundreds of testcases already and it's easy to set up since it's available in experimental:

apt-get install -t experimental libvirt-tck

Edit /etc/libvirt-tck/default.cfg if you don't want to use the default connection URI. Then just run libvirt-tck:

libvirt-tck

Since this is supposed to stress libvirtd and the hypervisor and since it creates and deletes storage pools, networks and virtual machines it's recommended to run this on a dedicated system to make sure the tests don't blow away any precious config.

If a test fails one can debug that single test using:

LIBVIRT_TCK_CONFIG=/etc/libvirt-tck/default.cfg prove --verbose /usr/share/libvirt-tck/tests/hooks/051-daemon-hook.t

This already revealed errors in our package like a missing parted build dependency breaking the creation of disk based storage pools, bugs in libvirt, crashes in QEMU and minor errors in the test suite itself. We're currently cheating a bit since the tests for hooks and nwfilter are currently disabled due to license problems with the used Perl modules.

libvirt-tck can easily be integrated into Jenkins since it can now use libtap-formatter-junit-perl to generate JUnit XML. To do so simply configure a free-style software project to execute these commands:

rm -f libvirt-tck.xml
sudo libvirt-tck --timer --format junit --force > libvirt-tck.xml

allow Jenkins to run libvirt-tck as root

jenkins ALL=(ALL) NOPASSWD: /usr/bin/libvirt-tck --timer --format junit --force

and configure it to publish a JUnit test result report.

Currently I'm only running the tests for qemu:///system so any help running and debugging this for LXC, VirtualBox or XEN is very welcome.

Many thanks go to Salvatore Bonaccorso for packaging the missing Perl modules needed by libvirt-tck.

During todays very interesting Puppet Skills Exchange given by Christian Hofstaedtler at Debconf 11 it was recommended to syntax check puppet manifests in git commit hooks. Since I wanted to do the same some time ago and I couldn't find anything that does manifests, ruby and erb I wrote some hooks that can be either used on commit or on the remote site when receiving the update. The git archive of this can be found at:

git clone git://honk.sigxcpu.org/git/puppet-helpers.git

This blog is flattr enabled.

Due to two totally different bugs in tip22 the d-i netinstall images for IP22 (SGI Indy) and IP32 (SGI O2) won't boot the installer correctly.

Tip22 is responsible for merging a minimal loader, kernel and initramfs into a single ELF or ECOFF binary, depending on the architecture. This can then be fetched by the machine's ARC PROM via tftp.

A fixed tip22 has been uploaded to unstable and updated images are available from here until we can get this fixed via stable-proposed-updates.

This blog is flattr enabled.

This went out to d-d-a a couple of days ago already but I figured that this might be of interest here too:

The fourth Debian Groupware Meeting was held in the LinuxHotel, Essen, Germany. This is a short summary of what happened during the weekend:

• We pushed new versions of icedove and iceowl to unstable fixing several issues with gnome-shell in the later. Unstable now ships packages based on Thunderbird's current 3.1 branch.

• The iceowl-l10n language package got resurrected (currently sitting in NEW) providing translations for iceowl-extension and (in a yet incomplete way) for iceowl. (Update: it's already in unstable now)

• We've done Citadel ↔ ice{dove,owl} interop testing and bug fixing.

• Work was done on Citadel's event driven SMTP client and IPv6 compatibility

• The z-push package got updated to 1.5.1. The patent restrictions are resolved now and we're closer to resolving the trademark issues. So hopefully an upload to main can happen real soon now.

• SOGo packaging made nice progress. Remaining issues involve linking against GNUTLS to resolve the OpenSSL GPL license incompatibility, and handling of the embedded copies of JavaScript libraries.

• We updated the groupware overview page.

• We were invited by the FrOSCon organizers to join their barbecue. Many thanks for that!

In order to ease creation of remote repositories to publish your Debian packaging work git-buildpackage ships gbp-create-remote-repo: If you run

gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/%(pkg)s.git'

from inside a git repository it will create a remote repository on git.debian.org in the given directory, push your debian, upstream and pristine-tar branches into it and set up branch tracking so you can easily use gbp-pull or git pull to update your local repository from there. '%(pkg)s' will be replaced by the source packages name. If you want to be more explicit you can use:

gbp-create-remote-repo --remote-url-pattern='ssh://git.debian.org/home/users/agx/public_git/foo.git'

so no substitution will take place. In case you only want to push to that repository but not pull from there you can use the --no-track option so gbp-create-repo won't set up any branch tracking.

If you specify the remote-url-pattern via gbp.conf calling:

gbp-create-remote-repo

is enough to create a repo on your favorite git server. The default is to create new repositories in the collab-maint repository on alioth.debian.org.

This feature is available in your $PATH since 0.5.16 (it was shipped in examples/ before) and was inspired by the Debian OCaml Maintainers dom-new-git-repo work.

This blog is flattr enabled.

Since waiting for long running builds is boring and having to check if the build already finished distracts one from doing other stuff, git-buildpackage 0.5.16 reports the build status of a package via desktop notifications if python-notify is installed:

To disable this feature use:

[git-buildpackage]
notify = off

in your ~/.gbp.conf.

This blog is flattr enabled.

To make xul-ext-nostalgy work with icedove 3.1 I finally wanted to update to a new upstream version. The git repository is tracking upstream's svn via git-svn which works great but when I typed

git svn rebase

I got a

Connection refused: Can't connect to host 'frisch.fr': Connection refused at /usr/lib/git-core/git-svn line 2310

The svn upstream repo moved to google code. It took me a moment to figure out that this can be fixed easily with:

 git config svn-remote.svn.url http://nostalgy.googlecode.com/svn/
 git config svn-remote.svn.rewriteRoot svn://frisch.fr/nostalgy
 git svn rebase

Just replace the url with the new svn repository url and set rewriteRoot to the old svn repository url and you're done.

This blog is flattr enabled.

When reviewing packages from mentors.debian.net I like to have them under version control so I can easily compare different versions, write patches and clean up autogenerated files. So when looking at a package I do a

git-import-dsc --download http://mentors.debian.net/debian/pool/main/x/xul-ext-firetray/xul-ext-firetray_0.2.8-1.dsc

This command first fetches the files via dget from devscripts and then imports the upstream sources onto the upstream branch (upstream by default) and the debian modifications onto the debian branch (master by default). I can then invoke git-buildpackage as usual. Since this works incrementally I can import newer versions into the same repository and use git diff to see the changes.

If I'd like to hack on a random Debian package (say xul-ext-nostalgy) I usually use:

git-import-dsc --download xul-ext-nostalgy

This uses apt-get source to fetch the source package and imports it into git using the same branch layout as described above so I can use all the familiar git commands to generate patches, etc..

This blog is flattr enabled.

Let's say you want to clone a git repository that has the debian packaging on master and the upstream source is kept on upstream/master (since it tracks upstream's master branch). You can simply use git clone or you can do a

gbp-clone --upstream-branch=upstream/master --pristine-tar git://git.debian.org/git/pkg-lvm/multipath-tools.git

This will additionally set up master, upstream/master and pristine-tar to track the corresponding remote branches. There's no --debian-branch option in the above example since master is the default.

If you want to safely update these branches at a later point invoke

gbp-pull --upstream-branch=upstream/master --pristine-tar

from inside the repository. This will only update the branches if they can be fast-forwarded. If the repository has a debian/gbp.conf describing the branch layout a call to

gbp-pull

is enough.

In case somebody else wants to jhbuild current GNOME 3 prereleases on Debian here's the current set of dependencies and the jhbuildrc I'm using. With the necessary fixes applied upstream now this allows me to build gnome-shell, gnome-control-center and others via

jhbuild build <program>

It needs libmozjs3d-dev from experimental for the shell but the rest comes out of squeeze.

For a security update of a shared library to take effect processes need to be restarted in order to use the libraries from the newly installed package. The openssl and freetype updates got me thinking again if I caught all the affected services on servers and desktops/laptop systems I'm running.

So I put together a small script that takes a package name and scans /proc/pid/maps for processes that map libraries from this package, it then looks for init scripts in these packages. It can also hook into apt and restart the services after the upgrade. Since the mapping to the init scripts is quite dumb at the moment this should be used with a bit of caution though.

The script whatmaps can be fetched form here. Debs are also available. Besides Debian packages it also handles RPMs and already proved useful since it pointed me to clamav being possibly affected by the recent bzip2 advisory.

Many team maintained packages in Debian are maintained in Subversion which makes a lot of sense if people agreed on a common workflow. If you want to use git to work on these packages you can still do so with a bit of configuration without changing anything for the other team members. Let's take system-config-printer as example. git-svn can be used to checkout the svn repository:

git svn clone svn+ssh://svn.debian.org/svn/pkg-gnome/ -T packages/unstable/system-config-printer -t tags/system-config-printer system-config-printer

Since the pkg-gnome team keeps all the packages in one huge SVN repository and splits the directories by release first and then by package the above command uses -T to point git-svn to system-config-printer's trunk and -t to point it to the tags directory. In simpler repositories where trunk, branches and tags are subdirectories of the same base directory using --stdlayout instead is enough.

Since in SVN based packaging the upstream sources usually aren't kept in the repository git-buildpackage needs to know where to find them and how to combine things in the build-directory:

cd system-config-printer
cat <<EOF >.git/gbp.conf
[git-buildpackage]
# Build in a separate build-area
export-dir = ../build-area/
# Look for tarballs in ../tarballs
tarball-dir = ../tarballs/
# Overlay the upstream sources on top of it
overlay = True
# Don't use pristine-tar
pristine-tar = False
# Compression type of the tarball
compression = bzip2

Like with svn-buildpackage the orig-tarball is expected to be found in ../tarballs where you should put it now e.g. using the get-orig-source target of debian/rules (yes, git-buildpackage should support this implicitly). You can then work on the package as usual using all the nifty git commands like git-rebase, etc. and build the package (in this case using git-pbuilder):

git-buildpackage --git-pbuilder

or if you don't want to export the current branch's HEAD of your git repository but your working copy (which might contain uncommitted changes) to the build-area instead use:

git-buildpackage --git-pbuilder --git-export=WC

The built packages can then be found in ../build-area. Once the package is ready pushing the changes into the SVN remote repository is as simple as:

git svn dcommit
git svn tag -m"Tagging system-config-printer (1.2.3-0.2)" 1.2.3-0.2

The last command appropriately tags the new version. This saves a bit of typing. In order to fetch changes others have made use:

git svn rebase

I got tired of having to authenticate as root to change printer settings like paper size or printout mode via a GUI. Since system-config-printer uses PolicyKit things like allow myself to change printer settings when logged into the system should be possible without having to mess with cupsd.conf or sudo, are they?

Which printer related actions are governed by PolicyKit:

pkaction | grep printer

shows about the following if you have cups-pk-helper installed. The later is used by system-config-printer to interface with PolicyKit:

org.opensuse.cupspkhelper.mechanism.printer-enable
org.opensuse.cupspkhelper.mechanism.printer-local-edit
org.opensuse.cupspkhelper.mechanism.printer-remote-edit
org.opensuse.cupspkhelper.mechanism.printer-set-default
org.opensuse.cupspkhelper.mechanism.printeraddremove

So org.opensuse.cupspkhelper.mechanism.printer-local-edit seems to be what I'm looking for. Let's change the policy for this action:

cat <<EOF >/etc/polkit-1/localauthority/50-local.d/99-local.pkla 
[EditPrinters]
Identity=unix-user:foo
Action=org.opensuse.cupspkhelper.mechanism.printer-local-edit
ResultAny=no
ResultInactive=no
ResultActive=yes
EOF

This allows user foo to perform the action org.opensuse.cupspkhelper.mechanism.printer-local-edit if the user is logged into a local interactive session. The pklocalauthority(8) manpage has all the details. PolicyKit will pick up the configuration file changes on the fly. Lets see if this worked by getting the process id of the running system-config-printer and checking via pkcheck if the process is authorized to use that action:

PID=$(ps a | awk '/[p]ython .*system-config-printer/ { print $1 }')
pkcheck --action-id org.opensuse.cupspkhelper.mechanism.printer-local-edit --process $PID
echo $?

If pkcheck returns with a zero return value everything is fine and user foo won't need any password to modify local printer settings from now on.

Check the output of pkaction(1) to list more actions that can be setup this way.

Chris reports back to Debian duty: `Since one week I'm back from NYC where I enjoyed a very nice Debconf. It was my second one after last year in Cáceres. When I unpacked all my luggage - three weeks in the US need some stuff - I found these cute green guys between my clothes. Did they break their UFO and use my airplane to travel with me? Anyway. Thanks to all who made Debconf10 in New York possible. It was a great conference! And last but not least: "Happy Squeeze Freeze"' I too enjoyed DC10 a lot.

Git-buildpackage 0.5.6 in experimental got rid of it's pbuilder/cowbuilder examples and added Russ's nice git-pbuilder script. I'm very happy how this turned out, now building with cowbuilder is as simple as:

# Initially create a cowbuilder environment once
git-pbuilder create

# Build the package
git-buildpackage --git-pbuilder

# At a later point update the cowbuilder environment with new versions
git-pbuilder update

Or for another distribution:

DIST=lenny git-pbuilder create 
git-buildpackage --git-pbuilder --git-dist=lenny

The new version also better interacts with dch from devscripts. So things like:

git-dch --bpo|--qa|--nmu

are now also supported when adding new changelog sections. Git-dch now detects new upstream version numbers automatically and bumps the version accordingly. In order to get this working I finally fixed the tag format.

Since the current version in unstable should get a chance to move to testing first, I've uploaded 0.5.6 to experimental.

Those old school ones among us that still need a printer who are new school enough to want to get rid of HAL should try system-config-printer from experimental. After replacing hal-cups-utils by system-config-printer-udev aptitude tells me:

    The following packages will be REMOVED:
      hal{u} hal-info{u} 
    0 packages upgraded, 2 newly installed, 2 to remove and 121 not upgraded.

Which means faster startup times and one daemon less on Squeeze's GNOME desktop. The new version also uses PolicyKit instead of gksu for finer grained permission control.

Git-buildpackage 0.5.0 in experimental fixes quiete some bugs related to the import of upstream sources and Debian source packages. By getting rid of a complete source tree copy it also got about 50% faster when doing so. Since the code changed quiete a bit in that area it'd be great if some of you could give it some testing before I'll push it to unstable.

I've just added a simple afs plugin to krb5-auth-dialog. It just calls either aklog or afslog after acquiring or renewing your Kerberos ticket to get you into your AFS cell. To activate it use

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [afs]

and restart krb5-auth-dialog. A package with the above enabled has been uploaded to Debian. Thanks to the test account in the global2000.at cell provided by Jörg Herzinger I could test this easily and I have to say that AFS looks like a cool thing.

The slides of my talk about git-buildpackage at the Mini Debconf 2010 in Berlin are now available.

It was a great conference that I really enjoyed being at. Thanks a lot to all who made that event possible and happen!

Krb5-auth-dialog now sends DBus signals when you acquire or renew your Kerberos ticket granting ticket and when the ticket expires. When using OpenAFS This can e.g. be used to trigger a call to aklog on ticket renewal. It's simple to catch the DBus signals from a Python script:

import dbus
bus = dbus.SessionBus()
bus.add_signal_receiver(tgt_renewed_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_renewed")
bus.add_signal_receiver(tgt_acquired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_acquired")
bus.add_signal_receiver(tgt_expired_handler, dbus_interface = "org.gnome.KrbAuthDialog", signal_name = "krb_tgt_expired")

The tgt_*_handler will then be called when the signal is received. The shipped Python example allows to execute a script already:

tgt-signals.py -q --acquired-action=aklog --renewed-action=aklog

Krb5-auth-dialog also got a plugin system so you could use a loadable module for these kind of things instead. It already ships a PAM plugin that can be used to run some typical actions like calling pam-afs-session or getting kx509 set up.

You need to tell krb5-auth-dialog which plugins to load via gconf. To load the dummy and PAM plugins use:

gconftool-2 --set --list-type=string --type=list /apps/krb5-auth-dialog/plugins/enabled [pam,dummy]

Since I'm not using AFS or kx509 myself I'd be interested to know if this works out as expected.

If you want to write your one plugins you can use the dummy plugin as a basis.

A package with the above enabled has been uploaded to Debian experimental.

gnome-activity-journal recently entered Debian and it could become a great tool to keep track of hacking activities. The underlying zeitgeist can log these and other events and make the information available via DBus. I couldn't find a data provider that feeds the information about Git commits to it so I wrote a simple post commit hook. This way one can easily see when one worked on a source repository:

Now is there a nice way to store additional information like current branch or commit message along with that?

Fedora uses Plymouth to provide a flicker free boot for quiet some time now. Debian has packages in experimental but it took some patches to get these working. After adding a Debian logo the boot splash actually looks quiet nice. The initramfs and init scripts do need some more work but it's basically working. Thanks a lot Daniel for merging these so quickly!

To enable Plymouth you first need to set up KMS in the initramfs. For an intel based card you can do this by either adding

i915 modeset=1

to /etc/initramfs-tools/modules or by setting

i915.modeset=1

on the kernel command line. Then install plymouth, set a default theme and update the initramfs:

aptitude install plymouth plymouth-plugins-all
plymouth-set-default-theme solar
update-initramfs -u

Finally add splash to the kernel's command line (e.g. by adding it to /etc/default/grub).

Afterwards reboot and you should see the solar flares:

We're still not fully there yet since we need a newer gdm for a flicker free handover. Fortunately the Debian GNOME maintainers have already prepared a new package in svn. We also need proper support for encrypted disks, asking for the passphrase works with this fix but cryptsetup needs support for it.

In case somebody wants to run KDE together with some GTK+ based applications (like Iceweasel or Icedove) having a consistent style as well as look and feel between KDE and GTK+ applications is a nice thing to have. QtCurve together with xsettings-kde and gtk-qt-engine makes this easily possible:

aptitude install gtk-qt-engine kde-config-gtk-style qtcurve xsettings-kde

Then adjust the following settings:

• Settings->System-Settings->Appearance, Style set Style to QtCurve
• Settings->System-Settings->Appearance, GTK Styles under Use another style: select QtCurve
• Settings->System-Settings->Appearance, GTK Styles under Firefox and Thunderbird click Install scrollbar fix...

Log off and right back in. Now your GTK+ applications should blend nicely into the QtCurve KDE look. xsettings-kde additionally bridges KDE settings like double click speed and icon theme via xsettings to GTK+ applications.

Now back to using gnome-shell...

Here are some more examples of libguestfs usage:

What kernels, modules and packages are in a (currently powered off) libvirt based virtual machine vmfoo:

virt-inspector -c qemu:///system vmfoo

Show free space in virtual machine vmfoo:

virt-df -c qemu:///system vmfoo

List file systems:

virt-list-filesystems -c qemu:///system -l vmfoo

Edit /etc/passwd in vmfoo:

virt-edit -c qemu:///system lenny-base-clone /etc/passwd

Tell guestfish to mount all filesystems of virtual machine vmfoo for more complex inspection and manipulation tasks like LVM operations, partitioning, resizing or filesystem check or creation:

guestfish $(virt-inspector -c qemu:///system --ro-fish vmfoo)

Debian packages are still on alioth.

I've finally updated the libguestfs Debian packages to 1.0.84 getting them back in sync with upstream. Download instructions are on the pkg-libvirt's wiki page.

Fetching files from a vm image with guestfish is as simple as:

guestfish --ro -a lenny-base-clone.img -m /dev/debian/root download /etc/passwd /tmp/passwd

After hacking around #561991 by running debirf as root we now do pass the testsuite again. The new version includes fuse support as well as the hivex tools to manipulate windows registries.

The source for the Debian package is available at git.debian.org. The next step will be to split out the appliance so we can fetch that one via http and upload libguestfs to contrib.

Here's a short overview of 3.0 source format support in git-buildpackage 0.4.64:

• git-import-dsc & git-import-dscs import 3.0 (quilt and native) format packages.
• git-import-orig: imports gzip and bz2 compressed archives. Other formats will be enabled once pristine-tar supports them (#499489).
• git-buildpackage handles creating gzip, bzip2, lzma and xz compressed tarballs with the --git-compression option although it could get a bit smarter and autodetect the compression type.

One loose end is the handling of multiple upstream tarballs (#561071, #561072). I'd be great to hear from people already using this feature how this can best be added into the gbp workflow.

The newer kids in town gbp-clone, gbp-pull (for keeping the repo up to date when using team maintenance) and gbp-pq (for managing the quilt patch-queue) don't care about the underlying source package format. These three are a bit underdocumented in the manual but information about the workflow is in the wiki.

Release 1.0beta1 of Iceowl-extension (also known as Lightning), the calendaring extensions for Icedove, is now available in experimental. This version works with Icedove 3.0.1 which also lives in experimental at the moment.

Open TODOs for Iceowl:

• reenable standalone build
• don't use internal cairo
• finish branding

Iceowl's current packaging git is here:

http://git.debian.org/?p=users/agx/iceowl.git

Any help on the above issues is greatly appreciated. Other open tasks that need fixing in order to get things in shape for Squeeze:

• Updating icedove-l10n and iceowl-l10n - both packages are looking for a maintainer
• Adding an icedove-dev package for 3.0 ...
• ... so we can build Enigmail for Icedove 3.0

I've just uploaded Icedove 3.0 to Debian experimental. The package is heavily based on Alexanders work in Ubuntu and Chris did most of the hard work.

It's currently named icedove-3.0 so you can (for now) install this version in parallel to Icedove 2. This version copies over your Icedove 2 profile so it doesn't get messed up.

As long as the package is sitting in new you can grab it from the pkg-mozext repository:

deb http://pkg-mozext.alioth.debian.org/packages sid/i386/
deb http://pkg-mozext.alioth.debian.org/packages sid/all/

We now need help with going through the Debian bugreports against Icedove.

If you want to help out: grab a bug, check if it's fixed in Icedove 3 and if it is, simply mark it as fixed in 3.0~rc2-2 in the bts:

bts fixed <bugnumber> 3.0~rc2-2

Once we're confident the package doesn't break everything we'll rename the binary package to icedove so it replaces the default Icedove on upgrades.

If you want to help out with patches: Git is here

git clone git://git.debian.org/pkg-mozilla/icedove.git

As already mentioned on <pkg-libvirt-discuss@lists.alioth.debian.org> libvirt 0.7.4-2 (currently in experimental) runs qemu and kvm processes as libvirt-qemu:kvm instead of root allowing you to use features like bridged networking without having to run the emulator itself with full privileges.

Kvm 88+dfsg-3 supports ksm to safe memory when running several similar virtual machines. On a recent linux kernel just do a

echo 1 > /sys/kernel/mm/ksm/run

to activate it. Then run two similar virtual machines and see how /sys/kernel/mm/ksm/pages_shared increases.

Thanks to work of Jan and Micheal Debian now also ships kvm's stable branch qemu-kvm.

As of git-buildpackage 0.4.60 gbp-pull supports --redo-pq which additionally recreates the patch-queue branch after a pull. Now you can keep your clone fresh with one command.

Inspired by tools developed by Debian's OCaml maintainers git-buildpackage now ships gbp-pull that can be used to keep your debian-, upstream- and pistine-tar branch up to date when doing team maintenance.

I added a short explanation on howto handle backports with git-buildpackage to the GBP workflow page.

git-buildpackage 0.4.57 adds gbp-clone to /usr/share/doc/examples/. If you use it instead of git pull it will automatically set up your upstream and pristine-tar branches. This was inspired by the helper scripts the ocaml team uses.

git-import-orig now calls a postimport hook which can be used to call git-dch after import so I could remove the hardcoded dch call.

The slides of my talk about libvirt at dc9 are now available.

git-buildpackage 0.4.55 now ships gbp-pq for easier serializing of git patch queue branches into quilt patch series and vice versa. It's currently in /usr/share/doc/git-buildpackage/examples/. I'll move it to /usr/bin/ once I feel a bit more confident that this is the right interface.

I've worked a bit on Richard's libguestfs Debian packages They now also provide perl and python bindings as well as a debug package and the appliance is built using debootstrap/debirf. The wiki has the necessary apt/sources.list (packages are currently available for i386 only).

The source for the Debian package is available at git.debian.org so please send patches to wrap more of the available language bindings into Debian packages.

If you're interested in updates on this as well as other virtualization related stuff in Debian what about joining the pkg-libvirt-discuss list.

As of version 0.4.53 git-buildpackage's git-import-orig supports --fast-import. This uses git fast-import to import the new upstream version and speeds up imports by about a factor of two.

It's not as well tested as importing without --fast-import so please be careful and file bugreports if it fails.

As a result of the 2nd Debian Groupware Meeting snapshot builds of the Thunderbird 3.0 release branch could be rebraned and build for Debian as Icedove. We'll continue to upload snapshots. See the pkg-mozext maintainers page for download instructions.

As of version 0.4.47 git-buildpackage exports these environment variables to a called posttag hook:

• GBP_TAG: the tags name
• GBP_BRANCH: the branch you were on when creating the tag
• GBP_SHA1: the sha1 of the commit the tag was created at

This allows you to write posttag hooks that push out only the changes that correspond to the created tag. For a simple example see the GBP Manual. Using such a hook makes team maintenance a lot easier since you can't forget to push out the commits and tags for a newly uploaded package while making sure you don't push out any other changes.

The current state of multipath support in Debian Installer's RC2 for Lenny is documented here. The netinst works fine if you use the patched grub (#442382). Unfortunately the CD images are currently broken due to missing libaio udeb.

The easiest way to get the patched grub into your system is via http://tinyurl.com/mpgrub/inst_i386.sh as described in the README.

The recently updated multipath-tools 0.4.8-14 support disks >2TB and also work with kernels more recent then Debian's 2.6.26.

New upstream versions of virtinst and virt-manager are available via Debian's experimental distribution. All the bugfixes we carried as patches have been applied upstream by Cole Robinson, which is great. New features include disk- and newtork-I/O graphs and direct support for installing paravirtualized Debian Lenny Xen Guests via:

   virt-install -n xenfoo1 -r 96 --disk path=/path/to/file,device=disk,size=1 --location=http://ftp.nl.debian.org/debian/dists/testing

While Debian's Iceweasel ships a nice search engine for Debian packages it doesn't have one for the bug tracking system (which I tend to use more frequently). So I stitched together a simple search engine following the Opensearch specificaton. To install it in Firefox/Iceweasel go here.

sapgui-package allows you to build a Debian package out of the SAP GUI for Java by simply running:

make-sgpkg PlatinGUI-Linux-710r7.jar

You can then install the resulting Debian package via:

dpkg -i sapgui_7.10rev7_i386.deb

The 'guistart' and 'guilogon' binaries are available as 'sapguistart' and 'sapguilogon' in your path.

Once a new release comes out simply repeat the above steps and all users on your system(s) will enjoy the new version. This has been tested with 7.10r6 and 7.10r7.

The source code is available via:

git clone http://honk.sigxcpu.org/git/sapgui-package.git/

An ITP has already been filed.

When following Debian changelogs (e.g. via apt-listchanges or update-manager) one often wonders what an actual commit messages actually means or how a bug got actually fixed. Currently finding this information is cumbersome:

• Find out the version control system of the package, either via the PTS or via debian/control.
• Browse it's VCSs revision history either by using the web interface or by cloning the repository.
• Try to locate the correct commit from it's commit message. Hopefully it's the same as in the changelog and hopefully it mentions the bug number - otherwise: tough luck!

However this process can be automated if a package uses the following format for changelog entries:

* [commitd] changelog message

e.g.:

* [fed3f3d] fixed segfault during daemon startup (Closes: #7005180)

then you can use Cl2vcs to locate the exact commit that corressponds to that changelog entry. Cl2vcs uses the PTS to parse the packages Vcs-Browser URL to create a link back to the commit.

If you maintian your package in Git, creating this type of changelog entry is simple: You can tell git-dch to include N digits of the commit's SHA1 (the commit id) using the --id-length option, e.g.:

git-dch --release --auto --id-length=7

This way git-dch will include the first 7 digits of the commit's SHA1 (this options can of course also be specified in gbp.conf). Packages already using this are e.g. libvirt and calendarserver.

Note: a possibly useful extension of the above format would be:

 * [commitid1,commitid2,commitid3] changelog message 

so several commits can make up a changelog entry. For Subversion this would then look like:

 * [r123,r125.r127] cleanup whitespace errors

The nice thing about d-i is that it's even more flexible then one thinks. Usually an autopartitioning recipe looks like:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
filesystem{ ext3 }
mountpoint{ / } .

But what if you want a to set a filesystem label. That's easy:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
label{ root }
filesystem{ ext3 }
mountpoint{ / } .

This sets the label root on the ext3 filesystem that will be mounted as /. You can set any variable here and the text between the curly braces ends up in $<partition>/<var> ready for partman to pick it up. See partman-auto-recipe for the full details.

The label allows to mount the filesystem by it's label instead of it's device name, so /etc/fstab looks like:

 LABEL=root /     ext3  defaults,errors=remount-ro,relatime 0 1
 LABEL=home /home ext3  defaults,relatime,user_xattr        0 2

Very handy if you insert partitions later which would change the numbering or work with partimage snapshots that should work on PATA and SATA. However this currently isn't supported by d-i since it can only create filesystem labels but can't write them to /etc/fstab. With the patches from #488321 and #488322 this can be done with:

500 10000 1000000 ext3
method{ format }
format{ }
use_filesystem{ }
label{ root }
labeled_mount{ }
filesystem{ ext3 }
mountpoint{ / } .

You also need to fixup mount since it will otherwise segfault during d-i's initial deboostrap run (#488312). Now support for labels on swap devides needs to be added to d-i.

Nothing earth shaking in this release:

• [bf8738f] add --git-tag-only (Closes: #485114)
• [b06bcf0] document git-import-dscs
• [c1deeb2] add epoch to dch call (Closes: #483718)
• [6640ac7] Fix typo (Closes: #484243)

''--git-tag-only'' allows you to create a tag without having to build the whole project again - useful for large packages. You can either clone from:

git clone http://honk.sigxcpu.org/git/git-buildpackage.git/

or fetch the package from the Debian Archive once it went through the new queue. The updated documentation is available here