Please merge devscripts_2.10.53 from Debian unstable

Bug #414298 reported by أحمد المحمودي (Ahmed El-Mahmoudy)
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
devscripts (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: devscripts

Changes from devscripts_2.10.48ubuntu2:

devscripts (2.10.53) unstable; urgency=low

  The "Debconf fish!" upload

  [ Adam D. Barratt ]
  * bts:
    + Add a missing "use IO::File" to make "bts select file:foo" work.
      Thanks, Raphaël Hertzog. (Closes: #538288)
    + Add the "affects" command to mark a bug as affecting packages other
      than the package it was filed against.
  * checkbashisms: Detect the use of "source" when the sourced filename
    contains a tilde (Closes: #528592) or consists of a single character
    (Closes: #535252). Thanks, Raphael Geissert and Ryan Niebur.
  * debcommit: Add darcs support. Thanks to Joachim Breitner for the patch.
    (Closes: #536037)
  * nmudiff:
    + Fix specification of BCc to control@bugs so that it's interpreted
      as an option to mutt and not as a recipient address. Thanks, Filippo
      Giunchedi. (Closes: #534585)
    + Add a missing "feel" to the delayed/XX template. Thanks, Raphael
      Geissert.
  * rmadison:
    + Add patch from Ubuntu to make lookups against their database work again.
      (The server moved from people.ubuntu.com to people.canonical.com)
      (Closes: #537302)
    + When using curl, follow redirects by default. (Also from the Ubuntu
      patch).
  * debian/control: Replace descriptions of cvs-* with those from README,
    because they're better.

  [ Patrick Schoenfeld ]
  * bts: Implement a --mutt parameter, which allows mails to be sent
    using mutt.
  * debchange: Implement a dist indication mechanism that parses
    an 'Upload to $DIST' line and sets the distribution accordingly, when
    the --release parameter is used. (Closes: #515346)
  * debi:
    + Implement a --with-depends switch to install depencies of the
      package together with the package
      (Closes: #511061)
    + Implement a --tool switch to choose the tool for installing
      dependencies
  * dget: Make it clear in manpage and usage information, that dget is capable
    of processing several URLs or packages (Closes: #535977)
  * dscverify:
    + Implement a --verbose option to disable suppressing
      of GPG output (Closes: #525670)
    + Add a notice to the manpage of dscverify that the debian-keyring package
      has the potential to be out of date and how this can be worked around
      (Closes: #438679)
    + Document standard keyring locations in the dscverify manpage
  * licensecheck: Skip empty files instead of reporting that they don't
    have a copyright (Closes: #535337)
  * nmudiff: Use 'bts select' to test, weither a check already has a patch
    tag set or not and only set it, if not (Closes: #519678)
  * Add a script listing to devscripts.1 which is auto-generated from
    debian/control (Closes: #504008)

 -- Adam D. Barratt <email address hidden> Wed, 29 Jul 2009 15:12:24 +0100

devscripts (2.10.52) unstable; urgency=low

  * debdiff: Make --diffstat work again; accidentally broken in 2.10.48.
  * uupdate: Fix invocation of *cat when attempting to apply diffs.
    Thanks, Yannick Roehlly. (Closes: #533415)
  * debian/control: Update Standards-Version to 3.8.2 (no changes needed)

 -- Adam D. Barratt <email address hidden> Wed, 17 Jun 2009 19:39:33 +0100

devscripts (2.10.51) unstable; urgency=low

  [ Adam D. Barratt ]
  * bts:
    + Add a note to the description of --smtp-server explaining that
      reportbug.debian.org does not support relaying and is therefore not a
      suitable server to use in circumstances where $<email address hidden>
      may be automatically Cced.
    + Ignore the --{force-,}interactive options when combined with -n.
      (Closes: #531422)
  * checkbashisms:
    + Detect shellscript wrappers that use "then" or "else" before calling
      exec. Thanks, Raphael Geissert. (Closes: #530815)
    + Fix a false positive detection of ". $(foo bar)" as attempting to pass
      arguments to a sourced script. Thanks, Raphael Geissert.
    + Detect use of passing arguments to a sourced script as part of a
      conditional statement. Thanks, Raphael Geissert.
    + Correctly count the number of quotes in a line when detecting whether
      we are currently inside a "quoted block". Thanks, Raphael Geissert.
      (Closes: #531247)
    + Do not check the contents of a dpatch. The wrapper script always uses
      /bin/sh and we can't detect the interpreter of a patch.
    + Improve the check for the use of $[] inside quoted text. Thanks,
      Raphael Geissert.
    + Apply the "common lead-in text" to the "readonly" check.
    + Remove "\\" from the list of unsafe backslash escapes, as it appears to
      work in all shells.
  * dcmd: Parse changes / dsc files containing section or priority entries of
    "-". (Closes: #531593)
  * licensecheck: Fix an error in a regular expression which led to an
    uninitialized value warning and missing version for some GPL headers.
    Thanks, Jakub Wilk. (Closes: #531059)
  * uscan: Make a regular expression example in the manpage clearer. Thanks,
    Jason Heeris. (Closes: #530362)
  * uupdate: Add support for .lzma compressed tarballs and diffs. Thanks to
    Simon Richter for the patch. (Closes: #531570)

  [ James Vega ]
  * bts: Only Cc $<email address hidden> if we're reasonably sure we have
    an email body instead of simply control messages; i.e., if the user
    specifies the --force-interactive option or the --interactive option and
    chooses to edit the email body. (Closes: #530926)
  * uscan: Log the correct filename when running the post-download action.
    Simplify the surrounding logic so the logging and command are less likely
    to get out of sync in the future.

  [ Mohammed Adnène Trojette ]
  * pts-subscribe: refer to bsd-mailx rather to the transitional mailx
    package. Thanks Ansgar Burchardt for the patch. (Closes: #531332)

 -- Adam D. Barratt <email address hidden> Mon, 15 Jun 2009 18:57:20 +0100

devscripts (2.10.50) unstable; urgency=low

  [ Adam D. Barratt ]
  * chdist: Make --data-dir work with relative paths. (Closes: #528254)
  * debchange: Add karmic (koala) to the list of recognised Ubuntu
    distributions.
  * debsnap: Fix mktemp call to use a sufficient number of Xs in the template
    string (Closes: #528193) and use -t rather than hard-coding /tmp.
  * debuild: Use printf when parsing the DEBUILD_LINTIAN_OPTS configuration
    file variable, to avoid eating -E. (Closes: #527027)
  * mass-bug: Add an option to specify that the supplied package names are
    those of source packages rather than binary packages. Based on a patch
    by Felipe Sateler. (Closes: #527396)
  * rc-alert: Use standard single quotes in the debtags section of the manpage
    to avoid odd formatting and warnings from man
  * uscan: Pass -n to gzip when repacking bz2 files to ensure consistent
    checksums. Thanks, Damyan Ivanov. (Closes: #504672)

  [ Christoph Berg ]
  * dget: -u implies dpkg-source --no-check. Also, force LC_ALL=C to correctly
    capture dpkg-source output with --build.

 -- Adam D. Barratt <email address hidden> Thu, 21 May 2009 21:50:18 +0100

devscripts (2.10.49) unstable; urgency=low

  * debchange:
    + Use == for numeric comparison, not eq.
    + Mention in the help output and manpage that a dummy changelog entry
      may be supplied in conjunction with --release in order to avoid
      spawning an editor.
    + Add a configuration variable and command line option to allow the
      recent change to --release's "auto-save" behaviour to be disabled.
      For consistency with other debchange options, the default is to
      retain the behaviour introduced in 2.10.48 - i.e. that the changelog
      must be explicitly saved after the use of --release. (Closes: #524393)
  * debcommit: If the installed version of dpkg-dev supports retrieving a
    list of appropriate bugs, automatically generate bzr --fixes arguments
    for Launchpad bugs as well as Debian bugs. Thanks, Colin Watson.
    (Closes: #525823)
  * debsign: Make the PGP signing method work again. Thanks, Florian Weimer.
    (Closes: #518821)
  * getbuildlog: Add a missing "use lib" to allow the special "last" and
    "last-all" versions to work correctly. Thanks, Iustin Pop.
    (Closes: #523982)
  * licensecheck: Add detection of the AGPL. Thanks, Didier Raboud.
    (Closes: #520903)
  * namecheck: Fix the formatting of a number of POD strings, also making
    them easier to translate. Thanks, Florentin Duneau. (Closes: #526047)
  * rc-alert:
    + Allow the generated list of bugs to be restricted to those affecting
      packages with particular debtags facets. Thanks, Jan Hauke Rahm.
     (Closes: #523523)
    + Allow the generated list of bugs to be sorted using popcon results.
      Thanks, Jan Hauke Rahm. (Closes: #478833)
  * rmadison: Allow a default URL to be specified in the configuration file.
    Thanks, Roland Mas. (Closes: #524198)
  * uscan: Remove a superfluous and repeated copy of the site name in an FTP
    error message. Thanks, Vaclav Ovsik.
  * Makefile: Remove cruft relating to French manpages, which has been handled
    by the po4a setup for a while now.

 -- Adam D. Barratt <email address hidden> Sat, 02 May 2009 19:34:55 +0100

CVE References

Revision history for this message
أحمد المحمودي (Ahmed El-Mahmoudy) (aelmahmoudy) wrote :

devscripts (2.10.53ubuntu1) karmic; urgency=low

  * Resynchronise with Debian. Remaining changes: (LP: #511269)
    - rmadison: Change default URL parameter to ubuntu.
    - scripts/debchange.pl:
      + Adjust --security template for Ubuntu.
      + Add -U/--upstream flag that forces original "just increment
        the end" behaviour; Ubuntu is upstream for some pieces of software.
      + Add --distributor= to override lsb_release output.
      + Default to "karmic" as distribution.
      + Add "ubuntu1" to version string for new versions, with tweaks for
        special cases.
      + Add -R/--rebuild flag for Ubuntu's no-change rebuilds.
    - Add test/debchange.pl, test/Makefile: debchange test suite; call it
      during build in debian/rules. Also add lsb-release build dependency for
      this, so that debchange uses Ubuntu mode.
    - scripts/debuild.pl: Enforce Ubuntu merge policy.
    - scripts/debsign.{sh,1}: Implement DEBSIGN_ALWAYS_RESIGN variable to skip
      the "Would you like to use the current signature?" question. (Debian
      #447955)
    - scripts/uupdate.{sh,1}: Use -0ubuntu1 default revision on Ubuntu.
    - scripts/dscverify.pl: Add Ubuntu keyrings.
    - Drop universe packages from Recommends to Suggests:
      + libcrypt-ssleay-perl: only needed for a corner case (uscan on SSL
        download sites), wasn't installed by default in previous releases
        either, and seems quite dead upstream
      + libsoap-lite-perl: only needed for one less common command ("select")
        for bts, which isn't useful for Ubuntu itself, and pulls in a lot of
        other universe Perl libraries
      + debian-{keyring,maintainers}: not useful enough in Ubuntu
      + equivs: too much of a hack to install by default
      + libyaml-syck-perl: transition-check is fairly Debian-specific

Changed in devscripts (Ubuntu):
status: New → Confirmed
Revision history for this message
Daniel Holbach (dholbach) wrote :

 - The new Recommends: debian-keyring and debian-maintainers are in Universe. I suggest making them Suggests: instead.
 - How does "rmadison: Change default URL parameter to ubuntu." work with the new RMADISON_DEFAULT_URL option?
 - Why is po4a/po/devscripts.pot and po4a/po/fr.po changed in your diff?

Revision history for this message
أحمد المحمودي (Ahmed El-Mahmoudy) (aelmahmoudy) wrote :

Yes, you're right, I forget to remove debian-keyring and debian-maintainers from Recommends.

Also pot & po files didn't need to be changed (that resulted from applying the previous ubuntu patch)

Revision history for this message
James Westby (james-w) wrote :

Hi,

I'm happy to upload this if the release team is happy to have this
in karmic.

Thanks,

James

Revision history for this message
Martin Pitt (pitti) wrote :

Release team ack. This isn't something that can cause breakage on the default installations or for users, and for developers it's nice to get the updates and fixes there.

Revision history for this message
Daniel Holbach (dholbach) wrote :

2.10.54 is out and has a security fix:
 * uscan: Evaluate mangle rules without evaluating them directly as Perl
    code to avoid the possibility of remote code execution. This is
    CVE-2009-2946. As a side effect, (Closes: #515209)

The old merge seems to mostly apply:
daniel@bert:~/devscripts-2.10.54$ patch -p1 < ../devscripts*diff
patching file debian/changelog
Hunk #1 FAILED at 1.
Hunk #2 succeeded at 289 (offset 71 lines).
Hunk #3 succeeded at 713 (offset 71 lines).
Hunk #4 succeeded at 1293 (offset 71 lines).
Hunk #5 succeeded at 2195 (offset 71 lines).
Hunk #6 succeeded at 2295 (offset 71 lines).
Hunk #7 succeeded at 2368 (offset 71 lines).
Hunk #8 succeeded at 2487 (offset 71 lines).
Hunk #9 succeeded at 2603 (offset 71 lines).
Hunk #10 succeeded at 2663 (offset 71 lines).
Hunk #11 succeeded at 2756 (offset 71 lines).
Hunk #12 succeeded at 2885 (offset 71 lines).
Hunk #13 succeeded at 3044 (offset 71 lines).
1 out of 13 hunks FAILED -- saving rejects to file debian/changelog.rej
patching file debian/control
Hunk #1 FAILED at 1.
1 out of 1 hunk FAILED -- saving rejects to file debian/control.rej
patching file debian/rules
patching file scripts/debchange.1
Hunk #1 succeeded at 221 (offset 1 line).
patching file scripts/debchange.pl
Hunk #1 succeeded at 115 (offset 2 lines).
Hunk #2 succeeded at 148 (offset 2 lines).
Hunk #3 succeeded at 186 (offset 2 lines).
Hunk #4 succeeded at 304 (offset 2 lines).
Hunk #5 succeeded at 325 (offset 2 lines).
Hunk #6 succeeded at 388 (offset 2 lines).
Hunk #7 succeeded at 400 (offset 2 lines).
Hunk #8 succeeded at 450 (offset 3 lines).
Hunk #9 succeeded at 564 (offset 3 lines).
Hunk #10 succeeded at 738 (offset 4 lines).
Hunk #11 succeeded at 873 (offset 4 lines).
Hunk #12 succeeded at 950 (offset 4 lines).
Hunk #13 succeeded at 1024 (offset 4 lines).
Hunk #14 FAILED at 1042.
Hunk #15 succeeded at 1093 (offset 15 lines).
Hunk #16 FAILED at 1142.
Hunk #17 succeeded at 1418 (offset 15 lines).
2 out of 17 hunks FAILED -- saving rejects to file scripts/debchange.pl.rej
patching file scripts/debsign.1
patching file scripts/debsign.sh
patching file scripts/debuild.pl
patching file scripts/dscverify.pl
patching file scripts/rmadison.pl
patching file scripts/uupdate.1
patching file scripts/uupdate.sh
patching file test/debchange.pl
patching file test/Makefile
daniel@bert:~/devscripts-2.10.54$

Ahmed: can you take a look at it?

Revision history for this message
Daniel Holbach (dholbach) wrote :

Adam Barrat commented: "Unfortunately the security fix is buggy; see Debian #544931. We're hoping to have 2.10.55 out with the problems resolved within the next few days."

Revision history for this message
Adam D. Barratt (adam-barratt) wrote :

I uploaded 2.10.55 to Debian earlier today with the (hopefully this time) correct security fix for uscan.

Revision history for this message
أحمد المحمودي (Ahmed El-Mahmoudy) (aelmahmoudy) wrote :

Ok, I've prepared the devscripts 2.10.55ubuntu1 package

Revision history for this message
أحمد المحمودي (Ahmed El-Mahmoudy) (aelmahmoudy) wrote :
Revision history for this message
Benjamin Drung (bdrung) wrote :

2.10.53ubuntu2 is in karmic.

Changed in devscripts (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.