[FFe] Please merge lighttpd 1.4.26-1.1 from Debian unstable

[Daniel Hahler]

Binary package hint: lighttpd

Description:
This needs to obtain a FFe because this new upstream release includes various bug fixes. Most importantly, it fixes CVE-2010-0295. Debian Changelog can be seen as follows:

lighttpd (1.4.26-1.1) unstable; urgency=low

  * Non-maintainer upload.
  * Apply upstream patch to fix openssl (closes: #572031)

 -- John Ham <email address hidden> Mon, 15 Mar 2010 13:31:52 +0700

 lighttpd (1.4.26-1ubuntu1) lucid; urgency=low
 .
   * Merge from debian testing (LP: #407722). Remaining changes:
     - debian/control: libgamin-dev rather than libfam-dev to fix startup
       warning.
     - debian/init.d: clean environment; Check syntax during start/reload
       restart/force-reload.
     - debian/index.html: s/Debian/Ubuntu/g branding on the default page.
     - Added a UFW profile set:
       + debian/lighttpd.dirs: added etc/ufw/applications.d
       + debian/rules: install the ufw profile.
       + debian/control: Suggests on ufw.
     - Add lighttpd-dev package:
       + debian/control: Added lighttpd-dev package; Build-depends on
         automake1.10, libtool, quilt
       + debian/lighttpd-dev.install: Added.
   * debian/control: debhelper Build-depends bumped to (>= 7.0.50) for
     overrides in rules file.
   * debian/rules:
     - Add override_dh_installinit to set "defaults 91 09" to not start
       before apache2 but in the same runlevel with the same priority.
     - Add '--with quilt' in the relevant dh calls.
   * debian/patches/build-dev-package.patch: Updated
   * Also closes: (LP: #521659, LP: #523682)
 .
 lighttpd (1.4.26-1) unstable; urgency=low
 .
   * New upstream release (closes: #568735)
   * Use provided patch from Andres Rodriguez <email address hidden>
     to implement status action in init.d script (closes: #539955)
 .
 lighttpd (1.4.25-2) unstable; urgency=low
 .
   * Change behaviour of use-ipv6.pl script (closes: #560837)
 .
 lighttpd (1.4.25-1) unstable; urgency=low
 .
   * New upstream release (closes: #558045)
   * debian/watch: updated
   * debian/control: Section field changed to web
 .
 lighttpd (1.4.24-1) unstable; urgency=low
 .
   * New upstream release (closes: #530892) (closes: #538135) (closes: #482601)
     (closes: #541428)
   * debian/control:
    + Standards-Version: 3.8.3
   * debian/init.d renamed to debian/lighttpd.init
   * Added $syslog to LSB header in init script (closes: #545576)
     (Jeremy Lal <email address hidden>)
   * debian/init.d: force-reload moved to reload section (closes: #538661)
     (Peter Eisentraut <email address hidden>)
 .
 lighttpd (1.4.23-3) unstable; urgency=low
 .
   * debian/rules: make sure that scripts have proper rights
    (closes: #536668), (closes: #536681), (closes: #536688) (closes: #536668)
 .
 lighttpd (1.4.23-2) unstable; urgency=low
 .
   * Add lighttpd.docs with README & NEWS file
   * New upstream closes wishlist bugs (closes: #535065) (closes: #515777)
 .
 lighttpd (1.4.23-1) unstable; urgency=low
 .
   * New upstream release
   * spawn-fcgi is now separate package, recommends it debian/control
   * Update Standards-Version to 3.8.2 without changes
   * Remove cdbs, patchutils from Build-Depends, debian/rules uses
     debhelper 7 scripts
   * lighttpd.logrotate apply patch (closes: #535523)
     from Ubuntu (Daniel Hahler, https://launchpad.net/bugs/393792)

Build logs can be found in:
http://launchpadlibrarian.net/42200782/buildlog_ubuntu-lucid-i386.lighttpd_1.4.26-1.1ubuntu1_FULLYBUILT.txt.gz
http://launchpadlibrarian.net/42200182/buildlog_ubuntu-lucid-amd64.lighttpd_1.4.26-1.1ubuntu1_FULLYBUILT.txt.gz

Tests:

Lighttpd installs and runs.
Lighttpd-dev installs the files were supposed.

[Daniel Hahler (blueyed)]

Andres, are you working on this still?
I think we should get a FFe for lighttpd 1.4.26, due to security and other fixes.

[Andres Rodriguez (andreserl)]

Hey Daniel,

I'm been trying but i've also been unsuccessful due to the introduction of the -dev package. If you have it working now please feel free to unasign me and merge it. Otherwise, I'll still try to ping someone who can help us out in this one :) since all my tries have been unsuccessful.
 And yes, we definitely need to request a FFe

[Andres Rodriguez (andreserl)]

Daniel,

I gave it another try today and I already have the merge done with the problem of the -dev resolved. I'll be requesting the FFe tomorrow.

Thank you.

[Andres Rodriguez (andreserl)]

Attaching upstream changelog

[Andres Rodriguez (andreserl)]

Attaching debdiff just in case you want to review it.

[Steve Langasek (vorlon)]

FFe process bug - setting back to New, I assume you still want someone from the release team to review this and approve it :)

[Andres Rodriguez (andreserl)]

I do :)

[StefanPotyra (sistpoty)]

Maybe it would be a good idea to get 1.4.26-1.1 instead of -1?
What testing have you done?

[StefanPotyra (sistpoty)]

Having spent some time looking at the proposed update, I'm basically ok to bring in upstream changes, but I want it to be very thoroughly tested.

Looking at the Ubuntu change to build -dev package makes me weep, as it's so horribly wrong in many ways. However as I assume that it is already being used on users systems (cf. bug #326899), let's keep it as is for lucid. But please make it arch:any, as there is a config.h shipped. For lucid + 1 please contact upstream to get it done properly, thanks.

[Andres Rodriguez (andreserl)]

HI Stefan,

Yes I'll get 1.4.26-1.1 instead of just -1. Now, I'll make the arch changes. This bug was forwarded to debian as well a while ago but still no response from them. I'll do the new merge, test the package and upload it. Thank you for the review.

[StefanPotyra (sistpoty)]

Hi Andres,

Am Saturday 27 March 2010 16:42:28 schrieb Andres Rodriguez:
> HI Stefan,
>
> Yes I'll get 1.4.26-1.1 instead of just -1. Now, I'll make the arch
> changes.

Thanks!

> This bug was forwarded to debian as well a while ago but still
> no response from them.

I was referring to upstream upstream ;) (the debian bug made me take a closer
look in the first place). Defining a public API is certainly done best by
upstream.

> I'll do the new merge, test the package and
> upload it. Thank you for the review.

Thanks!

Cheers,
   Stefan.

[Andres Rodriguez (andreserl)]

Attaching new debdiff and buildlogs can be seen in:

http://launchpadlibrarian.net/42200782/buildlog_ubuntu-lucid-i386.lighttpd_1.4.26-1.1ubuntu1_FULLYBUILT.txt.gz
http://launchpadlibrarian.net/42200182/buildlog_ubuntu-lucid-amd64.lighttpd_1.4.26-1.1ubuntu1_FULLYBUILT.txt.gz

[StefanPotyra (sistpoty)]

ACK, FFe granted.

[Launchpad Janitor (janitor)]

This bug was fixed in the package lighttpd - 1.4.26-1.1ubuntu1

---------------
lighttpd (1.4.26-1.1ubuntu1) lucid; urgency=low

  * Merge from debian unstable (LP: #407722). Remaining changes:
    - debian/control: libgamin-dev rather than libfam-dev to fix startup
      warning.
    - debian/init.d: clean environment; Check syntax during start/reload
      restart/force-reload.
    - debian/index.html: s/Debian/Ubuntu/g branding on the default page.
    - Added a UFW profile set:
      + debian/lighttpd.dirs: added etc/ufw/applications.d
      + debian/rules: install the ufw profile.
      + debian/control: Suggests on ufw.
    - Add lighttpd-dev package:
      + debian/control: Added lighttpd-dev package; Build-depends on
        automake, libtool
      + debian/lighttpd-dev.install: Added.
  * debian/control: debhelper Build-depends bumped to (>= 7.0.50) for
    overrides in rules file.
  * debian/rules:
    - Add override_dh_installinit to set "defaults 91 09" to not start
      before apache2 but in the same runlevel with the same priority.
  * debian/patches/build-dev-package.patch: Updated
  * Also closes: (LP: #521659, LP: #523682)

lighttpd (1.4.26-1.1) unstable; urgency=low

  * Non-maintainer upload.
  * Apply upstream patch to fix openssl (closes: #572031)

lighttpd (1.4.26-1) unstable; urgency=low

  * New upstream release (closes: #568735)
  * Use provided patch from Andres Rodriguez <email address hidden>
    to implement status action in init.d script (closes: #539955)

lighttpd (1.4.25-2) unstable; urgency=low

  * Change behaviour of use-ipv6.pl script (closes: #560837)

lighttpd (1.4.25-1) unstable; urgency=low

  * New upstream release (closes: #558045)
  * debian/watch: updated
  * debian/control: Section field changed to web

lighttpd (1.4.24-1) unstable; urgency=low

  * New upstream release (closes: #530892) (closes: #538135) (closes: #482601)
    (closes: #541428)
  * debian/control:
   + Standards-Version: 3.8.3
  * debian/init.d renamed to debian/lighttpd.init
  * Added $syslog to LSB header in init script (closes: #545576)
    (Jeremy Lal <email address hidden>)
  * debian/init.d: force-reload moved to reload section (closes: #538661)
    (Peter Eisentraut <email address hidden>)

lighttpd (1.4.23-3) unstable; urgency=low

  * debian/rules: make sure that scripts have proper rights
   (closes: #536668), (closes: #536681), (closes: #536688) (closes: #536668)

lighttpd (1.4.23-2) unstable; urgency=low

  * Add lighttpd.docs with README & NEWS file
  * New upstream closes wishlist bugs (closes: #535065) (closes: #515777)

lighttpd (1.4.23-1) unstable; urgency=low

  * New upstream release
  * spawn-fcgi is now separate package, recommends it debian/control
  * Update Standards-Version to 3.8.2 without changes
  * Remove cdbs, patchutils from Build-Depends, debian/rules uses
    debhelper 7 scripts
  * lighttpd.logrotate apply patch (closes: #535523)
    from Ubuntu (Daniel Hahler, https://launchpad.net/bugs/393792)
 -- Andres Rodriguez <email address hidden> Sat, 27 Mar 2010 15:53:32 -0400