Here is my monthly update covering what I have been doing in the free software world during April 2018 (previous month).

• It was a great honour to learn that I was re-elected by the community to the post of Debian Project Leader for another year. I wholeheartedly thank everyone for placing their trust in me for another term and I am looking forward to the year ahead. My specific activities this month as the Debian Project Leader are covered in my "Bits from the DPL" email to the debian-devel-announce mailing list.
• Gave the keynote presentation at FLOSSUK's Spring Conference in Edinburgh, Scotland on reproducible builds and how it can prevent individual developers & centralised infrastructure from becoming targets from malicious actors.
• Presented at foss-north 2018 in Gothenburg, Sweden to speak about diffoscope, a tool to analyse reproducibility issues in packages and how it can be used in quality-assurance efforts more generally.
• Added support to curl for a --rootme command line parameter. [...]
• Filed 10 upstream patches to make their build or output reproducible for the Sphinx documentation generator [...], the Lexicon DNS manager [...], the Dashell C++ stream library [...], the Pylint static analysis tool [...], the vcr.py HTTP-interaction testing tool [...], the Click Python command-line parser [...], the ASDF interchange format [...], the strace system call tracer [...], the libdazzle Glib component library [...] and the Corosync Cluster Engine [...].
• I attended two Open Source Initiative board meetings.
• Wrote a pull request for the redis-py Python library to prevent testsuite failures when run against a 32-bit installation of Redis. [...]
• Sent a pull request for dh-virtualenv (a tool to create Debian packages that wrap a Python virtual environment) to prevent broken builds if building from within a virtual environment. [...]
• Opened an issue against the wasavi browser extension which transforms <textarea> element of any page into a vim-style editor to report a crashing bug. [...]
• Requested that the Bad Voltage podcast appears on Rajeev Bharshetty's list of awesome podcasts. [...]
• Even more hacking on the Lintian static analysis system for Debian packages:
  • New features:
    • Entirely rework the description-synopsis-might-not-be-phrased-properly tag. (#896671)
    • Detect debian/rules files that specify the sanitize=+all build flag. (#895831)
    • Make the file-contains-trailing-whitespace tag also emit for whitespace at end of files. [...]
    • Disable the changelog-should-mention-nmu and source-nmu-has-incorrect-version-number tags in the PureOS vendor profile. [...]
    • Re-enable YAML parsing of upstream metadata which was disabled in in #861958 to close CVE-2017-8829 — we can now use the $LoadBlessed option of YAML:XS. (#894747)
    • Also check for find(1) calls when checking for maintainer scripts that use a recursive chown or chmod. (#895370)
    • Warn about packages that have apparently unnecessary get-orig-source targets such as single-line calls to uscan(1). (#895036)
    • Add support for derivative-specific field parsing to allow enforcement of additional restrictions (eg. Vcs-Git format, etc.) [...], version numbers [...] and Changed-By [...].
    • Add support for blacklisting source packages. [...]
    • Add 4.1.4 as a known Standards-Version. [...]
  • Bug fixes:
    • Stop recommending that packages with repacked tarballs specify get-orig-source; this was removed in Policy 4.1.4. [...]
    • Add a special case for the Debhelper python3 addon as it needs a dependency on dh-python unless the -dev packages are used. (#895284)
    • Avoid false-positives in Mallard XML files. (#894690)
    • Ensure directory names end in a trailing forward-slash in source indexes. (#896010)
    • Prevent false-positives in the non-consecutive-debian-revision and possible-new-upstream-release-without-new-version tags by skipping them if the source package was renamed. (#896675)
    • Allow spaces within the ownership field of tar -tvf output. (#895175)
    • Add wIH (#895841) and selectOn (#895818) to the list of spelling-error-in-binary exceptions.
    • Don't warn about binary-package-depends-on-toolchain-package for Conflicts/Breaks relations. (#896133)
    • Disable "anchored roots" for packages, otherwise the systemd-complex-service-file tag breaks. [...]
    • Don't use Perl's $. operator out of context. [...]
  • Reporting:
    • Include the offending output in the description-synopsis-might-not-be-phrased-properly [...], non-consecutive-debian-revision [...] & dep5-copyright-license-name-not-unique [...] tags and also include the shebang for missing interpreters [...] and the X-script-but-no-X-dep tags [...].
    • Correct the classification of maybe-not-arch-all-binnmuable by marking it as experimental, downgrading the certainty and adding a note recommending against making any changes. (#895674)
    • Change the severity from P: → I: for the missing-explanation-for-repacked-upstream-tarball tag. [...]
  • Documentation:
    • Update description of debian-watch-uses-insecure-uri to clarify what to do if there is currently no secure URI. (#897082)
    • Clarify the "2020" date for Python 2.x deprecation. (#896079)
    • Correct confusing not-binnmuable-any-depends-all tag description. (#895656)
  • Misc:
    • Add a toogle → toggle spelling correction. (#895573)
    • Add a passing testcase to ensure /usr/share/doc/$pkg/examples can be a symlink for package-does-not-install-examples (re. #897157). [...]
    • Correct an as_anchored_root_dir → has_anchored_root_dir typo. [...]
    • Move repository from Alioth to salsa. [...]

You can subscribe to new posts via email or RSS.