Here is my monthly update covering what I have been doing in the free software world in December 2017 (previous month):

• Released a new version of python-gfshare, my Python library that implements Shamir’s method for secret sharing fixing parts of the documentation as well as fixing two warnings via contributions by Kevin Ji [...] [...].
• Opened a PR against vim-pizza (a plugin to order pizza from within the Vim text editor) to use xdg-open or sensible-browser under Debian and derivatives. [...]
• Created two pull requests for the RediSearch search engine module for Redis, first to un-ignore the /debian dir in .gitignore to aid packaging [...] and second to inherit CFLAGS/LDFLAGS from the outside environment to enable hardening support [...].
• Even more hacking on the Lintian static analysis tool for Debian packages:
  • New features:
    • Support Standards-Version 4.1.3.
    • Warn when files specified in Files-Excluded exist in the source tree. (#871454)
    • Check Microsoft Windows Portable Executable (PE) files missing hardening features. (#837548)
    • Warn about Python 2.x packages using ${python3:Depends} and Python 3.x packages using ${python:Depends}. (#884676)
    • Check changelog entries with incorrectly formatted dates. (#793406)
    • Check override_dh_fixperms targets missing calls to dh_fixperms. (#885910)
    • Ensure PAM modules are in the admin, preventing a false positive for libpam-krb5. (#885899)
    • Check Python packages installing modules called site, docs, examples etc. into the global namespace. (#769365)
    • Check packages that invoke AC_PATH_PROG without considering cross-compilation. (#884798)
    • Emit a warning for packages that mismatch version control systems in Vcs-* headers. (#884503)
    • Warn when packages specify a Bugs field in debian/control that does not refer to official Debian infrastructure. (#741071)
    • Warn for packages shipping pkg-config files under /usr/lib/pkgconfig. (#885096)
    • Warn about packages that ship non-reproducible Python .doctree files. (#885327)
    • Bump the recommended Debhelper compat level to 11. (#884699)
    • Warn about Python 3 packages that depend on Python 2 packages (and vice versa). (#782277)
    • Check for override_dh_clean targets missing calls to dh_clean. (#884817)
    • Check Apache 2.0-licensed packages that do not distribute their accompanying NOTICE files. (#885042)
    • Detect embedded jQuery libraries with version number in their filenames. (#833613)
    • Also emit embedded-javascript-library for Twitter Bootstrap and Mustache.
    • Check development packages that ship ELF binaries in $PATH. (#794295)
    • Warn about library packages with excessive priority. (#834290)
    • Warn about Multi-Arch: foreign packages that ship CMake, pkg-config or static libraries in public, architecture-dependent search paths. (#882684)
    • Test for packages shipping gschemas.compiled files. (#884142)
    • Warn if a package ships compiled font files. (#884165)
    • Detect invalid debian/po/POTFILES.in. (#883653)
    • Warn for packages that modify the epoch yet there's no comment about the change in the changelog.
  • Bug fixes:
    • Refactor django-package-does-not-depend-on-django check to correctly check Django packages called python2-django-foo.
    • Match python2.7:any (etc.) when checking dependency-on-python-version-marked-for-end-of-life, not just python2.7. (#883053)
    • Correct parsing of jobs=42 in .lintianrc. If specified, it would be coerced to a boolean resulting in a value of 1.
    • Avoid false positives in apache2-deprecated-auth-config where the offending lines are wrapped in IfModule or IfVersion. (#788991, #710656)
    • Prevent false positives when checking for Python 2 documentation, development common and tools packages that depend on Python 3 (etc.) packages. (#885693)
    • Prevent false positives in missing-python-build-dependency. (#750537)
    • Don't emit init.d-script-needs-depends-on-lsb-base if the package ships a Systemd service file. (#864999)
    • Ignore commented-out lines in debian/watch to avoid false-positives referencing old values. (#806237)
    • Prevent a false positive in possibly-insecure-handling-of-tmp-files-in-maintainer-script by detecting XXX-like mktemp(1) templates. (#601323)
    • Use the list of files in the orig tarball to prevent false positives when checking for the source-includes-file-in-files-excluded. (#884848)
    • Fix various issues in the src-orig-index collection script.
    • dh_scour is provided by python3-scour, not python-scour. (#885106)
    • Avoid a embedded-php-library false positive for streams.php. (#637473)
    • Add a regression test for a potential false positive for vcs-field-has-unexpected-spaces. (#884870)
    • Don't hardcode architecture triplet to fix FTBFS on non-AMD64 architectures. (#884683)
    • Prevent a false-positive in missing-dep-for-interpreter by matching ABI-versioned virtual packages for Erlang. (#810204)
    • Don't match, for example, FB.login() when used as a documentation example. (#884296)
    • Correct operator precedence in epoch-change-without-comment to prevent a false positive when an epoch is present but is unchanged between versions.
    • Correct false positives in source-includes-file-in-files-excluded where the maintainer has removed upstream's debian/ directory and then we would trigger it on the maintainer's replacement files.
  • Reporting improvements:
    • Include the offending filename and line number in the output of apache2-deprecated-auth-config & apache2-unparsable-dependency.
    • Include the offending/unknown shebang in the output of various interpreter-related tags. (#673734)
    • Avoid misleading tag descriptions when emitting timewarp-standards-version if the date parts are identical. (#884785)
    • Add links from each maintainer page to the corresponding package on the full report. (#884572)
  • Documentation:
    • Suggest using /usr/share/dpkg/architecture.mk for debian-rules-sets-dpkg-architecture-variable.
    • Standardise on capital-L Lintian in package descriptions.
    • Also note that unused-override can be triggered if Lintian adds/modifies supplementary tag metadata.
    • Add debian/changelog to the file-contains-trailing-whitespace example.
    • Update description of python-script-but-no-python-dep to refer to ${python3:Depends}. (#660718)
    • Clarify that new-package-should-not-package-python2-module triggers when there is a single changelog entry & provide general guidance where upstreams have not ported to Python 3 yet.
    • Correct reference to dh_elpa(1) manpage. (#883356)
    • Raise the severity of the dependency-on-python-version-marked-for-end-of-life and python-foo-but-no-python3-foo Python 2.x deprecation tags to regular warnings. (#883581)
  • Miscellaneous:
    • Add a vendor profile for Purism's PureOS. (#884408)
    • Allow the tag display limit to be configured via --tag-display-limit. (#813525)
    • Tag build-dependencies with <!nocheck> in debian/control.
    • Make -v imply --no-tag-display-limit. (#812756)
    • Remove russian → Russian corrections as they are covered by data/spelling/corrections-case. (#883041)
• Suggested an improvement to the "lack of entropy" error message in the TLSH (Trend Micro Locality Sensitive Hash) fuzzy matching algorithm. [...]
• I also blogged about simple media cachebusting when using GitHub Pages.

You can subscribe to new posts via email or RSS.