Here is my monthly update covering what I have been doing in the free software world in February 2018 (previous month):

• Submitted a pull request to the libical calendar library to make the build reproducible. [...]

• Reviewed a pull request for my email debugging tool which aids development of Django web applications that email attachments / HTML components. [...]

• Created a pull request for the RediSearch — a search engine module for Redis — to make the build reproducible. [...]

• Added myself to Philip James' experimental project that attempts to find ways to funding development of software packages. [...]

• Filed a pull request for the "ufo2ft" font conversion tool to make .OTF font generation reproducible. [...]

• Re-submitted a pull request for the Promise.js library to make the build reproducible. [...]

• Even more hacking on the Lintian static analysis tool for Debian packages:

  • New features:
    • Warn if maintainer scripts use chown -R to prevent hardlink attacks. (#889066)
    • Warn if packages use ENABLED="true" in /etc/default. [...]
    • Warn about systemd unit files that install to "unusual" WantedBy= targets. (#817170)
    • Warn about changelog files that are too short. (#890920)
    • Check for unnecessary SOURCE_DATE_EPOCH assignments. (#832099)
    • Warn if packages define multiple "compat" levels. [...]
    • Check for maintainer scripts that call udevadm without a guard as it can fail within a chroot. (#890224)
    • Warn when specifying --parallel to dh(1) in compat levels ≥ 10. (#890358)
    • Add classification tags for the .deb member compression format. (#738442, #889856)
    • Check for .jar files that embed Foo.java alongside a Foo.class file. (#762113)
    • Emit a pendatic warning for packages with repacked upstream tarballs that lack headers in debian/copyright. [...]
    • Check for debian/rules files that are dh_make(1) templates. (#679124)
    • Add pedantic check for packages using debian/source.lintian-overrides. [...]
  • False-positives:
    • Add simple GOTO parsing to avoid false positives when checking udev rules. (#869547, #889639)
    • Check the first line of the description separately for spelling errors. (#890100)
    • Do not emit package-does-not-install-examples if we don't have any binary packages in our laboratory. (#889591)
    • Avoid false-positives when detecting Twitter's bootstrap library. (#888972)
    • Allow rel="generator" and others; they do not cause internet access by default. (#891301)
    • Avoid a false-positive in init.d-script-possible-missing-stop. (#889640)
    • Avoid a false-positive when matching a Lena Söderberg image. (#890943)
    • Fix a bug in version-substvar-for-external-package parsing to prevent false-positives when the LHS of the binary relation contains a substvar. (#726589)
    • Prevent a large number of false-positives when checking debian-rules-is-dh_make-template. (#890660)
    • Update override_dh_auto_test-does-not-check-DEB_BUILD_OPTIONS to fix a number of false positives. (#890537)
    • Allow rel="canonical in <link/> HTML tags. (#762753)
    • Avoid false positives by ignoring text that itself contains "typo" or "spelling". (#889964)
    • Avoid false positives when checking binary packages depending on toolchain packages by ignoring packages starting with dh-. (#889486)
    • Prevent false positives when checking for missing NOTICE.txt files by looking inside .jar archives. (#889760)
    • Only warn about bad-jar-name for "public" .jar files. (#889628)
    • Fix a number of false-positives when checking override_dh_auto-test-does-not-check-DEB_BUILD_PROFILES. (#889592)
  • Improvements/bug fixes:
    • Ensure salsa.debian.org Vcs-Git & Vcs-Browser are canonical. (#888809)
    • Ignore any change of epoch when checking latest-debian-changelog-entry-without-new-version. (#889991)
    • Detect core as an overly-generic module name. (#891027)
    • Rework the missing systemd .service detection. (#858588)
    • Also check for RUN= and DAEMONRUN= when evalating for init.d-script-should-always-start-service violations. (#890916)
    • Make a large number of changes to override_dh_auto_test-does-not-check-DEB_BUILD_PROFILES. (#889746)
    • Also match Make's "ignore result" prefix for override_dh_auto_test-does-not-check-DEB_BUILD_PROFILES [...]
    • Ensure package-contains-python-doctree-file also warns about compressed .doctree files. [...]
    • Don't emit warnings when debian/patches is a file. (#889535)
    • Pick the first out of debian/source/lintian-overrides & debian/source.lintian-overrides. (#890361)
  • Documentation:
    • Improve the long description of maintainer-script-should-not-use-recursive-chown-or-chmod. (#889489)
    • Correct a grammatical error and tighten the language of binary-package-depends-on-toolchain-package. (#890530)
    • Update text for epoch-change-without-comment, making it much clearer for skim-readers. [...]
    • Update maintainer-script-should-not-use-service to include advice and Debian Policy reference. (#889154)
  • Reporting:
    • Link package entries to sources.debian.org. [...]
    • Improve the long description of epoch-change-without-comment.. (#889814)
    • Downgrade severity of build-depends-on-obsolete-package from error to warning. (#889638)
  • Misc:
    • Update requirement for dh_scour from python3-scour to scour. (#889016)
    • Update architecture lists to include riscv64. This will change everything. (#891387)
    • Drop all the overrides for Lintian itself now that we use the <!nocheck> build profile. [...]
    • Add cwl-runner as an interpreter for CWL scripts. (#890667)
    • Also check, for example, override_dh_fixperms-(indep|arch) targets for override_dh_fixperms-does-not-call-dh_fixperms. [...] [...]

You can subscribe to new posts via email or RSS.