* Update for Debian 6.0: 6.0.4 released
* Bits from the Release Team
* Bits from the piuparts maintainers
* Report from Debian Med sprint
* Setting up a new school with Debian Edu/Squeeze
* Answering Debian users’ questions
* Debian/Ubuntu games screenshot party
* GNOME Shell 3.2 in “Wheezy” : a retrospective
* Interviews
* Other news
* Upcoming events
* New Debian Contributors
* Release-Critical bugs statistics for the upcoming release
* Important Debian Security Advisories
* New and noteworthy packages
* Work-needing packages
* Want to continue reading DPN?

Update for Debian 6.0: 6.0.4 released
————————————-

The fourth update for Debian 6.0 (codenamed [1] “Squeeze” ) has been released.
This update mainly adds corrections for security problems to the stable
release, along with some adjustments for serious problems.

1 : http://www.debian.org/News/2012/20120128

Bits from the Release Team
————————–

Niels Thykier sent some bits from the Release Team [2] where he announced
various bits of news: the addition of armhf and s390x to testing (though these
architectures may be temporarily out of sync with the others), the acceptance
of a new release goal ( “security hardening build flags” ), and the completion
of more than fourteen transitions to testing (including GNOME 3, Perl 5.14,
Python 2.7, etc.). Niels also issued a reminder that the freeze is due in June,
even if an exact freeze date has not been selected.

2 : http://lists.debian.org/debian-devel-announce/2012/01/msg00009.html

In addition, Niels announced that Cyril Brulebois joined the Release Team,
becoming Release Assistant: congratulations Cyril!

Bits from the piuparts maintainers
———————————-

Holger Levsen sent some bits from the piuparts maintainers [3] announcing that
piuparts is again maintained by a team and they’re receiving various patches
and other contributions. piuparts is an important tool for Quality Assurance
within Debian as it runs various tests in order to verify that packages can be
installed, upgraded and removed without problems. Tests results are publicly
available on the piuparts website [4], where they are updated on a daily basis.
Holger urged maintainers to regularly check their personal status pages on
piuparts in order to fix issues related to their packages. In addition to their
regular tests, since December 2011, the piuparts maintainers have been testing
the upgrade of individual packages from [5] “Squeeze” to “Wheezy” : 158
packages failed the test (and another 130 failed it due to dependencies) while
33,708 passed it.

3 : http://lists.debian.org/debian-devel-announce/2012/01/msg00007.html
4 : http://piuparts.debian.org
5 : http://piuparts.debian.org/squeeze2wheezy/

Report from Debian Med sprint
—————————–

Andreas Tille sent a report from the Debian Med sprint [6] held in Southport,
UK on 27-29 January. Among other activities, the Debian Med team fixed some
bugs, mentored new members and students (consolidating the effort made via the
[7] “Mentoring of the Month” initiative) and packaged new software.

For more information on Debian Med activity, you can check their real time
activity page [8].

6 : http://lists.debian.org/debian-med/2012/01/msg00452.html
7 : http://wiki.debian.org/DebianMed/MoM
8 : http://debian-med.alioth.debian.org/

Setting up a new school with Debian Edu/Squeeze
———————————————–

Petter Reinholdtsen announced on his blog that the next version of Debian
Edu/Squeeze will contain a new tool, called sitesummary2ldapdhcp [9], which
allows all the computers of a school to be quickly set up with a minimal number
of manual steps. Once the central server is installed, this tool collects data
from the network to generate system objects in the LDAP database. After a few
modifications of the configuration from a GUI, the network of computers is
ready to use.

A third beta version of Debian Edu based on “Squeeze” and containing this tool
has just been released.

9 : http://people.skolelinux.org/pere/blog/Setting_up_a_new_school_with_Debian_Edu_Squeeze.html

Answering Debian users’ questions
———————————

Raphaël Hertzog wrote a useful blogpost about how to answer the questions of
Debian users [10] and, in general, how to support new users. There are many
places for helping users (mailing lists [11], IRC channels [12], questions &
answers websites [13], etc.) each with different characteristics, but the
golden rule for every support channel is to be respectful and courteous (as
stated in the Debian Community Guidelines [14]).

10 : http://raphaelhertzog.com/2012/01/24/answering-questions-of-debian-users-on-various-support-channels/
11 : http://lists.debian.org/users.html#debian-user
12 : http://wiki.debian.org/IRC
13 : ask.debian.net
14 : http://people.debian.org/~enrico/dcg/

Debian/Ubuntu games screenshot party
————————————

Paul Wise announced a Debian/Ubuntu games screenshot party [15] to be held on
25 and 26 February and organised by the Games Team [16]. The idea is to create
screenshots for as many games in Debian/Ubuntu as possible and upload them to
screenshots.debian.net [17] in order to have them available to goplay [18] (a
games package browser).

For more information, you can visit the related wiki page [19].

15 : http://bonedaddy.net/pabs3/log/2012/02/03/debian-ubuntu-games-screenshot-party/
16 : http://wiki.debian.org/Games/Team
17 : http://screenshots.debian.net/
18 : http://packages.debian.org/unstable/goplay
19 : http://wiki.debian.org/Games/Parties/Screenshots

GNOME Shell 3.2 in “Wheezy” : a retrospective
———————————————-

Jordi Mallach wrote an article on the transition from GNOME 2 to GNOME 3 in
Debian [20] from the Debian GNOME Team point of view. “When you’re dealing
with dozens of GNOME source packages at the same time, many of which introduce
new libraries, or worse, introduce incompatible APIs that affect many more
unrelated packages, things get hairy, and you need a plan” Jordi said. But even
with a plan for a smooth transition, they encountered a lot of difficulties,
such as failures to build from source on various architectures and
incompatibilities with other packages. Finally GNOME Shell 3.2 has transitioned
to Debian’s testing suite and Jordi thanks not only all Debian GNOME Team
members, but also Release Team members Julien Cristau and Cyril Brulebois and
FTP assistant Luca Falavigna, who helped in reaching this goal.

20 : http://oskuro.net/blog/freesoftware/gnome-shell-3.2-in-wheezy-2012-01-31-01-23

Interviews
———-

There has been a
“People behind Debian” interview withJosselin Mouette [21], founder of the
Debian GNOME team.

21 : http://raphaelhertzog.com/2012/01/27/people-behind-debian-josselin-mouette-founder-of-the-debian-gnome-team/

Other news
———-

The 28th issue of the miscellaneous news for developers [22] has been released
and covers the following topics:

22 : http://lists.debian.org/debian-devel-announce/2012/01/msg00005.html

* Debian Member Portfolio Service
* Release goals bugs displayed in the PTS
* Transitions displayed in the PTS
* dh_linktree helper tool
* Patch Tagging Guidelines: DEP-3 moved to ACCEPTED status

The Debian website is now also optimised for handheld devices [23].

23 : http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654205

Didier Raboud announced the birth of a new mailing list dedicated to everyone
interested in discussing mobile inferfaces in Debian [24]. The debian-mobile
mailing list [25] is intended as a place for “discussions around packaging
suitable mobile interfaces for Debian” . For more information about running
Debian on mobile devices, you can visit themobile [26] and smartphone [27] wiki
pages.

24 : http://lists.debian.org/debian-project/2012/01/msg00076.html
25 : http://lists.debian.org/debian-mobile
26 : http://wiki.debian.org/Mobile
27 : http://wiki.debian.org/Smartphone

Micheal Gilbert wrote an article on a recent security flaw [28] (CVE-2012-0064
[29]) and how it was handled by distributions. Thanks also to the detailed
research by the discoverer of the issue, Debian reacted really fast and the
issue was already fixed in Debian unstable less than six hours after the
disclosure.

28 : https://lwn.net/Articles/477062/
29 : http://security-tracker.debian.org/tracker/CVE-2012-0064

Andrew Pollock wrote some bits from the ISC DHCP Maintainer [30]: during a
meeting with upstream, he gave them an overview of his packages on Debian
advocating GNU/Hurd patches. A nice example of good distribution maintainer
practices.

30 : http://blog.andrew.net.au/2012/01/21

Ben Hutchings announced that Debian 7.0 [31] “Wheezy” will include Linux 3.2,
which is currently in unstable and will soon enter testing.

31 : http://lists.debian.org/debian-devel-announce/2012/01/msg00012.html

Lior Kaplan blogged about the upcoming PHP 5.4.0 [32] release, a pre-release
version is already available in the experimental repository. Lior worked in
particular on PHP extensions in order to make them compatible with PHP 5.4.

32 : http://liorkaplan.wordpress.com/2012/01/22/php-5-4-debian/

Upcoming events
—————

There are several upcoming Debian-related events:

* February 10-12, Oslo, Norway —Skolelinux/Debian Edu developers meeting
[33]
* February 10-12, Minsk, Belarus — Debian contributors and enthusiasts will
be present at the winter edition ofLinux Vacation / Eastern Europe [34]
* February 15, Redwood Shores, CA, USA — [35] “Multiarch and Why You Should
Care: Running, Installing and Crossbuilding With Multiple Architectures” by
Wookey at Embedded Linux Conference
* February 17-19, Paris, France —Debian Bug Squashing Party [36]

You can find more information about Debian-related events and talks on the
events section [37] of the Debian web site, or subscribe to one of our events
mailing lists for different regions: Europe [38], Netherlands [39], Hispanic
America [40], North America [41].

33 : http://friprogramvareiskolen.no/Gathering/2012-02-10-12-Oslo
34 : http://wiki.debian.org/DebianEvents/LVEE/2012Winter
35 : https://events.linuxfoundation.org/events/embedded-linux-conference/wookey
36 : http://wiki.debian.org/BSP2012/Paris
37 : http://www.debian.org/events
38 : http://lists.debian.org/debian-events-eu
39 : http://lists.debian.org/debian-events-nl
40 : http://lists.debian.org/debian-events-ha
41 : http://lists.debian.org/debian-events-na

Do you want to organise a Debian booth or a Debian install party? Are you aware
of other upcoming Debian related events? Have you delivered a Debian talk that
you want to link on our talks page [42]? Send an email to the Debian Events
Team [43].

42 : http://www.debian.org/events/talks
43 : mailto:events@debian.org

New Debian Contributors
———————–

Six applicants have been accepted
as Debian Maintainer, and nine people have started to maintain packages
[44] since the previous issue of the Debian Project News.
Please welcome Neutron Soutmun, Boris Pek, Christian M.
Amsüss, Alexandre Mestiashvili, Emmanuel “Kasper” Kasprzyk, Aleksey
Kravchenko, Dan Stowell, Adam Michal Ziaja, Sebastian Boehm, Cyril Lavier,
Phillip Susi, Jose Ernesto Davila Pantoja, Peter Drysdale, Dominique Lasserre
and Antono Vasiljev into our project!

44 : http://udd.debian.org/cgi-bin/new-maintainers.cgi

Release-Critical bugs statistics for the upcoming release
———————————————————

According to the Bugs Search interface of the Ultimate Debian Database
[45], the upcoming release, Debian 7.0 “Wheezy” , is currently affected
by 695 Release-Critical bugs.
Ignoring bugs which are easily solved or on the way to being solved,
roughly speaking, about 482 Release-Critical bugs remain to be solved for the
release to happen.

45 : http://udd.debian.org/bugs.cgi

There are also more detailed statistics [46] as well as some hints on
how to interpret [47] these numbers.

46 : http://blog.schmehl.info/Debian/rc-stats/7.0-wheezy/2012-05
47 : http://wiki.debian.org/ProjectNews/RC-Stats

Important Debian Security Advisories
————————————

Debian’s Security Team recently released
advisories for these packages (among others): rails [48] (update),
cacti [49] (update), openssl [50], bip [51], libxml2 [52], wireshark [53],
qemu-kvm [54], icu [55], curl [56], php5 [57], iceweasel [58], tomcat6 [59],
iceape [60], php5 [61] and xen-qemu-dm-4.0 [62].
Please read them carefully and take the proper measures.

48 : http://www.debian.org/security/2011/dsa-2301
49 : http://www.debian.org/security/2012/dsa-2384
50 : http://www.debian.org/security/2012/dsa-2392
51 : http://www.debian.org/security/2012/dsa-2393
52 : http://www.debian.org/security/2012/dsa-2394
53 : http://www.debian.org/security/2012/dsa-2395
54 : http://www.debian.org/security/2012/dsa-2396
55 : http://www.debian.org/security/2012/dsa-2397
56 : http://www.debian.org/security/2012/dsa-2398
57 : http://www.debian.org/security/2012/dsa-2399
58 : http://www.debian.org/security/2012/dsa-2400
59 : http://www.debian.org/security/2012/dsa-2401
60 : http://www.debian.org/security/2012/dsa-2402
61 : http://www.debian.org/security/2012/dsa-2403
62 : http://www.debian.org/security/2012/dsa-2404

Debian’s Stable Release Team released an update announcement for the package
clive [63]. Please read it carefully and take the proper measures.

63 : http://lists.debian.org/debian-stable-announce/2012/02/msg00000.html

Please note that these are a selection of the more important security
advisories of the last weeks. If you need to be kept up to date about security
advisories released by the Debian Security Team, please subscribe to the
security mailing list [64] (and the separate backports list [65], and stable
updates list [66] or volatile list [67], for “Lenny” , the oldstable
distribution) for announcements.

64 : http://lists.debian.org/debian-security-announce/
65 : http://lists.debian.org/debian-backports-announce/
66 : http://lists.debian.org/debian-stable-announce/
67 : http://lists.debian.org/debian-volatile-announce/

New and noteworthy packages
—————————

1008 packages were added to the unstable Debian archive recently. Among many
others [68] are:

68 : http://packages.debian.org/unstable/main/newpkg

* clinica — simple medical records manager [69]
* coinst — computes the co-installability kernel of a deb or RPM repository
[70]
* espeak-gui — graphical user interface for eSpeak [71]
* instead — simple text adventures/visual novels engine [72]
* pyformex — program to create 3D geometry from Python scripts [73]
* actionaz — emulate human activity through a powerful GUI and JavaScript
[74]
* apper — KDE package management tool [75]
* vagrant — tool for building and distributing virtualized development
environments [76]

69 : http://packages.debian.org/unstable/main/clinica
70 : http://packages.debian.org/unstable/main/coinst
71 : http://packages.debian.org/unstable/main/espeak-gui
72 : http://packages.debian.org/unstable/main/instead
73 : http://packages.debian.org/unstable/main/pyformex
74 : http://packages.debian.org/unstable/main/actionaz
75 : http://packages.debian.org/unstable/main/apper
76 : http://packages.debian.org/unstable/main/vagrant

Work-needing packages
———————

Currently 390 packages are orphaned [77] and 148 packages are up for
adoption [78]: please visit the complete
list of packages which need your help [79].

77 : http://www.debian.org/devel/wnpp/orphaned
78 : http://www.debian.org/devel/wnpp/rfa
79 : http://www.debian.org/devel/wnpp/help_requested

Want to continue reading DPN?
—————————–

Please help us create this newsletter. We still need more volunteer writers to
watch the Debian community and report about what is going on. Please see the
contributing page [80] to find out how to help. We’re looking forward to
receiving your mail at debian-publicity@lists.debian.org [81].

80 : http://wiki.debian.org/ProjectNews/HowToContribute
81 : mailto:debian-publicity@lists.debian.org

This issue of Debian Project News was edited by Cédric Boutillier, Francesca
Ciceri, David Prévot, Justin B Rye and Paul Wise [82].

82 : mailto:debian-publicity@lists.debian.org

• Installation CDs

The Debian Installer includes support for a graphical interface, CD
and DVD images are available[3]. For the impatient we also have a
ready-to-go QEMU image[4]. Make sure to read the README file in all
cases!

• GHM meeting

At the GNU Hackers Meeting in Paris in August 2011, Samuel Thibault
presented “GNU/Hurd, aka. Extensibility from the Ground” with a very
good response from the audience. Slides[5] and a video[6] from that
presentation are available.

• Wheezy release goal

Since the ftp-master meeting in July 2011, significant improvements
have been made, and a technological preview of GNU/Hurd with Wheezy,
as was made for kFreeBSD did for Squeeze, is still the target. More
information is available in the updated TODO list[7]. With respect to
package porting only a few packages are still being fetched from the
ftp://ftp.debian-ports.org site, and the network installation images now
use the main archive.

• Archive coverage

Thanks to the efforts of various Debian/Hurd porters, the percentage of
packages built for Debian GNU/Hurd has passed 70%.

Quite a few hurd-i386 FTBFS patches are waiting for an upload, thanks
for helping us by handling them!

The remaining 30% of packages are either waiting for other packages to
become available (see [8] for a (big) graph of those relationships) or
are failing for some reason[9]; a complete list of build failures can be
found at [10].

To name some packages, we now have Iceweasel, Abiword, Gnumeric, etc.
working.

The autobuilders are keeping the pace relatively nicely, notably thanks
to a new buildd provided by Richard Braun: ironforge.sceen.net.

• Developer machines

A new, way-faster Debian porter box is provided by Richard Braun,
exodar.debian.net, immediately accessible to DDs, and accounts can be
opened to non-DD alioth members on request to admin@exodar.debian.net

• Hardware support

Work on the DDE layer to seamlessly integrate Linux 2.6 drivers in
userland processes is in the integration stage. Network card support
is basically working on real hardware, and the overhead is quite
low. Integration of other driver classes is also on the roadmap.

The sister project Arch Hurd has released a Live CD some time ago and
have also experimental DDE integrated to enable the use of up-to-date
GNU/Linux drivers for GNU/Hurd.

The Debian GNU/Hurd porters.

[1] http://lists.debian.org/debian-devel-announce/2011/07/msg00002.html
[2] http://www.debian.org/ports/hurd
[3] http://people.debian.org/~sthibault/hurd-i386/installer/cdimage
[4] http://people.debian.org/~sthibault/hurd-i386/debian-hurd.img.tar.gz
[5] http://www.gnu.org/ghm/2011/paris/slides/samuel-thibault-hurd.pdf
[6] http://audio-video.gnu.org/video/ghm2011/Samuel_Thibault-GNU_Hurd.ogv
[7] http://wiki.debian.org/Debian_GNU/Hurd
[8] http://people.debian.org/~sthibault/graph-radial.pdf
[9] http://www.bddebian.com/~hurd-web/hurd/porting/guidelines/
[10] http://unstable.buildd.net/buildd/hurd-i386_Failed.html

Legal stuff
===========

- Webmaster heroes have decided to tackle the long standing issues of
copyright and licensing of the Debian website [1,2]. I’ve accepted to
help them out in reaching consensus with license choice and I’m happy
to report that we’ve managed to pick a DFSG-free license (BSD-ish) for
future contributions. Webmasters will soon contact contributors to
re-license old contributions (or get rid of them), so hopefully will
have a DFSG-free website RSN. Many thanks go to David Prévot for
successfully tackling such a can of worms.

[1] http://bugs.debian.org/238245
[2] http://bugs.debian.org/388141

- I’ve sought a second legal advice on the constraints that trademarks
(might) impose on the work-flow of a distro like Debian. Luckily, it
is coherent with one I’ve sought in the past so I’m now in condition
to wrap up the “trademark vs DFSG” thread on -project [3] with the
missing legal information. Hopefully, I’ll find time to do that
sometime next week.

[3] http://lists.debian.org/debian-project/2011/10/msg00028.html

- I’ve restarted discussions with the Debian France association so that
they can become a Debian Trusted Organization (as per Constitution
§9.3). Members of the board of the association seem to be interested
and I’m positive it could happen fairly soon. The importance of this
is that we could use a back-up association in Europe to hold Debian
assets, to complement the services that FFIS are already offering us.

[4] http://france.debian.net/pipermail/asso/2012-January/001614.html
(thread in French)

- Thanks to the contributions of Benjamin Mako Hill and SPI lawyers,
I’ve now what I consider a final draft of a trademark policy for
Debian trademarks. Before proposing it to you, I’m waiting for some
feedback from another umbrella organization for Free Software
projects, that is working on a trademark policy for all their
associated projects. As many Free Software projects are seeking
trademark protection these days, I see benefits in having uniform (and
sane!) policies. I hope to be able to gather the feedback I still miss
this week-end at FOSDEM, and let you know shortly after that. Once
this is done, we’ll also be able to (finally!) relicense all kinds of
Debian logos under a DFSG-free license.

On this front, I’ve also updated http://www.debian.org/trademark with
the information needed to contact us about trademark usage; hopefully
it’ll reduce the burden of answering to such inquiries.

- With the help of Kenshi Muto, Fumitoshi Ukai, Ishikawa Mutsumi, Shuzo
Hatta, and Yasuhiro Araki we’ve started the process to move the Debian
trademark in Japan from individuals (who are present or past members
of the Debian JP association) to SPI. That would help dealing with
these matters, as well as ensure that important Debian assets are held
by Debian Trusted Organizations.

- I remind you that we’ve an ongoing complaint with the current
registrant of debian.eu, domain that we believe Debian should
legitimately own. Lawyers at SPI has now formally contacted the
current owner and hopefully we’ll be able to solve the issue amicably
in the next months.

- Some of the past legal advice I sought for PPA came handy in a
discussion [12] on the legal risks of running a service like
mentors.debian.net, hopefully addressing part of the issues in turning
that into mentors.debian.org

[12] http://lists.debian.org/debian-mentors/2012/01/msg00589.html

- Patent policy for the Debian archive is now ready as well and I also
have a patch for the website ready to be merged. I’m just waiting for
the final blessing from SPI (lawyers) to go ahead and publish it.

Most of the above wouldn’t have been possible without the precious help
of folks at SFLC [13] working for SPI and Debian. Be sure to thank SFLC
for what they’re doing for us and many other Free Software projects.

[13] http://www.softwarefreedom.org/

Coordination
============

Nobody stepped up to coordinate the artwork collection for Wheezy I’ve
mentioned last month [11], so I’ve tried to do a little bit of that
myself. The -publicity team is now preparing the call for artwork and
hopefully we’ll send it out RSN. In case you want to help, there is
still a lot of room for that; just show up on the debian-desktop mailing
list.

[11] http://lists.debian.org/debian-devel-announce/2012/01/msg00001.html

Sprints
=======

A Debian Med sprint has happened in January, and Andreas Tille has
provided a nice and detailed report about it [5]. Some more sprints are
forthcoming this spring, how about yours?

[5] http://lists.debian.org/debian-sprints/2012/01/msg00001.html

Money
=====

- We got from SPI a prepaid and rechargeable credit card that we can use
for expenses or other kind of guarantees. Many thanks to Michael
Schulteiss, SPI treasurer, for his help with that. Using it, we’ve
redeemed 10k$ of credits offered to us by Amazon, that (thanks to
ongoing work by Lucas Nussbaum) we’re going to use to make our QA
rebuilds independent from the underlying computing infrastructure.

- Thanks to the help of Luca Capello, we advanced quite a bit on forming
the Debian Event Box kit [6] that should make it easier to set up
Debian booth at FOSS events. We bought the machine for it (for about
~755 CHF) and the box to contain it will soon be on its way as well.
If you’re at FOSDEM, tend to the Debian booth to check it out (and
possibly help out with the technical setup).

[6] http://wiki.debian.org/Teams/Events/DebianEventsBox

- We’ve got quite a bit of donations during the December holidays. I’ve
took the chance to thank donors, discuss what we do with donations and
the status of publishing periodic Debian budgets in [7].

[7] http://upsilon.cc/~zack/blog/posts/2012/01/debian_donations-fu/

- Pinged by Yves-Alexis Perez, I’ve now properly documented the fact
that DDs are welcome to apply for hardware sponsoring, in case the
hardware can be used to help/improve their Debian work [9,10]. As
suggested by Yves-Alexis [8], you can also advocate *other* DDs for hw
sponsoring.

[8] http://www.corsac.net/?rub=blog&post=1541
[9] http://upsilon.cc/~zack/blog/posts/2012/01/hardware_sponsorship_for_Debian_Developers/
[10] http://wiki.debian.org/Teams/DPL/SponsoringGuidelines#Hardware_Guidelines

- Given hardware invariably age and that we can afford it, I’ve prodded
DSA to prepare a general hardware replacement plan for our
machines. Planning will go on this week-end and FOSDEM (thanks to
Martin Zobel-Helas and Faidon Liambotis for their presence here) and I
hope to have an approved machine replacement plan well before the end
of the current DPL term (although I’m usually optimist…).

Important stuff going on
========================

Other important stuff has been going on in various area of the project
in January. I’d like to point your attention to a couple of things:

- People active on debian-mentors have proposed an improved work-flow to
deal with sponsoring/mentoring requests [14], based on the usage of a
new pseudo package “sponsorship-requests”. Thanks to Ansgar Burchardt,
Jakub Wilk, Arno Töll, and Gregor Herrmann for working on this.

[14] http://lists.debian.org/debian-mentors/2012/01/msg00365.html

- Raphael Hertzog has kickstarted work on DEP-2 [15], as a way to
rationalize the flow of package-related information that
(co-)maintainers get. Discussion about the idea are ongoing on the
debian-qa mailing list.

[15] http://dep.debian.net/deps/dep2/

Miscellanea
===========

- Work has further progressed in reaching out to companies with an
interest in giving support for, and contributing to Debian. Thanks to
Alexander Wirt the technical work is now done and some sort of
governance policy has been decided. Further step for me is to announce
it properly hoping to reach out to as many interested companies as
possible. I hope to finalize that in the next month. (If you’re
working for such a company and you happen to read this, feel free to
reach out to me already.)

[16] http://bugs.debian.org/650082

- I’ve completed an old todo item setting up and documenting
titanpad.debian.net [17,18], service that has been requested for
collaborative work during various kinds of online events. Help is
welcome to help administering the service (see [18]).

[17] http://lists.debian.org/debian-project/2012/01/msg00072.html
[18] http://wiki.debian.org/TitanpadDebianNet

- SPI has clarified the role of project representatives and, as a
consequence of that, I (as DPL) no longer receive SPI board
discussions addressed to board@spi. That is good not only for the
sanity of my inbox, but also because it puts all projects affiliated
to SPI at the same level of communication within SPI. Thanks to Robert
Brockway for his work on this.

In the unlikely case you’ve read thus far, thanks for your attention!
Happy Debian hacking.

PS as usual, the boring day-to-day activity log is available at

–

The kernel team is open to backporting some features from later kernel
versions, particularly to support newer hardware.

Featuresets
———–

The only featureset provided will be ‘rt’ (realtime), currently built
for amd64 only. If there is interest in realtime support for other
architectures, we may be able to add that. However, we do need to
consider the total time taken to build binary packages for each
architecture.

If there are particular container features that should be enabled or
backported to provide a useful replacement for OpenVZ or VServer,
please let us know. We cannot promise that these will all be enabled
but we need to know what is missing.

Compatibility
————-

If you maintain a package for which the current stable version is not
compatible with Linux 3.2, excluding kernel module packages, please
consider making a stable update that fixes this.

If you maintain a kernel module package, please ensure that this is
compatible with Linux 3.2 in time for the freeze. Any modules that
are not compatible will not be included in the release. I recently
tested building all the module packages I could find against Linux 3.1
and have filed bugs against those that failed to build; however I have
not tested against Linux 3.2 and would prefer that the respective
maintainers did so.

We intend to switch to 2-component upstream version numbers in the
kernel version string, e.g. 3.3-1-amd64. This change has been
deferred until after wheezy to avoid incompatibility with packages in
squeeze that assume 3-component version numbers. If your package uses
uname(1) or uname(2) please ensure that it is prepared for this *in
wheezy* so that we can make the change immediately after.

Upstream support
—————-

Debian, Ubuntu and others will work upstream on a 3.2.y longterm
series of bug fixes.

Ben.

– Ben Hutchings We get into the habit of living before acquiring the habit of thinking. – Albert Camus

Please note that this update does not constitute a new version of
Debian 6.0 but only updates some of the packages included. There is no
need to throw away 6.0 CDs or DVDs but only to update via an up-to-date
Debian mirror after an installation, to cause any out of date packages
to be updated.

Those who frequently install updates from security.debian.org won’t
have to update many packages and most updates from security.debian.org
are included in this update.

New installation media and CD and DVD images containing updated
packages will be available soon at the regular locations.

Upgrading to this revision online is usually done by pointing the
aptitude (or apt) package tool (see the sources.list(5) manual page) to
one of Debian’s many FTP or HTTP mirrors. A comprehensive list of
mirrors is available at:

http://www.debian.org/mirror/list

Miscellaneous Bugfixes
———————-
This stable update adds a few important corrections to the following
packages:

Package Reason

adolc Remove Visual C++ runtime from windows/
directory
backuppc Fix data corruption in tarballs due to
logging to stdout and two XSS issues
base-files Update /etc/debian_version for the
point release
base-installer Add POWER7 to the powerpc64 family
bti Fix identi.ca OAuth URLs
bugzilla Security fixes
byobu Correct postinst chmod semantics
bzip2 Fix CVE-2011-4089
c-ares Fix encoded length for indirect root
cherokee Avoid brute-forceable password in
cherokee-admin
cifs-utils Fix mtab corruption issues
clamav New upstream version; fix potential DoS
clamz Handle unencrypted amz files
cpufrequtils Load powernow-k8 for AMD family 20
(i.e. AMD E-350 cpus); better support
3.0 kernels
debian-installer Stop menu falling off the screen
debian-installer-netboot-images Update to d-i 20110106+squeeze4
dpkg Add armhf to {os,triplet}table; defer
hardlink renames; do not fail to unpack
shared directories missing on the file
system from packages being replaced by
other packages
eglibc New upstream stable release plus fixes
from stable branch
erlang Fix CVE-2011-0766 (cryptographic
weakness) in the erlang ssh application
etherape Null pointer dereferences
gimp Fix printing when used with libcairo
version 1.10 or above
gnutls26 Fix buffer overflow in
gnutls_session_get_data()
hplip Fix insecure use of temporary file
ia32-libs Update packages
ia32-libs-gtk Update packages
ifupdown-extra Handle moved location of ethtool; fix
handling of “rejects” in static-route;
use –tmpdir for temporary files; move
/etc/network/network-routes to
/e/n/routes; documentation updates
iotop Give a helpful error instead of
crashing when Linux denies permission
to read the taskstats files
jabberbot Bind callbacks after the roster has
been initialised
kernel-wedge Add et131x to nic-extra-modules; add
isci to scsi-extra-modules; add
xhci-hcd to usb-modules
killer Use DNS for mail domain rather than
NIS; stop cron job failing when package
is removed
ldap2zone Don’t send mail on success; syslog
instead
libdata-formvalidator-perl Fix possible passing of invalid data in
untaint mode
libdebian-installer Detect IBM pSeries platform as
powerpc/chrp_ibm
libdigest-perl Fix unsafe use of eval in Digest->new()
libhtml-template-pro-perl Fix XSS
libjifty-dbi-perl SQL injection
libmtp Add support for Motorola Xoom devices
libpar-packer-perl Fix use of unsafe and predictable
temporary directories
libpar-perl Fix use of unsafe and predictable
temporary directories
linux-2.6 Fixes for xen regression, GRO/GSO IPv6
forwarding, ppc vserver; add stable
releases 2.6.32.47-54, various fixes;
fix tg3 regression; xen fixes
linux-kernel-di-amd64-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-armel-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-i386-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-ia64-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-mips-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-mipsel-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-powerpc-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-s390-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
linux-kernel-di-sparc-2.6 Rebuild against linux-2.6 kernel
2.6.32-41
masqmail Fix improper seteuid() calls
mdadm Quieten some cron messages; don’t break
when no scheduling class is specified
or no devices are active; LSB header
updates
mediawiki Fix unintended exposure of hidden
content through cache pollution;
disable CVE-2011-4360.patch; doesn’t
apply to this version and causes errors
module-init-tools Support 3.0 kernels
multipath-tools Change HP hardware handler to hp_sw;
update man pages
mutt Fix validation of commonname (gnutls)
nfs-utils Allow negotiated enctypes to be limited;
avoid corrupting mtab
nginx Fix compression pointer processing in
DNS response greater than 255 bytes
nss-pam-ldapd Correctly parse /etc/nsswitch.conf,
detect calling process identity and fix
disconnect logic
partman-target Stop treating ISO hybrid images on USB
sticks as real optical drives
pastebinit Fix support for user configuration
files
pbuilder Rename the /run script from –execute
to /runscript, for compatibility with
wheezy and later which have /run as a
directory replacing /var/run
perl Unregister signal handler before
destroying my_perl; fixes segfault;
minor security fixes
phppgadmin Fix XSS
pidgin Fix remote crash issues
postgresql-8.4 New upstream micro-release
pure-ftpd Fix man in the middle attack on
encrypted sessions
python-debian Allow “:” as the first character of a
value
python3-defaults Ignore binary files while checking
shebangs
qemu-kvm Fix NIC hotplug from libvirt
quassel Fix missing translations
recoll Plug conversion descriptor leak in
unac.c::convert() error path
rng-tools Work around VIA Nano xstore bug; add
3.0 kernel support
rpm Fix malformed header parsing
samba Allow using unencrypted passwords with
Windows clients with KB2536276
installed
shorewall Install missing
/usr/share/shorewall/helpers
shorewall-lite Install missing
/usr/share/shorewall/helpers
shorewall6 Install missing
/usr/share/shorewall/helpers
shorewall6-lite Install missing
/usr/share/shorewall/helpers
slbackup Fix path to configuration file in the
cron job
slbackup-php Fix login issues, deal with blanks in
filenames, fix last failed timestamp
tinyproxy Validate port number specified in
configuration
tzdata New upstream version; add DST for
America/Bahia
user-mode-linux Rebuild against linux-source-2.6.32
(2.6.32-41)
webkit Avoid doing lots of needless NULL DNS
lookups
whatsnewfm Handle renaming of freshmeat
to freshcode
xorg-server GLX: add missing input sanitization;
fix a file disclosure vulnerability and
a file permission change vulnerability
xpdf Fix insecure temporary file usage

Security Updates
—————-
This revision adds the following security updates to the stable
release. The Security Team has already released an advisory for each of
these updates:

Advisory ID Package Correction(s)

DSA-2181 subversion Denial of service
DSA-2251 subversion Multiple issues
DSA-2283 krb5-appl Programming error
DSA-2284 opensaml2 Implementation error
DSA-2301 rails Multiple issues
DSA-2311 openjdk-6 Multiple issues
DSA-2315 openoffice.org Multiple issues
DSA-2318 cyrus-imapd-2.2 Multiple issues
DSA-2322 bugzilla Multiple issues
DSA-2323 radvd Multiple issues
DSA-2324 wireshark Programming error
DSA-2325 kfreebsd-8 Privilege escalation/denial
of service
DSA-2326 pam Multiple issues
DSA-2327 libfcgi-perl Authentication bypass
DSA-2328 freetype Missing input sanitising
DSA-2329 torque Buffer overflow
DSA-2330 simplesamlphp Multiple issues
DSA-2331 tor Multiple issues
DSA-2332 python-django Multiple issues
DSA-2333 phpldapadmin Multiple issues
DSA-2334 mahara Multiple issues
DSA-2335 man2html Missing input sanitization
DSA-2337 xen Multiple issues
DSA-2338 moodle Multiple issues
DSA-2339 nss Multiple issues
DSA-2340 postgresql-8.4 Weak password hashing
DSA-2341 iceweasel Multiple issues
DSA-2342 iceape Multiple issues
DSA-2343 openssl CA trust revocation
DSA-2344 python-django-piston Deserialization vulnerability
DSA-2345 icedove Multiple issues
DSA-2346 proftpd-dfsg Multiple issues
DSA-2347 bind9 Improper assert
DSA-2348 systemtap Multiple issues
DSA-2349 spip Multiple issues
DSA-2350 freetype Missing input sanitising
DSA-2351 wireshark Buffer overflow
DSA-2353 ldns Buffer overflow
DSA-2354 cups Multiple issues
DSA-2355 clearsilver Format string vulnerability
DSA-2356 openjdk-6 Multiple issues
DSA-2357 evince Multiple issues
DSA-2361 chasen Buffer overflow
DSA-2362 acpid Multiple issues
DSA-2363 tor Buffer overflow
DSA-2364 xorg Incorrect permission check
DSA-2366 mediawiki Multiple issues
DSA-2367 asterisk Multiple issues
DSA-2368 lighttpd Multiple issues
DSA-2369 libsoup2.4 Directory traversal
DSA-2370 unbound Multiple issues
DSA-2371 jasper Buffer overflows
DSA-2372 heimdal Buffer overflow
DSA-2373 inetutils Buffer overflow
DSA-2374 openswan Implementation error
DSA-2375 krb5-appl Buffer overflow
DSA-2376 ipmitool Insecure pid file
DSA-2377 cyrus-imapd-2.2 Denial of service
DSA-2378 ffmpeg Multiple issues
DSA-2379 krb5 Multiple issues
DSA-2380 foomatic-filters Shell command injection
DSA-2381 squid3 Invalid memory deallocation
DSA-2382 ecryptfs-utils Multiple issues
DSA-2383 super Buffer overflow
DSA-2384 cacti Multiple issues
DSA-2385 pdns Packet loop
DSA-2386 openttd Multiple issues
DSA-2387 simplesamlphp Cross site scripting
DSA-2388 t1lib Multiple issues
DSA-2390 openssl Multiple issues
DSA-2391 phpmyadmin Multiple issues
DSA-2392 openssl Out-of-bounds read
DSA-2393 bip Buffer overflow

Debian Installer
—————-
The installer has been updated with this point release to add support
for installing on POWER7 machines and to adjust the dimensions of the
initial boot menu to avoid issues with some screens.

The kernel used by the installer has been updated to include various
security fixes and to add support for Agere ET-1310-based network cards
(et131x driver), Intel C600-series SAS/SATA controllers (isci driver)
and USB 3.0 controllers (xhci driver).

Removed packages
—————-
The following packages were removed due to circumstances beyond our
control:

Package Reason
partlibrary Non-distributable
cad Non-distributable

URLs
—-
The complete lists of packages that have changed with this revision:

http://ftp.debian.org/debian/dists/squeeze/ChangeLog

The current stable distribution:

http://ftp.debian.org/debian/dists/stable/

Proposed updates to the stable distribution:

http://ftp.debian.org/debian/dists/proposed-updates

Stable distribution information (release notes, errata etc.):

http://www.debian.org/releases/stable/

Security announcements and information:

http://security.debian.org/

About Debian
————
The Debian Project is an association of Free Software developers who
volunteer their time and effort in order to produce the completely free
operating system Debian.

Contact Information
——————-
For further information, please visit the Debian web pages at
http://www.debian.org/, send mail to , or contact the
stable release team at .