La Salle Debain

Emanuele Rocca sent me an Italian translation of my flyer for tradeshows which I have added to CVS. The output is kind of messed up at the moment but I'm working on it.

The Debian servers are still down so I've put the .debs for the latest release of dovecot plus a backport to woody on the open source page.

There's a new release of dovecot and I've just uploaded it to sid. Backports to woody can be found on the open source page.

I've made some new .debs of pine available.

A buffer overflow exists in the way unpatched versions of Pine prior to 4.57 handle the 'message/external-body' type. The Common Vulnerabilities and Exposures project has assigned the name CAN-2003-0720 to this issue.

An integer overflow exists in the Pine MIME header parsing in versions prior to 4.57. The Common Vulnerabilities and Exposures project has assigned the name CAN-2003-0721 to this issue.

Both of these flaws could be exploited by a remote attacker sending a carefully crafted email to the victim that will execute arbitrary code when the email is opened using Pine. So please upgrade ASAP.

People on the Debian-User mailing list have posted two howtos recently. Using OpenLDAP on Debian Woody to serve Linux and Samba users by Markus Amersdorfer and Configuring SSH2 for Public Key authentication from Jadev.

Bram Stolk has created a 'self organizing map' visualisation of the dependencies in Debian packages.

It depicts all packages from testing/main with 5 or more dependencies. Instead of visualizing the dependencies directly, a classification has been made.

In the chart, all packages that have highly similar dependencies are grouped close together. Alternatively, packages placed on opposite sides of the map truly have wildly different dependencies. Clustering is present at all scales. Unfortunately, some clusters are too dense to read.

This is an introductory book with a Debian focus and lots of useful information for desktop users.

[Posted to debian-devel by Drew Scott Daniels.]

debian-release@lists.debian.org is the best place to discuss this. I'm going to start posting this unofficial status report there like I did for my freeze date estimate last month in http://lists.debian.org/debian-release/2003/debian-release-200306/msg00004.html
Again, I'm having trouble keeping this up to date and accurate, but here it is as I'll likely be busy for the next few weeks. I'll try to post another message updating this stuff again next month, but next time it'll be to debian-release.

Note I don't think I've updated the menu and translation items yet.

I may not be pointing to the canonical locations. My guesses about priorities (1-3) of things to be done before Sarge is released is below with status information. I'm unsure as to where to get status information about some things in the second paragraph below (which is mainly about packages).

• 2 Installer TODO: http://cvs.debian.org/debian-installer/doc/TODO?rev=HEAD&content-type=text/vnd.viewcvs-markup you can follow my experiences in my "installation-report" at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=186283
• 1 Debian installer Ports(and architectures?) status: http://people.debian.org/~mckinstry/ports-status.html http://lists.debian.org/debian-boot/2003/debian-boot-200305/msg00445.html says all ports not likely for sarge. http://lists.debian.org/debian-hurd/2003/debian-hurd-200305/msg00165.html talks about the hurd status. http://www.m17n.org/linux-sh/debian/packages.html seems to show that the super H (sh) is almost ready (all base compiled). Note http://lists.debian.org/debian-devel/2002/debian-devel-200207/msg01479.html says: "If you don't have a functioning installer by release, then sure, you'll release, but you won't be installable when you do."
• 2 i386 libc support? (The large thread starting with http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01895.html and going into the May archive talks about this). Do we have to wait for upstream to fix this? We want to stay compatible with other distributions which broke support for i386 in libc. http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg00360.html describes the current situation.
• 1 gcc 3.3 (and g++ abi change?) transition status (versions with c102 suffix): http://people.debian.org/~rmurray/c++transition.html a search reveils: http://www.google.ca/search?as_q=c102&num=100&hl=en&ie=UTF-8&oe=UTF-8&btnG=Google+Search&as_epq=&as_oq=&as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=all&as_occt=any&as_dt=i&as_sitesearch=packages.debian.org&safe=images but this search is inaccurate. It only tells about the last crawled i386 package pages and includes packages that depend/recomend/suggest these i386 c102 packages. g++–3.2 and 3.3 have the same ABI. Transition should now be done to 3.3, but I beleive this means packages already compiled with 3.2 should still work.
• 2 Release Critical Bugs status: http://bugs.debian.org/release-critical/
• 1 Problems in testing: http://ftp-master.debian.org/testing/testing_probs.html
• 2 IPV6 status & status guesses: http://debdev.fabbione.net/cgi-bin/getstats and ipv6 tagged bugs: http://bugs.debian.org/tag:ipv6 Note some 3rd party 2005 and october deadlines for IPV6 stuff in http://news.com.com/2100-1028_3-1020653.html?tag=fd_top
• 3 Debian Description Translation Projects (DDTP?) status: http://ddtp.debian.org/stats/ with an anoucement ( http://lists.debian.org/debian-devel-announce/2003/debian-devel-announce-200304/msg00015.html ) of an APT with translation support. Also: http://www.de.debian.org/international/l10n/ has status and ranked information about l10n and i18n in package Descriptions and templates. http://www.de.debian.org/doc/devel-manuals#i18n (in development) talks about howto do l10n, i18n, and m17n. http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg00348.html discusses 4 basic goals.
• 2 UTF-8 or UTF8? http://lists.debian.org/debian-devel/2003/debian-devel-200303/msg01520.html suggests a status site. http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg02012.html talks about the current list of programs with i18n support disabled.
• 3 Package attributes: (Is done by "tags" and/or keywords. I'd like to include upstream trove information): http://deb-usability.alioth.debian.org/debtags/index.html has details of the tag Package browser, debtags package information and links to other package tag discussions/information.
• 3 Menu system update to conform to http://www.freedesktop.org/standards/menu/draft/menu-spec/menu-spec.html (as suggested in http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg00800.html ) The old update was abandonded but contributes to the new standard.
• 3 AMD x86-64 port? Several threads have been on debian-devel about this. i386 packages will aparently work for this arch. (Note: According to http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01975.html AMD prefers the port to be called AMD64 and not x86-64 or alike) "gcc-3.3 is a prerequisite" says http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg00360.html There is also a mailing list at http://lists.debian.org/debian-x86-64 to replace the old alioth mailing list. http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=197117 and http://people.debian.org/~gt/lib64/ may also be of interest
• 3 lfs (large file size) bugs: http://bugs.debian.org/tag:lfs

• 2 flex transition: Silently a major revision of flex came into unstable and broke parts of openoffice.org, postgresql and many others. flex-old is now available so a slower transition can be allowed while not delaying sarge.
• 1 XFree86 status (sarge'll have 4.3.0, 4.2.1 was abandonded due to gcc compilation issues, but is back): http://people.debian.org/~branden/xsf/ http://lists.debian.org/debian-x/2003/debian-x-200305/msg00134.html gives some status and information about how to help. http://lists.debian.org/debian-x86-64/2003/debian-x86-64-200305/msg00003.html asks for help to port 4.3.0 to the AMD64 (aka x86-64). http://lists.debian.org/debian-x/2003/debian-x-200306/msg00480.html apears to be the 4.3.0 release plan. http://packages.qa.debian.org/xfree86 shows 4.2.1-9 is in unstable (and I'm expecting will be in testing in 2 days).
• 1 Linux Kernel: The thread starting at http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg01334.html discusses how the kernel source, images, patches and related packages need to be handled differnely, especialy for security update reasons.
• 3 Linux kernel 2.6: http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg00964.html there were some potential Debian Installer (d-i) issues listed in the same thread. In http://lists.debian.org/debian-devel/2003/debian-devel-200305/msg00397.html aj says not to wait for 2.6. 2.5 was feture frozen October 31, 2002 ? The thread at http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg02113.html discusses how 2.5 can work. m68k still uses 2.2 and it's hoped that 2.2 won't be in sarge+1. Rummors of a release this summer are discussed, but it's also predicted to be "unstable" for a while after it goes to 2.6.
• 1 KDE (3.1?)? 3.1.1 is in unstable. http://lists.debian.org/debian-devel/2003/debian-devel-200306/msg00424.html suggests tracking the kdebase package. The thread at http://lists.debian.org/debian-kde/2003/debian-kde-200306/msg00278.html talks about the current transition status.
• 1 libpng transition: versioned symbols are now available. debian-devel has some discussion about this archived for Jan and Jul 2002. http://lists.debian.org/debian-devel/2002/debian-devel-200207/msg01106.html is quite interesting. http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01079.html lists some more info. http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01880.html described a past situation, http://lists.debian.org/debian-devel/2003/debian-devel-200306/msg00619.html describes the current situation.
• 3 QT transition (Qt2–>Qt3)? Mentioned in thread http://lists.debian.org/debian-devel/2003/debian-devel-200303/msg00217.html
• 3 MySQL 4: http://packages.qa.debian.org/m/mysql-dfsg.html (note there was a libmysqlclient12 bug, it isn't lgpl and there's openssl vs gpl and gpl vs lgpl licence issues) http://lists.debian.org/debian-legal/2003/debian-legal-200305/msg00253.html discusses the current situation.
• 1 Gnome2: http://people.debian.org/~walters/gnome2.html (is the imlib png library compatiblility issue involve here?) In http://lists.debian.org/debian-release/2003/debian-release-200307/msg00002.html I give some status information. Some of Gnome2 is in testing.
• 2 Java (some packages were in contrib/non-free because they wouldn't work with free Java implementations (ie kaffe). kaffe is free but marked [REMOVE], (Sun's jre isn't?), gjc and gij need some work acording to http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01210.html An old, but still relevant java faq is at http://www.debian.org/doc/manuals/debian-java-faq I'm unsure what's holding up an upload of Kaffe (I haven't asked).
• 3 guile 1.4 -> 1.6 transition? http://lists.debian.org/debian-devel/2003/debian-devel-200302/msg00255.html Josselin Mouette says in http://lists.debian.org/debian-devel/2003/debian-devel-200304/msg01079.html that 1.6 is broken. It seems we'll be sticking with 1.4 for a while. http://bjorn.haxx.se/debian/testing.pl?package=guile-1.6 p.qa.d.o and bugs.d.o seems to indicate that only build issues are holding back guile 1.6, and there are now proposed patches.
• 1 Apache2, Apache and php4: http://lists.debian.org/debian-devel/2003/debian-devel-200306/msg00916.html Also http://lists.debian.org/debian-release/2003/debian-release-200306/msg00026.html says gdbm needs a new apache2 which has a new RC bug, waits for openldap2, and libapr0-dev in testing depends on libgdbmg1-dev which is gone. Apache2 has a version in testing.
• 3 ocaml status? http://lists.debian.org/debian-devel/2003/debian-devel-200306/msg01062.html says there's a new target of getting 3.07 in.
• 1 openldap2: http://lists.debian.org/debian-release/2003/debian-release-200307/msg00001.html openldap2 is blocking quite a few things and it looks like it'll all be fixed "soon" (10 days+NEW queue?)

Some other notes:

• "reasons sarge is going to blow you away": http://lists.debian.org/debian-devel-announce/2002/debian-devel-announce-200209/msg00004.html
• Boot-floppies status (very likely has to be replaced with the debian-installer): http://people.debian.org/~dwhedon/

• Packages not in testing reasons and prioraty lists: http://bjorn.haxx.se/debian/
• Testing information: http://www.debian.org/devel/testing
• Update excuses: http://ftp-master.debian.org/testing/update_excuses.html.gz
• Update output: http://ftp-master.debian.org/testing/update_output.txt
• Archives of the mailing list for "Coordinating Debian releases" (includes assignments and reports on assignments): http://lists.debian.org/debian-release/

• QA information (links to info on RC bugs and alike): http://qa.debian.org

• A Woody+1 (aka sarge) release goal wishlist: http://people.debian.org/~erich/woody+1/
• Discussion about Woody+1 (goals) at: http://lists.debian.org/debian-devel/2002/debian-devel-200205/msg02497.html
• Older (hamm, slink) release goals: http://people.debian.org/~joey/goals/

• Info about release(d) revisions of Stable: http://people.debian.org/~joey/stable.html
• Website translation status: http://www.debian.org/devel/website/stats/
• Debian keys trust metrics: http://people.debian.org/~weasel/weboftrust/ (It'd be nice to see a higher trust metric.)
• Package Popularity (popularity-contest): http://people.debian.org/~ballombe/popcon/ replaces the now broken http://people.debian.org/~apenwarr/popcon/

• Devel todo list: http://www.debian.org/devel/todo/

• General information about sarge: http://www.debian.org/releases/testing/
• Package diff bethween Debian testing and unstable: http://developer.skolelinux.no/info/cdbygging/distdiff-all.html.gz
• http://lists.debian.org/debian-release/2003/debian-release-200306/msg00003.html talks about some dependancy loop packages and says they "could have hints applied in update_out.py".

Old items that I haven't updated because I consider them to be resolved for now:

• 3 gzip rsync patch (patch will be removed or fixed for alphas): http://bugs.debian.org/cgi-bin/pkgreport.cgi?pkg=gzip this was fixed, but there's still a bug set to hold the rsync patch out of testing.
• 3 fhs status: http://qa.debian.org/fhs.html Done, see the bugs.
• 3 Postgresql (uprade bug fixed, but flex bug is kludged, help needed)
• 3 Ooo (OpenOffice.org 1.0.3?): More info at least on the debian ooo mailing list. http://packages.qa.debian.org/o/openoffice.org.html shows some info
• 2 Perl transition (5.6-5.8): The debian-perl list might have an up to date status. Perl 5.8.0-17 is in testing now.
• 2 Postgresql 7.3.2r1-5 is in testing
• 2 Python transition: 2.2.2-6 is in testing. http://lists.debian.org/debian-python/2003/debian-python-200304/msg00010.html shows part of how it finnished.

An Australian Linux magazine has an editorial wondering 'Will Debian survive the rise of Linux?' . This seems to be a stage every new convert goes through. :-)

Jono Bacon wrote a short introductory article for SitePoint.