Debian Project News - July 21st, 2008

---------------------------------------------------------------------------
Debian Project News
http://www.debian.org/News/project/
Debian Project News - July 21st, 2008
---------------------------------------------------------------------------

Welcome to this year's 7th issue of DPN, the newsletter for the Debian
community.
Some of the topics covered in this issue:

 * Updates to the Lenny release process
 * Debian-installer to support loading of external firmwares
 * Best practice for debug packages
 * ... and much more.

Updates to the Lenny release process

Luk Claes sent a [1]release update regarding the upcoming stable
release Debian 5.0 "Lenny". An important part is, that starting with
next week, the transition of packages from the unstable to the testing
branch will be frozen to concentrate on: fixing the remaining bugs. He
further reports on the different release goals, which he sees in good
shape, but is a bit worried about the architecture qualification pages
on wiki.debian.org, which still miss a lot of information. Porters
should provide status information on these pages, so it's easier for
the release team to inform themselves about the status of different
hardware architectures.

  1: http://lists.debian.org/debian-devel-announce/2008/07/msg00005.html

In related news Ana Guerrero [2]reported about the status of KDE
especially KDE4 related packages in the upcoming release of Debian.

  2: http://ekaia.org/blog/2008/07/19/debian-packages-for-kde-41-koffice-alpha9-and-more/

Debian-installer to support loading of external firmwares

Joey Hess [3]announced a new feature of the Debian installer: On
demand loading of firmwares. Since some drivers need to load such
binary blobs to the device before they can operate but these firmwares
are often non-free according to the [4]Debian Free Software
Guidelines, some devices could only be operated after Debian has been
successfully installed and network access has been configured by adding
Debian's non-free section to the package sources. Which would fail, if
the network driver itself needed to load a firmware to operate.

  3: http://kitenet.net/~joey/blog/entry/d-i_firmware_loading/
  4: http://www.debian.org/social_contract#guidelines

With the newly introduced feature, it is now possible to drop the
firmware files on a separate medium, like an USB stick. The
Debian-Installer will then automatically load the necessary files. He
also noted, that the Debian-CD team [5]builds zip files and tarballs
containing all the firmware that Debian ships in non-free.

  5: http://cdimage.debian.org/cdimage/unofficial/non-free/firmware/

Best practice for debug packages

Theodore Tso [6]wondered about the best practice regarding debug
packages, containing additional data to ease debugging of programs and
libraries. [7]Mike Hommey answered that debug files should be
installed at the non-debug files path preceded by /usr/lib/debug/ and,
depending on the size of the debug data, split of in a separate
package. Joerg Jaspert [8]added that the priority of such debug
packages should be extra and that they should be in the same section as
the parent package.

  6: http://lists.debian.org/debian-devel/2008/07/msg00187.html
  7: http://lists.debian.org/debian-devel/2008/07/msg00188.html
  8: http://lists.debian.org/debian-devel/2008/07/msg00205.html

Call for help DebConf 8 website

Martin Ferrari [9]called for help for the website of the upcoming
Debian Conference. A lot of information needed by travellers is
missing. The most important thing he sees, is to recognise missing
data, since it's difficult to guess what foreigners might need to know
when youâre a local.

  9: http://blog.debconf.org/blog/debconf8/mf_website_help.dc

Debian release versioning

Martin Krafft [10]proposed to change the way Debian versions its
releases. He proposed increasing the first number with each release,
and the second one with every "point release" / "r-release" of the
stable branch only including fixed packages, while new releases of the
stable release adding new features (like the upcoming "Etch and a
half") should get a five as second number to show the "half" update.
Lars Wirzenius [11]reminded that Debian introduced the current
versioning scheme because CD vendors feared old boxes would stay in the
shelves after a point release. Others preferred a "classic two dot"
versioning scheme, where the first number gets increased with every new
major release, the third one with "bug fix" releases and the second one
with releases adding new features.

 10: http://lists.debian.org/debian-devel/2008/07/msg00371.html
 11: http://lists.debian.org/debian-devel/2008/07/msg00395.html

Package management unsafe? - No.

A recently published [12]study which described several attack vectors
against Linux systems using their package management has recently
caused [13]some [14]discussion. While the study was generally judged to
be "oversensationalized attention-grabbing" the consensus was, that one
weak point does remain: a potential attacker could manipulate the
domain name system and redirect security.debian.org, source of security
updates for Debian, to an outdated copy of that server. Currently plans
are drafted to add a signed time stamp to prevent that kind of attacks.

 12: http://www.cs.arizona.edu/people/justin/packagemanagersecurity/attacks-on-package-managers.html
 13: http://lists.debian.org/debian-security/2008/07/msg00054.html
 14: http://lists.debian.org/debian-devel/2008/07/msg00321.html

Other news

Steve McIntyre [15]sent bits from the DPL. Beside mentioning several
personnel changes already reported in last issues of the Debian Project
News, he also informs about his intention to intense the cooperation
between Debian and its derivatives. He already contacted several
derivatives, namely Linspire, Xandros and Ubuntu.

 15: http://lists.debian.org/debian-devel-announce/2008/07/msg00004.html

Obey Arthur Liu [16]gave another status report on his graphical front
end to the package manager aptitude. While he thinks that the basic
functionality is already present, he lists several missing features he
would like to add.

 16: http://www.milliways.fr/2008/07/09/state-of-the-aptitude-week-7/

Neil Williams [17]reported about the status of Emdebian (for the ARM
architecture).

 17: http://lists.debian.org/debian-devel-announce/2008/07/msg00003.html

Olivier Berger informed us, that videos from two French speeches from
the 9th Libre Software Meeting by Debian Developer Lucas Nussbaum on
the topics [18]Why and how to make a first contribution to Debian and
[19]Debianâs production process and infrastructure are available.

 18: http://2008.rmll.info/Making-a-first-contribution-to.html
 19: http://2008.rmll.info/Debian-distribution-s-production.html

Martin Borgert [20]asked for updates and [21]new translations of the
Debian reference card.

 20: http://lists.debian.org/debian-doc/2008/07/msg00039.html
 21: http://lists.debian.org/debian-doc/2008/07/msg00078.html

Bastian Venthur [22]released version 1.0 of reportbug-ng a graphical
front end to report bugs to the Debian bug tracking system.

 22: http://blog.venthur.de/2008/07/19/rng-10-in-unstable/

Starting with the next release, [23]rsyslog will be the [24]preferred
system logging daemon, replacing [25]syslogd and [26]klogd.

 23: http://packages.debian.org/rsyslog
 24: http://lists.debian.org/debian-release/2008/07/msg00259.html
 25: http://packages.debian.org/sysklogd
 26: http://packages.debian.org/klogd

Patrick Schoenfeld [27]called for testers of the mantis package.

 27: http://lists.debian.org/debian-user/2008/07/msg01050.html

Christian Perrier [28]kindly asks package maintainers changing debconf
templates, which are used to ask questions during the configuration of
a package, to coordinate with translators.

 28: http://www.perrier.eu.org/weblog/2008/07/15#anti-l10n-cabal

Thijs Kinkhorst [29]noted, that he renamed the [30]msttcorefonts
package to [31]ttf-mscorefonts-installer. He also notes, that they
continue to [32]loose relevance, since it's often possible to replace
them them with the fonts supplied by the [33]ttf-liberation package.

 29: http://loeki.tv/log/archives/86-msttcorefonts-renamed-and-losing-relevance.html
 30: http://packages.debian.org/msttcorefonts
 31: http://packages.debian.org/ttf-mscorefonts-installer
 32: http://people.debian.org/~igloo/popcon-graphs/index.php?packages=ttf-liberation
 33: http://packages.debian.org/ttf-liberation

Important Debian Security Advisories

Debian's Security Team released among others advisories for the
packages [34]bind9, [35]bind8, [36]DNS vulnerability through glibc,
[37]poppler, [38]Iceweasel, [39]MySQL, [40]Gaim and [41]ruby1.8. Please
read them carefully and take the proper measures.

 34: http://www.debian.org/security/2008/dsa-1603
 35: http://www.debian.org/security/2008/dsa-1604
 36: http://www.debian.org/security/2008/dsa-1605
 37: http://www.debian.org/security/2008/dsa-1606
 38: http://www.debian.org/security/2008/dsa-1607
 39: http://www.debian.org/security/2008/dsa-1608
 40: http://www.debian.org/security/2008/dsa-1610
 41: http://www.debian.org/security/2008/dsa-1612

Please note that those are only the most important security advisories
of the last two weeks. If you would like to kept up to date about the
security advisories released by the Debian Security Team, please
subscribe to [42]our mailing list for security announcements.

 42: http://lists.debian.org/debian-security-announce/

Work-needing packages

Currently 486 packages are orphaned and 123 packages are up for
adoption. Please take a look at the [43]recent [44]reports to see if
there are packages you are interested in or view the complete archive
of packages requesting [45]help.

 43: http://lists.debian.org/debian-devel/2008/07/msg00309.html
 44: http://lists.debian.org/debian-devel/2008/07/msg00595.html
 45: http://www.debian.org/devel/wnpp/help_requested

Want to continue reading DPN? Please help us create this newsletter. We
still need more volunteer writers who watch the Debian community and
report about what is going on. Please see our [46]"HOWTO contribute"
page to find out how to help. We're looking forward to receiving your
mail at [47]debian-publicity <at> lists.debian.org.

 46: http://wiki.debian.org/ProjectNews/HowToContribute
 47: mailto:debian-publicity <at> lists.debian.org

This issue of Debian Project News was edited by Meike Reichle and
Alexander Reichle-Schmehl.

PS: As a personal note, we - Meike and Alexander - would like to thank
everyone for their greetings, congratulations and nice mails after our
appearance in the previous issue of the Debian Project News.
Many thanks!