Debian Contributions: 2024-06
Contributing to Debian is part of Freexian’s mission. This article covers the latest achievements of Freexian and their collaborators. All of this is made possible by organizations subscribing to our Long Term Support contracts and consulting services.
YubiHSM packaging, by Colin Watson
Freexian is starting to use YubiHSM devices (hardware security modules)
as part of some projects, and we wanted to have the supporting software
directly in Debian rather than needing to use third-party repositories.
Since Yubico publish everything we need under free software licences,
Colin packaged yubihsm-connector, yubihsm-shell, and
python-yubihsm from
https://developers.yubico.com/, in
some cases based partly on the upstream packaging, and got them all into
Debian unstable.
Backports to bookworm will be forthcoming once they’ve all reached
testing.
unschroot by Helmut Grohne
Following an in-person discussion at MiniDebConf Berlin, Helmut
attempted splitting the containment functionality of sbuild --chroot-mode=unshare into a dedicated tool interfacing with sbuild
as a variant of --chroot-mode=schroot providing a sufficiently
compatible
interface.
While this seemed technically promising initially, a discussion on
debian-devel
indicated a desire to rely on an existing container runtime such as
podman instead of using another Debian-specific tool with unclear long
term maintenance.
None of the existing container runtimes meet the specific needs of
sbuild, so further advancing this matter implies a compromise one way
or another.
Linux live-patching, by Santiago Ruano Rincón
In collaboration with Emmanuel Arias, Santiago is working on the development of linux live-patching for Debian. For the moment, this is in an exploratory phase, that includes how to handle the different patches that will need to be provided. kpatch could help significantly in this regard. However, kpatch was removed from unstable because there are some RC bugs affecting the version that was present in Debian unstable. Santiago packaged the most recent upstream version (0.9.9) and filed an Intent to Salvage bug. Santiago is waiting for an ACK by the maintainer, and will upload to unstable after July 10th, following the package salvaging rules. While kpatch 0.9.9 fixes the main issues, it still needs some work to properly support Debian and the Linux kernel versions packaged in our distribution. More on this in the report next month.
Salsa CI, by Santiago Ruano Rincón
The work by Santiago in Salsa CI this month includes a merge request to ease testing how the production images are built from the changes introduced by future merge requests. By default, the pipelines triggered by a merge request build a subset of the images built for production, to reduce the use of resources, and because most of the time the subset of staging images is enough to test the proposed modifications. However, sometimes it is needed to test how the full set of production images is built, and the above mentioned MR helps to do that. The changes include documentation, so hopefully this will make it easier to test future contributions.
Also, for being able to include support for RISC-V, Salsa CI needs to replace kaniko as the tool used to build the images. Santiago tested buildah, but there are some issues when pushing built images for non-default platform architectures (i386, armhf, armel) to the container registry. Santiago will continue to work on this to find a solution.
Miscellaneous contributions
- Stefano Rivera prepared updates for a number of Python modules.
- Stefano uploaded the latest point release of Python 3.12 and the latest Python 3.13 beta. Both uncovered upstream regressions that had to be addressed.
- Stefano worked on preparations for DebConf 24.
- Stefano helped SPI to reconcile their financial records for DebConf 23.
- Colin did his usual routine work on the Python team, upgrading 36
packages to new upstream versions (including fixes for four CVEs in
python-aiohttp), fixing RC bugs inipykernel,ipywidgets,khard, andpython-repoze.sphinx.autointerface, and packagingzope.deferredimportwhich was needed for a new upstream version ofpython-persistent. - Colin removed the
user_readenvoption from OpenSSH’s PAM configuration (#1018260), and prepared a release note. - Thorsten Alteholz uploaded a new upstream version of
cups. - Nicholas Skaggs updated xmacro to support reproducible builds (#1014428), DEP-3 and DEP-5 compatibility, along with utilizing hardening build flags. Helmut supported and uploaded package.
- As a result of
loginhaving become non-essential, Helmut uploadeddebvmto unstable and stable and fixed a crossqa.debian.net worker. - Santiago worked on the Content Team activities for DebConf24. Together with other DebConf25 team members, Santiago wrote a document for the head of the venue to describe the project of the conference.