Re: Security issue in groovy<2.5.0

[Felix Natter <fnatter@gmx.net>]

殷啟聰 | Kai-Chung Yan <seamlikok@gmail.com> writes:

> Hello Natter,

hi Kai,
thanks for the reply.

s/Natter/Felix/g ;-) (my first name is Felix)

> Since it's just one commit, I suggest you put it as a patch in
> `debian/patches`. When someone is updating the package to 2.5.0, she
> can just remove it.

There is already a 2.4.8-2 in the git pipeline (unreleased) by Miguel
Landaeta (CC):
  https://anonscm.debian.org/cgit/pkg-java/groovy.git

In the corresponding bug for 2.4.8-2 (#871857) Miguel says:

"I removed myself from uploaders list and prepared a tentative QA upload
but I didn't upload it to the archive since the resulting package would
be in violation of Debian Policy (§3.3 and §5.6.3). I'd appreciate if
somebody else can step in as maintainer."

Policy §5.6.3 says:
"This is normally an optional field, but if the Maintainer control field
names a group of people and a shared email address, the Uploaders field
must be present and must contain at least one human with their personal
email address."

--> groovy currently only has:
  Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
 (no Uploader:)
which seems to violate §5.6.3. So how can we make a policy-compliant
team upload without becoming maintainer (I'd like to avoid taking over
groovy maintainership if possible)?

Shall we set
  Maintainer: Debian QA Group <packages@qa.debian.org>
according to Policy §3.3, even if we usually do team uploads?

Other than that: @Miguel, @Emmanuel, @Kai: do you agree to make a simple
2.4.8-2 release with Miguel's changes only adding that patch?

Thanks and Best Regards,
-- 
Felix Natter
debian/rules!