Debian LTS and ELTS - March 2025

[Sylvain Beucler <beuc@beuc.net>]

Here is my public monthly report.

Thanks to our sponsors for making this possible, and to Freexian for
handling the offering.
https://www.freexian.com/lts/debian/#sponsors


LTS

- openvpn review
  - Continue reviewing proposed update by @aquilamacedo
    https://salsa.debian.org/debian/openvpn/-/merge_requests/14
  - DLA 4079-1
    https://lists.debian.org/debian-lts-announce/2025/03/msg00005.html

- Horde & CKEditor
  - ckeditor3 is EOL, but the Horde suite still depends on it.
    Additionally the Horde suite development slowed down.
  - Coordinate with package maintainers
    https://lists.debian.org/debian-lts/2025/03/msg00011.html
    https://lists.debian.org/debian-lts/2025/03/msg00012.html
    https://lists.debian.org/debian-lts/2025/03/msg00015.html
  - Setup Horde IMP (webmail) test environments for all Debian dists,
    and improve upon Bastien's proposed fix to upgrade to ckeditor[v4]
    https://salsa.debian.org/horde-team/php-horde-editor/-/merge_requests/1
    Non-maintainer upload to unstable and Debian Salsa.
  - Request virtuoso-opensource to drop ckeditor3 so we can remove it
    https://bugs.debian.org/1101019
  - Tidy BTS entries for php-horde*, grade PHP8-related bugs grave
  - Suggest removing php-horde* from bookworm, where it suffers
    incompatibility with PHP8. Sadly this represents 121 packages and
    probably won't be practical for the Release Team and FTP Masters:
    https://bugs.debian.org/1101047
  - Add php-horde ecosystem to security-support-ended.12
    https://salsa.debian.org/debian/debian-security-support/-/merge_requests/37


ELTS

- python2.7
  - Take over pending update from Bastien and Stefano
  - Review changes, improve documentation, finalize fixes
  - Many test suite fixes; fix Salsa-CI builds and test suite runs
  - Fix remaining open CVEs; in particular:
    CVE-2024-11168: report issues to OpenSuSE; exchange about their approach
    https://github.com/python/cpython/issues/103848#issuecomment-2706746403
  - Replicate all changes to buster, stretch and jessie
  - Report ci.freexian.com general issues on armhf architecture
  - ELA-1347-1, ELA-1348-1 and ELA-1349-1
    https://www.freexian.com/lts/extended/updates/ela-1347-1-python2.7/
    https://www.freexian.com/lts/extended/updates/ela-1348-1-python2.7/
    https://www.freexian.com/lts/extended/updates/ela-1349-1-python2.7/
  - Help identify a regression in python-django's testsuite, and
    ensure it runs automatically in Freexian CI next time

- pypy
  - Follow-up from last month
  - Porting above fixes from python2.7 (7 CVEs)
  - Attempt to fix CVE-2024-0397 but mysterious crashes turn out too
    time consuming to debug, and make the change too risky
  - Fix SSL test suite
    Attempt to fix Salsa-CI on armhf, but there is generally a lack of
    support for aarch64 in this pypy version
  - ELA-1350-1 for pypy
    https://www.freexian.com/lts/extended/updates/ela-1350-1-pypy/

- Drop packages from our work queue that are now out of support

- Identify and alert about stuck dnsmasq/stretch upload (ELA-1331-1)


Documentation and tooling

- LTS Documentation docs

  - TestSuites
    - autopkgtest: troubleshooting, important options, full VM example
      https://lts-team.pages.debian.net/wiki/TestSuites/autopkgtest.html
    - openvpn: new page, basic 2-nodes tests
      https://lts-team.pages.debian.net/wiki/TestSuites/openvpn.html
    - pypy: reference build issue, more examples, identify pypy stdlib
      https://lts-team.pages.debian.net/wiki/TestSuites/pypy.html
    - python2: testsuite status and configuration, external supported
      versions, more examples, how to manually test python-django
      https://lts-team.pages.debian.net/wiki/TestSuites/python2.html
    - php-horde: installation and work-arounds buster, current status
      https://lts-team.pages.debian.net/wiki/TestSuites/horde.html
      https://wiki.debian.org/Horde
    - golang: finish last month's review for updated guidelines
      https://salsa.debian.org/lts-team/lts-team.pages.debian.net/-/merge_requests/16
      https://lts-team.pages.debian.net/wiki/TestSuites/golang.html
      https://wiki.debian.org/StaticLinking#Go
    - Reference new emacs24 entry, and fix missing references in our
      internal packages.yml database

  - Development: reference alternative for preparing binary patches
    https://lts-team.pages.debian.net/wiki/Development.html#prepare-the-update

- Internal documentation:
  - ELTS Front-Desk: refresh documentation, detail bin/related-cves.py
  - Upload procedure: check proper package publication before issuing
    the ELA

- Help around on lists and IRC

- IRC Meeting
  https://meetbot.debian.net/debian-lts/2025/debian-lts.2025-03-27-14.00.html

-- 
Sylvain Beucler
Debian LTS Team