Your message dated Sat, 07 Oct 2017 11:33:55 +0100 with message-id <1507372435.18586.64.camel@adam-barratt.org.uk> and subject line Closing bugs for 9.2 point release has caused the Debian Bug report #873061, regarding stretch-pu: package dnsviz/0.6.4-1+deb9u1 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 873061: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=873061 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: stretch-pu: package dnsviz/0.6.4-1+deb9u1
- From: Ondřej Surý <ondrej@debian.org>
- Date: Thu, 24 Aug 2017 09:31:05 +0200
- Message-id: <150355986584.16160.11112419993653349658.reportbug@lettie.labs.nic.cz>
Package: release.debian.org Severity: normal Tags: stretch User: release.debian.org@packages.debian.org Usertags: pu Dear release team, this is another package in series KSK-2017 RZ DNSKEY rollover. I pulled couple of patches from upstream git in between 0.6.4..0.6.6 release and the other option might just be to update to 0.6.6, because the only thing left is basically some cosmetic changes + python3 compatibility we don't use yet. Anyway this update add following upstream patches: 0001-Check-for-invalid-ECDSA-key.patch - Adds extra checks for invalid ECDSA keys 0002-Add-IPv6-address-for-G-root.patch 0007-Update-b-root-IPv6-address.patch 0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch - root.hints updates related to the recent changes in the IP addresses of root servers 0004-Use-correct-constant-name.patch - bugfix for a contact name 0005-Remove-the-interface-from-link-local-addresses.patch - Removes link-local addresses from the list 0006-Add-newline.patch - Cosmetic for output 0009-Handle-root-KSK-rollover.patch 0010-Correct-trust-anchor-errors.patch - This is the KSK-2017 related changes Cheers, Ondrej -- System Information: Debian Release: 9.1 APT prefers stable APT policy: (990, 'stable'), (500, 'unstable-debug'), (500, 'stable-debug'), (500, 'unstable'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.4.0-83-generic (SMP w/8 CPU cores) Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8), LANGUAGE=en_DK.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 3.0 (quilt) Source: dnsviz Binary: dnsviz Architecture: all Version: 0.6.4-1+deb9u1 Maintainer: Debian DNS Maintainers <pkg-dns-devel@lists.alioth.debian.org> Uploaders: Robert Edmonds <edmonds@debian.org>, Ondřej Surý <ondrej@debian.org> Homepage: https://github.com/dnsviz/dnsviz Standards-Version: 3.9.8 Vcs-Browser: https://anonscm.debian.org/cgit/pkg-dns/dnsviz.git/ Vcs-Git: git://anonscm.debian.org/pkg-dns/dnsviz.git Build-Depends: debhelper (>= 9~), dh-python, inkscape, python (>= 2.7~), python-dnspython (>= 1.11.0~), python-m2crypto (>= 0.24.0~), python-pygraphviz (>= 1.1~) Package-List: dnsviz deb net optional arch=all Checksums-Sha1: ef64d0ba7afd4062edd64a9ec4f79c5a91543815 233769 dnsviz_0.6.4.orig.tar.gz caf5f1fc86465b73c51f07a5f56e44c5cc1824dd 12976 dnsviz_0.6.4-1+deb9u1.debian.tar.gz Checksums-Sha256: 900a81e94908405697753c1b714995985b366df9a45c9068f7864274d7821176 233769 dnsviz_0.6.4.orig.tar.gz dfa1c6a7bdccc5d929c77a5cbd76d2a0f28aae49cc3648c9755ce405ca5df08a 12976 dnsviz_0.6.4-1+deb9u1.debian.tar.gz Files: 317c3ca1396fa0d6c75c5a22725f53ce 233769 dnsviz_0.6.4.orig.tar.gz 3aaa2caab3bd220a52dbfcf0dd608cad 12976 dnsviz_0.6.4-1+deb9u1.debian.tar.gz -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEMLkz2A/OPZgaLTj7DJm3DvT8uwcFAlmef4hfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDMw QjkzM0Q4MEZDRTNEOTgxQTJEMzhGQjBDOTlCNzBFRjRGQ0JCMDcACgkQDJm3DvT8 uwfpnhAA2icQLzIxXEbXWNdcU11O9dIktey9eM6ERu8o4AcLttv1LDWHKEWyZ4/B RsP9+flUcKv0zCueriJMaqfZduYPvT4XjaO1TVOtHt6jAvDfPyMV7zhIdIX3gu2W l/DJyKLqXai8pOwRXbcvDsEUOeA1uH6/5kFkKV/ogWv1SlKa4t+H47yad02bguqH E7LFPQI4q6/nBDmXk+3p9Owqk8+cy/qKqvIDUdkYI/SpoVO8bNG1stZJkU+6l/sN TYqjBrAtkvpZ6y/q8sH+hdc46HGXnzG2Sk3iBQYPZFLK+nJzh3HI2VoRx13lcNQY cH6aC/q/II8xudSEdPSNeWHhJt5QiXJlO3ean7QuTukwNQBDdnvm5w+Y5UlGPBfS USTD2NSlbR1hlflfvowiv6knFVfrrl1CGvosyYBw5wKtm85QZjjKK0kOJKcC2Rwq xuzXCHaDiiEdLX1iYV1V0wezI8Ip9QxEtcv+hjjTfM6F6lnjBauPoLQhwdXF3uVn I2O2Zxj9vTbyGv5JjvokjZIui/UJ3hdwmX5ZghNz12SAM6bRGJ6L/RbvjxEEcUj9 9NtypfBgr9NEs4MfrKYV3oxNq1kTfUDFZ3g+p1qeL9jpii3EDVgdSovbr599iZER Z4v+kVMrjLmroUFpSbMMY9c6pYNOj5BaL/Sro2tIefhuoO1rerQ= =c9ZU -----END PGP SIGNATURE-----Attachment: dnsviz_0.6.4-1+deb9u1.debian.tar.gz
Description: application/gzipdiff -Nru dnsviz-0.6.4/debian/changelog dnsviz-0.6.4/debian/changelog --- dnsviz-0.6.4/debian/changelog 2016-11-01 15:19:12.000000000 +0100 +++ dnsviz-0.6.4/debian/changelog 2017-08-24 08:32:18.000000000 +0200 @@ -1,3 +1,10 @@ +dnsviz (0.6.4-1+deb9u1) stretch-updates; urgency=medium + + * Cherry-pick upstream fixes related to root.hints and root.keys changes + * Update gbp.conf for debian/stretch branch + + -- Ondřej Surý <ondrej@debian.org> Thu, 24 Aug 2017 08:32:18 +0200 + dnsviz (0.6.4-1) unstable; urgency=medium * Imported upstream version 0.6.4 diff -Nru dnsviz-0.6.4/debian/gbp.conf dnsviz-0.6.4/debian/gbp.conf --- dnsviz-0.6.4/debian/gbp.conf 2016-11-01 15:19:12.000000000 +0100 +++ dnsviz-0.6.4/debian/gbp.conf 2017-08-24 08:32:18.000000000 +0200 @@ -1,5 +1,5 @@ [DEFAULT] -debian-branch = debian/sid +debian-branch = debian/stretch [buildpackage] pristine-tar = True diff -Nru dnsviz-0.6.4/debian/patches/0001-Check-for-invalid-ECDSA-key.patch dnsviz-0.6.4/debian/patches/0001-Check-for-invalid-ECDSA-key.patch --- dnsviz-0.6.4/debian/patches/0001-Check-for-invalid-ECDSA-key.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0001-Check-for-invalid-ECDSA-key.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,36 @@ +From: Casey Deccio <casey@deccio.net> +Date: Wed, 9 Nov 2016 08:53:18 -0700 +Subject: Check for invalid ECDSA key + +(cherry picked from commit d953c7c6756390a9c8a8a4f207b96d501a5be71d) +--- + dnsviz/crypto.py | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/dnsviz/crypto.py b/dnsviz/crypto.py +index ee4978c..9e502f4 100644 +--- a/dnsviz/crypto.py ++++ b/dnsviz/crypto.py +@@ -244,7 +244,10 @@ def _dnskey_to_ec(alg, key): + else: + raise ValueError('Algorithm not supported') + +- return EC.pub_key_from_params(curve, EC_NOCOMPRESSION + key) ++ try: ++ return EC.pub_key_from_params(curve, EC_NOCOMPRESSION + key) ++ except ValueError: ++ return None + + def _validate_rrsig_rsa(alg, sig, msg, key): + pubkey = _dnskey_to_rsa(key) +@@ -314,6 +317,10 @@ def _validate_rrsig_gost(alg, sig, msg, key): + def _validate_rrsig_ec(alg, sig, msg, key): + pubkey = _dnskey_to_ec(alg, key) + ++ # if the key is invalid, then the signature is also invalid ++ if pubkey is None: ++ return False ++ + if alg in (13,): + alg='sha256' + sigsize = 64 diff -Nru dnsviz-0.6.4/debian/patches/0002-Add-IPv6-address-for-G-root.patch dnsviz-0.6.4/debian/patches/0002-Add-IPv6-address-for-G-root.patch --- dnsviz-0.6.4/debian/patches/0002-Add-IPv6-address-for-G-root.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0002-Add-IPv6-address-for-G-root.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,45 @@ +From: Casey Deccio <casey@deccio.net> +Date: Thu, 17 Nov 2016 08:54:11 -0800 +Subject: Add IPv6 address for G-root + +(cherry picked from commit 406e5e1073f684f9e069ca7e85bda18a9875a791) +--- + dnsviz/util.py | 1 + + share/hints/named.root | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/dnsviz/util.py b/dnsviz/util.py +index 83d74c0..2f2c744 100644 +--- a/dnsviz/util.py ++++ b/dnsviz/util.py +@@ -66,6 +66,7 @@ F.ROOT-SERVERS.NET. 3600000 A 192.5.5.241 + F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f + . 3600000 NS G.ROOT-SERVERS.NET. + G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 ++G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d + . 3600000 NS H.ROOT-SERVERS.NET. + H.ROOT-SERVERS.NET. 3600000 A 198.97.190.53 + H.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:1::53 +diff --git a/share/hints/named.root b/share/hints/named.root +index 805aded..231cb2a 100644 +--- a/share/hints/named.root ++++ b/share/hints/named.root +@@ -9,8 +9,8 @@ + ; on server FTP.INTERNIC.NET + ; -OR- RS.INTERNIC.NET + ; +-; last update: August 25, 2016 +-; related version of root zone: 2016082500 ++; last update: October 20, 2016 ++; related version of root zone: 2016102001 + ; + ; formerly NS.INTERNIC.NET + ; +@@ -52,6 +52,7 @@ F.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2f::f + ; + . 3600000 NS G.ROOT-SERVERS.NET. + G.ROOT-SERVERS.NET. 3600000 A 192.112.36.4 ++G.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:12::d0d + ; + ; FORMERLY AOS.ARL.ARMY.MIL + ; diff -Nru dnsviz-0.6.4/debian/patches/0003-Fix-python3-compatibility-issue-with-dnspython-1.15..patch dnsviz-0.6.4/debian/patches/0003-Fix-python3-compatibility-issue-with-dnspython-1.15..patch --- dnsviz-0.6.4/debian/patches/0003-Fix-python3-compatibility-issue-with-dnspython-1.15..patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0003-Fix-python3-compatibility-issue-with-dnspython-1.15..patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,25 @@ +From: Casey Deccio <casey@deccio.net> +Date: Wed, 21 Dec 2016 14:28:42 -0700 +Subject: Fix python3 compatibility issue with dnspython 1.15.0 release + +(cherry picked from commit 0105b679e8b6311bbc7455a9d7f46ca66037bb43) +--- + dnsviz/format.py | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/dnsviz/format.py b/dnsviz/format.py +index db179cf..0067a67 100644 +--- a/dnsviz/format.py ++++ b/dnsviz/format.py +@@ -168,5 +168,10 @@ def humanize_name(name, idn=False): + return name.rstrip('.') + + def latin1_binary_to_string(s): +- return codecs.decode(s, 'latin1') ++ # python3/python2 dual compatibility ++ #XXX In places where this method wraps calls to dns.name.Name.to_text(), ++ # this is no longer needed with dnspython 1.15.0 ++ if isinstance(s, bytes): ++ return codecs.decode(s, 'latin1') ++ return s + lb2s = latin1_binary_to_string diff -Nru dnsviz-0.6.4/debian/patches/0004-Use-correct-constant-name.patch dnsviz-0.6.4/debian/patches/0004-Use-correct-constant-name.patch --- dnsviz-0.6.4/debian/patches/0004-Use-correct-constant-name.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0004-Use-correct-constant-name.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,21 @@ +From: Casey Deccio <casey@deccio.net> +Date: Thu, 5 Jan 2017 13:13:14 -0700 +Subject: Use correct constant name + +--- + dnsviz/analysis/offline.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/dnsviz/analysis/offline.py b/dnsviz/analysis/offline.py +index 62ea30f..9d27dfb 100644 +--- a/dnsviz/analysis/offline.py ++++ b/dnsviz/analysis/offline.py +@@ -503,7 +503,7 @@ class OfflineDomainNameAnalysis(OnlineDomainNameAnalysis): + if self.response_component_status is not None: + zone_status = Status.delegation_status_mapping[self.response_component_status[parent_obj]] + else: +- zone_status = Status.delegation_status_mapping[Status.INSECURE] ++ zone_status = Status.delegation_status_mapping[Status.DELEGATION_STATUS_INSECURE] + zone_warnings = [w.terse_description for w in parent_obj.zone_warnings] + zone_errors = [e.terse_description for e in parent_obj.zone_errors] + if parent_obj.parent is not None: diff -Nru dnsviz-0.6.4/debian/patches/0005-Remove-the-interface-from-link-local-addresses.patch dnsviz-0.6.4/debian/patches/0005-Remove-the-interface-from-link-local-addresses.patch --- dnsviz-0.6.4/debian/patches/0005-Remove-the-interface-from-link-local-addresses.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0005-Remove-the-interface-from-link-local-addresses.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,33 @@ +From: Casey Deccio <casey@deccio.net> +Date: Tue, 11 Apr 2017 13:42:59 -0600 +Subject: Remove the interface from link-local addresses + +--- + dnsviz/ipaddr.py | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/dnsviz/ipaddr.py b/dnsviz/ipaddr.py +index 18a4e9a..d712aed 100644 +--- a/dnsviz/ipaddr.py ++++ b/dnsviz/ipaddr.py +@@ -25,6 +25,8 @@ import codecs + import re + import socket + ++INTERFACE_RE = re.compile(r'%[a-z0-9]+$') ++ + class IPAddr(str): + def __new__(cls, string): + # python 2/3 compatibility +@@ -33,9 +35,11 @@ class IPAddr(str): + if ':' in string: + af = socket.AF_INET6 + vers = 6 ++ string = INTERFACE_RE.sub('', string) + else: + af = socket.AF_INET + vers = 4 ++ + try: + ipaddr_bytes = socket.inet_pton(af, string) + except socket.error: diff -Nru dnsviz-0.6.4/debian/patches/0006-Add-newline.patch dnsviz-0.6.4/debian/patches/0006-Add-newline.patch --- dnsviz-0.6.4/debian/patches/0006-Add-newline.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0006-Add-newline.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,22 @@ +From: Casey Deccio <casey@deccio.net> +Date: Thu, 13 Apr 2017 23:08:55 -0600 +Subject: Add newline + +(cherry picked from commit 8b0c434660fbf6471df1bb15b203def886aaa808) +--- + contrib/digviz | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/contrib/digviz b/contrib/digviz +index aadb66e..3f3a656 100755 +--- a/contrib/digviz ++++ b/contrib/digviz +@@ -348,7 +348,7 @@ class DigCommandLineQuery: + + def display(self, response, server, options): + if response is None: +- return ';; no servers were queried' ++ return ';; no servers were queried\n' + + elif response.message is not None: + if self.short: diff -Nru dnsviz-0.6.4/debian/patches/0007-Update-b-root-IPv6-address.patch dnsviz-0.6.4/debian/patches/0007-Update-b-root-IPv6-address.patch --- dnsviz-0.6.4/debian/patches/0007-Update-b-root-IPv6-address.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0007-Update-b-root-IPv6-address.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,47 @@ +From: Casey Deccio <casey@deccio.net> +Date: Tue, 6 Jun 2017 15:57:46 -0700 +Subject: Update b-root IPv6 address + +(cherry picked from commit 2c77cf4875ede26b3e6cfea745048a6b072dab10) +--- + dnsviz/util.py | 2 +- + share/hints/named.root | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/dnsviz/util.py b/dnsviz/util.py +index 2f2c744..bb6e52f 100644 +--- a/dnsviz/util.py ++++ b/dnsviz/util.py +@@ -51,7 +51,7 @@ A.ROOT-SERVERS.NET. 3600000 A 198.41.0.4 + A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 + . 3600000 NS B.ROOT-SERVERS.NET. + B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201 +-B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:84::b ++B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b + . 3600000 NS C.ROOT-SERVERS.NET. + C.ROOT-SERVERS.NET. 3600000 A 192.33.4.12 + C.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:2::c +diff --git a/share/hints/named.root b/share/hints/named.root +index 231cb2a..088f7cc 100644 +--- a/share/hints/named.root ++++ b/share/hints/named.root +@@ -9,8 +9,8 @@ + ; on server FTP.INTERNIC.NET + ; -OR- RS.INTERNIC.NET + ; +-; last update: October 20, 2016 +-; related version of root zone: 2016102001 ++; last update: June 01, 2017 ++; related version of root zone: 2017060102 + ; + ; formerly NS.INTERNIC.NET + ; +@@ -22,7 +22,7 @@ A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 + ; + . 3600000 NS B.ROOT-SERVERS.NET. + B.ROOT-SERVERS.NET. 3600000 A 192.228.79.201 +-B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:84::b ++B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b + ; + ; FORMERLY C.PSI.NET + ; diff -Nru dnsviz-0.6.4/debian/patches/0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch dnsviz-0.6.4/debian/patches/0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch --- dnsviz-0.6.4/debian/patches/0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,77 @@ +From: Casey Deccio <casey@deccio.net> +Date: Wed, 7 Jun 2017 00:48:28 -0700 +Subject: Use root hints for IP-to-name mapping of root + +Use root hints and historical root IP addresses for IP-to-name mapping +of root. Sometimes a domain was analyzed with old hints files, and when +translating the IP address to name, there is no way to match the +obsolete IP address with a name. Using the root hints and the +historical root addresses helps with this issue. + +(cherry picked from commit f9266de17fe09fcdbdd4874bfca85abdb726cf15) +--- + dnsviz/analysis/online.py | 26 +++++++++++++++++++++++++- + dnsviz/util.py | 6 ++++++ + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/dnsviz/analysis/online.py b/dnsviz/analysis/online.py +index 1827402..663dc6c 100644 +--- a/dnsviz/analysis/online.py ++++ b/dnsviz/analysis/online.py +@@ -496,6 +496,27 @@ class OnlineDomainNameAnalysis(object): + + return self._glue_ip_mapping + ++ def get_root_hint_mapping(self): ++ servers = {} ++ hints = util.get_root_hints() ++ for rdata in hints[(dns.name.root, dns.rdatatype.NS)]: ++ servers[rdata.target] = set() ++ for rdtype in (dns.rdatatype.A, dns.rdatatype.AAAA): ++ if (rdata.target, rdtype) in hints: ++ servers[rdata.target].update([IPAddr(r.address) for r in hints[(rdata.target, rdtype)]]) ++ for name, server in util.HISTORICAL_ROOT_IPS: ++ if name not in servers: ++ servers[name] = set() ++ servers[name].add(server) ++ return servers ++ ++ def _get_servers_from_hints(self, name, hints): ++ servers = set() ++ server_mapping = self._get_server_ip_mapping_from_hints(name, hints) ++ for ns_name in server_mapping: ++ servers.update(server_mapping[ns_name]) ++ return servers ++ + def get_auth_ns_ip_mapping(self): + '''Return a reference to the mapping of NS targets from delegation or + authoritative source to their authoritative IPv4 and IPv6 addresses.''' +@@ -667,7 +688,10 @@ class OnlineDomainNameAnalysis(object): + + if not hasattr(self, '_ip_ns_name_mapping') or self._ip_ns_name_mapping is None: + self._ip_ns_name_mapping = {} +- glue_ips = self.get_glue_ip_mapping() ++ if self.name == dns.name.root: ++ glue_ips = self.get_root_hint_mapping() ++ else: ++ glue_ips = self.get_glue_ip_mapping() + auth_ips = self.get_auth_ns_ip_mapping() + if self.stub: + auth_names = set(auth_ips) +diff --git a/dnsviz/util.py b/dnsviz/util.py +index bb6e52f..668b527 100644 +--- a/dnsviz/util.py ++++ b/dnsviz/util.py +@@ -87,6 +87,12 @@ M.ROOT-SERVERS.NET. 3600000 A 202.12.27.33 + M.ROOT-SERVERS.NET. 3600000 AAAA 2001:dc3::35 + ''' + ++HISTORICAL_ROOT_IPS = ( ++ (dns.name.from_text('h.root-servers.net.'), IPAddr('2001:500:1::803f:235')), # December 1, 2015 ++ (dns.name.from_text('l.root-servers.net.'), IPAddr('2001:500:3::42')), # March 24, 2016 ++ (dns.name.from_text('b.root-servers.net.'), IPAddr('2001:500:84::b')), # June 1, 2017 ++) ++ + def tuple_to_dict(t): + d = {} + for n, v in t: diff -Nru dnsviz-0.6.4/debian/patches/0009-Handle-root-KSK-rollover.patch dnsviz-0.6.4/debian/patches/0009-Handle-root-KSK-rollover.patch --- dnsviz-0.6.4/debian/patches/0009-Handle-root-KSK-rollover.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0009-Handle-root-KSK-rollover.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,225 @@ +From: Casey Deccio <casey@deccio.net> +Date: Wed, 28 Jun 2017 15:42:30 -0600 +Subject: Handle root KSK rollover + +Keep track of both past and current trust anchors for the root zone. +Add new root KSK to trusted keys file root.txt, but don't actually use +the file directly anymore. Instead use the get_default_trusted_keys() +function. + +(cherry picked from commit ee03e5e351b528ddc069da7212ff54924b2e615f) +--- + dnsviz/commands/graph.py | 24 ++++++++++-------------- + dnsviz/commands/grok.py | 5 +++-- + dnsviz/commands/print.py | 24 ++++++++++-------------- + dnsviz/util.py | 36 +++++++++++++++++++++++++++++------- + share/trusted-keys/root.txt | 1 + + 5 files changed, 53 insertions(+), 37 deletions(-) + +diff --git a/dnsviz/commands/graph.py b/dnsviz/commands/graph.py +index 7af16da..c408d24 100644 +--- a/dnsviz/commands/graph.py ++++ b/dnsviz/commands/graph.py +@@ -36,7 +36,7 @@ import dns.exception, dns.name + from dnsviz.analysis import OfflineDomainNameAnalysis, DNS_RAW_VERSION + from dnsviz.config import DNSVIZ_SHARE_PATH, JQUERY_PATH, JQUERY_UI_PATH, JQUERY_UI_CSS_PATH, RAPHAEL_PATH + from dnsviz.format import latin1_binary_to_string as lb2s +-from dnsviz.util import TRUSTED_KEYS_ROOT, get_trusted_keys ++from dnsviz.util import get_trusted_keys, get_default_trusted_keys + + # If the import of DNSAuthGraph fails because of the lack of pygraphviz, it + # will be reported later +@@ -280,18 +280,7 @@ def main(argv): + else: + names.append(name) + +- if '-t' not in opts: +- try: +- tk_str = io.open(TRUSTED_KEYS_ROOT, 'r', encoding='utf-8').read() +- except IOError as e: +- logger.error('Error reading trusted keys file "%s": %s' % (TRUSTED_KEYS_ROOT, e.strerror)) +- sys.exit(3) +- try: +- trusted_keys.extend(get_trusted_keys(tk_str)) +- except dns.exception.DNSException: +- logger.error('There was an error parsing the trusted keys file: "%s"' % arg) +- sys.exit(3) +- ++ latest_analysis_date = None + name_objs = [] + cache = {} + for name in names: +@@ -299,11 +288,18 @@ def main(argv): + if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True): + logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text())) + continue +- name_objs.append(OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache)) ++ name_obj = OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache) ++ name_objs.append(name_obj) ++ ++ if latest_analysis_date is None or latest_analysis_date > name_obj.analysis_end: ++ latest_analysis_date = name_obj.analysis_end + + if not name_objs: + sys.exit(4) + ++ if '-t' not in opts: ++ trusted_keys = get_default_trusted_keys(latest_analysis_date) ++ + G = DNSAuthGraph() + for name_obj in name_objs: + name_obj.populate_status(trusted_keys) +diff --git a/dnsviz/commands/grok.py b/dnsviz/commands/grok.py +index 644f512..89823c5 100644 +--- a/dnsviz/commands/grok.py ++++ b/dnsviz/commands/grok.py +@@ -41,7 +41,7 @@ import dns.exception, dns.name + + from dnsviz.analysis import OfflineDomainNameAnalysis, DNS_RAW_VERSION + from dnsviz.format import latin1_binary_to_string as lb2s +-from dnsviz.util import TRUSTED_KEYS_ROOT, get_trusted_keys ++from dnsviz.util import get_trusted_keys + + # If the import of DNSAuthGraph fails because of the lack of pygraphviz, it + # will be reported later +@@ -316,7 +316,8 @@ def main(argv): + if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True): + logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text())) + continue +- name_objs.append(OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache)) ++ name_obj = OfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache) ++ name_objs.append(name_obj) + + if not name_objs: + sys.exit(4) +diff --git a/dnsviz/commands/print.py b/dnsviz/commands/print.py +index ad4ec65..0e39439 100644 +--- a/dnsviz/commands/print.py ++++ b/dnsviz/commands/print.py +@@ -35,7 +35,7 @@ import dns.exception, dns.name + + from dnsviz.analysis import TTLAgnosticOfflineDomainNameAnalysis, DNS_RAW_VERSION + from dnsviz.format import latin1_binary_to_string as lb2s +-from dnsviz.util import TRUSTED_KEYS_ROOT, get_trusted_keys ++from dnsviz.util import get_trusted_keys, get_default_trusted_keys + + # If the import of DNSAuthGraph fails because of the lack of pygraphviz, it + # will be reported later +@@ -430,18 +430,7 @@ def main(argv): + else: + names.append(name) + +- if '-t' not in opts: +- try: +- tk_str = io.open(TRUSTED_KEYS_ROOT, 'r', encoding='utf-8').read() +- except IOError as e: +- logger.error('Error reading trusted keys file "%s": %s' % (TRUSTED_KEYS_ROOT, e.strerror)) +- sys.exit(3) +- try: +- trusted_keys.extend(get_trusted_keys(tk_str)) +- except dns.exception.DNSException: +- logger.error('There was an error parsing the trusted keys file: "%s"' % arg) +- sys.exit(3) +- ++ latest_analysis_date = None + name_objs = [] + cache = {} + for name in names: +@@ -449,11 +438,18 @@ def main(argv): + if name_str not in analysis_structured or analysis_structured[name_str].get('stub', True): + logger.error('The analysis of "%s" was not found in the input.' % lb2s(name.to_text())) + continue +- name_objs.append(TTLAgnosticOfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache)) ++ name_obj = TTLAgnosticOfflineDomainNameAnalysis.deserialize(name, analysis_structured, cache) ++ name_objs.append(name_obj) ++ ++ if latest_analysis_date is None or latest_analysis_date > name_obj.analysis_end: ++ latest_analysis_date = name_obj.analysis_end + + if not name_objs: + sys.exit(4) + ++ if '-t' not in opts: ++ trusted_keys = get_default_trusted_keys(latest_analysis_date) ++ + G = DNSAuthGraph() + for name_obj in name_objs: + name_obj.populate_status(trusted_keys) +diff --git a/dnsviz/util.py b/dnsviz/util.py +index 668b527..9ea41ad 100644 +--- a/dnsviz/util.py ++++ b/dnsviz/util.py +@@ -27,18 +27,18 @@ + + from __future__ import unicode_literals + ++import datetime + import io + import os + import re + import socket + +-import dns.message, dns.rdatatype ++import dns.message, dns.name, dns.rdataclass, dns.rdatatype, dns.rrset + + from .config import DNSVIZ_SHARE_PATH + from . import format as fmt + from .ipaddr import IPAddr + +-TRUSTED_KEYS_ROOT = os.path.join(DNSVIZ_SHARE_PATH, 'trusted-keys', 'root.txt') + ROOT_HINTS = os.path.join(DNSVIZ_SHARE_PATH, 'hints', 'named.root') + + CR_RE = re.compile(r'\r\n', re.MULTILINE) +@@ -93,6 +93,25 @@ HISTORICAL_ROOT_IPS = ( + (dns.name.from_text('b.root-servers.net.'), IPAddr('2001:500:84::b')), # June 1, 2017 + ) + ++# The following list should include all current and historical trust anchors ++# for the root zone. This makes it possible to perform analysis of current DNS ++# responses, but also archived DNS responses. ++# ++# For each root zone trust anchor, the start value is the day it is first ++# published in the root zone. Even though the key is not yet signing, this ++# draws attention to the fact that it will be signing and likely replacing its ++# predecessor. The end value is (at least) the minimum of the TTL and the ++# expiration of its last published RRSIG. This allows us to query caches with ++# contents referring to the old key, even after its replacement has taken over. ++TRUSTED_KEYS_ROOT = ( ++ ('. IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0=', ++ datetime.datetime(2010, 7, 16, 0, 0, 0, 0, fmt.utc), ++ datetime.datetime(2017, 10, 15, 0, 0, 0, 0, fmt.utc)), ++ ('. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU=', ++ datetime.datetime(2017, 7, 12, 0, 0, 0, 0, fmt.utc), ++ None), ++) ++ + def tuple_to_dict(t): + d = {} + for n, v in t: +@@ -119,11 +138,14 @@ def get_trusted_keys(s): + + return trusted_keys + +-def get_default_trusted_keys(): +- try: +- tk_str = io.open(TRUSTED_KEYS_ROOT, 'r', encoding='utf-8').read() +- except IOError as e: +- return [] ++def get_default_trusted_keys(date): ++ tk_str = '' ++ for tk, start, end in TRUSTED_KEYS_ROOT: ++ if start is not None and date < start: ++ continue ++ if end is not None and date > end: ++ continue ++ tk_str += tk + '\n' + return get_trusted_keys(tk_str) + + def get_hints(s): +diff --git a/share/trusted-keys/root.txt b/share/trusted-keys/root.txt +index 7f25350..846682f 100644 +--- a/share/trusted-keys/root.txt ++++ b/share/trusted-keys/root.txt +@@ -1 +1,2 @@ + . IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0= ++. IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3 +/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kv ArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF 0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+e oZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfd RUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwN R1AkUTV74bU= diff -Nru dnsviz-0.6.4/debian/patches/0010-Correct-trust-anchor-errors.patch dnsviz-0.6.4/debian/patches/0010-Correct-trust-anchor-errors.patch --- dnsviz-0.6.4/debian/patches/0010-Correct-trust-anchor-errors.patch 1970-01-01 01:00:00.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/0010-Correct-trust-anchor-errors.patch 2017-08-24 08:32:18.000000000 +0200 @@ -0,0 +1,91 @@ +From: Casey Deccio <casey@deccio.net> +Date: Wed, 28 Jun 2017 16:00:36 -0600 +Subject: Correct trust anchor errors + +Errors associated with bad trust anchor configurations should show up as +zone errors, not problems with DNSKEYs. + +(cherry picked from commit cf7c7780c675f7dea243bc85ecaa11598cbfd7cc) +--- + dnsviz/analysis/errors.py | 14 +++++++++----- + dnsviz/analysis/offline.py | 18 ++++++------------ + 2 files changed, 15 insertions(+), 17 deletions(-) + +diff --git a/dnsviz/analysis/errors.py b/dnsviz/analysis/errors.py +index 06dcf84..691f88c 100644 +--- a/dnsviz/analysis/errors.py ++++ b/dnsviz/analysis/errors.py +@@ -1754,15 +1754,19 @@ class DNSKEYNotAtZoneApex(DNSKEYError): + code = 'DNSKEY_NOT_AT_ZONE_APEX' + required_params = ['zone', 'name'] + +-class TrustAnchorNotSigning(DNSKEYError): ++class TrustAnchorError(DomainNameAnalysisError): ++ pass ++ ++class NoTrustAnchorSigning(TrustAnchorError): + ''' +- >>> e = TrustAnchorNotSigning() ++ >>> e = NoTrustAnchorSigning(zone='foo.baz.') + >>> e.description +- 'The key was designated as a trust anchor but was not found signing the RRset.' ++ 'One or more keys were designated as trust anchors for foo.baz., but none were found signing the DNSKEY RRset.' + ''' + _abstract = False +- description_template = "The key was designated as a trust anchor but was not found signing the RRset." +- code = 'TRUST_ANCHOR_NOT_SIGNING' ++ description_template = "One or more keys were designated as trust anchors for %(zone)s, but none were found signing the DNSKEY RRset." ++ code = 'NO_TRUST_ANCHOR_SIGNING' ++ required_params = ['zone'] + + class RevokedNotSigning(DNSKEYError): + ''' +diff --git a/dnsviz/analysis/offline.py b/dnsviz/analysis/offline.py +index 9d27dfb..2a38a3d 100644 +--- a/dnsviz/analysis/offline.py ++++ b/dnsviz/analysis/offline.py +@@ -2133,8 +2133,7 @@ class OfflineDomainNameAnalysis(OnlineDomainNameAnalysis): + return + + trusted_keys_rdata = set([k for z, k in trusted_keys if z == self.name]) +- trusted_keys_existing = set() +- trusted_keys_not_self_signing = set() ++ trusted_keys_self_signing = set() + + # buid a list of responsive servers + bailiwick_map, default_bailiwick = self.get_bailiwick_mapping() +@@ -2146,10 +2145,8 @@ class OfflineDomainNameAnalysis(OnlineDomainNameAnalysis): + + # any errors point to their own servers_clients value + for dnskey in self.get_dnskeys(): +- if dnskey.rdata in trusted_keys_rdata: +- trusted_keys_existing.add(dnskey) +- if dnskey not in self.ksks: +- trusted_keys_not_self_signing.add(dnskey) ++ if dnskey.rdata in trusted_keys_rdata and dnskey in self.ksks: ++ trusted_keys_self_signing.add(dnskey) + if dnskey in self.revoked_keys and dnskey not in self.ksks: + err = Errors.RevokedNotSigning() + err.servers_clients = dnskey.servers_clients +@@ -2170,18 +2167,15 @@ class OfflineDomainNameAnalysis(OnlineDomainNameAnalysis): + # if the key is shown to be signing anything other than the + # DNSKEY RRset, or if it associated with a DS or trust anchor, + # then mark it as an error; otherwise, mark it as a warning. +- if dnskey in self.zsks or dnskey in self.dnskey_with_ds or dnskey in trusted_keys_existing: ++ if dnskey in self.zsks or dnskey in self.dnskey_with_ds or dnskey.rdata in trusted_keys_rdata: + dnskey.errors.append(err) + else: + dnskey.warnings.append(err) + for (server,client,response) in servers_clients_without: + err.add_server_client(server, client, response) + +- if not trusted_keys_existing.difference(trusted_keys_not_self_signing): +- for dnskey in trusted_keys_not_self_signing: +- err = Errors.TrustAnchorNotSigning() +- err.servers_clients = dnskey.servers_clients +- dnskey.errors.append(err) ++ if trusted_keys_rdata and not trusted_keys_self_signing: ++ self.zone_errors.append(Errors.NoTrustAnchorSigning(zone=fmt.humanize_name(self.zone.name))) + + def populate_response_component_status(self, G): + response_component_status = {} diff -Nru dnsviz-0.6.4/debian/patches/series dnsviz-0.6.4/debian/patches/series --- dnsviz-0.6.4/debian/patches/series 2016-11-01 15:19:12.000000000 +0100 +++ dnsviz-0.6.4/debian/patches/series 2017-08-24 08:32:18.000000000 +0200 @@ -1 +1,10 @@ +0001-Check-for-invalid-ECDSA-key.patch +0002-Add-IPv6-address-for-G-root.patch +0004-Use-correct-constant-name.patch +0005-Remove-the-interface-from-link-local-addresses.patch +0006-Add-newline.patch +0007-Update-b-root-IPv6-address.patch +0008-Use-root-hints-for-IP-to-name-mapping-of-root.patch +0009-Handle-root-KSK-rollover.patch +0010-Correct-trust-anchor-errors.patch debian-changes-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 24 Aug 2017 08:32:18 +0200 Source: dnsviz Binary: dnsviz Architecture: source all Version: 0.6.4-1+deb9u1 Distribution: stretch-updates Urgency: medium Maintainer: Ondřej Surý <ondrej@debian.org> Changed-By: Ondřej Surý <ondrej@debian.org> Description: dnsviz - Tools for analyzing and visualizing DNS and DNSSEC behavior Changes: dnsviz (0.6.4-1+deb9u1) stretch-updates; urgency=medium . * Cherry-pick upstream fixes related to root.hints and root.keys changes * Update gbp.conf for debian/stretch branch Checksums-Sha1: f5e58387decaedfb5ddadce83d5aa82078847b4a 2205 dnsviz_0.6.4-1+deb9u1.dsc caf5f1fc86465b73c51f07a5f56e44c5cc1824dd 12976 dnsviz_0.6.4-1+deb9u1.debian.tar.gz e66ca9058f52623f7b6a5bebd66e811aff190ab4 730914 dnsviz_0.6.4-1+deb9u1_all.deb 657eeb0e80200ddf76cc730f5c2a8ba49a74760d 10104 dnsviz_0.6.4-1+deb9u1_amd64.buildinfo Checksums-Sha256: 3614721ec7b88faaaf8381d3e46d5bdebfb1508507271c1044471769930b7a51 2205 dnsviz_0.6.4-1+deb9u1.dsc dfa1c6a7bdccc5d929c77a5cbd76d2a0f28aae49cc3648c9755ce405ca5df08a 12976 dnsviz_0.6.4-1+deb9u1.debian.tar.gz 760632189b01f19c126322ef0e6c9ed26400606912f9943d67ad634fdde740a6 730914 dnsviz_0.6.4-1+deb9u1_all.deb 723c8401655139998a3aa6bc26d5be84e404cff3d765c32c19a57cfdb18099c5 10104 dnsviz_0.6.4-1+deb9u1_amd64.buildinfo Files: 6e546de69c5178589b7fe31fe3d4b5aa 2205 net optional dnsviz_0.6.4-1+deb9u1.dsc 3aaa2caab3bd220a52dbfcf0dd608cad 12976 net optional dnsviz_0.6.4-1+deb9u1.debian.tar.gz f5619524d924b149f5756d0f129e96a6 730914 net optional dnsviz_0.6.4-1+deb9u1_all.deb 2be19a42f15eaa2086ad017f61981e06 10104 net optional dnsviz_0.6.4-1+deb9u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEMLkz2A/OPZgaLTj7DJm3DvT8uwcFAlmef4lfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDMw QjkzM0Q4MEZDRTNEOTgxQTJEMzhGQjBDOTlCNzBFRjRGQ0JCMDcACgkQDJm3DvT8 uwckXQ//UvplBI5LG/nHjX1rkGY83je1QjlSZ9gs0xFerkCv20ZnyvRyw5/pt0/O ZyONYYpHiAibSuvNKK5qfh/4jcq7ntv5wpSzJAK775FKGT21aOe/rwcZWkgdHXFY JeN932BMb3X9ZRT/7vRmpSaTavN2v48PoCKkqxcoYYBGJhfiYFID8QRfp3sh4L6g o2/PEs6mQ76aahu2oTS8dzJqqz1ZO5tpYky1YnlZhLwJFJ4EfgmKVVdr7V8R83Va 3ZMAg17dUFPA61YzAxJylj+MOlqrcLuslpFrcuLiZHCWAISJY3MFBzCV390P5v5R JGLBBztwe7ymVovymvhZPLCeCNRKtKnV8Ebkv5hfwmaVTdbZux1VkX55JYzzLENx JOgvQBBXF9Oe4gCJShQmfsQTF9hDq0v8zH/o63nGtxyPl602OlLkoBBMXGM6veTR iD5PXH4q+NbJ5cC+GgjHcNEfeXr1IGiHUWy/JunBEqBR26yTr+NTt2hQ7mcq/HEb vdhPZu0KP6bbkywAG6BGGUK+hruvZgjA649/u0zGSmajQSSFKsZKzkknNWKWDXdg YuPsEhdzre+O5jkbxd3TLOFd+9rDqKx84HoQIkAoyHGuTDitkU9GXOIu26rekDSq OBi1M70S+kNrSG26FjvEjWdFYkEcoscbBbFs2Tdrwbv5zXhcexE= =6W0e -----END PGP SIGNATURE-----
--- End Message ---
--- Begin Message ---
- To: 863734-done@bugs.debian.org, 864027-done@bugs.debian.org, 864028-done@bugs.debian.org, 864911-done@bugs.debian.org, 865971-done@bugs.debian.org, 866045-done@bugs.debian.org, 866537-done@bugs.debian.org, 867814-done@bugs.debian.org, 868284-done@bugs.debian.org, 868517-done@bugs.debian.org, 868684-done@bugs.debian.org, 868756-done@bugs.debian.org, 868809-done@bugs.debian.org, 869414-done@bugs.debian.org, 869419-done@bugs.debian.org, 869434-done@bugs.debian.org, 869574-done@bugs.debian.org, 869577-done@bugs.debian.org, 869634-done@bugs.debian.org, 869661-done@bugs.debian.org, 869667-done@bugs.debian.org, 869676-done@bugs.debian.org, 869754-done@bugs.debian.org, 869772-done@bugs.debian.org, 869836-done@bugs.debian.org, 869920-done@bugs.debian.org, 869966-done@bugs.debian.org, 870005-done@bugs.debian.org, 870142-done@bugs.debian.org, 870181-done@bugs.debian.org, 870205-done@bugs.debian.org, 870465-done@bugs.debian.org, 870604-done@bugs.debian.org, 870609-done@bugs.debian.org, 870659-done@bugs.debian.org, 870911-done@bugs.debian.org, 871242-done@bugs.debian.org, 871440-done@bugs.debian.org, 871451-done@bugs.debian.org, 871466-done@bugs.debian.org, 871661-done@bugs.debian.org, 871720-done@bugs.debian.org, 871739-done@bugs.debian.org, 871943-done@bugs.debian.org, 872441-done@bugs.debian.org, 872774-done@bugs.debian.org, 872776-done@bugs.debian.org, 872818-done@bugs.debian.org, 872928-done@bugs.debian.org, 872953-done@bugs.debian.org, 872991-done@bugs.debian.org, 873054-done@bugs.debian.org, 873061-done@bugs.debian.org, 873309-done@bugs.debian.org, 873371-done@bugs.debian.org, 873479-done@bugs.debian.org, 873624-done@bugs.debian.org, 873771-done@bugs.debian.org, 874198-done@bugs.debian.org, 874350-done@bugs.debian.org, 874389-done@bugs.debian.org, 874477-done@bugs.debian.org, 874580-done@bugs.debian.org, 875695-done@bugs.debian.org, 875765-done@bugs.debian.org, 875777-done@bugs.debian.org, 876020-done@bugs.debian.org, 876092-done@bugs.debian.org, 876114-done@bugs.debian.org, 876116-done@bugs.debian.org, 876117-done@bugs.debian.org, 876139-done@bugs.debian.org, 876314-done@bugs.debian.org, 876629-done@bugs.debian.org, 876731-done@bugs.debian.org, 876909-done@bugs.debian.org, 876913-done@bugs.debian.org, 876949-done@bugs.debian.org, 877348-done@bugs.debian.org, 877415-done@bugs.debian.org, 875771-done@bugs.debian.org, 876633-done@bugs.debian.org
- Subject: Closing bugs for 9.2 point release
- From: "Adam D. Barratt" <adam@adam-barratt.org.uk>
- Date: Sat, 07 Oct 2017 11:33:55 +0100
- Message-id: <1507372435.18586.64.camel@adam-barratt.org.uk>
Version: 9.2 Hi. The updates referenced by each of these bugs was included in today's point release of stretch. Regards, Adam
--- End Message ---