[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1081035: marked as done (bookworm-pu: package fcgiwrap/1.1.0-14+deb12u1)

Your message dated Sat, 09 Nov 2024 10:51:02 +0000
with message-id <b0a29248bc631362ed06a8879f93b8cdae5414d0.camel@adam-barratt.org.uk>
and subject line Closing bugs released with 12.8
has caused the Debian Bug report #1081035,
regarding bookworm-pu: package fcgiwrap/1.1.0-14+deb12u1
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


-- 
1081035: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1081035
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message --- 
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: fcgiwrap@packages.debian.org, team@security.debian.org, Jonathan Nieder <jrnieder@gmail.com>, Jordi Mallach <jordi@debian.org>, carnil@debian.org
Control: affects -1 + src:fcgiwrap
User: release.debian.org@packages.debian.org
Usertags: pu

Hi

We (security-team) plan to release an update of git fixing several
CVEs, prepared by Jonathan Nieder and rebasing git version to 2.39.5
upstream, which uncovered regressions in both fcgiwrap (#1072394) and
ikiwiki-hosting (cf. #1076751).

They were triggered as well in autopkgtests with the prepared
git/1:2.39.5-0+deb12u1 version.

We discussed this, if we should release the update for ikiwiki-hosting
(real impact) and fcgiwrap (only autopkgtests) via a corresponding
update or a proposed-update is enough. We prpoose the later, and let
it go through the upcoming point release.

Attached ist the proposed debdiff for fcgiwrap.

I have not yet uploaded the package, but CC'ing Jordi.

Regards,
Salvatore

diff -Nru fcgiwrap-1.1.0/debian/changelog fcgiwrap-1.1.0/debian/changelog
--- fcgiwrap-1.1.0/debian/changelog	2022-12-17 18:23:54.000000000 +0100
+++ fcgiwrap-1.1.0/debian/changelog	2024-09-07 11:31:30.000000000 +0200
@@ -1,3 +1,13 @@
+fcgiwrap (1.1.0-14+deb12u1) bookworm; urgency=medium
+
+  [ Mitchell Dzurick ]
+  * d/t/git-http-backend: make www-data own $AUTOPKGTEST_TMP/test1/.git
+    git introduced more aggressive security checking, so the dep8 test needs
+    to explicitly change ownership of the new git directory.
+    (LP: #2067942, Closes: #1072394)
+
+ -- Salvatore Bonaccorso <carnil@debian.org>  Sat, 07 Sep 2024 11:31:30 +0200
+
 fcgiwrap (1.1.0-14) unstable; urgency=medium
 
   * Brown paper bag release.
diff -Nru fcgiwrap-1.1.0/debian/tests/git-http-backend fcgiwrap-1.1.0/debian/tests/git-http-backend
--- fcgiwrap-1.1.0/debian/tests/git-http-backend	2022-11-21 18:05:05.000000000 +0100
+++ fcgiwrap-1.1.0/debian/tests/git-http-backend	2024-09-07 11:30:46.000000000 +0200
@@ -12,6 +12,7 @@
 
 git init test1
 git -C test1 commit --allow-empty -m test
+chown -R www-data:www-data "$AUTOPKGTEST_TMP"/test1/.git
 
 tee /etc/nginx/sites-available/default <<EOF
 server {

--- End Message ---
--- Begin Message --- 
Source: release.debian.org
Version: 12.8

Hi,

Each of the updates tracked by these bugs was included in today's 12.8
bookworm point release.

Regards,

Adam

--- End Message ---
Reply to: