• Candy Tsai: Outreachy Week 4: Weekly Report

  Just a normal weekly report this week. Can’t believe I’ve been in the Outreachy program for a month!

• CVE-2019-0201 : Debian has Released Security Update for zookeeper

  Debian has released security update for zookeeper package.

  This release fixes vulnerability against zookeeper package.

• Raphaël Hertzog: Freexian’s report about Debian Long Term Support, May 2019

  Like each month, here comes a report about the work of paid contributors to Debian LTS.

Debian takes an almost completely "hands off" approach to the decisions that Debian developers (DDs) can make in regard to the packaging and maintenance of their packages. That leads to maximal freedom for DDs, but impacts the project in other ways, some of which may be less than entirely desirable. New Debian project leader (DPL) Sam Hartman started a conversation about potential changes to the Debian packaging requirements back in mid-May. In something of a departure from the Debian tradition of nearly endless discussion without reaching a conclusion (and, possibly, punting the decision to the technical committee or a vote in a general resolution), Hartman has instead tried to guide the discussion toward reaching some kind of rough consensus.

The question revolves around an adjunct to the debhelper tool that is used to build many Debian packages. The additional tool is a "command sequencer" for debhelper commands; it is called dh. Debhelper has commands that get invoked from the rules file that is used to build a .deb from the source code and other files that are part of a Debian package. By default, dh steps through a sequence of debhelper commands that should suffice to build many types of packages; if some of the steps need overrides or changes, that can be handled as well. In effect, dh encapsulates the standard way to build a Debian package using debhelper.

But not all packages use dh, so Hartman asked whether the distribution wanted to require, or at least recommend, the use of dh. In that posting to debian-devel, he noted that some have said that a package not using dh has a "package smell", which is an indication that the maintainers should consider fixing it. His question might ultimately boil down to "whether maintainers should be expected to apply well-written patches to convert a package to using dh".

• Debian 10.0 "Buster" Lining Up To Release In Early July

  We now have a tentative release date for the big Debian 10 "Buster" release.

  If no show-stoppers come up in the next few weeks, Debian 10.0 will be making its official debut on Saturday, 6 July. This comes following Debian developers working through around 150 release critical bugs as of a few months ago but everything is now getting ironed out and they are onto the home stretch ahead of this major update succeeding the Debian 9 "Stretch" series.

• Markus Koschany: My Free Software Activities in May 2019

  Welcome to gambaru.de. Here is my monthly report that covers what I have been doing for Debian. If you’re interested in Java, Games and LTS topics, this might be interesting for you.

• DebConf19 welcomes its sponsors!

  DebConf19 is taking place in Curitiba, Brazil, from 21 July to 28 July 2019. It is the 20th edition of the Debian conference and organisers are working hard to create another interesting and fruitful event for attendees.

  We would like to warmly welcome the first 29 sponsors of DebConf19, and introduce you to them.

  So far we have three Platinum sponsors.

  Our first Platinum sponsor is Infomaniak. Infomaniak is Switzerland's largest web-hosting company, also offering backup and storage services, solutions for event organizers, live-streaming and video on demand services. It wholly owns its datacenters and all elements critical to the functioning of the services and products provided by the company (both software and hardware).

  Next, as a Platinum sponsor, is Google. Google is one of the largest technology companies in the world, providing a wide range of Internet-related services and products as online advertising technologies, search, cloud computing, software, and hardware. Google has been supporting Debian by sponsoring DebConf since more than ten years, and is also a Debian partner.

• More sales number for my Free Culture paper editions (2019-edition)

  The first book I published, Free Culture by Lawrence Lessig, is still selling a few copies. Not a lot, but enough to have contributed slightly over $500 to the Creative Commons Corporation so far. All the profit is sent there. Most books are still sold via Amazon (83 copies), with Ingram second (49) and Lulu (12) and Machette (7) as minor channels. Bying directly from Lulu bring the largest cut to Creative Commons. The English Edition sold 80 copies so far, the French 59 copies, and Norwegian only 8 copies. Nothing impressive, but nice to see the work we put down is still being appreciated. The ebook edition is available for free from Github.

Debian supports (either officially or unofficially) a lot of architectures, which is of course a nice thing. Sometimes you want to play with some exotic architecture you are not familiar with, or you want to debug a problem with that architecture, but you do not have a computer implementing that architecture. Fortunately QEMU is able to emulate most of the architectures supported by Debian (ia64 being an exception), however it can be difficult to install it or to find ready-to-use images on the Internet (there are some, but usually they are quite a few years old). Let's also say that for some reason you cannot or do not want to use the Debian porterboxes (maybe you are not a DD, or you want to mess up with the network, or you want to be root). What do you do?

Mostly for the fun of hacking on some exotic architectures, I tried to brew together a little script, the Debian Quick Image Baker (DQIB). It is basically a wrapper that calls qemu-debootstrap with the right options (where "right" means "those that I have experimentally found to work"), with some thin icing layer on top. qemu-debootstrap is basically another wrapper on top of debootstrap, which of course does the heavy lifting, and qemu-user-static, that allows debootstrap to run executables for foreign architectures.