LUG Community Blogs

Debian Bits: Debian Project Leader elections 2017

Planet HantsLUG - Sat, 25/03/2017 - 22:30

It's that time of year again for the Debian Project: the elections of its Project Leader!

The Project Leader position is described in the Debian Constitution.

Two Debian Developers run this year to become Project Leader: Mehdi Dogguy, who has held the office for the last year, and Chris Lamb.

We are in the middle of the campaigning period that will last until the end of April 1st. The candidates and Debian contributors are already engaging in debates and discussions on the debian-vote mailing list.

The voting period starts on April 2nd, and during the following two weeks, Debian Developers can vote to choose the person that will fit that role for one year.

The results will be published on April 16th with the term for new the project leader starting the following day.

Categories: LUG Community Blogs

Debian Bits: DebConf17 welcomes its first eighteen sponsors!

Planet HantsLUG - Mon, 20/03/2017 - 15:15

DebConf17 will take place in Montreal, Canada in August 2017. We are working hard to provide fuel for hearts and minds, to make this conference once again a fertile soil for the Debian Project flourishing. Please join us and support this landmark in the Free Software calendar.

Eighteen companies have already committed to sponsor DebConf17! With a warm welcome, we'd like to introduce them to you.

Our first Platinum sponsor is Savoir-faire Linux, a Montreal-based Free/Open-Source Software company which offers Linux and Free Software integration solutions and actively contributes to many free software projects. "We believe that it's an essential piece [Debian], in a social and political way, to the freedom of users using modern technological systems", said Cyrille Béraud, president of Savoir-faire Linux.

Our first Gold sponsor is Valve, a company developing games, social entertainment platform, and game engine technologies. And our second Gold sponsor is Collabora, which offers a comprehensive range of services to help its clients to navigate the ever-evolving world of Open Source.

As Silver sponsors we have credativ (a service-oriented company focusing on open-source software and also a Debian development partner), Mojatatu Networks (a Canadian company developing Software Defined Networking (SDN) solutions), the Bern University of Applied Sciences (with over 6,600 students enrolled, located in the Swiss capital), Microsoft (an American multinational technology company), Evolix (an IT managed services and support company located in Montreal), Ubuntu (the OS supported by Canonical) and Roche (a major international pharmaceutical provider and research company dedicated to personalized healthcare).

ISG.EE, IBM, Bluemosh, Univention and Skroutz are our Bronze sponsors so far.

And finally, The Linux foundation, Réseau Koumbit and are our supporter sponsors.

Become a sponsor too!

Would you like to become a sponsor? Do you know of or work in a company or organization that may consider sponsorship?

Please have a look at our sponsorship brochure (or a summarized flyer), in which we outline all the details and describe the sponsor benefits.

For further details, feel free to contact us through, and visit the DebConf17 website at

Categories: LUG Community Blogs

Mick Morgan: pwned

Planet ALUG - Sat, 18/03/2017 - 13:55

I recently received a spam email to one of my email addresses. In itself this is annoying, but not particularly interesting or that unusual (despite my efforts to avoid such nuisances). What was unusual was the form of the address because it contained a username I have not used in a long time, and only on one specific site.

The address took the form “username” <realaddress@realdomain> and the email invited me to hook up with a “hot girl” who “was missing me”. The return address was at a Russian domain.

Intrigued as to how this specific UID and address had appeared in my inbox I checked Troy Hunt’s haveibeenpwned database and found that, sure enough, the site I had signed up to with that UID had been compromised. I have since both changed the password on that site (too late of course because it would seem that the password database was stored insecurely) and deleted the account (which I haven’t used in years anyway). I don’t /think/ that I have used that particular UID/password combination anywhere else, but I’m checking nonetheless.

The obvious lesson here is that a) password re-use is a /very/ bad idea and b) even old unused accounts can later cause you difficulty if you don’t manage them actively.

But you knew that anyway. Didn’t you?

Categories: LUG Community Blogs

Debian Bits: Build Android apps with Debian: apt install android-sdk

Planet HantsLUG - Wed, 15/03/2017 - 12:00

In Debian stretch, the upcoming new release, it is now possible to build Android apps using only packages from Debian. This will provide all of the tools needed to build an Android app targeting the "platform" android-23 using the SDK build-tools 24.0.0. Those two are the only versions of "platform" and "build-tools" currently in Debian, but it is possible to use the Google binaries by installing them into /usr/lib/android-sdk.

This doesn't cover yet all of the libraries that are used in the app, like the Android Support libraries, or all of the other myriad libraries that are usually fetched from jCenter or Maven Central. One big question for us is whether and how libraries should be included in Debian. All the Java libraries in Debian can be used in an Android app, but including something like Android Support in Debian would be strange since they are only useful in an Android app, never for a Debian app.

Building apps with these packages

Here are the steps for building Android apps using Debian's Android SDK on Stretch.

  1. sudo apt install android-sdk android-sdk-platform-23
  2. export ANDROID_HOME=/usr/lib/android-sdk
  3. In build.gradle, set compileSdkVersion to 23 and buildToolsVersion to 24.0.0
  4. run gradle build

The Gradle Android Plugin is also packaged. Using the Debian package instead of the one from online Maven repositories requires a little configuration before running gradle. In the buildscript block:

  • add maven { url 'file:///usr/share/maven-repo' } to repositories
  • use compile '' to load the plugin

Currently there is only the target platform of API Level 23 packaged, so only apps targeted at android-23 can be built with only Debian packages. There are plans to add more API platform packages via backports. Only build-tools 24.0.0 is available, so in order to use the SDK, build scripts need to be modified. Beware that the Lint in this version of Gradle Android Plugin is still problematic, so running the :lint tasks might not work. They can be turned off with lintOptions.abortOnError in build.gradle. Google binaries can be combined with the Debian packages, for example to use a different version of the platform or build-tools.

Why include the Android SDK in Debian?

While Android developers could develop and ship apps right now using these Debian packages, this is not very flexible since only build-tools-24.0.0 and android-23 platform are available. Currently, the Debian Android Tools Team is not aiming to cover the most common use cases. Those are pretty well covered by Google's binaries (except for the proprietary license on the Google binaries), and are probably the most work for the Android Tools Team to cover. The current focus is on use cases that are poorly covered by the Google binaries, for example, like where only specific parts of the whole SDK are used. Here are some examples:

  • tools for security researchers, forensics, reverse engineering, etc. which can then be included in live CDs and distros like Kali Linux
  • a hardened APK signing server using apksigner that uses a standard, audited, public configuration of all reproducibly built packages
  • Replicant is a 100% free software Android distribution, so of course they want to have a 100% free software SDK
  • high security apps need a build environment that matches their level of security, the Debian Android Tools packages are reproducibly built only from publicly available sources
  • support architectures besides i386 and amd64, for example, the Linaro LAVA setup for testing ARM devices of all kinds uses the adb packages on ARM servers to make their whole testing setup all ARM architecture
  • dead simple install with strong trust path with mirrors all over the world

In the long run, the Android Tools Team aims to cover more use cases well, and also building the Android NDK. This all will happen more quickly if there are more contributors on the Android Tools team! Android is the most popular mobile OS, and can be 100% free software like Debian. Debian and its derivatives are one of the most popular platforms for Android development. This is an important combination that should grow only more integrated.

Last but not least, the Android Tools Team wants feedback on how this should all work, for example, ideas for how to nicely integrate Debian's Java libraries into the Android gradle workflow. And ideally, the Android Support libraries would also be reproducibly built and packaged somewhere that enforces only free software. Come find us on IRC and/or email!

Categories: LUG Community Blogs

How S Note + Samsung account works

Planet SurreyLUG - Sun, 12/03/2017 - 08:46
  1. Get Galaxy Note device 
  2. Create your documents in S Note
  3. Place your trust in it
  4. Create a Samsung Account
  5. Log in to Samsung account on device
  6. Sync S Notes to Samsung account
  7. NEVER, ever remove Samsung account from phone and delete it online immediately afterwards. It will delete irrevocably all your S NOTE files on your device
  8. Let’s just repeat that. Your data, that you created on your device, which you choose to  then sync with Samsung, will be deleted.
  9. Accept that Samsung now pwns your data.
  10. Never make that mistake again.

    #proprietary shame 


    The post How S Note + Samsung account works appeared first on

    Facebook Twitter

    Categories: LUG Community Blogs

    Steve Kemp: How I started programming

    Planet HantsLUG - Sun, 12/03/2017 - 01:00

    I've written parts of this story in the past, but never in one place and never in much detail. So why not now?

    In 1982 my family moved house, so one morning I went to school and at lunch-time I had to walk home to a completely different house.

    We moved sometime towards the end of the year, and ended up spending lots of money replacing the windows of the new place. For people in York I was born in Farrar Street, Y010 3BY, and we moved to a place on Thief Lane, YO1 3HS. Being named as it was I "ironically" stole at least two street-signs and hung them on my bedroom wall. I suspect my parents were disappointed.

    Anyway the net result of this relocation, and the extra repairs meant that my sisters and I had a joint Christmas present that year, a ZX Spectrum 48k.

    I tried to find pictures of what we received but unfortunately the web doesn't remember the precise bundle. All together though we received:

    I know we also received Horace and the Spiders, and I have vague memories of some other things being included, including a Space Invaders clone. No doubt my parents bought them separately.

    Highlights of my Spectrum-gaming memories include R-Type, Strider, and the various "Dizzy" games. Some of the latter I remember very fondly.

    Unfortunately this Christmas was pretty underwhelming. We unpacked the machine, we cabled it up to the family TV-set - we only had the one, after all - and then proceeded to be very disappointed when nothing we did resulted in a successful game! It turns out our cassette-deck was not good enough. Being back in the 80s the shops were closed over Christmas, and my memory is that it was around January before we received a working tape-player/recorder, such that we could load games.

    Happily the computer came with manuals. I read one, skipping words and terms I didn't understand. I then read the other, which was the spiral-bound orange book. It contained enough examples and decent wording that I learned to write code in BASIC. Not bad for an 11/12 year old.

    Later I discovered that my local library contained "computer books". These were colourful books that promised "The Mystery of Silver Mounter", or "Write your own ADVENTURE PROGRAMS". But were largely dry books that contained nothing but multi-page listings of BASIC programs to type in. Often with adjustments that had to be made for your own computer-flavour (BASIC varying between different systems).

    If you want to recapture the magic scroll to the foot of this Osbourne page and you can download them!

    Later I taught myself Z80 Assembly Language, partly via the Spectrum manual and partly via such books as these two (which I still own 30ish years later):

    • Understanding your Spectrum, Basic & Machine Code Programming.
      • by Dr Ian Logan
    • An introduction to Z80 Machine Code.
      • R.A & J.W Penfold

    Pretty much the only reason I continued down this path is because I wanted infinite/extra lives in the few games I owned. (Which were largely pirated via the schoolboy network of parents with cassette-copiers.)

    Eventually I got some of my l33t POKES printed in magazines, and received free badges from the magazines of the day such as Your Sinclair & Sinclair User. For example I was "Hacker of the Month" in the Your Sinclair issue 67 , Page 32, apparently because I "asked so nicely in my letter".

    Terrible scan is terrible:

    Anyway that takes me from 1980ish to 1984. The only computer I ever touched was a Spectrum. Friends had other things, and there were Sega consoles, but I have no memories of them. Suffice it to say that later when I first saw a PC (complete with Hercules graphics, hard drives, and similar sourcery, running GEM IIRC) I was pleased that Intel assembly was "similar" to Z80 assembly - and now I know the reason why.

    Some time in the future I might document how I got my first computer job. It is hillarious. As was my naivete.

    Categories: LUG Community Blogs

    Looks like is down?!

    Planet SurreyLUG - Thu, 09/03/2017 - 17:39

    Looking like is down… Has been for past 24-48 hours.

    #gnusocial #quitter

    The post Looks like is down?! appeared first on


    Categories: LUG Community Blogs

    Debian Bits: New Debian Developers and Maintainers (January and February 2017)

    Planet HantsLUG - Wed, 08/03/2017 - 00:30

    The following contributors got their Debian Developer accounts in the last two months:

    • Ulrike Uhlig (ulrike)
    • Hanno Wagner (wagner)
    • Jose M Calhariz (calharis)
    • Bastien Roucariès (rouca)

    The following contributors were added as Debian Maintainers in the last two months:

    • Dara Adib
    • Félix Sipma
    • Kunal Mehta
    • Valentin Vidic
    • Adrian Alves
    • William Blough
    • Jan Luca Naumann
    • Mohanasundaram Devarajulu
    • Paulo Henrique de Lima Santana
    • Vincent Prat


    Categories: LUG Community Blogs

    Jonathan McDowell: Rational thoughts on the GitHub ToS change

    Planet ALUG - Thu, 02/03/2017 - 19:13

    I woke this morning to Thorsten claiming the new GitHub Terms of Service could require the removal of Free software projects from it. This was followed by joeyh removing everything from github. I hadn’t actually been paying attention, so I went looking for some sort of summary of whether I should be worried and ended up reading the actual ToS instead. TL;DR version: No, I’m not worried and I don’t think you should be either.

    First, a disclaimer. I’m not a lawyer. I have some legal training, but none of what I’m about to say is legal advice. If you’re really worried about the changes then you should engage the services of a professional.

    The gist of the concerns around GitHub’s changes are that they potentially circumvent any license you have applied to your code, either converting GPL licensed software to BSD style (and thus permitting redistribution of binary forms without source) or making it illegal to host software under certain Free software licenses on GitHub due to being unable to meet the requirements of those licenses as a result of GitHub’s ToS.

    My reading of the GitHub changes is that they are driven by a desire to ensure that GitHub are legally covered for the things they need to do with your code in order to run their service. There are sadly too many people who upload code there without a license, meaning that technically no one can do anything with it. Don’t do this people; make sure that any project you put on GitHub has some sort of license attached to it (don’t write your own - it’s highly likely one of Apache/BSD/GPL will suit your needs) so people know whether they can make use of it or not. “I don’t care” is not a valid reason not to do this.

    Section D, relating to user generated content, is the one causing the problems. It’s possibly easiest to walk through each subsection in order.

    D1 says GitHub don’t take any responsibility for your content; you make it, you’re responsible for it, they’re not accepting any blame for harm your content does nor for anything any member of the public might do with content you’ve put on GitHub. This seems uncontentious.

    D2 reaffirms your ownership of any content you create, and requires you to only post 3rd party content to GitHub that you have appropriate rights to. So I can’t, for example, upload a copy of ‘Friday’ by Rebecca Black.

    Thorsten has some problems with D3, where GitHub reserve the right to remove content that violates their terms or policies. He argues this could cause issues with licenses that require unmodified source code. This seems to be alarmist, and also applies to any random software mirror. The intent of such licenses is in general to ensure that the pristine source code is clearly separate from 3rd party modifications. Removal of content that infringes GitHub’s T&Cs is not going to cause an issue.

    D4 is a license grant to GitHub, and I think forms part of joeyh’s problems with the changes. It affirms the content belongs to the user, but grants rights to GitHub to store and display the content, as well as make copies such as necessary to provide the GitHub service. They explicitly state that no right is granted to sell the content at all or to distribute the content outside of providing the GitHub service.

    This term would seem to be the minimum necessary for GitHub to ensure they are allowed to provide code uploaded to them for download, and provide their web interface. If you’ve actually put a Free license on your code then this isn’t necessary, but from GitHub’s point of view I can understand wanting to make it explicit that they need these rights to be granted. I don’t believe it provides a method of subverting the licensing intent of Free software authors.

    D5 provides more concern to Thorsten. It seems he believes that the ability to fork code on GitHub provides a mechanism to circumvent copyleft licenses. I don’t agree. The second paragraph of this subsection limits the license granted to the user to be the ability to reproduce the content on GitHub - it does not grant them additional rights to reproduce outside of GitHub. These rights, to my eye, enable the forking and viewing of content within GitHub but say nothing about my rights to check code out and ignore the author’s upstream license.

    D6 clarifies that if you submit content to a GitHub repo that features a license you are licensing your contribution under these terms, assuming you have no other agreement in place. This looks to be something that benefits projects on GitHub receiving contributions from users there; it’s an explicit statement that such contributions are under the project license.

    D7 confirms the retention of moral rights by the content owner, but states they are waived purely for the purposes of enabling GitHub to provide service, as stated under D4. In particular this right is revocable so in the event they do something you don’t like you can instantly remove all of their rights. Thorsten is more worried about the ability to remove attribution and thus breach CC-BY or some BSD licenses, but GitHub’s whole model is providing attribution for changesets and tracking such changes over time, so it’s hard to understand exactly where the service falls down on ensuring the provenance of content is clear.

    There are reasons to be wary of GitHub (they’ve taken a decentralised revision control system and made a business model around being a centralised implementation of it, and they store additional metadata such as PRs that aren’t as easily extracted), but I don’t see any indication that the most recent changes to their Terms of Service are something to worry about. The intent is clearly to provide GitHub with the legal basis they need to provide their service, rather than to provide a means for them to subvert the license intent of any Free software uploaded.

    Categories: LUG Community Blogs

    Brett Parker (iDunno): Using the Mythic Beasts IPv4 -&gt; IPv6 Proxy for Websites on a v6 only Pi and getting the right REMOTE_ADDR

    Planet ALUG - Wed, 01/03/2017 - 19:35

    So, more because I was intrigued than anything else, I've got a pi3 from Mythic Beasts, they're supplied with IPv6 only connectivity and the file storage is NFS over a private v4 network. The proxy will happily redirect requests to either http or https to the Pi, but this results (without turning on the Proxy Protocol) with getting remote addresses in your logs of the proxy servers, which is not entirely useful.

    I've cheated a bit, because the turning on of ProxyProtocol for the addresses is currently not exposed to customers (it's on the list!), to do it without access to Mythic's backends use your own domainname (I've also got mapped to this Pi).

    So, first step first, we get our RPi and we make sure that we can login to it via ssh (I'm nearly always on a v6 connection anyways, so this was a simple case of sshing to the v6 address of the Pi). I then installed haproxy and apache2 on the Pi and went about configuring them, with apache2 I changed it to listen to localhost only and on ports 8080 and 4443, I hadn't at this point enabled the ssl module so, really, the change for 4443 didn't kick in. Here's my /etc/apache2/ports.conf file:

    # If you just change the port or add more ports here, you will likely also # have to change the VirtualHost statement in # /etc/apache2/sites-enabled/000-default.conf Listen [::1]:8080 <IfModule ssl_module> Listen [::1]:4443 </IfModule> <IfModule mod_gnutls.c> Listen [::1]:4443 </IfModule> # vim: syntax=apache ts=4 sw=4 sts=4 sr noet

    I then edited /etc/apache2/sites-available/000-default.conf to change the VirtualHost line to [::1]:8080.

    So, with that in place, now we deploy haproxy infront of it, the basic /etc/haproxy/haproxy.cfg config is:

    global log /dev/log local0 log /dev/log local1 notice chroot /var/lib/haproxy stats socket /run/haproxy/admin.sock mode 660 level admin stats timeout 30s user haproxy group haproxy daemon # Default SSL material locations ca-base /etc/ssl/certs crt-base /etc/ssl/private # Default ciphers to use on SSL-enabled listening sockets. # For more information, see ciphers(1SSL). This list is from: # ssl-default-bind-ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS ssl-default-bind-options no-sslv3 defaults log global mode http option httplog option dontlognull timeout connect 5000 timeout client 50000 timeout server 50000 errorfile 400 /etc/haproxy/errors/400.http errorfile 403 /etc/haproxy/errors/403.http errorfile 408 /etc/haproxy/errors/408.http errorfile 500 /etc/haproxy/errors/500.http errorfile 502 /etc/haproxy/errors/502.http errorfile 503 /etc/haproxy/errors/503.http errorfile 504 /etc/haproxy/errors/504.http frontend any_http option httplog option forwardfor acl is_from_proxy src 2a00:1098:0:82:1000:3b:1:1 2a00:1098:0:80:1000:3b:1:1 tcp-request connection expect-proxy layer4 if is_from_proxy bind :::80 default_backend any_http backend any_http server apache2 ::1:8080

    Obviously after that you then do:

    systemctl restart apache2 systemctl restart haproxy

    Now you have a proxy protocol'd setup from the proxy servers, and you can still talk directly to the Pi over ipv6, you're not yet logging the right remote ips, but we're a step closer. Next enable mod_remoteip in apache2:

    a2enmod remoteip

    And add a file, /etc/apache2/conf-available/remoteip-logformats.conf containing:

    LogFormat "%v:%p %a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" remoteip_vhost_combined

    And edit the /etc/apache2/sites-available/000-default.conf to change the CustomLog line to use remoteip_vhost_combined rather than combined as the LogFormat and add the relevant RemoteIP settings:

    RemoteIPHeader X-Forwarded-For RemoteIPTrustedProxy ::1 CustomLog ${APACHE_LOG_DIR}/access.log remoteip_vhost_combined

    Now, enable the config and restart apache2:

    a2enconf remoteip-logformats systemctl restart apache2

    Now you'll get the right remote ip in the logs (cool, huh!), and, better still, the environment that gets pushed through to cgi scripts/php/whatever is now also correct.

    So, you can now happily visit http://www.<your-pi-name>, e.g.

    Next up, you'll want something like dehydrated - I grabbed the packaged version from debian's jessie-backports repository - so that you can make yourself some nice shiny SSL certificates (why wouldn't you, after all!), once you've got dehydrated installed, you'll probably want to tweak it a bit, I have some magic extra files that I use, I also suggest getting the dehydrated-apache2 package, which just makes it all much easier too.








    #!/bin/sh action="$1" domain="$2" case $action in deploy_cert) privkey="$3" cert="$4" fullchain="$5" chain="$6" cat "$privkey" "$fullchain" > /etc/ssl/private/srwpi.pem chmod 640 /etc/ssl/private/srwpi.pem ;; *) ;; esac

    /etc/dehydrated/hooks/srwpi has the execute bit set (chmod +x /etc/dehydrated/hooks/srwpi), and is really only there so that the certificate can be used easily in haproxy.

    And finally the file /etc/dehydrated/domains.txt:

    Obviously, use your own pi name in there, or better yet, one of your own domain names that you've mapped to the proxies.

    Run dehydrated in cron mode (it's noisy, but meh...):

    dehydrated -c

    That s then generated you some shiny certificates (hopefully). For now, I'll just tell you how to do it through the /etc/apache2/sites-available/default-ssl.conf file, just edit that file and change the SSLCertificateFile and SSLCertificateKeyFile to point to /var/lib/dehydrated/certs/ and /var/llib/dehydrated/certs/ files, do the edit for the CustomLog as you did for the other default site, and change the VirtualHost to be [::1]:443 and enable the site:

    a2ensite default-ssl a2enmod ssl

    And restart apache2:

    systemctl restart apache2

    Now time to add some bits to haproxy.cfg, usefully this is only a tiny tiny bit of extra config:

    frontend any_https option httplog option forwardfor acl is_from_proxy src 2a00:1098:0:82:1000:3b:1:1 2a00:1098:0:80:1000:3b:1:1 tcp-request connection expect-proxy layer4 if is_from_proxy bind :::443 ssl crt /etc/ssl/private/srwpi.pem default_backend any_https backend any_https server apache2 ::1:4443 ssl ca-file /etc/ssl/certs/ca-certificates.crt

    Restart haproxy:

    systemctl restart haproxy

    And we're all done! REMOTE_ADDR will appear as the correct remote address in the logs, and in the environment.

    Categories: LUG Community Blogs

    Brett Parker (iDunno): Ooooooh! Shiny!

    Planet ALUG - Wed, 01/03/2017 - 16:12

    Yay! So, it's a year and a bit on from the last post (eeep!), and we get the news of the Psion Gemini - I wants one, that looks nice and shiny and just the right size to not be inconvenient to lug around all the time, and far better for ssh usage than the onscreen keyboard on my phone!

    Categories: LUG Community Blogs

    Chris Lamb: Free software activities in February 2017

    Planet ALUG - Tue, 28/02/2017 - 23:09

    Here is my monthly update covering what I have been doing in the free software world (previous month):

    • Submitted a number of pull requests to the Django web development framework:
      • Add a --mode=unified option to the "diffsettings" management command. (#8113)
      • Fix a crash in setup_test_environment() if ALLOWED_HOSTS is a tuple. (#8101)
      • Use Python 3 "shebangs" now that the master branch is Python 3 only. (#8105)
      • URL namespacing warning should consider nested namespaces. (#8102)
    • Created an experimental patch against the Python interpreter in order to find reproducibility-related assumptions in dict handling in arbitrary Python code. (#29431)
    • Filed two issues against dh-virtualenv, a tool to package Python virtualenv environments in Debian packages:
      • Fix "upgrage-pip" typo in usage documentation. (#195)
      • Missing DH_UPGRADE_SETUPTOOLS equivalent for dh_virtualenv (#196)
    • Fixed a large number of spelling corrections in Samba, a free-software re-implementation of the Windows networking protocols.
    • Reviewed and merged a pull request by @jheld for django-slack (my library to easily post messages to the Slack group-messaging utility) to support per-message backends and channels. (#63)
    • Created a pull request for django-two-factor-auth, a complete Two-Factor Authentication (2FA) framework for projects using the Django web development framework to drop use of the @lazy_property decorator to ensure compatibility with Django 1.11. (#195)
    • Filed, triaged and eventually merged a change from @evgeni to fix an autopkgtest-related issue in, my hosted service for projects that host their Debian packaging on GitHub to use the Travis CI continuous integration platform to test builds on every code change) (#41)
    • Submitted a pull request against social-core — a library to allow Python applications to authenticate against third-party web services such as Facebook, Twitter, etc. — to use the more-readable X if Y else Z construction over Y and X or Z. (#44)
    • Filed an issue against freezegun (a tool to make it easier to write Python tests involving times) to report that dateutils was missing from requirements.txt. (#173)
    • Submitted a pull request against the Hypothesis "QuickCheck"-like testing framework to make the build reproducible. (#440)
    • Fixed an issue reported by @davidak in trydiffoscope (a web-based version of the diffoscope in-depth and content-aware diff utility) where the maximum upload size was incorrectly calculated. (#22)
    • Created a pull request for the Mars Simulation Project to remove some embedded timestamps from the changelog.gz and mars-sim.1.gz files in order to make the build reproducible. (#24)
    • Filed a bug against the cpio archiving utility to report that the testsuite fails when run in the UTC +1300 timezone. (Thread)
    • Submitted a pull request against the "pnmixer" system-tray volume mixer in order to make the build reproducible. (#153)
    • Sent a patch to Testfixtures (a collection of helpers and mock objects that are useful when writing Python unit tests or doctests) to make the build reproducible. (#56)
    • Created a pull request for the "Cloud" Sphinx documentation theme in order to make the output reproducible. (#22)
    Reproducible builds

    Whilst anyone can inspect the source code of free software for malicious flaws, most software is distributed pre-compiled to end users.

    The motivation behind the Reproducible Builds effort is to permit verification that no flaws have been introduced — either maliciously or accidentally — during this compilation process by promising identical results are always generated from a given source, thus allowing multiple third-parties to come to a consensus on whether a build was compromised.

    (I have been awarded a grant from the Core Infrastructure Initiative to fund my work in this area.)

    This month I:

    I also made the following changes to our tooling:


    diffoscope is our in-depth and content-aware diff utility that can locate and diagnose reproducibility issues.

    • New features:
      • Add a machine-readable JSON output format. (Closes: #850791).
      • Add an --exclude option. (Closes: #854783).
      • Show results from debugging packages last. (Closes: #820427).
      • Extract archive members using an auto-incrementing integer avoiding the need to sanitise filenames. (Closes: #854723).
      • Apply --max-report-size to --text output. (Closes: #851147).
      • Specify <html lang="en"> in the HTML output. (re. #849411).
    • Bug fixes:
      • Fix errors when comparing directories with non-directories. (Closes: #835641).
      • Device and RPM fallback comparisons require xxd. (Closes: #854593).
      • Fix tests that call xxd on Debian Jessie due to change of output format. (Closes: #855239).
      • Add missing Recommends for comparators. (Closes: #854655).
      • Importing submodules (ie. parent.child) will attempt to import parent. (Closes: #854670).
      • Correct logic of module_exists ensuring we correctly skip the debian.deb822 tests when python3-debian is not installed. (Closes: #854745).
      • Clean all temporary files in the signal handler thread instead of attempting to pass the exception back to the main thread. (Closes: #852013).
      • Fix behaviour of setting report maximums to zero (ie. no limit).
    • Optimisations:
      • Don't uselessly run xxd(1) on non-directories.
      • No need to track libarchive directory locations.
      • Optimise create_limited_print_func.
    • Tests:
      • When comparing two empty directories, ensure that the mtime of the directory is consistent to avoid non-deterministic failures.
      • Ensure we can at least import the "deb_fallback" and "rpm_fallback" modules.
      • Add test for symlink differing in destination.
      • Add tests for --progress, --status-fd and profiling output options as well as the Deb{Changes,Buildinfo,Dsc} and RPM fallback comparisons.
      • Add get_data and @skip_unless_module_exists test helpers.
      • Mark impossible-to-reach code to improve test coverage. is my experiment into how to process, store and distribute .buildinfo files after the Debian archive software has processed them.

    • Drop raw_text fields now as we've moved these to Amazon S3.
    • Drop storage of Installed-Build-Depends and subsequently-orphaned Binary package instances to recover diskspace.


    strip-nondeterminism is our tool to remove specific non-deterministic results from a completed build.

    • Print log entry when fixing a file. (Closes: #777239).
    • Run our entire testsuite in autopkgtests, not just the first test. (Closes: #852517).
    • Don't test for stat(2)'s blksize and block attributes. (Closes: #854937).
    • Use error() from over "manual" die().

    Debian Patches contributed Debian LTS

    This month I have been paid to work 13 hours on Debian Long Term Support (LTS). In that time I did the following:

    • "Frontdesk" duties, triaging CVEs, etc.
    • Issued DLA 817-1 for libphp-phpmailer, correcting a local file disclosure vulnerability where insufficient parsing of HTML messages could potentially be used by attacker to read a local file.
    • Issued DLA 826-1 for wireshark which fixes a denial of service vulnerability in wireshark, where a malformed NATO Ground Moving Target Indicator Format ("STANAG 4607") capture file could cause a memory exhausion/infinite loop.
    • python-django (1:1.11~beta1-1) — New upstream beta release.
    • redis (3:3.2.8-1) — New upstream release.
    • gunicorn (19.6.0-11) — Use ${misc:Pre-Depends} to populate Pre-Depends for dpkg-maintscript-helper.
    • dh-virtualenv (1.0-1~bpo8+1) — Upload to jessie-backports.

    I sponsored the following uploads:

    I also performed the following QA uploads:

    • dh-kpatches (0.99.36+nmu4) — Make kernel kernel builds reproducible.

    Finally, I made the following non-maintainer uploads:

    • cpio (2.12+dfsg-3) — Remove rmt.8.gz to prevent a piuparts error.
    • dot-forward (1:0.71-2.2) — Correct a FTBFS; we don't install anything to /usr/sbin, so use GNU Make's $(wildcard ..) over the shell's own * expansion.
    Debian bugs filed

    I also filed 15 FTBFS bugs against binaryornot, chaussette, examl, ftpcopy, golang-codegangsta-cli, hiro, jarisplayer, libchado-perl, python-irc, python-stopit, python-stopit, python-stopit, python-websockets, rubocop & yash.

    FTP Team

    As a Debian FTP assistant I ACCEPTed 116 packages: autobahn-cpp, automat, bglibs, bitlbee, bmusb, bullet, case, certspotter, checkit-tiff, dash-el, dash-functional-el, debian-reference, el-x, elisp-bug-hunter, emacs-git-messenger, emacs-which-key, examl, genwqe-user, giac, golang-github-cloudflare-cfssl, golang-github-docker-goamz, golang-github-docker-libnetwork, golang-github-go-openapi-spec, golang-github-google-certificate-transparency, golang-github-karlseguin-ccache, golang-github-karlseguin-expect, golang-github-nebulouslabs-bolt, gpiozero, gsequencer, jel, libconfig-mvp-slicer-perl, libcrush, libdist-zilla-config-slicer-perl, libdist-zilla-role-pluginbundle-pluginremover-perl, libevent, libfunction-parameters-perl, libopenshot, libpod-weaver-section-generatesection-perl, libpodofo, libprelude, libprotocol-http2-perl, libscout, libsmali-1-java, libtest-abortable-perl, linux, linux-grsec, linux-signed, lockdown, lrslib, lua-curses, lua-torch-cutorch, mariadb-10.1, mini-buildd, mkchromecast, mocker-el, node-arr-exclude, node-brorand, node-buffer-xor, node-caller, node-duplexer3, node-ieee754, node-is-finite, node-lowercase-keys, node-minimalistic-assert, node-os-browserify, node-p-finally, node-parse-ms, node-plur, node-prepend-http, node-safe-buffer, node-text-table, node-time-zone, node-tty-browserify, node-widest-line, npd6, openoverlayrouter, pandoc-citeproc-preamble, pydenticon, pyicloud, pyroute2, pytest-qt, pytest-xvfb, python-biomaj3, python-canonicaljson, python-cgcloud, python-gffutils, python-h5netcdf, python-imageio, python-kaptan, python-libtmux, python-pybedtools, python-pyflow, python-scrapy, python-scrapy-djangoitem, python-signedjson, python-unpaddedbase64, python-xarray, qcumber, r-cran-urltools, radiant, repo, rmlint, ruby-googleauth, ruby-os, shutilwhich, sia, six, slimit, sphinx-celery, subuser, swarmkit, tmuxp, tpm2-tools, vine, wala & x265.

    I additionally filed 8 RC bugs against packages that had incomplete debian/copyright files against: checkit-tiff, dash-el, dash-functional-el, libcrush, libopenshot, mkchromecast, pytest-qt & x265.

    Categories: LUG Community Blogs

    Steve Kemp: Rotating passwords

    Planet HantsLUG - Thu, 23/02/2017 - 23:00

    Like many people I use a password-manage to record logins to websites. I previously used a tool called pwsafe, but these days I switched to using pass.

    Although I don't like the fact the meta-data is exposed the tool is very useful, and its integration with git is both simple and reliable.

    Reading about the security issue that recently affected cloudflare made me consider rotating some passwords. Using git I figured I could look at the last update-time of my passwords. Indeed that was pretty simple:

    git ls-tree -r --name-only HEAD | while read filename; do echo "$(git log -1 --format="%ad" -- $filename) $filename" done

    Of course that's not quite enough because we want it sorted, and to do that using the seconds-since-epoch is neater. All together I wrote this:

    #!/bin/sh # # Show password age - should be useful for rotation - we first of all # format the timestamp of every *.gpg file, as both unix+relative time, # then we sort, and finally we output that sorted data - but we skip # the first field which is the unix-epoch time. # ( git ls-tree -r --name-only HEAD | grep '\.gpg$' | while read filename; do \ echo "$(git log -1 --format="%at %ar" -- $filename) $filename" ; done ) \ | sort | awk '{for (i=2; i<NF; i++) printf $i " "; print $NF}'

    Not the cleanest script I've ever hacked together, but the output is nice:

    steve@ssh ~ $ cd ~/Repos/personal/pass/ steve@ssh ~/Repos/personal/pass $ ./password-age | head -n 5 1 year, 10 months ago GPG/root@localhost.gpg 1 year, 10 months ago GPG/ 1 year, 10 months ago GPG/ 1 year, 10 months ago Git/ 1 year, 10 months ago Git/

    Now I need to pick the sites that are more than a year old and rotate credentials. Or delete accounts, as appropriate.

    Categories: LUG Community Blogs

    Steve Kemp: Apologies for the blog-churn.

    Planet HantsLUG - Sat, 18/02/2017 - 23:00

    I've been tweaking my blog a little over the past few days, getting ready for a new release of the chronicle blog compiler (github).

    During the course of that I rewrote all the posts to have 100% lower-case file-paths. Redirection-pages have been auto-generated for each page which was previously mixed-case, but unfortunately that will have meant that the RSS feed updated unnecessarily:

    • If it used to contain:
    • It would have been updated to contain

    That triggered a lot of spamming, as the URLs would have shown up as being new/unread/distinct.

    Categories: LUG Community Blogs

    No, seriously. The Nokia 3310 is coming back

    Planet SurreyLUG - Tue, 14/02/2017 - 16:35

    Everyone will be happy so long as Snake really is part of this.

    In fact, it’ll be worth buying really just for that.

    The post No, seriously. The Nokia 3310 is coming back appeared first on

    Facebook Twitter

    Categories: LUG Community Blogs
    Syndicate content