Debian Bug report logs - #653503
Please enable hardened build flags

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Please enable hardened build flags

Date: Thu, 29 Dec 2011 00:33:33 +0100

[Message part 1 (text/plain, inline)]

Package: amule
Version: 2.3.1-1
Severity: important
Tags: patch

Please enable hardened build flags from dpkg-buildflags.

Patch attached.

Cheers,
        Moritz

[amule-harden.patch (text/x-diff, attachment)]

Message #10 received at 653503@bugs.debian.org (full text, mbox, reply):

From: Sandro Tosi <morph@debian.org>

To: 653503@bugs.debian.org,control@bugs.debian.org,653503-submitter@bugs.debian.org

Subject: [ecc91bc] Fix for Bug#653503 committed to git

Date: Thu, 29 Dec 2011 23:15:12 +0000

tags 653503 + pending
thanks

Hello,

     The following change has been committed for this bug by
 Sandro Tosi <morph@debian.org> on Fri, 30 Dec 2011 00:14:23 +0100.
 The fix will be in the next upload. 
=========================================================================
enable hardening flags; thanks to Moritz Muehlenhoff; Closes: #653503


=========================================================================

You can check the diff of the fix at:

    http://git.debian.org/?p=pkg-amule/amule.git;a=commitdiff;h=ecc91bc

Message #20 received at 653503-close@bugs.debian.org (full text, mbox, reply):

From: Sandro Tosi <morph@debian.org>

To: 653503-close@bugs.debian.org

Subject: Bug#653503: fixed in amule 2.3.1-2

Date: Sat, 31 Dec 2011 16:02:20 +0000

Source: amule
Source-Version: 2.3.1-2

We believe that the bug you reported is fixed in the latest version of
amule, which is due to be installed in the Debian FTP archive:

amule-common_2.3.1-2_all.deb
  to main/a/amule/amule-common_2.3.1-2_all.deb
amule-daemon_2.3.1-2_amd64.deb
  to main/a/amule/amule-daemon_2.3.1-2_amd64.deb
amule-gnome-support_2.3.1-2_all.deb
  to main/a/amule/amule-gnome-support_2.3.1-2_all.deb
amule-plasmamule_2.3.1-2_amd64.deb
  to main/a/amule/amule-plasmamule_2.3.1-2_amd64.deb
amule-utils-gui_2.3.1-2_amd64.deb
  to main/a/amule/amule-utils-gui_2.3.1-2_amd64.deb
amule-utils_2.3.1-2_amd64.deb
  to main/a/amule/amule-utils_2.3.1-2_amd64.deb
amule_2.3.1-2.debian.tar.gz
  to main/a/amule/amule_2.3.1-2.debian.tar.gz
amule_2.3.1-2.dsc
  to main/a/amule/amule_2.3.1-2.dsc
amule_2.3.1-2_amd64.deb
  to main/a/amule/amule_2.3.1-2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 653503@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sandro Tosi <morph@debian.org> (supplier of updated amule package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Fri, 30 Dec 2011 22:11:04 +0100
Source: amule
Binary: amule amule-common amule-utils amule-utils-gui amule-daemon amule-gnome-support amule-plasmamule
Architecture: source amd64 all
Version: 2.3.1-2
Distribution: unstable
Urgency: low
Maintainer: Debian aMule Team <pkg-amule-devel@lists.alioth.debian.org>
Changed-By: Sandro Tosi <morph@debian.org>
Description: 
 amule      - client for the eD2k and Kad networks, like eMule
 amule-common - common files for the rest of aMule packages
 amule-daemon - non-graphic version of aMule, a client for the eD2k and Kad netwo
 amule-gnome-support - ed2k links handling support for GNOME web browsers
 amule-plasmamule - kde plasmoid to control amule
 amule-utils - utilities for aMule (command-line version)
 amule-utils-gui - graphic utilities for aMule
Closes: 653503
Changes: 
 amule (2.3.1-2) unstable; urgency=low
 .
   [ Sandro Tosi ]
   * [9fd98bf] remove unneeded b-d on quilt
   * [2310fc3] remove explicit reference to quilt, we're using 3.0 (quilt) now
   * [ecc91bc] enable hardening flags; thanks to Moritz Muehlenhoff;
     Closes: #653503
 .
   [ Vollstrecker ]
   * [b88ae44] Added plasma-applett pkg
Checksums-Sha1: 
 b4441365dcc0a3a69c78e35caa237a6d0d5caa0d 1807 amule_2.3.1-2.dsc
 1d5e297c334dfd6c81362d786fad27e01463e6e6 26322 amule_2.3.1-2.debian.tar.gz
 a46e904cee2e24b90cea7d3628a3a5e7950878f5 1780196 amule_2.3.1-2_amd64.deb
 aa12447977085eab853e1dee282b1d2eef1a10dd 516752 amule-utils_2.3.1-2_amd64.deb
 8a1d4ba4c5ae2c29f36252c091b9804ee865439e 1351400 amule-utils-gui_2.3.1-2_amd64.deb
 e0bd45ce1d89623fb3aa503f186d023284a92e7c 1275728 amule-daemon_2.3.1-2_amd64.deb
 cdb6fcb77701eba414b06cd8609f6837e3b3935c 219120 amule-plasmamule_2.3.1-2_amd64.deb
 4a37696644492ac6cc5923407505c53d42c6e5bb 2111034 amule-common_2.3.1-2_all.deb
 0645c2822113ec65eb17df041010b87f9a2497f5 129150 amule-gnome-support_2.3.1-2_all.deb
Checksums-Sha256: 
 3c2a0d7bde743bb339b5141168fed705f54f918b0b90cc2a7a6f52eafd0c06c4 1807 amule_2.3.1-2.dsc
 a8378d3522b9b93df0fc0fdf684be4c2c6b105ce3ed96ab26e7bd6197fe8f0fa 26322 amule_2.3.1-2.debian.tar.gz
 93bd1d220ea9b32c48f517e7accb2fa4d5d95f42d9c87df569852099c3b66c89 1780196 amule_2.3.1-2_amd64.deb
 e1537d7c2a68fd4bf48e427e60ae38e20f6a3847196991871292faecb4c19284 516752 amule-utils_2.3.1-2_amd64.deb
 0a6bdf672c4a0cd71aa537ac3d3722e61b7becb298be5ede748308a6d0ca844b 1351400 amule-utils-gui_2.3.1-2_amd64.deb
 7ad3280cc13b0da4b332dca7505cfc33e9d9044189e7176e75a659dd52a5774f 1275728 amule-daemon_2.3.1-2_amd64.deb
 55ec536297fa675ce7a704a9226fd3fcf5e68811011fd5595114950e90cdf241 219120 amule-plasmamule_2.3.1-2_amd64.deb
 9c1c295f83766d95d81771233aa694442695dfbafb1a86195da548693afba75d 2111034 amule-common_2.3.1-2_all.deb
 0f59357067a4567b3fb5042a15990cbc08cfbb950b51e25711ca72bcd6cb67f7 129150 amule-gnome-support_2.3.1-2_all.deb
Files: 
 f49ab377f2deee8b52844bb20fb696bc 1807 net optional amule_2.3.1-2.dsc
 2c27dd0c26d4e8e7330258f82ccd8488 26322 net optional amule_2.3.1-2.debian.tar.gz
 44b174e4bf32ae91157330c554bd5020 1780196 net optional amule_2.3.1-2_amd64.deb
 c6d9e9b1725e6058e8ef22e56f9beef8 516752 net optional amule-utils_2.3.1-2_amd64.deb
 32226ae8c213c725b936fce40d0207fe 1351400 net optional amule-utils-gui_2.3.1-2_amd64.deb
 887ef2a0fb330b2b363cdf2353b478a9 1275728 net optional amule-daemon_2.3.1-2_amd64.deb
 1adf26406213ec9fdb0e46e6121f29ff 219120 net optional amule-plasmamule_2.3.1-2_amd64.deb
 fc627ff990bcda915bbafe725d1c6d94 2111034 net optional amule-common_2.3.1-2_all.deb
 a0409199476016b6bd5b58b993c147a7 129150 net optional amule-gnome-support_2.3.1-2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAk7+MAMACgkQAukwV0RN2VABRQCdEb/rJ3Cf58A6xYPjJwCYXLat
wqAAn08CN53SAKQMGARIXbw3b3geRKoV
=tiIW
-----END PGP SIGNATURE-----

Message #31 received at 653503@bugs.debian.org (full text, mbox, reply):

From: Simon Ruderich <simon@ruderich.org>

To: 653503@bugs.debian.org

Subject: Hardening flags missing for mkFileSum.c

Date: Mon, 12 Mar 2012 23:55:12 +0100

[Message part 1 (text/plain, inline)]

Dear Maintainer,

The hardening flags are missing for mkFileSum.c because the build
system doesn't use them.

The attached patch fixes the issue - but I'm not sure if it's the
best way, I have no idea why the build system use BUILD_*FLAGS
variables instead of just *FLAGS. If possible it should be sent
upstream (maybe in modified form).

Regards,
Simon

[1]: https://wiki.debian.org/ReleaseGoals/SecurityHardeningBuildFlags
[2]: https://wiki.debian.org/HardeningWalkthrough
[3]: https://wiki.debian.org/Hardening
-- 
+ privacy is necessary
+ using gnupg http://gnupg.org
+ public key id: 0x92FEFDB7E44C32F9

[libs-use-dpkg-buildflags.diff (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #38 received at 653503@bugs.debian.org (full text, mbox, reply):

From: Sandro Tosi <morph@debian.org>

To: 653503@bugs.debian.org,control@bugs.debian.org,653503-submitter@bugs.debian.org

Subject: [c6b9487] Fix for Bug#653503 committed to git

Date: Sat, 07 Apr 2012 22:27:22 +0000

tags 653503 + pending
thanks

Hello,

     The following change has been committed for this bug by
 Sandro Tosi <morph@debian.org> on Sun, 8 Apr 2012 00:27:09 +0200.
 The fix will be in the next upload. 
=========================================================================
enable hardening flags for mkFileSum.c too; thanks to Simon Ruderich for the patch; Closes: #653503


=========================================================================

You can check the diff of the fix at:

    http://git.debian.org/?p=pkg-amule/amule.git;a=commitdiff;h=c6b9487

Message #48 received at 653503@bugs.debian.org (full text, mbox, reply):

From: Stu Redman <stuamule@googlemail.com>

To: 653503@bugs.debian.org

Subject: Please leave mkFileSum alone

Date: Sun, 29 Apr 2012 18:20:51 +0200

[Message part 1 (text/plain, inline)]

Hi,

patch from message #31 is not only useless (mkFileSum is just a build 
tool, no need to pack it into a package or harden it).
It also breaks cross platform compilation.
I suggest you revert it.

Regards,
Stu Redman, aMule developer

[Message part 2 (text/html, inline)]

Message #53 received at 653503-close@bugs.debian.org (full text, mbox, reply):

From: Sandro Tosi <morph@debian.org>

To: 653503-close@bugs.debian.org

Subject: Bug#653503: fixed in amule 2.3.1-7

Date: Thu, 03 May 2012 21:05:35 +0000

Source: amule
Source-Version: 2.3.1-7

We believe that the bug you reported is fixed in the latest version of
amule, which is due to be installed in the Debian FTP archive:

amule-common_2.3.1-7_all.deb
  to main/a/amule/amule-common_2.3.1-7_all.deb
amule-daemon_2.3.1-7_amd64.deb
  to main/a/amule/amule-daemon_2.3.1-7_amd64.deb
amule-gnome-support_2.3.1-7_all.deb
  to main/a/amule/amule-gnome-support_2.3.1-7_all.deb
amule-utils-gui_2.3.1-7_amd64.deb
  to main/a/amule/amule-utils-gui_2.3.1-7_amd64.deb
amule-utils_2.3.1-7_amd64.deb
  to main/a/amule/amule-utils_2.3.1-7_amd64.deb
amule_2.3.1-7.debian.tar.gz
  to main/a/amule/amule_2.3.1-7.debian.tar.gz
amule_2.3.1-7.dsc
  to main/a/amule/amule_2.3.1-7.dsc
amule_2.3.1-7_amd64.deb
  to main/a/amule/amule_2.3.1-7_amd64.deb
plasma-widget-amule_2.3.1-7_amd64.deb
  to main/a/amule/plasma-widget-amule_2.3.1-7_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 653503@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sandro Tosi <morph@debian.org> (supplier of updated amule package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Thu, 03 May 2012 22:11:58 +0200
Source: amule
Binary: amule amule-common amule-utils amule-utils-gui amule-daemon amule-gnome-support plasma-widget-amule
Architecture: source amd64 all
Version: 2.3.1-7
Distribution: unstable
Urgency: low
Maintainer: Debian aMule Team <pkg-amule-devel@lists.alioth.debian.org>
Changed-By: Sandro Tosi <morph@debian.org>
Description: 
 amule      - client for the eD2k and Kad networks, like eMule
 amule-common - common files for the rest of aMule packages
 amule-daemon - non-graphic version of aMule, a client for the eD2k and Kad netwo
 amule-gnome-support - ed2k links handling support for GNOME web browsers
 amule-utils - utilities for aMule (command-line version)
 amule-utils-gui - graphic utilities for aMule
 plasma-widget-amule - kde plasmoid to control amule
Closes: 653503 662267 670962
Changes: 
 amule (2.3.1-7) unstable; urgency=low
 .
   * [af4640e] build-depends on libpng-dev, to prepare for libpng transition;
     thanks to Nobuhiro Iwamatsu for the report; Closes: #662267
   * [c6b9487] enable hardening flags for mkFileSum.c too; thanks to Simon
     Ruderich for the patch; Closes: #653503
   * [117b5c6] Handle libupnp3->libupnp6 transition; thanks to Adam D. Barratt
     for the report and Nick Leverton for the patch; Closes: #670962
   * [2c2f6d5] Bump Standards-Version to 3.9.3 (no changes needed)
   * [6bae44f] don't ignore real errors with lintian-overrides
Checksums-Sha1: 
 fd93ebc9ae5eae6805fc03cd5f7da540b6649a03 1810 amule_2.3.1-7.dsc
 7c672af083931e4c834486bc696e0addbfb050c4 27695 amule_2.3.1-7.debian.tar.gz
 ecab05570deca3021e8a1aa0800a5226566deb01 1780422 amule_2.3.1-7_amd64.deb
 55f1e1fe2199a221a42c9d1f4f5e8d28c48665b1 517068 amule-utils_2.3.1-7_amd64.deb
 2a3dd5d0bbf43d9e14bd29989f0642e5eb88e74f 1351934 amule-utils-gui_2.3.1-7_amd64.deb
 69100b0786f7827523438aa2828068cc858a831b 1276030 amule-daemon_2.3.1-7_amd64.deb
 ad22c527b66473a087d7915f00aee23576f35bce 219644 plasma-widget-amule_2.3.1-7_amd64.deb
 a9a06fdf59bbbec9efb07386b30641d07791149e 2111610 amule-common_2.3.1-7_all.deb
 e38f31ec90d89f7b55ec76d55a8da5ca2efea103 129616 amule-gnome-support_2.3.1-7_all.deb
Checksums-Sha256: 
 218d6df3348a575b1f9e8cc5980ee4fc36885e80bfd7b24e3d98600ca61cfdf3 1810 amule_2.3.1-7.dsc
 957e8d981fe61a53f7923aa177502e4a10687a3682094998a1878137503ef376 27695 amule_2.3.1-7.debian.tar.gz
 eef80a20bc52ca2adac6ff2cc48faa988048eace51e7a6f2b82ba9ff369c23d6 1780422 amule_2.3.1-7_amd64.deb
 f8070a1214db92147f27502070f8254f2d8c0c8f7021a5ace1a6315a4fa22552 517068 amule-utils_2.3.1-7_amd64.deb
 23f3c87bcdcf7e8d192ab44ef85578a3c1256cf335ca0d882653760aaa0ecbe4 1351934 amule-utils-gui_2.3.1-7_amd64.deb
 8d520a28e69a06d6f487f1c301b80c20889ca0c4e2aaab17fc5b6188412cea6c 1276030 amule-daemon_2.3.1-7_amd64.deb
 a731019a83298bd5058080cc50382eed2a06ce245d9682405a0e1a0468e8dc16 219644 plasma-widget-amule_2.3.1-7_amd64.deb
 d525abc010abc32eb9d915dc9e6e79cfd91ee2f765828a51dbce2d46971e9a8e 2111610 amule-common_2.3.1-7_all.deb
 99e11c672df8122cdc3b08644236ba0c6c8bbae1bcd47c93c0113b764d18e2bf 129616 amule-gnome-support_2.3.1-7_all.deb
Files: 
 5072865eb87eb568b14385573579cd69 1810 net optional amule_2.3.1-7.dsc
 1684737c9e84489437443e8572a08935 27695 net optional amule_2.3.1-7.debian.tar.gz
 e0746bcca900050696bb392a4d8594c9 1780422 net optional amule_2.3.1-7_amd64.deb
 46300f495cee696564a25b45ed375048 517068 net optional amule-utils_2.3.1-7_amd64.deb
 318561eb7267ad30a6b056721735c981 1351934 net optional amule-utils-gui_2.3.1-7_amd64.deb
 b6750ee941f98e71d26b91946e67885e 1276030 net optional amule-daemon_2.3.1-7_amd64.deb
 49258e8a55232d44e2110cd6fe630afd 219644 net optional plasma-widget-amule_2.3.1-7_amd64.deb
 aee5f29108ff6b442130c9cf0dafdcaa 2111610 net optional amule-common_2.3.1-7_all.deb
 8e3c03b06114cd48b554b9b915a5c57f 129616 net optional amule-gnome-support_2.3.1-7_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAk+i6aQACgkQAukwV0RN2VDtRgCgndiQDDKkzYn9rkrxNMFnCEsV
4cYAn2z+/VXYAlvnJB3vCm0cpOHx5jAw
=9Gqp
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.