Hi,

this email contains several important points. Please read all of it
carefully.

Due to the weakness in our openssl's random number generator (see the
Debian Security Advisory #1571 from a few minutes ago[1]) that affects
among other things ssh keys we have disabled public key auth on all
project systems until further notice.

If you operate a service on debian.org machines that requires key based
auth for instance to transfer stuff between hosts or to push rebuilds
please contact DSA[2] after you verified the keys in question are safe,
or have replaced them. We can enable individual accounts' key based
access.

Export of ssh keys from the LDAP to our machines is currently disabled,
and will be enabled only after we have cleared all ssh keys from the
database and put resonable safeguards in place to prevent people from
uploading bad keys. An announcement will be made on the mailinglist
debian-infrastructure-announce[4] at such time. There is no point
in adding new keys to the ldap right now.

Heya,

To finally finish the Perl5.10 transition, I have just used the dak
transitions feature to block uploads for a few packages (~250) involved
with it. A complete list (passed through dd-list) is attached.

I will send another mail when this transition is finished. At the
moment, we are waiting for builds for the sendmail/clamav
mini-transitions.

Thanks for the attention,
Marc

Hi,

following a suggestion from Bug #479953[1] there are two new headers defined
for automated package maintenance emails, to make it easier for
Developers to filter mail from all the various tools in Debian sending
mail.

The headers follow the definition in the following few points:

a. Every tool can add X-whatever headers as it sees fit, but do not
bloat the mails unneccesarily.

b. Every tool sending automated mail to Debian Developers should add
headers of the form

X-Debian: $TOOL
X-Debian-Package: $PACKAGE

and so clearly mark that it is an automagic generated mail by
$TOOL and about $PACKAGE. Every bit more information, like what
script exactly did generate the mail, should be in seperate
X-whatever headers or the mail body.

The X-Debian-Package: header can be omitted if it is not possible to
name a specific source package for a mail, like when the mail is
about multiple packages.

Hi,

good news for me that Marc 'HE' Brockschmidt didn't become DPL (though I
think he would've been a good DPL), so I managed to convince him to
become Release Manager. Of course, Luk stays Release Manager, and I will
also continue to help releasing Lenny as release wizard.

I want to use this occasion to thank all the people (in different roles)
who helped so far with the releases I had the privilege to be involved
from a closer distance, that are Sarge, Etch and Lenny - I'm enjoying
most of that. Thanks for all the support from so many people in Debian.

Cheers,
Andi

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFIG4l8mdOZoew2oYURAlh/AJ9DylMVOsm7cXSjnkqdE8eMaBuArgCgnB6i
FkwjG/3/q6Yuln7qMFyMS3k=
=uVaH
-----END PGP SIGNATURE-----

Hello,

The latest run of britney put python-defaults 2.5 in testing, along with
140 more packages and 600 binNMUs. This means that the blocking of
uploads previously announced here is no longer in place.

The next transition in the release team's plate is Perl 5.10, and Marc
Brockschmidt will be coordinating it. Other transitions that we've been
notified about and haven't forgotten are:

* ocaml 3.10.2
* poppler 0.8.0
* ffmpeg

Plus some minor ones already in unstable like heimdal and webkit.

If you have a pending transition in one of your packages, please send a
mail to lists.debian.org> to notify that it should be
done at some point, so that we can allocate a slot for it. As always,
you are welcome to upload SONAME-bumping packages to experimental first.

Thanks for your cooperation,

--
Adeodato Simó

After extensive discussion in Bug#250202 and elsewhere on how to handle
the increasing variety of different build and patch systems in Debian, the
consensus on the debian-policy list is to recommend adding a new
documentation file, debian/README.source, to any Debian source package
with a complex build system. The precise definition of "complex" is a
package where one one cannot unpack the source package with dpkg-source -x
and immediately get the source that would be built without running further
commands or where additional steps must be taken to incorporate changes
beyond just modifying files.

This new recommendation is *not* RC for lenny, only a recommendation.
However, it is still a recommendation that most affected packages don't
currently follow, so I wanted to give the development community a heads-up
on this change.

The specific new wording is:

4.14. Source package handling: `debian/README.source'
=2D----------------------------------------------------

After some discussion with James and Joerg, Christoph Berg
debian.org> has accepted an offer to join the Debian Account
Manager team. He's already shown his skills on NM Front Desk, so I'm
happy to confirm his delegation here.

Welcome to the team, Christoph!

--
Steve McIntyre, Debian Project Leader debian.org>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIFlawfDt5cIjHwfcRAmJOAKCx9AMl0N/gAWaEgQ1CVx0FKBz3pQCbBYp/
KJcA50bZebTro7dILDSS+5w=
=Y5ZA
-----END PGP SIGNATURE-----

Hi folks,

As part of my election platform this year, I promised a thorough
review of how Debian's team are working. It's taken a few days longer
than I planned to get here, but I've just sent out copies of a survey
to lots of our mailing lists. I've deliberately sent those mails to
individual teams wherever I could easily identify them, but I know
that I'm just about guaranteed to have missed out some people. Don't
feel slighted if I forgot your team - it's nothing personal! If you're
working in a team for something larger than just a single package and
you haven't already received a copy of the survey yet, then please
grab it from

http://people.debian.org/~93sam/teams_review.txt

, fill it in and mail it back to me at leader@debian.org. I want
responses inside the next 4 weeks (by 23:59:59 UTC, Sunday 25th May),
so please don't delay - help fill my inbox today!

I hope to present you with more news on other fronts in the next few
days, but I wanted to highlight this survey right now.

The news are collected on http://wiki.debian.org/DeveloperNews
Please contribute: add important news related to your Debian work, too.

debhelper v7
------------

debhelper v7 is ready for daring developers to use. In this version I've
tried to learn some things from cdbs, and the result is a new "dh"
command which can be used to create debian/rules files that are as short
as 3 lines for many packages. I hope this will be more powerful and have
a lower learning curve than cdbs, so give it a try.

-- Joey Hess

Help the DPL
------------

Steve McIntyre, our beloved DPL, has requested help[1] in handling the CD
build infrastructure. Work is needed on an on-going basis to handle the
weekly/daily ISO images and also at release time to generate and test the
final ISO images.

-- Raphaël Hertzog

[1] http://lists.debian.org/debian-cd/2008/04/msg00041.html

Hello.

We're currently trying to migrate Python 2.5 as default to testing,
which involves a lot of packages -- including some unrelated ones like
the Mozilla family (via the hunspell transition, tied to Python via
OpenOffice), and the Evolution gang, tied to Python via deskbar-applet
and empathy.

We're sloowly getting there, and reaching the point at which uploads of
some of the involved packages are starting to get in the way: almost all
sourceful fixes are in the archive already, and we're only missing a
handful of builds on some architectures, which should be ready in the
next days.

Because of this, we've decided to make use of the "release transitions"
feature implemented by ftpmaster [1, 2] to temporarily block uploads of
(*gasp*) all the involved packages.

This means that uploads will be rejected by dak, but it does not mean
that you can't **coordinate with us to make an upload**. The idea is to
prevent disturbing uploads, but if you have something that it's important
to upload (like fixes for RC bugs), please mail debian-release@l.d.o and
we'll talk.