Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1214348 > unrolled thread

Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy

Started byAndrey Rakhmatullin <wrar@debian.org>
First post2024-09-26 19:30 +0200
Last post2024-10-04 01:00 +0200
Articles 6 — 4 participants

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Andrey Rakhmatullin <wrar@debian.org> - 2024-09-26 19:30 +0200
    Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Philipp Kern <pkern@debian.org> - 2024-09-30 09:50 +0200
      Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Andrey Rakhmatullin <wrar@debian.org> - 2024-09-30 13:40 +0200
        Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Chris Hofstaedtler <zeha@debian.org> - 2024-10-01 23:10 +0200
          Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Philipp Kern <pkern@debian.org> - 2024-10-02 11:40 +0200
    Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy Javier Fernandez-Sanguino <jfs@computer.org> - 2024-10-04 01:00 +0200

#1214348 — Bug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy

FromAndrey Rakhmatullin <wrar@debian.org>
Date2024-09-26 19:30 +0200
SubjectBug#1082808: RM: samhain -- RoQA; unmaintained; RC-buggy
Message-ID<Jr0tr-f0z8-1@gated-at.bofh.it>
Package: ftp.debian.org
Severity: normal
X-Debbugs-Cc: samhain@packages.debian.org
Control: affects -1 + src:samhain
User: ftp.debian.org@packages.debian.org
Usertags: remove

Not in testing since Apr 2024. No maintainer uploads since 2016. No revdeps.

[toc] | [next] | [standalone]

#1214682

FromPhilipp Kern <pkern@debian.org>
Date2024-09-30 09:50 +0200
Message-ID<Jsjkl-fRFb-5@gated-at.bofh.it>
In reply to#1214348
Control: user debian-admin@lists.debian.org
Control: usertags -1 needed-by-DSA-Team

Hi,

On Thu, Sep 26, 2024 at 10:18:57PM +0500, Andrey Rakhmatullin wrote:
> Package: ftp.debian.org
> Severity: normal
> X-Debbugs-Cc: samhain@packages.debian.org
> Control: affects -1 + src:samhain
> User: ftp.debian.org@packages.debian.org
> Usertags: remove
> 
> Not in testing since Apr 2024. No maintainer uploads since 2016. No revdeps.

This feels like a tad too much. Could we make sure this is orphaned
first and see if there's someone willing to maintain it?

For context: DSA is currently using this package as our host IDS. It
works and while new upstream releases exist, it's not like we need new
features.

Obviously the RC bug needs fixing and I'll go and upload the patch. But
it'd be better to get it orphaned properly.

Kind regards
Philipp Kern

[toc] | [prev] | [next] | [standalone]

#1214705

FromAndrey Rakhmatullin <wrar@debian.org>
Date2024-09-30 13:40 +0200
Message-ID<JsmUW-fU7e-25@gated-at.bofh.it>
In reply to#1214682

[Multipart message — attachments visible in raw view] — view raw

On Mon, Sep 30, 2024 at 07:41:50AM +0000, Philipp Kern wrote:
> > Package: ftp.debian.org
> > Severity: normal
> > X-Debbugs-Cc: samhain@packages.debian.org
> > Control: affects -1 + src:samhain
> > User: ftp.debian.org@packages.debian.org
> > Usertags: remove
> > 
> > Not in testing since Apr 2024. No maintainer uploads since 2016. No revdeps.
> 
> This feels like a tad too much. Could we make sure this is orphaned
> first and see if there's someone willing to maintain it?

This assumes formally orphaned packages attract more contributors than
just unmaintained ones, even when RC-buggy and not in testing.

> For context: DSA is currently using this package as our host IDS. It
> works and while new upstream releases exist, it's not like we need new
> features.

I see.

For the record: "new releases aren't packaged" is not the reason I'm
suggesting to drop this, it's the fact that it's RC-buggy for 6 months.

For the context: I was looking at libprelude which doesn't support Python
3.13 (#1081473) and I've found that this whole leaf stack of 8 packages is
unmaintained, has low popcon and several RC-buggy packages.
As was discussed a couple of times, most recently a month ago in d-d@, see
e.g. <869352CA-781D-44D2-949D-5E7FFCF578FA@kitterman.com>, I suggested in
that bug report that RMing the whole stack is possible and then filed two
RM bugs for two of its packages which are already leaf, RC-buggy and not
in testing (sagan and samhain).
As discussed in the past, the MIA process is dead and there is no other
official process to orphan somebody else's packages, and also as someone
who often sees packages that are broken right now where filing RM
immediately is a good idea, as opposed to packages that are simply
unmaintained/NMU-maintained, where filing O immediately is a good idea,
I often do the former and only rarely do the latter. It would indeed be
nice to have someone routinely orphan somebody else's packages before it's
too late, but there is work needed to be done for that.

-- 
WBR, wRAR

[toc] | [prev] | [next] | [standalone]

#1214834

FromChris Hofstaedtler <zeha@debian.org>
Date2024-10-01 23:10 +0200
Message-ID<JsSi5-ghIF-3@gated-at.bofh.it>
In reply to#1214705
On Mon, Sep 30, 2024 at 04:36:10PM +0500, Andrey Rakhmatullin wrote:
> > For context: DSA is currently using this package as our host IDS. It
> > works and while new upstream releases exist, it's not like we need new
> > features.
[..]
> 
> For the context: I was looking at libprelude which doesn't support Python
> 3.13 (#1081473) and I've found that this whole leaf stack of 8 packages is
> unmaintained, has low popcon and several RC-buggy packages.

Would samhain continue to be useful to DSA without libprelude?

That would allow removing libprelude, and samhain can stay around a
bit longer until a maintainer shows up or it breaks later?

Chris

[toc] | [prev] | [next] | [standalone]

#1214877

FromPhilipp Kern <pkern@debian.org>
Date2024-10-02 11:40 +0200
Message-ID<Jt3ZU-goI2-9@gated-at.bofh.it>
In reply to#1214834
Hi,

On 10/1/24 10:59 PM, Chris Hofstaedtler wrote:
> On Mon, Sep 30, 2024 at 04:36:10PM +0500, Andrey Rakhmatullin wrote:
>>> For context: DSA is currently using this package as our host IDS. It
>>> works and while new upstream releases exist, it's not like we need new
>>> features.
> [..]
>>
>> For the context: I was looking at libprelude which doesn't support Python
>> 3.13 (#1081473) and I've found that this whole leaf stack of 8 packages is
>> unmaintained, has low popcon and several RC-buggy packages.
> 
> Would samhain continue to be useful to DSA without libprelude?
> 
> That would allow removing libprelude, and samhain can stay around a
> bit longer until a maintainer shows up or it breaks later?

At least from our side removing libprelude support would be completely
fine. And it seems optional on the samhain side as well.

Kind regards
Philipp Kern

[toc] | [prev] | [next] | [standalone]

#1215071

FromJavier Fernandez-Sanguino <jfs@computer.org>
Date2024-10-04 01:00 +0200
Message-ID<JtCXD-gKc1-3@gated-at.bofh.it>
In reply to#1214348

[Multipart message — attachments visible in raw view] — view raw

Dear Andrey,

I have been unable to work in this package for some time, but, as indicated
in bug #1083112, I have uploaded today my repo to Salsa to enable team
maintainership (by the security-tools packaging team). I have also worked
on fixing some bugs and will try to make an upload to the archive soon.

Reviewing this bug's thread (which BTW i do not receive for whatever
reason) I have also committed a fix [1]  to remove the dependency from
libprelude so that it is not affected by the bugs in that package.

[1]
https://salsa.debian.org/pkg-security-team/samhain/-/commit/50eb7ef3ebb7f72c9381df8d5747cf177246ce04

Best regards,

Javier

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web