Forw/Re: Removal of systemtap from testing

Forw/Re: Removal of systemtap from testing

[Frank Ch. Eigler]

Hi -

mehdi wrote on debian-devel:

> Systemtap seems in pretty bad shape. Its removal from testing has
> been requested (See #635543) and will be effective by Saturday if
> still not fixed.  It you still care about systemtap, please step up
> and offer your help to fix it.

While we have no debian contributors on the team, would it help if we
adopt debian build metadata within the source tree?

(For what it's worth, the recent unprivileged-usage-related security
problems may not affect debian, as debian kernels lack user-space
probing support, so unprivileged/stapusr configurations are unlikely.)

- FChE

Re: Forw/Re: Removal of systemtap from testing

[Lucas Nussbaum]

On 27/07/11 at 10:39 -0400, Frank Ch. Eigler wrote:
> Hi -
> 
> mehdi wrote on debian-devel:
> 
> > Systemtap seems in pretty bad shape. Its removal from testing has
> > been requested (See #635543) and will be effective by Saturday if
> > still not fixed.  It you still care about systemtap, please step up
> > and offer your help to fix it.
> 
> While we have no debian contributors on the team, would it help if we
> adopt debian build metadata within the source tree?

Hi,

I don't think so: it's usually considered better practice to keep the
debian packaging separate from the upstream sources (even if YMMV).

What would help:
- subscribe to systemtap email notifications on the PTS
  (http://packages.qa.debian.org/s/systemtap.html, see little box on the
  bottom left corner) and contribute to the bug mail when you receive
  some
- go through systemtap bugs on
  http://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=systemtap
  comment on them by sending email to bugnumber@bugs.debian.org (e.g
  635542@bugs.debian.org)

I'm interested in systemtap, but don't have much time to spend on
maintaining it currently. I don't know:

- how many of the current critical issues affecting the Debian package
  are fixed in the latest upstream version (1.5). (I expect "all of
  them")

- if that latest upstream version would work on Debian

Any input on that would be very much appreciated.

If you want to dig deeper, the debian package are available from git
(see links on the PTS page mentioned above).

Thanks,

- Lucas

Re: Forw/Re: Removal of systemtap from testing

[Josh Stone]

On 07/27/2011 11:08 AM, Lucas Nussbaum wrote:
> I'm interested in systemtap, but don't have much time to spend on
> maintaining it currently. I don't know:
> 
> - how many of the current critical issues affecting the Debian package
>   are fixed in the latest upstream version (1.5). (I expect "all of
>   them")

The latest is actually 1.6, released two days ago.  All known security
bugs are fixed in that release.  Compatibility issues should also be
fixed, e.g. for the gcc 4.6 bug 625414.  If for some reason you couldn't
update to the latest, we can certainly help identify the patches needed.

> - if that latest upstream version would work on Debian

It should.  We strive to maintain compatibility all the way from RHEL4
(kernel 2.6.9+) to Fedora rawhide (now kernel 3.0).  So as much as any
older version of systemtap worked on Debian, the new should too, and
we'll gladly accept bugs reporting otherwise.


Josh

Re: Forw/Re: Removal of systemtap from testing

[Lucas Nussbaum]

On 29/07/11 at 11:31 +1000, Nathan Scott wrote:
> Hi Lucas,
> 
> On 28 July 2011 04:08, Lucas Nussbaum <lucas@lucas-nussbaum.net> wrote:
> 
> > ...
> > What would help:
> > - subscribe to systemtap email notifications on the PTS
> >  (http://packages.qa.debian.org/s/systemtap.html, see little box on the
> >  bottom left corner) and contribute to the bug mail when you receive
> >  some
> > - go through systemtap bugs on
> >
> > http://bugs.debian.org/cgi-bin/pkgreport.cgi?repeatmerged=no&src=systemtap
> >  comment on them by sending email to bugnumber@bugs.debian.org (e.g
> >  635542@bugs.debian.org)
> >
> > I'm interested in systemtap, but don't have much time to spend on
> > maintaining it currently. I don't know:
> >
> >
> I'm in a similar camp - I'd like to help but time is always the enemy.  I
> would
> be interested in being part of a maintainer team though, if others are keen?
> I'm happy to go through the current deb packaging and update it for current
> systemtap and to the current deb standards version (unless someone has
> already started?) but I wont be able to do that by tomorrow.

Hi,

Please get in touch with the other systemtap maintainer (Ritesh Raj
Sarraf <rrs@debian.org>, Cced). He currently has the "lock" on the
update of 1.6. Help is of course welcomed.

Lucas

Re: Forw/Re: Removal of systemtap from testing

[Frank Ch. Eigler]

[-- Attachment #1: Type: text/plain, Size: 895 bytes --]

Hi, Ritesh -

On Fri, Jul 29, 2011 at 01:01:54PM +0530, Ritesh Raj Sarraf wrote:
> [...]
> The 1.6 packaging is almost done. It runs on my box.

Thank you very much.

> TODO:
> * 1.6 stripped down many things. The systemtap-client package is almost
> empty. The only worthy file it installs is stap-env. I'm not sure if
> that is still required (I use stap only on my local box).

You can eliminate the -client subpackage entirely.  That facility is
built into the main stap executable now.

> * There were a bunch of CVEs. We need to run through them to check which
> all are fixed in the 1.6 release.  If they are not, we need to pull in
> those fixes.

They are.

> * There's also an FTBFS with newer gcc. That needs to be fixed.

We're happy to pull in such patches; we'll keep an eye out here:

http://anonscm.debian.org/gitweb/?p=collab-maint/systemtap.git;a=tree;f=debian/patches

- FChE

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Forw/Re: Removal of systemtap from testing

[Ritesh Raj Sarraf]

[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]

On 07/29/2011 12:17 PM, Lucas Nussbaum wrote:
> Please get in touch with the other systemtap maintainer (Ritesh Raj
> Sarraf <rrs@debian.org>, Cced). He currently has the "lock" on the
> update of 1.6. Help is of course welcomed.

Yes, please. Any help is appreciated. If you'd like to co-maintain,
please respond to this email. I'll add you to uploaders.

The 1.6 packaging is almost done. It runs on my box.

TODO:
* 1.6 stripped down many things. The systemtap-client package is almost
empty. The only worthy file it installs is stap-env. I'm not sure if
that is still required (I use stap only on my local box).

* There were a bunch of CVEs. We need to run through them to check which
all are fixed in the 1.6 release.  If they are not, we need to pull in
those fixes.

* There's also an FTBFS with newer gcc. That needs to be fixed.


Frank, can you please confirm if the following CVEs are fixed in 1.6 ?

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2502
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-2503
CVE-2011-1769
CVE-2011-1781

It doesn't talk about the exact systemtap version in the bug report.


-- 
Ritesh Raj Sarraf | http://people.debian.org/~rrs
Debian - The Universal Operating System


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 900 bytes --]