[dput-ng-maint] Bug#696659: Security uploads not working

Moritz Mühlenhoff jmm at inutil.org
Wed Dec 26 15:05:19 UTC 2012


On Wed, Dec 26, 2012 at 03:27:26PM +0100, Moritz Mühlenhoff wrote:
> On Wed, Dec 26, 2012 at 01:24:42PM +0100, Arno Töll wrote:
> > Hi,
> > 
> > On 26.12.2012 03:48, Paul Tagliamonte wrote:
> > > Arno, can you ACK this change?
> > 
> > The patch itself is fine, but I believe a warning instead of an error
> > would be more appropriate. You do logger.error, but you don't fail out
> > which makes your error essentially a warning. Maybe it should be tagged
> > as such.
> > 
> > 
> > By the way Moritz: You as a security team member probably want to
> > disable the "protected distribution" hook, prompting you for
> > confirmation before every upload.
> 
> Thanks, I will try that with the next security upload tonight.

I can easily workaround it, but just to let you know

It still fails to me if /etc/dput.cf is still present:

jmm at pisco:~/chroots/squeeze/home/jmm/free$ ls -lha /usr/bin/dput
-rwxr-xr-x 1 root root 4,5K Dez 26 15:33 /usr/bin/dput
jmm at pisco:~/chroots/squeeze/home/jmm/free$ dput security-master freetype_2.4.2-2.1+squeeze5_amd64.changes
Uploading freetype using ftp to security-master (host: security-master.debian.org; directory: /pub/SecurityUploadQueue)
running allowed-distribution: check whether a local profile permits uploads to the target distribution
running protected-distribution: warn before uploading to distributions where a special policy applies
Protected Checker: Are you sure to upload to stable-security? Did you coordinate with the Security Team before your upload? [yes, NO]: yes
Uploading with explicit confirmation by the user
running checksum: verify checksums before uploading
running suite-mismatch: check the target distribution for common errors
running check-debs: makes sure the upload contains a binary package
running gpg: check GnuPG signatures before the upload
gpg: Unterschrift vom Mi 26 Dez 2012 16:00:19 CET mittels DSA-Schl�ssel ID 4E2ECA5A
gpg: Korrekte Unterschrift von "Moritz Muehlenhoff <jmm at debian.org>"
gpg:                     alias "Moritz Muehlenhoff <jmm at inutil.org>"

Could not execute /usr/share/dput/helper/security-warning: [Errno 2] No such file or directory
Traceback (most recent call last):
  File "/usr/bin/dput", line 87, in <module>
    upload_package(changes, args)
  File "/usr/lib/python2.7/dist-packages/dput/uploader.py", line 275, in invoke_dput
    simulate=args.simulate) as obj:
  File "/usr/lib/python2.7/contextlib.py", line 17, in __enter__
    return self.gen.next()
  File "/usr/lib/python2.7/dist-packages/dput/uploader.py", line 157, in uploader
    obj._pre_hook()
  File "/usr/lib/python2.7/dist-packages/dput/uploader.py", line 64, in _pre_hook
    self._run_hook("pre_upload_command")
  File "/usr/lib/python2.7/dist-packages/dput/uploader.py", line 72, in _run_hook
    sys.stdout.write(output)  # XXX: Fixme
TypeError: expected a character buffer object

jmm at pisco:~/chroots/squeeze/home/jmm/free$ dpkg -l dput-ng
Gew�nscht=Unbekannt/Installieren/R=Entfernen/P=Vollst�ndig L�schen/Halten
| Status=Nicht/Installiert/Config/U=Entpackt/halb konFiguriert/
         Halb installiert/Trigger erWartet/Trigger anh�ngig
|/ Fehler?=(kein)/R=Neuinstallation notwendig (Status, Fehler: GROSS=schlecht)
||/ Name                       Version            Architektur        Beschreibung
+++-==========================-==================-==================-=========================================================
ii  dput-ng                    1.3                all                next generation Debian package upload tool


Cheers,
        Moritz



More information about the dput-ng-maint mailing list