Debian Package Tracker
Register | Log in
Subscribe

pcp

System level performance monitoring and performance management

Choose email to subscribe with

general
  • source: pcp (main)
  • version: 7.2.2-1
  • maintainer: PCP Development Team (DMD)
  • uploaders: Nathan Scott (DMD) – Ken McDonell (DMD)
  • arch: all any
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 5.2.6-1
  • oldstable: 6.0.3-1.1
  • stable: 6.3.8-1
  • testing: 7.2.2-1
  • unstable: 7.2.2-1
versioned links
  • 5.2.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.0.3-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.3.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.2.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libpcp-archive1
  • libpcp-archive1-dev
  • libpcp-gui2
  • libpcp-gui2-dev
  • libpcp-import-perl
  • libpcp-import1
  • libpcp-import1-dev
  • libpcp-import2
  • libpcp-import2-dev
  • libpcp-logsummary-perl
  • libpcp-mmv-perl
  • libpcp-mmv1
  • libpcp-mmv1-dev
  • libpcp-pmda-perl
  • libpcp-pmda3
  • libpcp-pmda3-dev
  • libpcp-trace2
  • libpcp-trace2-dev
  • libpcp-web1
  • libpcp-web1-dev
  • libpcp3
  • libpcp3-dev
  • libpcp4
  • libpcp4-dev
  • pcp (2 bugs: 0, 2, 0, 0)
  • pcp-atop
  • pcp-conf
  • pcp-doc
  • pcp-dstat (1 bugs: 0, 1, 0, 0)
  • pcp-export-pcp2elasticsearch
  • pcp-export-pcp2graphite
  • pcp-export-pcp2influxdb
  • pcp-export-pcp2json
  • pcp-export-pcp2spark
  • pcp-export-pcp2xlsx
  • pcp-export-pcp2xml
  • pcp-export-pcp2zabbix
  • pcp-export-zabbix-agent
  • pcp-gui
  • pcp-htop
  • pcp-import-benchmarks
  • pcp-import-collectl2pcp
  • pcp-import-ganglia2pcp
  • pcp-import-guidellm2pcp
  • pcp-import-iostat2pcp
  • pcp-import-mrtg2pcp
  • pcp-import-sar2pcp
  • pcp-import-sheet2pcp
  • pcp-pmda-infiniband
  • pcp-testsuite
  • pcp-zeroconf
  • python3-pcp
action needed
10 security issues in bookworm high

There are 10 open security issues in bookworm.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
4 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
  • CVE-2024-45769: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
  • CVE-2024-45770: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2024-02-29 Last update: 2026-10-30 18:00
lintian reports 2 errors and 12 warnings high
Lintian reports 2 errors and 12 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2026-08-14 Last update: 2026-10-15 16:30
9 security issues in bullseye high

There are 9 open security issues in bullseye.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
2 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
1 ignored issue:
  • CVE-2024-45770: A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2026-07-30 Last update: 2026-08-29 19:00
AppStream hints: 1 error and 1 warning for pcp-gui high
AppStream found metadata issues for packages:
  • pcp-gui: 1 error and 1 warning
You should get rid of them to provide more metadata about this software.
Created: 2018-06-04 Last update: 2026-02-23 04:00
Does not build reproducibly during testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2026-11-01 Last update: 2026-11-07 21:30
version in VCS is newer than in repository, is it time to upload? normal
vcswatch reports that this package seems to have a new changelog entry (version 7.2.3-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:
commit 9a98a0b36c8f94382f0748d7b08c025e34f9f8c0
Merge: aacfff8c 876d72ff
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 21:53:03 2026 +1100

    Merge pull request #2777 from kmcdonell/main
    
    Post-Halloween Mystery Bag

commit 876d72ffaa0bf1d41bd4a4a234f5c790625317af
Merge: 4fbd59d1 27f1a4bd
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 08:15:18 2026 +1100

    Merge branch 'main' of https://github.com/kmcdonell/pcp

commit 4fbd59d18cadcffd9d25780661b025ded7823c93
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 08:03:18 2026 +1100

    src/libpcp/src/util.c: extend buffer for "append pid" link name in logreopen()

commit 00795990cc09a1f9dd6624a201fbe483e06564eb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:56:04 2026 +1100

    src/libpcp_pmda/src/open.c: report bind error before OpenBSD desperate diagnostics
    
    In __pmdaOpenSocket().  Spotted by @coderabbitai.

commit 70537b94303aa1c90c81b7ba785ef5af61935528
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:51:06 2026 +1100

    qa/admin/post-setup: assorted Solaris fixups
    
    Mostly networking ... separate static IP addr setup from default route
    setup.

commit 377d370a23020231f1ae84f9a04f07dc1aa7a40d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:32:56 2026 +1100

    qa/admin/post-setup: rearrange some code blocks
    
    Make sure platform and packaging variables are set before
    they are used.

commit 3521fb6c5b0d66ff6da6f899a7c83927ded39398
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:20:01 2026 +1100

    qa/603: revert No route mapping from last commit
    
    Taking @coderabbitai's suggestion here.  After PR #2777 is done
    I'll cycle back and re-investigate this one failing on OpenSolaris
    (vm29).

commit 9447daeba4e30f0c0481506d1c0c10c56d81ab0d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 07:17:08 2026 +1100

    qa/admin/post-setup: rework logic for serial console login on Solaris
    
    Needed to seperate setting up the console-login:terma svc from
    enabling the same svc.

commit 30bb5cde78cee193eb292d71503a3998f7d23d03
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:24:45 2026 +1100

    src/libpcp/src/util.c: logreopen() tweaks
    
    - guard against strdup() failing in OpenBSD desperate diagnostic block
    - improve locking for one-trip initialization of append_pid

commit d69ff6f7a35d7105b2fe657e7dd5fd7d4a3e1e22
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:20:14 2026 +1100

    src/pmieconf/rules.c: fix free-then-return in read_all_rules()
    
    Not return-then-free!

commit 4adb47ba43f49ce29ba4e3541655ae0d0e7bb5ca
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:12:30 2026 +1100

    src/libpcp/src/tz.c: fclose for /etc/TIMEZONE in __pmZoneinfo before return

commit 3a230934802e8aaf61dee81bf8318756ceb12c6a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Nov 5 06:10:05 2026 +1100

    src/libpcp_pmda/src/pduroot.c: fix diagnostics in __pmdaRecvRootPDUStartReq()
    
    Message prefix should be __pmdaRecvRootPDUStartReq not __pmdaSendRootPDUStartReq
    (cut-n-paste error).

commit 27f1a4bdc4ecb7bd44edfa7af0cc4cbd807c64c7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:37:05 2026 +1100

    Update src/libpcp/src/util.c
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit ffbdba0b0346aaaf7d504749fc16d3ce01766c3d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:34:08 2026 +1100

    Update man/man1/pcpintro.1
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit e4e0def96d17dca05751bd7a357cccdd1c370073
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:29:36 2026 +1100

    qa/1339: use $PCP_RUN_DIR instead of /var/run/pcp

commit 5a00f1b9beeabb0596a2f8f1583bbe3ff25579c7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 21:24:31 2026 +1100

    qa/admin/post-setup: reinstate check for duplicate connections from nmcli(1)

commit 1b9c19ed39d0f62c65ffe9c3f5937176bc84f664
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 17:09:58 2026 +1100

    scripts/start: also need _systemctl_status() from qa/common.check

commit d677765502c2fd89f25fc86e0f82a0270466858e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:55:53 2026 +1100

    scripts/start: set $sts on success before exit

commit fa2b4b11be2b2ed22f641f8e396ae86ce4e84887
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:51:52 2026 +1100

    scripts.start et al: several changes
    
    Change from hard links to symlinks (the former are lost by git).
    Ensure probe for systemctl from qa/common.check that is outside
    _service() is included here.

commit f35b12461f9103537b135fa26097986c01a03a30
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:30:22 2026 +1100

    Update src/libpcp_pmda/src/root.c
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 2752574546c6940d9bdc04507ae1775d9bf0ab3b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 16:18:53 2026 +1100

    Update man/man1/pcpintro.1
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 77fa89d33775803192bf5bf04e859ccc4aa0c9e0
Merge: 2dd5b239 aacfff8c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:55:03 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 2dd5b2391f4e1277c3748bc8b603198ccaeccdf0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:42:49 2026 +1100

    qa/603: refactor for OpenIndiana (vm29)
    
    Several oddities surfaced on this platform.  Refactor works here and on Linux.

commit 180e6bc04e6b6e5e2facb781ba27402eb2d3efcf
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:41:57 2026 +1100

    qa/common.check: remove a remaining $seq.full ...
    
    Should be $seq_full, always.

commit 6abcf50112c80abf846a365cc8082c9dec32e1d8
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:40:51 2026 +1100

    qa/510: additional diagnostics to 510.full

commit ff54cd20c6f13c7f91966d5dd673a9cfc4fd9e7b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:40:02 2026 +1100

    qa/590: the C compiler is not necessarily cc
    
    Use $PCP_CC_PROG instead.
    
    Broke on OpenIndiana (vm29).

commit a4595c4aad193325cf5321a0dbb0243e6fcb02b3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:38:14 2026 +1100

    qa/063 and qa/069: the C compiler is not necessarily cc
    
    Use $PCP_CC_PROG instead.
    
    Broke on OpenIndiana (vm29).

commit e1edcfbe3931f04c054d6dfd52f787a6e0af0ea3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:20:31 2026 +1100

    src/libpcp/src/tz.c: add zoneinfo method for Solaris-style
    
    Timezone is hidden in /etc/TIMEZONE on these platforms, on a TZ=Foo/Bar
    line.
    
    Fixes the pmcd.zoneinfo metric value and a handful of QA failures on
    OpenIndiana (vm29).

commit 297c60be11879a17c6af0d0ad67891de34a79be9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Nov 4 14:16:51 2026 +1100

    scripts: add convenience shell wrappers for QA _service() function
    
    This itch has only been there for 30 years.
    
    Intended for developers ... so for example,
        $ restart pmcd
    works on EVERY platform.
    
    start, stop, restart and status are all hard links to the same
    script.

commit aacfff8cc9c41da0ead787ee3ca780a0cb9adf32
Author: William Cohen <wcohen@redhat.com>
Date:   Mon Nov 2 15:48:12 2026 -0500

    qa: Properly free allocated memory in interp_bug3.c
    
    Observed test 1583 failing due to memory leaks in interp_bug3.c:
    
    [82%] 1583 - output mismatch (see 1583.out.bad)
    5a6,15
    > 160 bytes in 1 blocks are definitely lost in loss record 60 of 72
    > at 0x486C826: malloc (vg_replace_malloc.c:447)
    > by 0x4002787: main (interp_bug3.c:199)
    > {
    >    <insert_a_suppression_name_here>
    >    Memcheck:Leak
    >    match-leak-kinds: definite
    >    fun:malloc
    >    fun:main
    > }
    7c17
    < definitely lost: 0 bytes in 0 blocks
    ---
    > definitely lost: 160 bytes in 1 blocks
    9c19
    < ERROR SUMMARY: 0 errors from 0 contexts ...
    ---
    > ERROR SUMMARY: 1 errors from 1 contexts ...
    Check local PMCD is still alive ...
    
    Added a matching call to free the memory allocated in main just before
    it is exited to eliminate the memory leak reported by valgrind.

commit 4eb252f44a9054ebf5aba1f30d877a4c75791ca6
Merge: d6de16a4 407329f9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:03:30 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit d6de16a4f24e62f52587d08e181fa6fa4244da28
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:01:54 2026 +1100

    qa/1429: tweak filter
    
    Had potential filter snarfoo when run on the first 3 days of any month.
    
    Don't ask.

commit 5b8c0dd03c8200825ce0ca6b2b1b290b636ec055
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 12:01:20 2026 +1100

    qa/1339: additional diagnostics for the socket+root-PMDA saga

commit 0ef1d4c70d1fa5fc1b3a8ef52a614935468013ac
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:59:52 2026 +1100

    src/libpcp_pmda/src/root.c: more on the socket+root-PMDA saga
    
    Added additional diagostics (with -Dlibpmda guard) to report (previously
    silent) failures in:
        pmdaRootProcessStart()

commit 56494422bd816b26f99deecca12a2582c0a98cf3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:50:33 2026 +1100

    src/libpcp_pmda/src/pduroot.c: more on the socket+root-PMDA saga
    
    Added additional diagostics (with -Dlibpmda guard) to report (previously
    silent) failures in:
        __pmdaSendRootPDUStartReq()
        __pmdaRecvRootPDUStartReq()
        __pmdaRootPDUStart()
    
    And the *critical* fix in __pmdaSendRootPDUStart() to not use msg_control
    when either infd < 0 or outfd < 0 ... *not* doing this led to a malformed
    struct msghdr being passed to sendmsg() which on OpenBSD (vm29) caused the
    hand-off from pmcd to the root PMDA to fail for the sample PMDA, and the
    fallback left the sample PMDA as a child of pmcd, not the root PMDA, so
    the sample PMDA was not killed off and the second attempt to install it
    with -i 54321 failed because the old sample PMDA was still using the port.
    
    All other platforms apparently have less-picky checking below sendmsg() so
    this issue had been undetected since it was introduced in Dec 2014!!

commit 882dd8894c19a43bdfffcc28679580aaf292ebb8
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 11:47:29 2026 +1100

    src/libpcp_pmda/src/open.c: additional OpenBSD-only diagnostics
    
    More of the socket+root-PMDA, this time chasing why binding to port 54321
    for the sample PMDA with -i fails in qa/1339 but only after qa/283 is run.
    
    Turns out this was only a symptom ... the root cause lies with the root
    (excuse the pun) PMDA ... more commits coming on this front.

commit f4ad3552914a051d5303e9f0004bd3a07b0dfbfc
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:55:36 2026 +1100

    src/pmcd/pmcd.defaults: expose $PCP_LOGS_APPEND_PID handle
    
    Commented out (of course).

commit bdc1da50e86dfdebe1d62b26cfa7cec8e6878543
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:52:01 2026 +1100

    src/pmcd/src/config.c: additional -Dappl6 diagnostics
    
    Calls to a number of routines had no diagnostics on their failure
    paths, specifically calls to:
            pmdaRootConnect()
            pmdaRootProcessStart()
            CreateRootAgentPOSIX()
    
    And a couple of diagnostics had the wrong (appl4) guard.
    
    All on the path to tracking down the socket+root-PMDA problem
    on OpenBSD.

commit 9ff89e6ccef37dfbf6311354d10531f54497b95e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:50:21 2026 +1100

    src/pmcd/src/dofetch.c: fix compiler warning on OpenBSD

commit d37046f8ae10038a92ce46ab0e4a0db83a32abf1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Nov 3 08:14:51 2026 +1100

    libpcp: add $PCP_LOGS_APPEND_PID - append <pid> to linked file for pmOpenLog
    
    In chasing a socket and pmda root problem on OpenBSD (vm27) I needed the
    complete history of pmcd and pmda log files ... the *.log and *.log.prev
    scheme is not detailed enough if these files churn frequently in a single
    QA test.
    
    When this environment variable is set, every fopen() in pmOpenLog()
    also creates a hard link using the same file name with a <pid> appended
    the links persist for ever and so provide a complete history for triage.
    
    The code change is confined to pmOpenLog() in src/libpcp/src/util.c but
    spilled out into check-statics (for the one-trip guard for the getenv())
    and the man pages.
    
    There is also some re-organization of the order of environment variable
    entries in the pcpintro.1 man page that was picked up in passing.

commit 407329f90725c7542d9eff40424e13f4080941d1
Author: Nathan Scott <nathans@redhat.com>
Date:   Sat Oct 31 13:48:20 2026 +1100

    build/ci: handle redis/valkey conflict on newer Ubuntu runners
    
    Newer Ubuntu releases (24.04+, and now ubuntu-latest 26.04) can install
    both redis-server and valkey-server.  Both default to port 6379, so only
    whichever package starts first during apt-get install is actually running;
    the other one fails to start.
    
    Previously redis-server invariably won that race, so the explicit
    'systemctl start redis' worked.  On the Ubuntu 26.04 runner image valkey
    starts first, so the redis-server unit is left failed and the QA init
    step aborts the job before any tests run.
    
    Start valkey first and fall back to redis, matching the preference QA
    already uses when both are installed.
    
    Signed-off-by: Nathan Scott <nathans@redhat.com>

commit 00c0fb2f49e9eedde624f5270ee449523cd7127d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 31 07:45:39 2026 +1100

    qa/admin scripts: rework after OpenIndiana forced re-install on vm29
    
    Lots of things missing from post-setup because the VM setup on vm29
    was previously done by hand and pre-dated post-setup.
    
    Small tweaks and extensions to check-vm.

commit 5aa3a2d5c45567862fbf2cc765b7137ce2ffe135
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 27 07:27:28 2026 +1100

    libpcp, libpcp3 and libpcp_pmda: improve cast for __pmSetSockOpt arg
    
    int one; ..., (char *)&one is misleading, it should be (void *)&one
    
    This is not the cause of the qa/1339 failure on vm27 (amd64 OpenBSD 7.8)
    with this signature:
        __pmdaOpenSocket(,54321,2): bind: Address already in use
    but with these changes in place grind 1339 ran for 14 hours without
    failing ... but when I ran it again *after* qa 283 the failure
    seems solid.
    
    Added diagnostics on the failure path pro tem to try and debug this.

commit 1846e834b1e909b404b3d253bce57ca1f70045e7
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 26 16:24:33 2026 +1100

    qa/admin/pcp-daily: fix botched Solaris package install line
    
    Was pkgadd'ing pcp twice which royally screwed with pmcd.conf.

commit 82cf4cf6e9db7216854a6cfb0c7676ea79733b44
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 26 14:46:32 2026 +1100

    Revert "qa/1339: _notrun on OpenBSD"
    
    This reverts commit 10e33da997c549467f30990a3e2d550d9b19b2cb.
    
    Triaging the root causes on OpenBSD some more.

commit 10e33da997c549467f30990a3e2d550d9b19b2cb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 25 07:00:37 2026 +1100

    qa/1339: _notrun on OpenBSD
    
    This one has been lurking forever ... there is something about the probing
    and use of a TCP/IP port here that fails 100% of the time on (apparently
    all versions of) OpenBSD with this in pmcd's log
    
    pmdasample(96990) Critical: __pmdaOpenSocket(,54321,2): bind: Address already in use
    
    Since the test passes everywhere else, skip it on OpenBSD.

commit 71a50cf5c8e7d918ce01969403a325637bc2b6de
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 24 18:44:23 2026 +1100

    src/pmieconf/rules.c: clean up memory leaks on error paths
    
    Probably never seen, because errors => exit for pmieconf, but
    Coverity noticed and CIDs 454664 and 454667 have been lurking
    for a long time.
    
    (new) qa/1736 and the valgriand dual qa/1737 exercise the
    error paths in question.

commit 791edf838b2ea39b18952cc0212b0d236489570a
Merge: c42b90f5 fe4b6e81
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 23 09:26:58 2026 +1100

    Merge pull request #2772 from kmcdonell/wip
    
    Refactor _get_primary_logger_pid()

commit fe4b6e8161efd70466ba8205e964272f7828bca1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 23 07:07:49 2026 +1100

    qa fixups after _get_primary_logger_pid() changes
    
    - update qa/COOKBOOK.md description
    - tweak filter for qa/1429

commit 941c5ae636e9cb009be5ca308aa24fb3d3c0c39a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 22 21:48:00 2026 +1100

    pmlogger scripts: refactor _get_primary_logger_pid()
    
    - add single implementation that is more robust in utilproc.sh
    - remove _get_primary_logger_pid() from pmlogger_check.sh,
      pmlogger_daily.sh and pmlogger_janitor.sh
    - replicate the single implementation in qa/common.check (where we
      cannot easily get the utilproc.sh one)
    - new qa/1734 to exercise this on all error paths

commit c42b90f5413f93b0365f473bd5d97d7ad6bf5e5a
Merge: 43780fa6 4831e68b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 17:51:22 2026 +1100

    Merge pull request #2770 from kmcdonell/wip
    
    macOS fixups

commit 4831e68b9ceda71c77085b58a6f74dbbc46fd4a1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 16:50:22 2026 +1100

    improvements from @coderabbitai
    
    In the context of PR #2770.

commit a7f94a677fb549b06ed9c770b4a4075d3b58492e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 11:54:32 2026 +1100

    admin/pcp-daily: dodge stderr from virsh
    
    ... when it is installed, but not configured ... nothing to report,
    nothing to see.

commit 10c33932c5e24b0f3b77a38ce11272c9c6528a33
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 11:49:07 2026 +1100

    qa/admin/package-lists/Darwin+27+arm64: new package list
    
    And some script updates for Darwin 27 (aka macOS Golden Gate).

commit 73aed9f404d8759b6e5c3d1b5319a38e4cf5cd43
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 07:48:17 2026 +1100

    qa/admin/package-lists/Darwin+25+arm64: package list updates
    
    and manifest update to include bison from Homebrew, not macOS
    base install.

commit dff18450beb3e046747f054e832abf2aa6d41ece
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 21 07:26:13 2026 +1100

    src/pmlogger/utilproc.sh: revert introduction of __realpath() function
    
    This was just a bad idea and is causing pmlogger_check to fail
    on at least macOS, see
    https://github.com/performancecopilot/pcp/issues/2769
    
    We use realpath(1) elsewhere in the build and QA so we should
    just use that in utilproc.sh.
    
    This commit reverts and replaces commit 01ed7a4fe.

commit 869cc4055f3edbb70e63f5d31476ac816cffde1e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 20 10:41:13 2026 +1100

    qa/admin/pcp-daily: add -f for poweroff on some VMs
    
    vm08 (CentOS 7) was hanging at shutdown without this.

commit d05820a9c8b98ee92c2f720b7587294feb5d1e4c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Oct 20 10:40:34 2026 +1100

    qa/admin/package-lists/NetBSD+10.1+i386: package list update

commit 43780fa6dc59cc035328d0b3418cc6fb16a99d59
Merge: 41af059d 55e37cce
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 08:08:38 2026 +1100

    Merge pull request #2767 from kmcdonell/wip
    
    fix macOS build

commit 55e37ccedf36a37415e3d784c54dafc49dc18c41
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:14:39 2026 +1100

    qa/admin/pcp-daily: change from $PCP_ECHO_PROG to printf(1)

commit 1d9c744cd7592d06aad0566413259599c0dcad10
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:12:50 2026 +1100

    configure.ac: make sure $yacc_prog is a full pathname ...
    
    Even in the unlikely event that we're not using bison.

commit 2d5092117906fd9ec40901179edafef2ec9f526d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 19 07:11:57 2026 +1100

    src/pmcd/rc_pmcd: guard against startup race for pmda.auto.update lock file

commit 9c16142ce9cacd1a6587b744e2192a1585d0aff3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:26:32 2026 +1100

    macOS build: add bison to Brewfile and tweak Darwin 25 package list

commit aaae48a8e32a3acc2cf3b2ef2687f12d79690ac2
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:05:02 2026 +1100

    macOS build: recent libpcp changes mean we need homebrew bison
    
    The old and mouldy bison that ships with macOS won't cut the mustard for
    the %destructor pragmas recently added to derive_parser.y.in in libpcp.
    
    But we need to dodge the macOS installed one and dig out the homebrew one
    that is a keg-only install and so the executable is hidden in a secret bin
    directory that configure.ac needs to know how to find.

commit 38c187af4ecd0ea624f9567bc3ecb02589d83a7d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 16:01:20 2026 +1100

    src/pmcd/rc_pmcd: remove stale pmda.auto.update lock file
    
    Seen on macOS ... and once it is there, all subsequent PMDA
    Install or Remove operations fail.

commit a27f513577a2d601fdc280fc98a5e54f6f40676c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 15:59:20 2026 +1100

    qa/admin/pcp-daily: replace echo -n (for macOS)

commit 41af059d081bfa05c6d27490f61739a977cd2246
Merge: 3751a9d1 a671496d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 08:00:28 2026 +1100

    Merge pull request #2766 from kmcdonell/wip
    
    QA and small changes for linux PMDA and pmlogger management scripts

commit a671496d55a30b2e844a928afaaeebbf4aca2ebe
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 06:55:51 2026 +1100

    src/pmdas/linux/add_netstat_field: add exit status logic
    
    1 (default) for all errors, 0 for success

commit 2a2cee3ab059a2a98f03da2a6d3e2e0e65b0ddb5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Oct 18 06:53:41 2026 +1100

    qa/admin/qa-summary: fix mac, mac-fed and mac-deb abbreviations and heading fields

commit 01ed7a4fe3884925b1ab47255a72ef4981d7ed82
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 17 16:49:19 2026 +1100

    misc: improvements suggested by coderabbitai in the context of PR #2766

commit 627234718ab153d7b6ceb24fe91e7f455a367af5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 08:41:11 2026 +1100

    Update src/pmlogger/utilproc.sh
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 486ee6e2f21a5529608c7eeffc4633a22fc52a1f
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:39:00 2026 +1100

    qa/2113: filter away differences in regexp error message text
    
    Problem seen on vm33 (OpenBSD 7.9).

commit cc5b974d5641fc0e22536aff3c85b2e38ea33c58
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:06:49 2026 +1100

    linux PMDA: add a bunch of new MPTcpExt fields for networking metrics
    
    Seen on vm12 (Fedora Rawhide).

commit faf7933f6afdad50ee49475ff33e1ac831f928c3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:06:12 2026 +1100

    src/pmdas/linux/add_netstat_field: extension to allow > 1 field on command line

commit 4939166b1891c43d4044fcab92029ab9544dc83c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 07:04:46 2026 +1100

    qa/2110: need $sudo with pminfo -L
    
    Else cannot access dev mapper control file.
    
    Seen on vm12 (Fedora Rawhide).

commit 3323ba2a3898d8592d806b4f733735c652e1a94d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 06:05:47 2026 +1100

    qa: package list and small qa test changes for MX Linux 25.3

commit 3cf1c733708694fc77da85cd22ac3d78991b1bfa
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Oct 16 06:05:09 2026 +1100

    ci-qa/update: keep tmp.* files for debugging with -d

commit 65a4a444c71fdc794c90bcbeb22fff32b43eebe0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 22:07:00 2026 +1100

    qa/1429: tweak filter

commit 7e437565915c07053a583a8cf4926d541b853598
Merge: 58c3eef1 3751a9d1
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:41:33 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 58c3eef1b9c979b183d048b219af67ae41f0477b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:37:10 2026 +1100

    qa/1187: refactor to dodge stty hanging issue
    
    On some platforms (notably bozo when running check from an interactive
    shell), qa/1187 was hanging in stty(1).
    
    - split the stty-part out from qa/1187 into the (new) qa/1733
    - refactor some of the qa/1733 logic and reduce output chatter
    - in qa/1733 add _notrun if stdout is not a tty (this seems to be the
      trigger for the hang scenario)

commit bc4e4bc1fc13bb232bf1c3b52f57866f54f50193
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Oct 15 08:35:45 2026 +1100

    qa/common.qt: add another Qt warning to filter_qt()

commit 3751a9d148d5b83af6e9d51a3b889ecb67772a13
Author: lmchilton <lauren.chilton26@gmail.com>
Date:   Tue Oct 13 13:53:56 2026 -0400

    Resolves: RHEL-130497 fix for too strict parsing, specifically handling empty scope in json object

commit f2ed83d0d0488d5590637a41f90a1ea551932c06
Merge: f2559055 5ef01f17
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 14:58:02 2026 +1100

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit f2559055bb3c0cd41da06b7a447e31344152d4cc
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 14:50:00 2026 +1100

    src/pmlogger/utilproc.sh: fix for directory matching in _find_matching_pmlogger()
    
    The combination of shell expansion in the control file lines and symbolic
    links meant this routine was trying to compare a directory name from the
    control file that had symbolic links resolved with a directory in the
    pmlogger statefile that did not.
    
    Blew up on bozo where the non-primary logger is logging to
    /gpfs/data/root/pcp/... via a symlink at /gpfs and the canoncial
    directory name is really /mnt/bozo-1/gpfs/data/root/pcp/...
    
    The end result was that pmlogger_janitor was incorrectly killing off the
    non-primary pmlogger during QA runs.

commit e6175b0c1323b412c325292292c54c26fcae2c8a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 14:49:15 2026 +1100

    qa/common.check: rework dodging systemctl rate limitation

commit 4241eaf471149c819dd19811050a990c06badb65
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 14:48:46 2026 +1100

    qa/1763: add _triage_wait_point to help debugging failures

commit b8d22320cdb9b7852bc597b470f0897f170863c5
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 06:23:39 2026 +1100

    qa/819: filter tweak for expected number of metrics for elasticsearch PMDA

commit 420c18936d25b517940360fa038e8ee6bca3de85
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 06:22:28 2026 +1100

    src/zshrc/_pcp: add -G and -N for pmseries

commit a74dd744c8fea885caa48ecf9b7f6d64262d785a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 06:22:00 2026 +1100

    qa/admin/package-lists/OpenBSD+7.7+amd64: package list update

commit 5ef01f172b74e7214c86b004cfa8f4e8d26546fe
Merge: ce12343f 0325e8d2
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Oct 14 06:20:41 2026 +1100

    Merge pull request #2757 from rmetrich/asan__9
    
    derive_parser: fix strdup'd token strings leaked on error paths

commit 0325e8d2ee72cebbd6dcace5dfdef9612a6b2150
Author: Renaud Métrich <rmetrich@redhat.com>
Date:   Fri Oct 9 10:38:24 2026 +0200

    derive_parser: reclaim discarded semantic values with %destructor
    
    Generalizes the per-error-path frees from 7ae26498cd.  Those only
    cover the rules that happen to have an error production; they cannot
    reach the values bison discards on its own.  Declare
    
        %destructor { free($$); }           <s>
        %destructor { free_expr_ctx($$); }  <n>
    
    so the parser reclaims the lookahead token that triggered a syntax
    error, every symbol popped while resynchronizing on the error token,
    and everything left on the stack at YYABORT.
    
    Note bison explicitly does _not_ run destructors for the symbols of
    the rule whose action called YYERROR or YYABORT, so those rules keep
    cleaning up after themselves and the two mechanisms compose.
    
    Supporting changes:
    
    - the "derive_error(NULL); return -1;" paths become YYABORT, so bison
      unwinds the stack.  A raw return from an action leaks every node
      built so far.  No caller uses derive_parse()'s return value, they
      all test parse_tree, so this is a no-op for them.
    
    - mkconst() and novalue() no longer build their node in a mid-rule
      action.  Bison cannot attach a %destructor to a mid-rule value, so
      a node parked there is lost if the speclist does not parse.  The
      node is built in the final action instead, which also leaves the
      number string owned by the parser stack (and so covered by the <s>
      destructor) for the whole of the speclist.  As a side effect both
      "mkconst(1)" and "mkconst(1, bogus=1)" are handled by the one
      free($3) in the error rule, so the mkconst_np tracking static
      suggested during review is not needed.
    
    - "$$ = NULL" is added to the YYERROR rules.  Bison cannot tell they
      never reduce and otherwise warns that the <n> destructor could see
      an unset $$ (65 new warnings against a baseline of none).
    
    - error actions use free_expr_ctx() rather than free_expr(), so a
      discarded matchinst() tree gets its compiled regex regfree()d.
    
    - reset_parser_state() clears lexpeek, in_matchinst, specflags and
      specmeta before each parse.  These file-scope statics are only
      cleared on the success paths of the productions that use them, so
      after a failed parse they leaked and bled into the next expression
      parsed in the process: a stale specmeta was grafted onto an
      unrelated mkconst(), stale META_* flags overrode the metadata it
      inherited, and a stale in_matchinst made the lexer read '/' as a
      regex delimiter instead of division.
    
    - two meta= in the one speclist no longer leaks the first node.
    
    - the anon() illegal type branch no longer falls through to use and
      return the node it just freed.
    
    Also fix the ownership of the compiled regex on teardown.
    bind_expr() shallow copies the regex_t into the per-context copy it
    builds for a global derived metric, so only the registered[] node
    owns the compiled buffers.  free_expr() must therefore not
    regfree(), and free_expr_ctx() must -- which makes free_expr_ctx()
    the right call for the registered[] tree in pmUnregisterDerived(),
    and for a per-context metric, which bind_expr() binds in place
    rather than copying.  Three call sites had it backwards and leaked
    884 bytes per registered matchinst() metric (the regex, plus the
    N_PATTERN value string, which free_expr() also skips).  The rule is
    now spelled out above free_expr().
    
    qa/2113 checks the diagnostics and the cross-expression state
    isolation; qa/2114 checks the same expressions, plus the regex
    teardown, for leaks under valgrind.  Note 2114 deliberately bundles
    many expressions into one config: the parser keeps its most recent
    allocations in np, specmeta and derive_lval, so the last thing a
    failed parse leaks is still reachable at exit and one expression per
    run reports nothing.
    
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

commit aac4469ac3dafc4375e6c4e2fd7e41ac61810e1a
Author: Renaud Métrich <rmetrich@redhat.com>
Date:   Fri Oct 9 10:31:21 2026 +0200

    derive_fetch: fix read off the end of an aliased pmid_ctl
    
    valgrind, fetching any derived metric from an archive:
    
    Invalid read of size 4
       at __dmpostvalueset (derive_fetch.c:2021)
       by __dmpostfetch (derive_fetch.c:2260)
       by __pmFinishResult (fetch.c:98)
       by __pmFetch (fetch.c:242)
       by pmFetch_ctx (fetch.c:294)
       by pmFetch (fetch.c:332)
     Address 0x554d098 is 0 bytes after a block of size 8 alloc'd
       at malloc
       by __pmLogFetch (logutil.c:2385)
    
    When a requested metric is absent from a log record, __pmLogFetch()
    points vset[j] at a pmid_ctl struct that has only pmid and numval
    fields.  Reading valfmt from it would be past the end of that
    allocation.  There are no values anyway, so PM_VAL_INSITU is a safe
    placeholder.
    
    __dmpostvalueset() hoisted the valfmt read out of the loop over the
    values, so it ran even when there are no values to copy.  Only read
    it when numval > 0, matching what __pmLogFetchInterp() already does
    in interp.c, and use PM_VAL_INSITU otherwise -- valfmt carries no
    information when there are no values, and the consumers agree:
    __pmFreeResultValueSets() guards on "numval > 0 && valfmt ==
    PM_VAL_DPTR", and interp.c leaves valfmt uninitialized altogether
    for the numval == 0 case it builds.
    
    Found while leak-checking the derived metrics parser; it predates
    that work and is unrelated to it.
    
    qa/2115 is a new valgrind test covering the derived metric fetch
    path.  f.nomatch is the case that matters, a matchinst() that
    matches no instances and so comes back with numval == 0; the others
    check that values are still copied correctly alongside it.
    
    Co-Authored-By: Ken McDonell <kenj@kenj.id.au
    Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

commit 52309c0bbdfd8f762ef846c8efb3b21b97c85973
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 16:26:20 2026 +1100

    qa: cleanup group -g pmproxy test metadata

commit e5e8ccea7f5c1c9b0a1222dd65a67eaa6739d1d3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 16:25:00 2026 +1100

    qa/1611: only run cleanup() actions once ...
    
    Trying to isolate qa/1616 failures (that one runs qa/1611 --valgrind).

commit bca4750f3d675d5cdb2b99d67ef2bee31112680a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 16:24:05 2026 +1100

    qa/grind: date --help output changed ... rework heuristic

commit 3dce2613728a0c5d1197fc82ee9a6761b9d2b59c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 10:55:59 2026 +1100

    qa/023: restart pmie service in _cleanup() if it was running at the start

commit 12f27457cdcbec4020fb541bc989fbf7158ad5c3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 07:56:57 2026 +1100

    qa/admin/qa-summary: fixes for CentOS (-stream10)
    
    Shortname in report was NQR.

commit fd190d4e35eae3e5e007c39aa948fd9621f4fa15
Merge: f84dbe7c 1b334d7d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 07:22:13 2026 +1100

    Merge branch 'main' of https://github.com/kmcdonell/pcp

commit f84dbe7ceadef5cf3e7a5de9d8f9222a667fbda8
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Oct 12 07:04:48 2026 +1100

    qa: mystery solved for pmlogger_daily tests that sometimes fail
    
    This group of tests:
            151 532 1429
    all populate directories with archives to be processed by
    pmlogger_daily and the archives are given names and timestamps
    corresponding to dates and times in the recent (3-5 days) past.
    
    Then the -k option to pmlogger_daily will cull old archives, but this
    depends on find(1) -mtime semantics and if an archive is timestamped
    (for example) 01:30 then find(1) produces different results depending
    if you the test is run today before or after 01:30.
    
    Consequently there was a window (not the same for all tests, but
    similar) just after midnight where if the test was run it would
    fail but would pass later, e.g. when trying to triage the fault.
    This explains both the "random but repeating" failures in the QA Farm
    and the "all-pass-yesterday-and-all-fail-today" failures in github CI.
    
    Apply a check and make these tests _notrun if the current time
    is in the critical window.

commit 1b334d7d473b2aeeaf076d2c6b57697bd15a9b9b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Oct 10 08:23:57 2026 +1100

    qa/1334: deal with non-determinism in hostname vs short hostname vs fqdn
    
    Neither hostname(1) (with no options, -s and -f) nor pmhostname(1)
    produce deterministic results.
    
    So try 'em all and sort results longest to shortest before filtering.
Created: 2026-05-23 Last update: 2026-11-07 07:04
Multiarch hinter reports 1 issue(s) low
There are issues with the multiarch metadata for this package.
  • pcp-doc could be marked Multi-Arch: foreign
Created: 2016-09-14 Last update: 2026-11-07 18:30
6 low-priority security issues in trixie low

There are 6 open security issues in trixie.

6 issues left for the package maintainer to handle:
  • CVE-2026-16524: (needs triaging) A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: (needs triaging) A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: (needs triaging) An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: (needs triaging) A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: (needs triaging) A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: (needs triaging) An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-30 Last update: 2026-10-30 18:00
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).
Created: 2025-12-23 Last update: 2026-10-07 09:20
testing migrations
  • This package will soon be part of the perl-5.44 transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
news
[rss feed]
  • [2026-10-31] pcp 7.2.2-1 MIGRATED to testing (Debian testing watch)
  • [2026-10-07] Accepted pcp 7.2.2-1 (source) into unstable (Nathan Scott)
  • [2026-08-30] pcp REMOVED from testing (Debian testing watch)
  • [2026-08-16] pcp 7.2.1-2 MIGRATED to testing (Debian testing watch)
  • [2026-08-14] Accepted pcp 7.2.1-2 (source) into unstable (Nathan Scott)
  • [2026-08-01] pcp 7.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-07-30] Accepted pcp 7.2.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2026-05-29] pcp 7.1.5-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-26] Accepted pcp 7.1.5-1 (source) into unstable (Nathan Scott)
  • [2026-05-25] pcp 7.1.4-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-22] Accepted pcp 7.1.4-1 (source) into unstable (Nathan Scott)
  • [2026-05-02] Accepted pcp 7.1.3-2 (source) into unstable (Nathan Scott)
  • [2026-04-27] pcp 7.1.2-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-24] Accepted pcp 7.1.2-1 (source) into unstable (Nathan Scott)
  • [2026-04-02] pcp 7.1.1-1 MIGRATED to testing (Debian testing watch)
  • [2026-03-30] Accepted pcp 7.1.1-1 (source) into unstable (Nathan Scott)
  • [2026-01-30] pcp 7.1.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-01-28] Accepted pcp 7.1.0-1 (source) into unstable (Nathan Scott)
  • [2025-12-05] pcp 7.0.5-1 MIGRATED to testing (Debian testing watch)
  • [2025-11-21] Accepted pcp 7.0.5-1 (source) into unstable (Nathan Scott)
  • [2025-11-19] Accepted pcp 7.0.4-1 (source) into unstable (Nathan Scott)
  • [2025-11-12] Accepted pcp 7.0.3-1 (source arm64 all) into unstable (Nathan Scott)
  • [2025-11-01] pcp REMOVED from testing (Debian testing watch)
  • [2025-10-16] Accepted pcp 7.0.2-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-23] Accepted pcp 7.0.1-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-01] Accepted pcp 7.0.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-04-21] pcp 6.3.8-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-11] Accepted pcp 6.3.8-1 (source) into unstable (Nathan Scott)
  • [2025-04-07] pcp 6.3.7-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-28] Accepted pcp 6.3.7-1 (source) into unstable (Nathan Scott)
  • 1
  • 2
bugs [bug history graph]
  • all: 3
  • RC: 0
  • I&N: 3
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (2, 12)
  • buildd: logs, reproducibility, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • screenshots
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 7.2.1-2build1
  • 2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing