There are 24 open security issues in bullseye.
There are 13 open security issues in buster.
commit 2db9c73610bb39a6b60c19520769d8c97f7b9cf1
Author: Ben Hutchings <benh@debian.org>
Date: Mon Apr 6 15:18:16 2026 +0200
d/b/gencontrol.py: Disable makefile generation more cleanly
Instead of monkey-patching the bundle object's write_makefile method,
override our own write method to only call write_control.
commit d551b760e780e98461c1e06408798c1d1cc5eb0c
Merge: 27b78e8 3328ca4
Author: Ben Hutchings <benh@debian.org>
Date: Mon Apr 6 13:59:49 2026 +0200
Merge branch 'config-cleanup' into 'debian/latest'
Clean up configuration format and directory
See merge request kernel-team/firmware-nonfree!143
commit 27b78e867ea4d83a3d455f4ca6def2005fadf2e1
Merge: 4574b21 e90faf9
Author: Ben Hutchings <benh@debian.org>
Date: Mon Apr 6 13:59:02 2026 +0200
Merge branch 'remove-usrmovemitigation' into 'debian/latest'
Remove usr-move mitigation, only needed for the trixie upgrade
See merge request kernel-team/firmware-nonfree!144
commit 3328ca498600e9a23e46dbe5776d47fd381a35fb
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 19:38:54 2026 +0200
Move EULA text into configuration file
Since TOML supports multi-line strings with newlines preserved, we can
now include the EULAs for ipw2x00 and ivtv firmware in the
configuration file. Do that, removing the last per-package files
under debian/config.
Group the 2 EULA fields into a subsection so we can require that both
or neither are present.
commit 9499157d141d63b144f49477af0e8ca8330b497c
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 17:47:46 2026 +0200
Change configuration handling to use TOML format and dacite
Switch configuration parsing over to TOML, with a schema defined via
dacite and dataclasses. The same change was previously done in
src:linux.
Since TOML allows defining an 'array of tables', take this opportunity
to put the per-package and global config together.
- debian_firmware.config:
- Define dataclasses for global and per-package config
- Read the config from d/c/defines.toml using tomllib and dacite
- Rename some fields to use underscores instead of hyphens
- d/config: Convert to the new format
- d/rules: Update CONTROL_FILES for the above change
- d/README.source: Update to describe the new format
- d/b/{check_upstream.py,gencontrol.py,install-files}: Update to use
the new config API
- d/t/source.control.in: Add dependency on dacite
commit 1f2e9384ba3db3167b53ae13358690775597b5b7
Author: Ben Hutchings <benh@debian.org>
Date: Fri Apr 3 19:08:03 2026 +0200
Remove 'license_accept' package config field
The 'license_accept' field is always set to 'required', not
'no-preseed', and we should not need to add any more firmware with
EULAs. So:
- d/t/preinst.license.in: Do not use the 'license_accept' variable,
and always allow preseeding
- d/b/gencontrol.py: Check for presence of the 'license_title' field
instead
- d/c/{ipw2x00,ivtv}/defines: Remove definition of the field
- d/README.source: Update description of package config
commit 650c376c4ba850204a4be634808596b1dbd3bc99
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 17:16:56 2026 +0200
Move added/replacement firmware to debian/added-firmware/
Currently added and replacement firmware files and symlinks are placed
under debian/config/<package>, but they are not config so this doesn't
make a lot of sense. It also complicates install-files which has to
filter out various filenames to determine whether any of that firmware
is unused.
- d/config: Move all firmware files and symlinks directly under
debian/added-firmware/
- d/bin: Change check_upstream.py and install-files to look there
- d/copyright, d/source/include-binaries: Update filenames and patterns
- d/c/misc-nonfree: Since this includes v4l-*, exclude files that
belong in ivtv and would otherwise now be included
- d/README.source: Remove text stating non-upstream files go under
debian/config and add a separate section describing
debian/added-firmware
commit e90faf944798013256e47216320dac11cd6e3f10
Author: Ben Hutchings <benh@debian.org>
Date: Fri Apr 3 19:34:17 2026 +0200
Remove usr-move mitigation, only needed for the trixie upgrade
The usr-move mitigation code was needed in upgrades from
bookworm(-backports) to trixie, but not in upgrades from trixie to
trixie-backports or forky. Release-skipping upgrades are not
supported, so it can be removed now.
commit 4574b210157d5194baffb63d2bd43e58bd790042
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 19:54:40 2026 +0200
d/copyright: Remove metainfo.xml files, no longer included in source package
Fixes: 56ef6cd0 ("Only install files and generate metainfo.xml at build time")
commit f86b7c1c92ea861a8e39d2a61bb094fc85a5ad8b
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 19:50:00 2026 +0200
d/copyright: Correct information for reverted QCA9377 rev 1.0 firmware
We reverted a breaking change in ath10k/QCA9377/hw1.0/firmware-5.bin
by adding the old version under debian/config/atheros. But the
copyright and license for this weren't correctly recorded here.
Add the old version to the same stanza as the current version.
commit 403c960195eb8917a92727a11cc75c07eba7b010
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 19:04:02 2026 +0200
d/b/check_upstream.py: Fix name of 'files-excluded' config field
The package config field is called 'files-excluded', like in
debian/copyright, not 'files-exclude'.
This fix results in reporting several more files as not included in
binary packages, but these seem to all be either legal notices which
we don't need to include (as they are already copied into
debian/copyright) or firmware that we intentionally don't want to
ship. These should be resolved later on.
commit 91fb15a016abbd3eff31cd88a79f72c867544535
Merge: 7db9447 2934a77
Author: Ben Hutchings <benh@debian.org>
Date: Thu Apr 2 17:03:04 2026 +0200
Merge branch 'replace-copy-firmware' into 'debian/latest'
Replace copy-firmware.sh; install files and generate metainfo.xml at build time
See merge request kernel-team/firmware-nonfree!142
commit 2934a774f32777d2699f5d4707c90a53af284ba5
Author: Ben Hutchings <benh@debian.org>
Date: Thu Mar 26 21:31:09 2026 +0100
Replace upstream copy-firmware.sh with our own WHENCE parser
The upstream copy-firmware.sh script doesn't work that well for us.
I've had to patch it to cope with the fact that we exclude some files,
and it's also rather slow.
Since we already have our own code to parse WHENCE, we don't actually
need copy-firmware.sh to do it.
In install-files:
- Parse WHENCE to find the upstream files and links.
- Apply file and link exclusion patterns from debian/copyright and
debian/config/defines.
- Report the installation actions, as copy-firmware.sh previously did.
In debian/rules:
- Change override_dh_auto_install to do nothing.
Drop all our patches to copy-firmware.sh.
commit 1875e02d32bd5b14a9d9ea34030ae79a996fe4dc
Author: Ben Hutchings <benh@debian.org>
Date: Sat Mar 28 13:07:00 2026 +0100
debian_firmware.firmware: Handle filename escaping and extra spaces
File/RawFile/Link fields can and do use backslash as an escape in
filenames. Change our parser to decode those.
Link fields are also allowed to have multiple spaces to the left or
right of the '->' separator. Use a regex to split at the separator.
commit 1d5adb095ab2c22fde4cd77c76a13dc3922d6a84
Author: Ben Hutchings <benh@debian.org>
Date: Sat Mar 28 01:04:05 2026 +0100
debian_firmware.firmware: Handle file groups with only links
There is currently a single section in WHENCE with only a link and no
files. This gets discarded because I failed to update the condition
for adding a new file group in commit febfc38e00df
"debian_firmware.firmware: Parse Link fields and include in
FirmwareGroup". Update that condition to check for files or links.
commit 56ef6cd062d75f26f1a960376c2c9582992cfc1c
Author: Ben Hutchings <benh@debian.org>
Date: Sat Mar 28 13:27:51 2026 +0100
Only install files and generate metainfo.xml at build time
Currently we generate the metainfo.xml files and dh_install file lists
from gencontrol.py, which requires installing files as part of source
package preparation. This was mostly done because it was convenient
to extend gencontrol.py, but it is not really necessary and it's
annoying to have to run the file installation multiple times when
building source and then binary packages.
In a new script debian/bin/install-files:
- Replace the generation of dh_install file lists in gencontrol.py
with immediate installation of the selected files in this script
- Move all the metainfo.xml generation from gencontrol.py into this
script
In debian/rules:
- Remove the now-unneeded execution of copy-firmware.sh from the
debian/control-real rule
- Change the execute_after_dh_install rule to override_dh_install and
run install-files there
There is 1 open security issue in trixie.
You can find information about how to handle this issue in the security team's documentation.
Among the 4 debian patches available in version 20260309-1 of the package, we noticed the following issues:
There are 13 open security issues in bookworm.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/firmware-nonfree.png){kind=link}