Debian Package Tracker

general

source: gradle (main)
version: 4.4.1-12
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Kai-Chung Yan [DMD]
arch: all
std-ver: 4.5.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.5-2
oldstable: 3.2.1-1
stable: 4.4.1-6
testing: 4.4.1-12
unstable: 4.4.1-12

versioned links

1.5-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
3.2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.4.1-12: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gradle (4 bugs: 0, 3, 1, 0)
gradle-doc
libgradle-core-java (1 bugs: 0, 1, 0, 0)
libgradle-plugins-java (1 bugs: 0, 1, 0, 0)

action needed

A new upstream version is available: 6.7 high

A new upstream version 6.7 is available, you should consider packaging it.

Created: 2020-06-29 Last update: 2020-10-25 09:05

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-04-11 Last update: 2020-10-08 21:30

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-07-07 Last update: 2020-10-08 21:30

Does not build reproducibly during testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2020-08-27 Last update: 2020-10-25 08:01

Depends on packages which need a new maintainer normal

The packages that gradle depends on which need a new maintainer are:

dh-exec (#851746)
- Build-Depends: dh-exec

Created: 2019-11-22 Last update: 2020-10-25 07:33

12 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 06588fe912cca025f36908a716cbb31ed8dedd97
Author: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date:   Mon Aug 24 17:11:07 2020 +0200

    Bump libguava-java dependency to 23.0

commit d24d55365c501c256757c594a4e5e08c3895fc7c
Author: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date:   Thu Aug 20 17:16:56 2020 +0200

    Update the changelog

commit 2899f36de976c9fcce599b05a2d16e5230fa2280
Author: Andrej Shadura <andrew.shadura@collabora.co.uk>
Date:   Thu Aug 20 16:52:26 2020 +0200

    Fix the AsciiDoc-to-POD conversion

commit fe4c287042aba3036c240c00ea374b36b0d2115e
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:35:12 2020 +0530

    Updates d/changelog for 4.4.1-12 release

commit 8c93dd0bf3a075f6855c9bb27d71bc84e0621db3
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:34:45 2020 +0530

    Bump debhelper-compat version to 13

commit fbf2947e25aac3087b36a6bb3f88c0a2e44f69c2
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:32:11 2020 +0530

    Add patch for backporting TaskProvider

commit ba293a44606470db4a8250f1882c21467df524de
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:31:40 2020 +0530

    Add patch for backporting NamedDomainObjectProvider

commit ea5654856581fd4facfe86d9d719a4aaf31bb5b5
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:31:20 2020 +0530

    Add patch for backporting FeaturePreviews

commit cd4de7ee49bc9f6de0f789181e5dcade7d206c1d
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:30:58 2020 +0530

    Add patch for backporting DependencyConstraint

commit 5692af371234d12c555809731086c82285bcf416
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:30:36 2020 +0530

    Add patch for backporting ComponentWithCoordinates

commit 9cee0dc58c80095873e2c21f7667fcb9f0f0c316
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:30:18 2020 +0530

    Add patch for backporting CommandLineArgumentProvider

commit fe677c53b05305a417f6fb59a140567896917b03
Author: Samyak Jain <samyak.jn11@gmail.com>
Date:   Thu Aug 13 16:29:56 2020 +0530

    Add patch for backporting capabilities

Created: 2020-08-20 Last update: 2020-10-22 16:05

lintian reports 6 warnings normal

Lintian reports 6 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-09-21 Last update: 2020-09-21 06:02

3 ignored security issues in stretch low

There are 3 open security issues in stretch.

3 issues skipped by the security teams:

CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-04-11 Last update: 2020-10-08 21:30

3 ignored security issues in buster low

There are 3 open security issues in buster.

3 issues skipped by the security teams:

CVE-2019-11065: Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
CVE-2019-15052: The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle also sends those credentials to all subsequent hosts that the request redirects to. This is similar to CVE-2018-1000007.
CVE-2019-16370: The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.

Please fix them.

Created: 2019-04-11 Last update: 2020-10-08 21:30

news

[rss feed]

[2020-08-26] gradle 4.4.1-12 MIGRATED to testing (Debian testing watch)
[2020-08-20] Accepted gradle 4.4.1-12 (source) into unstable (Andrej Shadura) (signed by: Andrew Shadura)
[2020-06-02] gradle 4.4.1-11 MIGRATED to testing (Debian testing watch)
[2020-05-27] Accepted gradle 4.4.1-11 (source) into unstable (Emmanuel Bourg)
[2019-12-15] gradle 4.4.1-10 MIGRATED to testing (Debian testing watch)
[2019-12-10] Accepted gradle 4.4.1-10 (source) into unstable (Hans-Christoph Steiner)
[2019-12-09] Accepted gradle 4.4.1-9 (source) into unstable (Hans-Christoph Steiner)
[2019-08-10] gradle 4.4.1-8 MIGRATED to testing (Debian testing watch)
[2019-08-05] Accepted gradle 4.4.1-8 (source) into unstable (Saif Abdul Cassim) (signed by: Emmanuel Bourg)
[2019-07-09] gradle 4.4.1-7 MIGRATED to testing (Debian testing watch)
[2019-06-27] Accepted gradle 4.4.1-7 (source) into unstable (Emmanuel Bourg)
[2019-06-26] gradle 4.4.1-6 MIGRATED to testing (Debian testing watch)
[2019-06-21] Accepted gradle 4.4.1-6 (source) into unstable (Emmanuel Bourg)
[2019-03-09] gradle 4.4.1-5 MIGRATED to testing (Debian testing watch)
[2019-02-26] Accepted gradle 4.4.1-5 (source) into unstable (Andrej Shadura)
[2019-01-20] gradle 4.4.1-4 MIGRATED to testing (Debian testing watch)
[2019-01-15] Accepted gradle 4.4.1-4 (source) into unstable (Emmanuel Bourg)
[2018-12-04] gradle 4.4.1-3 MIGRATED to testing (Debian testing watch)
[2018-11-29] Accepted gradle 4.4.1-3 (source) into unstable (tony mancill)
[2018-11-14] gradle 4.4.1-2 MIGRATED to testing (Debian testing watch)
[2018-11-09] Accepted gradle 4.4.1-2 (source) into unstable (Tiago Stürmer Daitx) (signed by: Emmanuel Bourg)
[2018-10-22] gradle 4.4.1-1 MIGRATED to testing (Debian testing watch)
[2018-10-03] Accepted gradle 4.4.1-1 (source) into unstable (Emmanuel Bourg)
[2018-10-01] Accepted gradle 4.4-3 (source) into unstable (Emmanuel Bourg)
[2018-09-17] Accepted gradle 4.4-2 (source) into unstable (Emmanuel Bourg)
[2018-09-16] Accepted gradle 3.4.1-8 (source) into unstable (Emmanuel Bourg)
[2018-05-18] Accepted gradle 4.4-1 (source) into experimental (Kai-Chung Yan (殷啟聰)) (signed by: Kai-Chung Yan)
[2018-05-14] gradle 3.4.1-7 MIGRATED to testing (Debian testing watch)
[2018-04-11] Accepted gradle 3.4.1-7 (source all) into unstable (Markus Koschany)
[2018-04-05] Accepted gradle 3.4.1-6 (source) into unstable (Emmanuel Bourg)

bugs [bug history graph]

all: 12 13
RC: 0
I&N: 9
M&W: 3 4
F&P: 0
patch: 0

links

homepage
lintian (0, 6)
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.4.1-12
3 bugs