Debian Package Tracker - open-build-service

general

source: open-build-service (main)
version: 2.9.4-3
maintainer: Debian Ruby Extras Maintainers (archive) (DMD)
uploaders: Andrew Lee (李健秋) [DMD] – Lucas Kanashiro [DMD] – Héctor Orón Martínez [DMD]
arch: all
std-ver: 4.3.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

oldstable: 2.7.1-10
unstable: 2.9.4-3

versioned links

2.7.1-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.9.4-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

obs-api (4 bugs: 0, 3, 1, 0)
obs-productconverter
obs-server (1 bugs: 1, 0, 0, 0)
obs-utils
obs-worker

action needed

A new upstream version is available: 2.10.5 high

A new upstream version 2.10.5 is available, you should consider packaging it.

Created: 2020-05-02 Last update: 2020-06-03 11:54

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2017-9268: In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).
CVE-2018-12466: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

Please fix them.

Created: 2018-03-05 Last update: 2020-04-14 00:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2020-04-19 Last update: 2020-06-03 15:04

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

obs-productconverter could be marked Multi-Arch: foreign

Created: 2016-12-16 Last update: 2020-06-03 13:35

Depends on packages which need a new maintainer normal

The packages that open-build-service depends on which need a new maintainer are:

rpm (#923352)
- Depends: rpm

Created: 2019-11-22 Last update: 2020-06-03 12:40

piuparts found (un)installation error(s) normal

Piuparts stresses package installation, uninstallation, upgrade, ... While doing such tests, one or more errors were found for the following suites:

sid - piuparts

You should fix them.

Created: 2020-06-02 Last update: 2020-06-02 07:34

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.9.4-4, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit f4bc540ee9171d168f532ee1bf1d2c289d0228ee
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:53:18 2020 +0000

    Update standards version to 4.4.1, no changes needed.
    
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit c2996acbceea5270046304135c65b5a3a3c53760
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:52:47 2020 +0000

    Drop unnecessary dh arguments: --parallel
    
    Fixes: lintian: debian-rules-uses-unnecessary-dh-argument
    See-also: https://lintian.debian.org/tags/debian-rules-uses-unnecessary-dh-argument.html

commit 54737fdffca17d4b828c87725a593b4e5cf83fdd
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:52:15 2020 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.
    
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    
    
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html
    
    
    Fixes: lintian: upstream-metadata-missing-repository
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-repository.html

commit 6fe236617c63d6af772e8d1ced869d43883aa2a7
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:51:37 2020 +0000

    Set debhelper-compat version in Build-Depends.
    
    Fixes: lintian: uses-debhelper-compat-file
    See-also: https://lintian.debian.org/tags/uses-debhelper-compat-file.html

commit 3e6ae98a7ccb8ca9baa3e7a537ebc028530c3a83
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:51:06 2020 +0000

    Bump debhelper from old 9 to 12.
    + Use dh_installsystemd rather than deprecated dh_systemd_enable.
    + Use dh_installsystemd rather than deprecated dh_systemd_start.
    
    Fixes: lintian: package-uses-old-debhelper-compat-version
    See-also: https://lintian.debian.org/tags/package-uses-old-debhelper-compat-version.html

commit 27a7619ce7f9b3fa160d59e4683a5375503d7dc0
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:50:33 2020 +0000

    Wrap long lines in changelog entries: 2.9.4-3.
    
    Fixes: lintian: debian-changelog-line-too-long
    See-also: https://lintian.debian.org/tags/debian-changelog-line-too-long.html

commit e9c8a282baafb517bba95796a1e7300ff2866c36
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:50:02 2020 +0000

    debian/copyright: use spaces rather than tabs to start continuation lines.
    
    Fixes: lintian: tab-in-license-text
    See-also: https://lintian.debian.org/tags/tab-in-license-text.html

commit 849bf2e679215755733d129849ef48b2476607cc
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Apr 13 21:49:30 2020 +0000

    Use secure copyright file specification URI.
    
    Fixes: lintian: insecure-copyright-format-uri
    See-also: https://lintian.debian.org/tags/insecure-copyright-format-uri.html

Created: 2020-04-14 Last update: 2020-05-30 10:34

lintian reports 36 warnings normal

Lintian reports 36 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2020-05-21 Last update: 2020-05-21 00:06

7 ignored security issues in stretch low

There are 7 open security issues in stretch.

7 issues skipped by the security teams:

CVE-2018-12467: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
CVE-2018-12479: A Improper Input Validation vulnerability in Open Build Service allows remote attackers to cause DoS by specifying crafted request IDs. Affected releases are openSUSE Open Build Service: versions prior to 01b015ca2a320afc4fae823465d1e72da8bd60df.
CVE-2017-9268: In the open build service before 201707022 the wipetrigger and rebuild actions checked the wrong project for permissions, allowing authenticated users to cause operations on projects where they did not have permissions leading to denial of service (resource consumption).
CVE-2018-12466: openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.
CVE-2018-7689: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
CVE-2018-7688: A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.
CVE-2017-5188: The bs_worker code in open build service before 20170320 followed relative symlinks, allowing reading of files outside of the package source directory during build, allowing leakage of private information.

Please fix them.

Created: 2018-03-05 Last update: 2020-04-14 00:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.3.0).

Created: 2019-07-08 Last update: 2020-04-14 00:09

testing migrations

excuses:
- Migrates after: libbssolv-perl
- Migration status for open-build-service (- to 2.9.4-3): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- Updating open-build-service introduces new bugs: #924233
- Build-Depends(-Arch): open-build-service libbssolv-perl
- Depends: open-build-service libbssolv-perl
- Additional info:
- Cannot be tested by piuparts (not a blocker) - https://piuparts.debian.org/sid/source/o/open-build-service.html
- 50 days old (needed 5 days)
- Not considered

news

[rss feed]

[2020-04-13] Accepted open-build-service 2.9.4-3 (source) into unstable (Lucas Kanashiro)
[2019-03-18] Accepted open-build-service 2.9.4-2 (source) into unstable (Lucas Kanashiro)
[2019-02-07] Accepted open-build-service 2.9.4-1 (source all) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2018-10-09] Accepted open-build-service 2.7.4-3 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2018-04-26] open-build-service REMOVED from testing (Debian testing watch)
[2018-03-17] open-build-service 2.7.4-2 MIGRATED to testing (Debian testing watch)
[2018-03-10] open-build-service REMOVED from testing (Debian testing watch)
[2017-09-04] open-build-service 2.7.4-2 MIGRATED to testing (Debian testing watch)
[2017-09-03] open-build-service REMOVED from testing (Debian testing watch)
[2017-08-12] open-build-service 2.7.4-2 MIGRATED to testing (Debian testing watch)
[2017-08-06] Accepted open-build-service 2.7.4-2 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2017-08-06] Accepted open-build-service 2.8.2-1 (source) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2017-08-03] Accepted open-build-service 2.7.4-1 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2017-02-05] open-build-service 2.7.1-10 MIGRATED to testing (Debian testing watch)
[2017-01-25] Accepted open-build-service 2.7.1-10 (source all) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2017-01-02] open-build-service 2.7.1-9 MIGRATED to testing (Debian testing watch)
[2016-12-22] Accepted open-build-service 2.7.1-9 (source) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-12-19] Accepted open-build-service 2.7.1-8 (source amd64) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-12-15] Accepted open-build-service 2.7.1-7 (source amd64) into unstable (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-12-08] Accepted open-build-service 2.7.1-6 (source amd64) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-11-17] Accepted open-build-service 2.7.1-5 (source amd64) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-10-25] Accepted open-build-service 2.7.1-4 (source amd64) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-10-20] Accepted open-build-service 2.7.1-3 (source amd64) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-10-19] Accepted open-build-service 2.7.1-2 (source amd64) into experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)
[2016-09-20] Accepted open-build-service 2.7.1-1 (source amd64) into experimental, experimental (Andrew Lee (李健秋)) (signed by: 李健秋 Andrew Lee)

bugs [bug history graph]

all: 8
RC: 1
I&N: 4
M&W: 2
F&P: 1
patch: 0

links

homepage
lintian (0, 36)
buildd: logs, clang
popcon
browse source code
edit tags
security tracker
debci