Debian Package Tracker
Register | Log in
Subscribe

pcp

System level performance monitoring and performance management

Choose email to subscribe with

general
  • source: pcp (main)
  • version: 7.2.1-2
  • maintainer: PCP Development Team (DMD)
  • uploaders: Ken McDonell [DMD] – Nathan Scott [DMD]
  • arch: all any
  • std-ver: 4.7.2
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 5.2.6-1
  • oldstable: 6.0.3-1.1
  • stable: 6.3.8-1
  • unstable: 7.2.1-2
versioned links
  • 5.2.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.0.3-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.3.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.2.1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libpcp-archive1
  • libpcp-archive1-dev
  • libpcp-gui2
  • libpcp-gui2-dev
  • libpcp-import-perl
  • libpcp-import1
  • libpcp-import1-dev
  • libpcp-import2
  • libpcp-import2-dev
  • libpcp-logsummary-perl
  • libpcp-mmv-perl
  • libpcp-mmv1
  • libpcp-mmv1-dev
  • libpcp-pmda-perl
  • libpcp-pmda3
  • libpcp-pmda3-dev
  • libpcp-trace2
  • libpcp-trace2-dev
  • libpcp-web1
  • libpcp-web1-dev
  • libpcp3
  • libpcp3-dev
  • libpcp4
  • libpcp4-dev
  • pcp (2 bugs: 0, 2, 0, 0)
  • pcp-atop
  • pcp-conf
  • pcp-doc
  • pcp-dstat (1 bugs: 0, 1, 0, 0)
  • pcp-export-pcp2elasticsearch
  • pcp-export-pcp2graphite
  • pcp-export-pcp2influxdb
  • pcp-export-pcp2json
  • pcp-export-pcp2spark
  • pcp-export-pcp2xlsx
  • pcp-export-pcp2xml
  • pcp-export-pcp2zabbix
  • pcp-export-zabbix-agent
  • pcp-gui
  • pcp-htop
  • pcp-import-benchmarks
  • pcp-import-collectl2pcp
  • pcp-import-ganglia2pcp
  • pcp-import-guidellm2pcp
  • pcp-import-iostat2pcp
  • pcp-import-mrtg2pcp
  • pcp-import-sar2pcp
  • pcp-import-sheet2pcp
  • pcp-pmda-infiniband
  • pcp-testsuite
  • pcp-zeroconf
  • python3-pcp
action needed
lintian reports 2 errors and 10 warnings high
Lintian reports 2 errors and 10 warnings about this package. You should make the package lintian clean getting rid of them.
Created: 2026-08-14 Last update: 2026-09-13 07:30
10 security issues in bookworm high

There are 10 open security issues in bookworm.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
4 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
  • CVE-2024-45769: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP).  This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash.
  • CVE-2024-45770: (needs triaging) A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2024-02-29 Last update: 2026-09-01 22:00
9 security issues in bullseye high

There are 9 open security issues in bullseye.

6 important issues:
  • CVE-2026-16524: A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.
2 issues postponed or untriaged:
  • CVE-2023-6917: (needs triaging) A vulnerability has been identified in the Performance Co-Pilot (PCP) package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges. This disparity in privilege levels poses a risk when privileged root processes interact with directories or directory trees owned by unprivileged PCP users. Specifically, this vulnerability may lead to the compromise of PCP user isolation and facilitate local PCP-to-root exploits, particularly through symlink attacks. These vulnerabilities underscore the importance of maintaining robust privilege separation mechanisms within PCP to mitigate the potential for unauthorized privilege escalation.
  • CVE-2024-3019: (needs triaging) A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer.
1 ignored issue:
  • CVE-2024-45770: A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges.
Created: 2026-07-30 Last update: 2026-08-29 19:00
AppStream hints: 1 error and 1 warning for pcp-gui high
AppStream found metadata issues for packages:
  • pcp-gui: 1 error and 1 warning
You should get rid of them to provide more metadata about this software.
Created: 2018-06-04 Last update: 2026-02-23 04:00
The package has not entered testing even though the delay is over normal
The package has not entered testing even though the 5-day delay is over. Check why.
Created: 2026-08-29 Last update: 2026-09-13 14:32
version in VCS is newer than in repository, is it time to upload? normal
vcswatch reports that this package seems to have a new changelog entry (version 7.2.2-1, distribution unstable) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:
commit aeb42550924a6733c113571cef61b5cb5440f805
Merge: e18b5609 1a49735c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 13 15:37:25 2026 +1000

    Merge pull request #2712 from kmcdonell/wip
    
    Second round of QA Farm rebuild fixups

commit 1a49735c4df7e244c16c1e8ab3df1f9090588eeb
Merge: 668fa172 d300ca16
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 13 14:00:24 2026 +1000

    Merge branch 'wip' of https://github.com/kmcdonell/pcp into wip

commit 668fa172d7cba1182b9959cb83f75af68b67e446
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 13 13:59:18 2026 +1000

    package list scripts fixups from @coderabbitai
    
    In the context of PR #2712.

commit d300ca16980d1ee04f0d36c4a6ff24bb8680bb50
Merge: d40cf8a6 e18b5609
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 13 07:39:08 2026 +1000

    Merge branch 'performancecopilot:main' into wip

commit d40cf8a62d604eef423ca4e2f050e69a4492fc75
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 13 07:27:15 2026 +1000

    package list, packaging and build updates for MacOS
    
    build/mac/GNUmakefile
        - if gawk is installed via brew, the awk recipe here dies a tragic
          death so force the use of the awk from a base MacOS install
    
    build/mac/cmdline-install
        - fix typo (-d -> -f) in guard for mounted package file
    
    qa/admin/check-other
    qa/admin/list-packages
    qa/admin/mac-path-to-pkg
    qa/admin/old-list-packages
    qa/admin/packages.rc
        - package list script updates, especially for brew-installed
          packages
    
    qa/admin/other-packages
        - package list updates
    
    qa/README.vm
        - add notes for MacOS
    
    src/include/builddefs.in
        --no-undefined does not work with ld(1) here
    
    src/python/GNUmakefile
        --allow-shlib-undefined does not work with ld(1) here
    
    qa/admin/pcp-daily
        add mac and UTH VMs on mac

commit 7e524183e393409c925284c398a009609ac085fc
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 10 21:14:54 2026 +1000

    package list and script updates for: Debian 13 on aarch64

commit e18b5609eb43baf299d05e1603df1df21c360f4c
Merge: f011f374 7e6361b1
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Sep 10 10:57:39 2026 +1000

    Merge branch 'jasonk000-jkoch/client-secure-key'

commit 7e6361b170c18f20fd85062336c1427b770cf6cc
Merge: f011f374 50c2fd09
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Sep 10 10:54:15 2026 +1000

    Merge branch 'jkoch/client-secure-key' of https://github.com/jasonk000/pcp into jasonk000-jkoch/client-secure-key

commit b130064bbd25e65ec599727923b2d4fff71350eb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 10 09:19:44 2026 +1000

    package list scripts updates from ArchLinux
    
    - fix botch when $version is empty, like it is here
    - add -s option to list-packages to strip cpan() and pip3() from the
      list of missing packages

commit 113c8b7170837043c398f1962bb4ea1ea96b8750
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 10 07:54:58 2026 +1000

    package list updates for Ubuntu 24.04 and vm31

commit f832511af68f65080796668105bb0830fa32b121
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 10 07:28:27 2026 +1000

    package lists, scripts and build changes: various
    
    - Debian 14
    - Ubuntu 22.04
    - OpenIndiana 2026
      + needed Python build tweak here to skip a gcc option that is
        required elsewhere

commit f77c35f07e168a0e8e18a4c17801b38e9f7d430a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 10 06:32:19 2026 +1000

    package list and scripts updates for OpenIndiana

commit 3173411dcd2a30bbfcc7a0c210a5b3a94d56478f
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 21:16:10 2026 +1000

    package list updates for: RHEL 9

commit d887dad18fee688f8cf067b2d81400011cfbaacf
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 21:08:11 2026 +1000

    package list updates for: RHEL 10 and OpenBSD 7.8

commit 5a6910d30f7a27004985a51610d58696c42784fb
Merge: 7f3bda94 f011f374
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 18:02:39 2026 +1000

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 7f3bda9493edd0611df82a730464db5c1e8b3258
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 18:02:23 2026 +1000

    package lists and scripts: updates for CentOS Stream9

commit 7a32062db6eccb8d7da717ebaa3c2f7ad3479f79
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 17:57:40 2026 +1000

    package list and script updates: for FreeBSD 14

commit f011f3748bebe3cb37c369b497074247dcb7117c
Merge: 7c7b3348 e591251b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 17:48:19 2026 +1000

    Merge pull request #2710 from kmcdonell/wip
    
    QA Farm rebuild changes

commit 20b49c374f496faf658707d26f6fe143cc8e495e
Merge: e591251b 7c7b3348
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 15:57:50 2026 +1000

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit e591251bf2f6319f73438cf99f24d9ac5cbae0b0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 15:55:31 2026 +1000

    More @coderabbitai cleanups for PR #2710

commit a391ea37bc30dffd48b8cdec1e98225b1658ec49
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 15:03:54 2026 +1000

    qa/admin/check-other: fixup sential file name

commit 7c7b334847c950e782660632a41f68287bfc75e3
Author: Jan Kurik <jkurik@redhat.com>
Date:   Mon Sep 7 13:26:31 2026 +0200

    pmdads389: prevent dynamic PMNS collisions
    
    Encode the complete replication agreement CN as a valid PMNS component
    instead of truncating it at the first dot. This keeps agreements with
    shared CN prefixes distinct.
    
    Register IPACA monitor metrics once per backend, outside the replication
    agreement loop. Add archive-based QA coverage for the generated metric
    names.
    
    Resolves: RHEL-244742
    Resolves: RHEL-182968

commit 5c825a4ea34e247224cfbd3793bb0c021a5588e0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 14:50:35 2026 +1000

    package list updates for Ubuntu 26.04 and script fixes from @coderabbitai
    
    All in the context of PR #2710.

commit 793974e334225117037bdba59508216842d0a986
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 11:17:21 2026 +1000

    qa/admin/package-lists/Ubuntu+24.04+x86_64: bpftrace-dbgsym needs to be not4ci

commit 25a6909d58ed0f274019123c99845a8e666e4780
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 11:08:25 2026 +1000

    package list: updates for CentOS 8

commit da3a26faa745084cfdd07e5e32582ef1c2c7baf3
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 10:57:38 2026 +1000

    package list: updates for OpenBSD 7.7

commit 8903431114ff0b48cda6a2a3cf0a6059ad733959
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 10:15:01 2026 +1000

    NetBSD: build and libpcp changes
    
    On vm09, the $(PACKAGE_DISTRIBUTION) macro is netbsdelf not netbsd, which broke the Python build
    macro in builddefs.
    
    Also, this C compiler is more picky about the argument to isspace() et al, expecting
    it to really be an (int) ... so some cosmetic casting needed to make the compiler warnings
    go away here [probably more changes needed outside libpcp, but not in this commit]

commit 14873ea73eadb295facc1305d96aa8970d6c88ec
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 09:42:25 2026 +1000

    package list: updates for Fedora 43

commit d3e2cdcfa2977c4aba6539de0d657bef24c7132c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 09:33:07 2026 +1000

    package list and scripts: updates for CentOS 7

commit 3022fb3d646332485364d1764f364a8ce2b1902c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 07:42:31 2026 +1000

    package list and scripts: updates for CentOS Stream10

commit 53b02b8c00deddf32be280a671221e99d2cbd55a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 07:23:43 2026 +1000

    package list and scripts: updates for Debian 13

commit b8ef9eae852c3b362063e7e46c28e69a75fe90f4
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 07:11:28 2026 +1000

    package list and scripts: updates for openSUSE 15.6

commit 08402bfab1c3db5e6601f6f018160fac446ff85b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 06:42:39 2026 +1000

    package list and scripts: updates for LinuxMint 22.3

commit 7917a26badb682302dc417c9102decbe66ef8ffd
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 06:19:31 2026 +1000

    package list and scripts: updates for Ubuntu 20.04

commit 0822fe01a072cdd9fffd8af1892a8f516c97a656
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Wed Sep 9 06:12:12 2026 +1000

    package list and scripts: updates for Fedora 46

commit 4df33c498a205e8beff39ccf655c898a4fb5a61d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 16:41:01 2026 +1000

    package list: updates for Linux MX

commit 521b02adfd57d1b8d3d39c9289a498c7e5ae528a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 16:17:31 2026 +1000

    package list: updates for i686 Debian 12

commit e37451fde201ae31964a4ae987548147404d2b5b
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 15:10:41 2026 +1000

    package list and scripts: updates for openSUSE Tumbleweed i686
    
    Plus (new) qa/src/whack-suse-libnuma.c to work around
    pervasive kernel+libnuma problem on this platform ... lots
    of commands emit
        get_mempolicy: Function not implemented
    which has nothing to do with PCP, but causes massive QA failures.
    
    This is built and installed on vm19 and no where else.

commit 35974621e566e288e6bcf38be9105ba4b11a795c
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 12:48:44 2026 +1000

    package list and scripts: updates for RHEL 8

commit d4e82b2af6182cfdc8e67b7475df13837f8b0ede
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 09:15:49 2026 +1000

    src/libpcp/src/getopt.c: refactor __pmStartOptions()
    
    On FreeBSD the change to include -Wl,--no-undefined in LDFLAGS caused a
    build failure because the external symbol environ cannot be resolved for
    a DSO at build time ... the symbol is resolved when the DSO is linked
    with an app and gets crt1.o included.
    
    Recode the logic here to use getenv() rather than walking the array of
    pointers from environ[] directly.
    
    Needed to backport the same change to the libpcp3 version of getopt.c
    because it had the same issue.

commit 8057bf1f96af4134f57c6fbedda34109d9922430
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 08:24:26 2026 +1000

    package list and scripts: updates for FreeBSD 15

commit 122358e096f592e49aa3c6ecccbb1dea3f86dbde
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Tue Sep 8 06:24:45 2026 +1000

    OpenBSD 7.9 changes: build and package lists
    
    The change to include -Wl,--no-undefined in LDFLAGS triggered build failures
    on OpenBSD (and the other *BSD platforms it looks like, but I've not triaged
    these yet) ... specifically when building *any* DSO we need an explicit
    -lc.  While needed here, this is harmless everywhere else, which is
    fortunate because the change needs to be made in lots of places.
    
    Also in this commit package list and package script updates for
    OpenBSD 7.9.

commit 50c2fd094e467512adf5cc4b2eb02909c96e2c44
Author: Jason Koch <jkoch@netflix.com>
Date:   Mon Sep 7 10:41:12 2026 -0700

    libpcp, qa: allow distinct client and server certificates
    
    The OpenSSL migration in 3e8b61aeda left the client certificate
    selection in an else-if chain. When client-specific files were
    configured, the generic server certificate could still be loaded,
    causing the subsequent client key to fail the certificate/key match.
    
    Commit fe8e9f8ddc later commented out QA 712 coverage for separate
    client and server certificates without documenting the reason.
    
    This change restores that coverage and selects the client certificate
    and key as a pair. Reject partial client-specific configuration.
    
    Tested with QA 712 on macOS in Tart.

commit aada983290db68f24cbaa45f6ccf541bf296baa9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 15:00:13 2026 +1000

    package list: updates for Ubuntu 24.04

commit 7d7f11a0382fefdecdb06d58defb0345618fb800
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 10:50:33 2026 +1000

    package list and scripts: updates for ArchLinux

commit c0500b4d3cdb02016b08cdf2d81fde0c402a6571
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 09:52:40 2026 +1000

    package list: updates for openSUSE 16.0

commit d0c723f23b7feaba71b85fb056a907a6719b0ffa
Merge: 21d4394c 8ee24013
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 09:44:03 2026 +1000

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit 21d4394c8f39ac0e09e4db3de0611f14aee015be
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 09:26:42 2026 +1000

    package list and scripts: updates for AmazonLinux

commit 8ee240139d77d1c320369fbe23eb360ffa9ea95e
Merge: 17a2b81d 90d3f74f
Author: Nathan Scott <nathans@redhat.com>
Date:   Mon Sep 7 09:03:42 2026 +1000

    Merge branch 'pauljevans-pevans-merge'

commit 49e5d05d81faf4f5715cafa849a852e4fc2a29a9
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Mon Sep 7 08:05:25 2026 +1000

    package list and scripts: updates for openSUSE Tumbleweed

commit 8cff513a37ebcabb894d3dd19ca2f425882922ae
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 6 08:00:09 2026 +1000

    package list and scripts: updates for Debian 14

commit 9db6055116a018d600b6cf30871069a4e384a5b4
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 6 06:43:53 2026 +1000

    package list and scripts: updates for Ubuntu 22.04

commit c7f29d04814218ad6c1d8d830a14860aa68c9eec
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sun Sep 6 05:49:17 2026 +1000

    package list and scripts: updates for RHEL 8

commit 8fc6dbbf132e2a404441214f4af79ad36271eb55
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Sep 5 15:35:14 2026 +1000

    package list and scripts: updates for Slackware 15.0

commit 0379d253a1dcdc400b2b5cd8bfe417e92961d628
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Sep 5 07:54:17 2026 +1000

    OracleLinux+10+x86_64: helps if you git add the package list

commit e5083e1c5b325a64bbd6c562f63c69df1ad6a446
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Sep 5 07:51:34 2026 +1000

    package list and scripts: updates for OracleLinux 10

commit 90d3f74f6a5554889fbd7b43dfb6a48cdb927f2a
Author: Paul Evans <pevans@redhat.com>
Date:   Fri Sep 4 12:49:20 2026 +0100

    pmdasmart: fix Coverity FORWARD_NULL and TOCTOU warnings
    
    Fix both warnings from Coverity from the recent pmdasmart changes

commit e19f6558931ab9ae2a838f71f39bb37ae4ee51ff
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 21:50:26 2026 +1000

    package list and scripts: updates for NetBSD 11

commit 7f88fddeef0ea08d47fb11baca562b88809d4d12
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 21:24:16 2026 +1000

    package list and scripts: update for Debian 12

commit c461efddcbda5a2288183259c723361a0b231801
Merge: abbd7291 17a2b81d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 15:24:11 2026 +1000

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit abbd729114e747b1c42929a527adb00319ae4e1d
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 15:23:27 2026 +1000

    package list and scripts: update for CentOS 7

commit 80943be0ea0844c85b68618b453c0b40c3d39f6f
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 14:25:27 2026 +1000

    package lists: updates for Fedora 44
    
    And dnf5 which is different to dnf (list options and output) and
    this broke a bunch of scripts.

commit 17a2b81d5a1ba2e414eb6d1b77760dd4b870af44
Merge: 7a2fa70b 56d35614
Author: Nathan Scott <nathans@redhat.com>
Date:   Fri Sep 4 11:47:05 2026 +1000

    Merge branch 'pauljevans-pevans-merge'

commit 5c0413ed2ea47c5f56ac22d56b9a353b6e41bbdd
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Sep 4 10:15:50 2026 +1000

    packaging and build: wind back some OpenMandriva changes and fix AmazonLinux
    
    Some of the OpenMandriva changes broke the build on other rpm
    platforms, so re-scope these to be mandriva-only or undo 'em
    and I'll return to the issue when I go back to getting OpenMandriva
    working:
        build/rpm/GNUmakefile:
            - if rpm -ba fails, fail the build
    
    build/rpm/pcp.spec.in
      - need %{nil} (not nothing) for empty macro definitions
      - some of the Requires: and Build-Requires: package macro-isation
        was wrong for non-mandriva platforms
    
    General fixups and improvements to the following scripts:
      - qa/admin/check-other
      - qa/admin/check-rpm
      - qa/admin/check-vm
      - qa/admin/list-packages
      - qa/admin/old-list-packages
    
    Package changes specific to AmazonLinux 2023:
      - qa/admin/other-packages/manifest
      - qa/admin/other-packages/unavailable
      - qa/admin/package-lists/AmazonLinux+2023+x86_64
    
    Make the byte-compiling changes for Python interface layers mandriva-only:
      - src/include/builddefs.in
      - src/python/GNUmakefile
    
    Make the omit -flto from CFLAGS changes mandriva-only:
      - src/perl/GNUmakefile
      - vendor/GNUmakefile

commit 56d356141e60180a3e5091786f2f9ab7f38e69bf
Author: Paul Evans <pevans@redhat.com>
Date:   Thu Sep 3 18:29:33 2026 +0100

    pmdasmart: enumerate block devices from sysfs instead of lsblk
    
    Replace the lsblk command with direct sysfs enumeration of
    /sys/class/block/ for discovering SMART-capable block devices.
    
    The previous approach used a hardcoded lsblk exclusion list
    (lsblk -e 1,2,7,11,251,252) to filter virtual devices by major
    number. This was fragile because major numbers like zram (251)
    and device-mapper (252) are dynamically allocated and vary across
    distributions and kernel configurations.
    
    The new smart_enumerate_devices() function filters sysfs entries
    using three checks:
      - skip partitions (have a "partition" sysfs attribute)
      - skip virtual devices (symlink resolves through /devices/virtual/)
      - skip non-disk SCSI types such as CD-ROM (device/type != 0)
    
    Accepted devices are sorted by major:minor to match the ordering
    previously provided by lsblk, preserving instance identifier
    stability for existing pmlogger archives.
    
    The SMART_SETUP_LSBLK environment variable override is retained
    for QA testing.
    
    Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

commit 466d5a6bd1936c24d13352160f8f06753ec85534
Author: Paul Evans <pevans@redhat.com>
Date:   Thu Sep 3 17:57:02 2026 +0100

    pmdasmart: skip devices without wwid instead of aborting
    
    When uuid_instance_refresh() encountered a block device without a
    world wide identifier (e.g. zram or loop devices), it called pclose()
    on the unfinished lsblk pipe and returned the error. This aborted
    the entire instance refresh rather than just skipping the problematic
    device.
    
    Change to continue so devices without a wwid are silently skipped in
    the UUID instance domain while the remaining devices are processed
    normally.
    
    Add QA test archive smart-root-006 with a fake device name
    (pcp_qa_disk0) that cannot match any real /sys/block/ entry,
    and extend test 1397 to verify the PMDA handles missing wwid
    gracefully.
    
    Resolves #2702

commit 45b3c0a9312ca008d082262bd46d105712985f24
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 16:23:35 2026 +1000

    qa/admin/post-setup: rework "ip show link" parser
    
    Change from broken to working (at least on vm01).

commit b5249d7179db059f05c9665b3a0bf8a3524be0e0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 16:19:26 2026 +1000

    src/include/builddefs.in: changes to byte-compiling Python interface bits
    
    New comment says is all:
        we're forcing integrated byte-compiling in the builds now with
        PYTHONDONTWRITEBYTECODE=0
        over in src/python/GNUmakefile
        so we don't need the find and append to the end of python3-pcp.list

commit 66ac08315e0d9c2289a6821eed59f7985ff415c2
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 12:31:54 2026 +1000

    pacake lists and scripts: updates for Ubuntu 16.04 (from vm01)

commit bd53becb6b18e954dc8b096b36d3e536a71bc363
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 11:54:24 2026 +1000

    build: enable -no-undefined for ld(1)
    
    Mandriva's rpmbuild forces this, which lead to a bunch of build
    failures.
    
    It is probably a "good thing", so turn it on for all our builds
    and then deal with the exceptions:
    - pmcd DSO PMDA (needs symbols from running pmcd at dlopen() time)
    - Python wrappers (by design and without exception, these need symbol
      resolution at dlopen())
    
    And this also fixes this class of build failure for OpenMandriva.

commit c73809b1b8a8e50905510162ef7e2d93440e210a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 11:51:25 2026 +1000

    src/pmdas/bpf/modules/GNUmakefile: link with -lz
    
    Avoids unresolved external symbols.

commit 57a78e161ea87b0e296534d6179e39037e6d0aae
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 08:04:40 2026 +1000

    build/rpm: changes for OpenMandriva
    
    - build/rpm/pcp.spec.in: lots of changes to accommodate (apparently
      arbitrary) package name changes between RH, SUSE and OpenMandriva ...
      most done with macro-driven names rather than conditionals
    
    - build/rpm/GNUmakefile: rpm -ba looks like it can work, but return a
      non-zero exit status ... make the makefile a little more accommodating

commit 534db01b1782ab3fdabc60adfff5963e89c276bf
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Sep 3 08:01:00 2026 +1000

    src/pmlogger/GNUmakefile: sed recipe for crontab.daily_report totally broken
    
    Not sure how this has been missed for, er over a year, but
    it broke the build on OpenMandriva.

commit 7a2fa70b3517e7f0055a1c7f91fdcd99eee573c1
Merge: 16ab2a18 6114b9f5
Author: Nathan Scott <natoscott@users.noreply.github.com>
Date:   Wed Sep 2 15:42:39 2026 +1000

    Merge pull request #2704 from performancecopilot/dependabot/github_actions/github/codeql-action-4.37.9
    
    build(deps): bump github/codeql-action from 4.37.8 to 4.37.9

commit 16ab2a180c3ad167cb62498128b1514c9382ea0e
Merge: d5ace94b 6fb9dc85
Author: Nathan Scott <nathans@redhat.com>
Date:   Wed Sep 2 15:42:01 2026 +1000

    Merge branches 'orasagar-pcp-ps_optimization' and 'lukas7811-main'

commit d5ace94bee7a7614e89a95408f1c93c0c201fa00
Merge: 719d454a 72dca1bd
Author: Nathan Scott <nathans@redhat.com>
Date:   Wed Sep 2 15:41:20 2026 +1000

    Merge branch 'pcp-ps_optimization' of github.com:orasagar/pcp into orasagar-pcp-ps_optimization

commit 6114b9f5f7033011bcfec01d77712c1233874e1a
Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Date:   Mon Aug 31 22:34:17 2026 +0000

    build(deps): bump github/codeql-action from 4.37.8 to 4.37.9
    
    Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.37.8 to 4.37.9.
    - [Release notes](https://github.com/github/codeql-action/releases)
    - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
    - [Commits](https://github.com/github/codeql-action/compare/v4.37.8...v4.37.9)
    
    ---
    updated-dependencies:
    - dependency-name: github/codeql-action
      dependency-version: 4.37.9
      dependency-type: direct:production
      update-type: version-update:semver-patch
    ...
    
    Signed-off-by: dependabot[bot] <support@github.com>

commit 6fb9dc85a539c77821106863072be1b7aec33beb
Author: Lukas Oliva <lukas.oliva@virtuozzo.com>
Date:   Tue Sep 1 00:21:08 2026 +0200

    macos: preserve already-absolute libpcp paths in QT_LINKER_FIXUP
    
    The previous guard only skipped rewriting a dependency already rooted
    at $(PCP_LIB_DIR), so any other absolute libpcp path found by otool -L
    would still get blindly prefixed with $(PCP_LIB_DIR), producing a
    broken concatenated path instead of being left alone. Match on any
    leading "/" instead, so every already-absolute dependency is preserved
    verbatim and only a bare "libpcp.N.dylib" name gets rewritten.
    
    Verified via a full Makepkgs --with-qt=yes rebuild plus standalone
    double-invocation (make run twice) on pmdumptext, pmchart and pmtime:
    otool -L shows a single /usr/local/lib/libpcp.N.dylib entry on both
    runs and all three run standalone (-V) without DYLD_LIBRARY_PATH.
    pmquery (also named in review) builds fine and never links libpcp, so
    the fixup is a no-op there. pmgadgets fails to build for an unrelated,
    pre-existing reason (missing images/pmgadgets.png, not in default
    SUBDIRS); pmview needs ENABLE_QT3D, which this configuration has off.

commit 72dca1bd4559164c491a9c3fe8e30663db6037b6
Author: Sagar Sagar <sagar.sagar@oracle.com>
Date:   Mon Aug 31 10:17:27 2026 +0000

    qa: update 1987 process output fixture

commit 19073e5832ea7e67e6b630bb35f2aba303c83814
Author: Lukas Oliva <lukas.oliva@virtuozzo.com>
Date:   Mon Aug 31 07:54:56 2026 +0200

    macos: fix libpcp install_name for qmake-built Qt tools
    
    pmchart, pmdumptext, pmtime, pmquery, pmgadgets and pmview are linked
    directly by qmake's generated Makefile via the QTMAKE build-me recipe,
    which bypasses the $(PROGTARGET)/$(LIBTARGET) rules in buildrules that
    invoke LINKER_MAKERULE after linking. On macOS that rule is what
    rewrites a binary's bare "libpcp.N.dylib" dependency into an absolute
    $(PCP_LIB_DIR) path, so without it these Qt tools keep the bare name
    and dyld fails to load them outside the build tree.
    
    Add QT_LINKER_FIXUP, the same fixup parameterized on an explicit binary
    path (build-me has no mtime-based prerequisites, so $@ isn't available
    and the recipe can legitimately run more than once per build; the
    fixup skips paths already rooted at $(PCP_LIB_DIR) so repeat runs are
    a no-op instead of nesting the prefix), and call it after $(LNMAKE) in
    each affected GNUmakefile.

commit 719d454ac3fe93404ab0121921d403434db27786
Merge: d68f585e 7814f52e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Sat Aug 29 05:40:42 2026 +1000

    Merge pull request #2701 from kmcdonell/wip
    
    QA Farm rebuild

commit 7814f52eecf0fb6d98d42c4c1537cfc741d18d89
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 16:40:35 2026 +1000

    Update build/tar/verify-install
    
    Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

commit 2ae632107f0144c3fa29e6cc93b0de9b51ead561
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 15:46:43 2026 +1000

    more nits from @coderabbitai for PR 2701

commit affaaaa98956d0c6a097a433ce73a0744e417f78
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 14:02:37 2026 +1000

    misc: pick at nits from @coderabbit

commit dcc384433e66e31aebc138e79de183c6c4cc7d16
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 13:44:14 2026 +1000

    packing lists: manifest cleanup and updates for openSUSE 16

commit 1a7c177ee62289d258609b228cb24f62a9823143
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 13:42:55 2026 +1000

    qa/admin/install-packages: (new) uber package installer
    
    Will install packages (like the ones from list-packages -m) on any platform.
    
    Logic borrowed from qa/admin/post-setup.

commit 87ae39b9e32c9a488931b9ad16ecbf5b7f9472d4
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 13:04:58 2026 +1000

    assorted fixups: from @coderabbit for PR 2701

commit b17ee08a1122ae8a4a5ec3b0829e7ea61072d50a
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 12:57:36 2026 +1000

    qa/1728 (and 1729): extent coverage for $PCP_SQUASH_NEWLINES
    
    In the same boat as the other PCP_FOO env vars for pmPrintValue()
    but this one had no obvious QA coverage.

commit 3faa5cda5a1b4d2be8d748e495590f8fac1bb0ef
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 12:43:59 2026 +1000

    libpcp: tweak pmPrintValue() env var uses
    
    Based on @coderabbitai feedback in PR 2701, add sanity checks for the
    values imported from $PCP_FLOAT_PRECISION and $PCP_DOUBLE_PRECISION and
    reject (and report if -Dmisc) unacceptable values.
    
    The new qa/1728 and the qa/1729 valgrind dual exercise all of this.

commit 6197acfc4ac56ec0d41789d03dd4d34223ed27e0
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 06:57:10 2026 +1000

    build/tar/verify-install: replace tar -tv usage
    
    coderabbitai pointed out in the context of PR 2701 that
    tar -tv is not portable ... GNU and BSD cannot agree on the output
    format, so post-processing this with awk to pick fields out is
    doomed.
    
    Claude handily suggested that the underlying archive format is
    invariant, and so a drop-in replacement in Python could be used
    safely across all platforms.
    [I've finally encountered an actual example where Python is really,
    really useful].

commit a9e2299e4dd5b424fb83dbb1d9497a9383ab9d20
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 06:55:26 2026 +1000

    qa/admin/other-packages/manifest: update pyarrow for dpkg

commit efb789c47977995ced96d9472daa88ad2fc22409
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Fri Aug 28 06:51:12 2026 +1000

    qa/admin/other-packages/manifest: add sqlite3.h packages
    
    Needed to build pmsearch now.

commit 3b50ba54a92cf8405748f92bd028207dfbcafc34
Merge: cc751922 d68f585e
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Aug 27 14:37:05 2026 +1000

    Merge branch 'main' of https://github.com/performancecopilot/pcp

commit d68f585e654da51846fdf056e032bf51851e812b
Merge: 90318199 a9b7fe54 affa7570
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Aug 27 14:30:17 2026 +1000

    Merge branches 'wtatarski-pmproxy-x509-leak', 'orasagar-pcp_tools_bug_fix' and 'kurik-ppc64le-huge'

commit affa75705ad61c5f2f82e8cf438905328039d9a0
Merge: 2f1a1613 201c5358
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Aug 27 14:29:55 2026 +1000

    Merge branch 'ppc64le-huge' of github.com:kurik/pcp into kurik-ppc64le-huge

commit a9b7fe5448d83f16589ed740482e1f0709db4364
Merge: 2f1a1613 e441fe62
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Aug 27 14:26:17 2026 +1000

    Merge branch 'pcp_tools_bug_fix' of github.com:orasagar/pcp into orasagar-pcp_tools_bug_fix

commit 903181990be362b18c3a7a170a92577926e5d25b
Merge: 2f1a1613 7e3df62e
Author: Nathan Scott <nathans@redhat.com>
Date:   Thu Aug 27 14:25:14 2026 +1000

    Merge branch 'pmproxy-x509-leak' of github.com:wtatarski/pcp into wtatarski-pmproxy-x509-leak

commit 2f1a1613a924eb9c032d3ee15a1a1be2b3c805a7
Merge: 55365f2e 0b24d731
Author: Nathan Scott <natoscott@users.noreply.github.com>
Date:   Thu Aug 27 14:24:43 2026 +1000

    Merge pull request #2696 from performancecopilot/dependabot/github_actions/github/codeql-action-4.37.8
    
    build(deps): bump github/codeql-action from 4.37.4 to 4.37.8

commit cc751922aaca84bfca27531a7690a511bf9e93ee
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Aug 27 13:50:20 2026 +1000

    libpcp: pmPrintValue: allow control of digits of precision for float and double values
    
    After bozo was rebuilt, the new faster CPU (AMD this time, not Intel as
    well) mean that the lmsensors PMDA was exporting values for PM_TYPE_FLOAT
    metrics like lmsensors.amdgpu_pci_7600.sclk in the 600000000 range, but
    t.his is big enough to flip libc so that %x.8g produces a value of 6e+8
    (scientific notation, ot fixed format) which blows up qa/1480 when it asks
    awk to do arithmetic on this value which is no longer numeric in awkland.
    
    This is really symptomatic of an arbitrary decision in libpcp (8) that
    the user cannot change.  pmPrintValue() is sufficently low-level that the
    problem is visible in pminfo, pmprobe, pmrep, ...
    
    So I've introduced another environment variable, $PCP_FLOAT_PRECISION that
    can be used to set the precision for float value printing to be something
    other than 8.
    
    And the same problem exists and is fixed the same way for PM_TYPE_DOUBLE
    where the (new) $PCP_DOUBLE_PRECISION allows something different to the
    hard-coded 16 digits of precision.

commit c7e75cbce86b4d790f1f8623d360aea0efd1a6bb
Author: Ken McDonell <kenj@kenj.id.au>
Date:   Thu Aug 27 08:02:35 2026 +1000

    Assorted package-list and VM build updates
    
    From the QA Farm rebuild for AmazonLinux 2023, Fedora 44, LinuxMint 25.2
    and MX Linux 25.2
    
    - new or updated packing-list files
    - tweaks for qa/admin/other-packages/manifest
    - effectively retire qa/admin/other-packages/require as this is no
      longer adding any value
    - qa/admin/post-setup needed more bells and whistles
    - qa/README.vm updates
    - fix qa/admin/old-list-packages so that qa/admin/packing-lists/new works
      better
    - qa/admin/list-packages - add a -u flag to run -c _and_ update the
      packing list for the things that can be unilaterally added or
      dropped
    - qa/admin/pcp-daily needs to know about some more special VMs and hosts
    - new qa/008.out.bozo for the born again bozo
    - qa/qa_hosts.primary update QA Farm "special" hosts
    - qa/check.callback.sample update QA Farm "special" hosts
    - qa/common.check fix a typo in _all_ipaddrs() for network interface
      names vibr should have been virbr and ditto for _all_hostnames()
Created: 2026-05-23 Last update: 2026-09-13 13:31
Multiarch hinter reports 1 issue(s) low
There are issues with the multiarch metadata for this package.
  • pcp-doc could be marked Multi-Arch: foreign
Created: 2016-09-14 Last update: 2026-09-13 11:32
6 low-priority security issues in trixie low

There are 6 open security issues in trixie.

6 issues left for the package maintainer to handle:
  • CVE-2026-16524: (needs triaging) A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh.
  • CVE-2026-16526: (needs triaging) A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root.
  • CVE-2026-16527: (needs triaging) An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover.
  • CVE-2026-16529: (needs triaging) A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads.
  • CVE-2026-16530: (needs triaging) A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory.
  • CVE-2026-16531: (needs triaging) An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-07-30 Last update: 2026-09-01 22:00
Standards version of the package is outdated. wishlist
The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).
Created: 2025-12-23 Last update: 2026-08-14 03:18
testing migrations
  • This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.
  • excuses:
    • Migration status for pcp (- to 7.2.1-2): BLOCKED: Rejected/violates migration policy/introduces a regression
    • Issues preventing migration:
    • ∙ ∙ New but not reproduced on amd64 - info: pcp-testsuite
    • ∙ ∙ New but not reproduced on arm64 - info: pcp, pcp-testsuite
    • ∙ ∙ New but not reproduced on armhf - info: pcp, pcp-testsuite
    • ∙ ∙ New but not reproduced on i386 - info: pcp, pcp-testsuite
    • Additional info (not blocking):
    • ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/p/pcp.html
    • ∙ ∙ 30 days old (needed 5 days)
    • Not considered
news
[rss feed]
  • [2026-08-30] pcp REMOVED from testing (Debian testing watch)
  • [2026-08-16] pcp 7.2.1-2 MIGRATED to testing (Debian testing watch)
  • [2026-08-14] Accepted pcp 7.2.1-2 (source) into unstable (Nathan Scott)
  • [2026-08-01] pcp 7.2.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-07-30] Accepted pcp 7.2.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2026-05-29] pcp 7.1.5-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-26] Accepted pcp 7.1.5-1 (source) into unstable (Nathan Scott)
  • [2026-05-25] pcp 7.1.4-1 MIGRATED to testing (Debian testing watch)
  • [2026-05-22] Accepted pcp 7.1.4-1 (source) into unstable (Nathan Scott)
  • [2026-05-02] Accepted pcp 7.1.3-2 (source) into unstable (Nathan Scott)
  • [2026-04-27] pcp 7.1.2-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-24] Accepted pcp 7.1.2-1 (source) into unstable (Nathan Scott)
  • [2026-04-02] pcp 7.1.1-1 MIGRATED to testing (Debian testing watch)
  • [2026-03-30] Accepted pcp 7.1.1-1 (source) into unstable (Nathan Scott)
  • [2026-01-30] pcp 7.1.0-1 MIGRATED to testing (Debian testing watch)
  • [2026-01-28] Accepted pcp 7.1.0-1 (source) into unstable (Nathan Scott)
  • [2025-12-05] pcp 7.0.5-1 MIGRATED to testing (Debian testing watch)
  • [2025-11-21] Accepted pcp 7.0.5-1 (source) into unstable (Nathan Scott)
  • [2025-11-19] Accepted pcp 7.0.4-1 (source) into unstable (Nathan Scott)
  • [2025-11-12] Accepted pcp 7.0.3-1 (source arm64 all) into unstable (Nathan Scott)
  • [2025-11-01] pcp REMOVED from testing (Debian testing watch)
  • [2025-10-16] Accepted pcp 7.0.2-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-23] Accepted pcp 7.0.1-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-09-01] Accepted pcp 7.0.0-1 (source arm64 all) into unstable (Debian FTP Masters) (signed by: Nathan Scott)
  • [2025-04-21] pcp 6.3.8-1 MIGRATED to testing (Debian testing watch)
  • [2025-04-11] Accepted pcp 6.3.8-1 (source) into unstable (Nathan Scott)
  • [2025-04-07] pcp 6.3.7-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-28] Accepted pcp 6.3.7-1 (source) into unstable (Nathan Scott)
  • [2025-03-17] Accepted pcp 6.3.6-1 (source) into unstable (Nathan Scott)
  • [2025-03-15] Accepted pcp 6.3.5-1 (source) into unstable (Nathan Scott)
  • 1
  • 2
bugs [bug history graph]
  • all: 3
  • RC: 0
  • I&N: 3
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian (2, 10)
  • buildd: logs, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • screenshots
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 7.2.1-2
  • 2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing