There are 2 open security issues in forky.
commit cfcea57d5601da27ada9392f42a612a95abfb25c
Author: Chris Boot <bootc@debian.org>
Date: Mon Nov 9 11:57:23 2026 +0000
Document how to reproduce the tag2upload orig tarball
tag2upload's git-deborig ignores upstream's export-ignore attributes, so
the archive's orig tarball includes .github/ and the .gitignore files.
uscan matches it via Git-Export: all in debian/watch; gbp matches it
byte-for-byte once "dgit setup-gitattributes" has written
.git/info/attributes in the clone, which cannot be committed, so record
that step in README.source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit 2f3e7a4b8b6858e0be5da699018fcbd5f6c0b0cf
Author: Chris Boot <bootc@debian.org>
Date: Mon Nov 9 11:55:03 2026 +0000
Set compression = xz in debian/gbp.conf
With the default of "auto", gbp guessed gzip from the pristine-tar
branch (which this package no longer uses), so it never found the
archive's ppp_2.5.5.orig.tar.xz and instead generated
ppp_2.5.5.orig.tar.gz from the upstream tag. That tarball is made with
git archive, so it lacks the files upstream marks export-ignore and does
not match the orig in the archive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
commit ad187b3b8c29638f2c3eecefa50e12830face9fb
Author: Chris Boot <bootc@debian.org>
Date: Mon Nov 9 11:49:11 2026 +0000
Set Git-Export: all in debian/watch
Uploads go through tag2upload, which generates the orig tarball with
git-deborig. git-deborig deliberately overrides upstream's ".git*
export-ignore" attribute, so the archive's ppp_2.5.5.orig.tar.xz
contains .github/, .gitattributes and the .gitignore files. uscan's git
mode honoured export-ignore and left them out, so an audit comparing the
archive orig with what uscan produces found extra files in the archive
tarball.
With Git-Export: all, uscan produces a tarball byte-identical to the
archive's ppp_2.5.5.orig.tar.xz (same SHA-256).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Among the 8 debian patches available in version 2.5.5-1+1 of the package, we noticed the following issues:
There are 2 open security issues in trixie.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/p/ppp.png){kind=link}