[DRE-maint] Bug#1144086: trixie-pu: package redmine/6.0.10

Tue Aug 11 04:48:10 BST 2026

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: redmine at packages.debian.org, debian-security at lists.debian.org
Control: affects -1 + src:redmine
User: release.debian.org at packages.debian.org
Usertags: pu

[ Reason ]
I am one of the maintainers of the redmine package.  During the time that I have
been involved with the package, we have not made an effort to fix bugs in
stable.  The package has historically been in bad shape, but a significant
effort has been made to improve the package, and the version in untable is now
much closer to Debian's standards.

I would now like to bring the package in stable up to Debian's standards as
well.

Stable currently has redmine 6.0.5+ds-1.  Unstable has 6.1.3+ds-1.  Upstream
actively fixes security and other bugs in old branches for a significant period
of time.  These updates for older branches are usually released quarterly.  At
the time of this writing, upstream lists the following supported versions on
their website:

Latest releases
5.1.13 (2026-06-15)
6.0.10 (2026-06-15)
6.1.3 (2026-06-15)
7.0.0 (2026-06-30)

https://www.redmine.org/projects/redmine/wiki/Download

The changelog for the 6.0.x series shows a significant amount of bugs (security
and otherwise) fixed between the 6.0.5 and 6.0.10 releases.

https://www.redmine.org/projects/redmine/wiki/Changelog_6_0

I know that typically it is preferable to backport individual patches to fix
bugs in stable.  Given the large number of such bugs, I do not think that any of
the redmine maintainers have the time to commit to such efforts.  Because
upstream is already doing the work of fixing bugs on these older branches, I
would like to seek permission to simply upload these stable releases in their
entirety.  If approved, I would perform a new upload every quarter with the new
upstream releases.

[ Impact ]
One of these changes is a security bug with CVE-2026-1836.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140483

If not approved, it would be possible to cherry-pick just this fix and backport
it.  However, I count at least 17 other security bugs (and dozens of
non-security bugs) listed in the changelog that do not have CVEs assigned to
them.  It is unlikely that any of the redmine maintainers have time to manually
cherry-pick patches to address all of these issues.

[ Tests ]
Upstream ships a test suite with over 5,000 tests (and 24,000 assertions) that
runs during build, as well as autopkgtests designed by the package maintainers.

https://salsa.debian.org/ruby-team/redmine/-/pipelines/1147370

Five of the upstream tests produce errors when backported to trixie, which are
caused by the output of the system not exactly matching the assertions expected
in the tests.  It appears the root cause is that trixie has rails-dom-testing
2.2.0, but the upstream tests expect 2.3.0, which changed the way whitespaces
are handled (several of the errors have whitespace differences).  There is also
some possiblity that the difference between rails 7.2.2.2 in trixie and rails
7.2.3.1 expected by upstream, which can explain the different in certain URLs
automatically generated by the system.

I have manually installed and tested the proposed 6.0.10+ds-1 packages,
particularly in the creation of issue attachments, and have verified that the
functionality works correctly in a live environment.

[ Risks ]
While most of the changes between 6.0.5 and 6.0.10 are bug fixes, there are some
modifications that go beyond the minimum requirements to fix the bugs.
Sometimes there is a gray area between the minimum change required to fix a bug
and general quality-of-life improvements, and upstream tends to error on the
side of including related improvements when backporting bug fixes.

In addition, as is common for Ruby on Rails projects, upstream uses a very tight
list of dependency versions.  We have to modify many of these in unstable to
work with what is available in Debian.  Some of the upstream changes in these
releases modify the Gemfile (which lists version dependencies).  Most of these
are small changes within the tolerance of the packages in trixie, but there is
some chance that these changes could introduce bugs that are not caught in the
automatic and manual testing.

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

[ Changes ]
The changes are made in the following 9 commits:

1.  Update Files-Excluded paths.

https://salsa.debian.org/ruby-team/redmine/-/commit/fe3a1fd2a4c93c5a45d333ebdcf44e0e944df501

* Update Files-Excluded to match the paths in the new upstream release.
* Bump my debian/copyright years.

2.  Initial upstream/trixie branch.

https://salsa.debian.org/ruby-team/redmine/-/commit/5f5e37ea36e7e01c22baa76d6bba7028e9e659b0

3.  Update gbp.conf for Debian trixie.

https://salsa.debian.org/ruby-team/redmine/-/commit/1f3ca9eb79fd518d6cfdad857649687f9a033bfe

* Update gbp.conf to point to the trixie branches.

4 and 5.  Import the 6.0.10 upstream.

https://salsa.debian.org/ruby-team/redmine/-/commit/8583d5990d44da66aef3801be0bd833657b93019
https://salsa.debian.org/ruby-team/redmine/-/commit/114ef9df6d19f32ebf28715f7bb2894d0a5173e4

6.  Adjust the patches for the new upstream release.

https://salsa.debian.org/ruby-team/redmine/-/commit/968aa4b6652d05d2d2316d3a96a25ab3cdab5e42

* debian/patches/0003-Use-production-environment-by-default.patch
  This is a simple refresh to fix offsets.

* debian/patches/autoload-thin-gem
  This is also a simple refresh to fix offsets.

* debian/patches/gemfile-deps-adjustment.patch
  The upstream Gemfile has very specific version constraints and has to be
  adjusted for what is available in Debian.

* debian/patches/use_system_jquery_libs.patch
  This patch has to be adjusted for updated file locations.  The previous patch
  also deleted a file, which is no longer needed.

7. Add debian/patches/skip-certain-tests-on-trixie.patch

https://salsa.debian.org/ruby-team/redmine/-/commit/0d3079cbfae34ddbda0f6e991bb23534c6a8588d

* This patch skips the five tests described above that fail in trixie due to the
  older testing environment.

8. Bump upstream copyright years.

https://salsa.debian.org/ruby-team/redmine/-/commit/f35161d6887841d0fe787c43afcbb0c8c1938b24

9. Refactor debian/copyright.

https://salsa.debian.org/ruby-team/redmine/-/commit/cbcb219b6b75867f9cc1872c109943c05b17244a

* The version of debian/copyright shipping in trixie had become out-of-sync with
  the upstream project, including the main license switching from GPL-2 to
  GPL-2+.

[ Other info ]
$ debdiff redmine_6.0.10+ds-1_amd64.changes redmine_6.0.5+ds-1_amd64.changes 
[The following lists of changes regard files as different if they have
different names, permissions or owners.]

Files in first .changes but not in second
-----------------------------------------
-rw-r--r--  root/root   /usr/share/redmine/app/assets/images/hourglass-empty.svg

Control files of package redmine: lines which differ (wdiff format)
-------------------------------------------------------------------
Installed-Size: [-9940-] {+9919+}
Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+}

Control files of package redmine-mysql: lines which differ (wdiff format)
-------------------------------------------------------------------------
Installed-Size: [-146-] {+138+}
Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+}
Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+}

Control files of package redmine-pgsql: lines which differ (wdiff format)
-------------------------------------------------------------------------
Installed-Size: [-146-] {+138+}
Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+}
Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+}

Control files of package redmine-sqlite: lines which differ (wdiff format)
--------------------------------------------------------------------------
Installed-Size: [-146-] {+138+}
Recommends: redmine (= [-6.0.10+ds-1)-] {+6.0.5+ds-1)+}
Version: [-6.0.10+ds-1-] {+6.0.5+ds-1+}