1. Forum
  2. Usenet
  3. LINUX.DEBIAN.MAINT.KDE

  • Bug#1020417: plasma-vault: encfs security warning during Debian-Install

    From Philip Hands@21:1/5 to All on Sun Oct 2 15:30:01 2022
    Hi,

    [Please CC me if you want me to see your replies]

    I'd imagine you all saw this bug go past, so I was wondering if the lack
    of reaction is due to it seeming to be Somebody Else's Problem.

    If so, I think it's pretty clear that there's an RC bug in there
    somewhere -- I didn't set the severity to critical myself because I
    think someone from the KDE team should decide what needs to be done, and
    apply the appropriate severity on whichever package really needs fixing.

    In case you're wondering how an install-time warning might count as RC,
    please consider that the result of this is that someone deciding to
    install Debian (perhaps for the first time) and selecting KDE as their
    DE currently gets presented with what amounts to a declaration that
    Debian is insecure by default -- there's a screenshot in the bug:

    https://bugs.debian.org/1020417

    Cheers, Phil.
    --
    |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd.
    |-| http://www.hands.com/ http://ftp.uk.debian.org/
    |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE3/FBWs4yJ/zyBwfW0EujoAEl1cAFAmM5kC0ACgkQ0EujoAEl 1cDFexAArOivYtYpG1m+RiHzRLFcbPMZuaWdBZz7SVpfd/HkaW1JPdtIeKem8HXZ 53CB8xrHXKiEcehQbRaNIv7XxriZY8z0xfRcDeoXhwDzZh6Q6vG24PBXFtMvtZn3 LxT29eHe7YYhvwOB7Cj6jZbIrXdSc4w39ZRjpekU3rxwc4+0gLiH6dHUhgJkuiX/ 01l+AMcUDrA7DQbyLl2fp1Ji4xmB+0OQcuulzYcRz6SbbggO4FW4nVUxefcRc+WS JN9UlTr1MGrFfcj7fyP6pzg30eIN21tkFKpzhqCpF2bvd6uqoBsGmVyGQqPT5cYo csLc4IemkRtV2lIJ+hI6DKDTmn/ltFffv1Qzks3dXr3EFnEL0wNhJ5QKjuzo2bEE 07+6G8tpKJCcH2AfaZ4kIHyO93fXJwn4hxzzYnOJmwLzFJvuIGuuZCh5DuhCLn45 ar807A64ZrQfYg8Rsm4CsTxXNSeKvjBjwVewaeRIFL3erju5fUpLAT8GVM9OxCr8 XkA7jY/Q69EeBOX68U3MZ7y+qupWL+PJIco1VpWwXA8G04Ytr1WT6Q6b91Biehi5 TBPGnAf+CM92rpkJWT5A0nGLTpCGfqrzwRwNB0JqiiG/hkcMadziSrqRBC6qiRMs 8jO8MXX8jM2B7nt
  • From =?ISO-8859-1?Q?Aur=E9lien_COUDERC?=@21:1/5 to All on Sun Oct 2 17:20:01 2022
    Le 2 octobre 2022 15:20:45 GMT+02:00, Philip Hands <phil@hands.com> a écrit : >Hi,

    Dear Phil,

    [Please CC me if you want me to see your replies]

    I'd imagine you all saw this bug go past, so I was wondering if the lack
    of reaction is due to it seeming to be Somebody Else's Problem.

    Not at all.

    I have 5.26 in the works with the fix for this bug and thought it could wait until then but it's taking more time than I had anticipated.

    Sune committed the fix to Salsa on top of 5.25.5 today and I'll upload it later today if no one beats me at it.


    Happy hacking,
    --
    Aurélien

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Luc Castermans@21:1/5 to All on Sun Oct 2 18:50:01 2022
    wow, nice stuff ahead!

    Op zo 2 okt. 2022 17:15 schreef Aurélien COUDERC <libre@coucouf.fr>:



    Le 2 octobre 2022 15:20:45 GMT+02:00, Philip Hands <phil@hands.com> a
    écrit :
    Hi,

    Dear Phil,

    [Please CC me if you want me to see your replies]

    I'd imagine you all saw this bug go past, so I was wondering if the lack
    of reaction is due to it seeming to be Somebody Else's Problem.

    Not at all.

    I have 5.26 in the works with the fix for this bug and thought it could
    wait until then but it's taking more time than I had anticipated.

    Sune committed the fix to Salsa on top of 5.25.5 today and I'll upload it later today if no one beats me at it.


    Happy hacking,
    --
    Aurélien



    <div dir="auto">wow, nice stuff ahead!</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Op zo 2 okt. 2022 17:15 schreef Aurélien COUDERC &lt;<a href="mailto:libre@coucouf.fr">libre@coucouf.fr</a>&gt;:<br></div><blockquote class="gmail_
    quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>

    Le 2 octobre 2022 15:20:45 GMT+02:00, Philip Hands &lt;<a href="mailto:phil@hands.com" target="_blank" rel="noreferrer">phil@hands.com</a>&gt; a écrit :<br>
    &gt;Hi,<br>

    Dear Phil,<br>

    &gt;[Please CC me if you want me to see your replies]<br>
    &gt;<br>
    &gt;I&#39;d imagine you all saw this bug go past, so I was wondering if the lack<br>
    &gt;of reaction is due to it seeming to be Somebody Else&#39;s Problem.<br>

    Not at all.<br>

    I have 5.26 in the works with the fix for this bug and thought it could wait until then but it&#39;s taking more time than I had anticipated.<br>

    Sune committed the fix to Salsa on top of 5.25.5 today and I&#39;ll upload it later today if no one beats me at it.<br>


    Happy hacking,<br>
    --<br>
    Aurélien<br>

    </blockquote></div>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?ISO-8859-1?Q?Aur=E9lien?= COUDERC@21:1/5 to All on Sun Oct 2 19:30:01 2022
    Le dimanche 2 octobre 2022, 16:59:13 CEST Aurélien COUDERC a écrit :

    Le 2 octobre 2022 15:20:45 GMT+02:00, Philip Hands <phil@hands.com> a écrit : >Hi,

    Dear Phil,

    [Please CC me if you want me to see your replies]

    I'd imagine you all saw this bug go past, so I was wondering if the lack
    of reaction is due to it seeming to be Somebody Else's Problem.

    Not at all.

    I have 5.26 in the works with the fix for this bug and thought it could wait until then but it's taking more time than I had anticipated.

    Sune committed the fix to Salsa on top of 5.25.5 today and I'll upload it later today if no one beats me at it.

    Voilà, the fix is uploaded.

    (btw, we use pkg-kde-talk@alioth for packaging discussions, debian-kde@l.d.o is for users)


    Happy hacking,
    --
    Aurélien

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Philip Hands@21:1/5 to libre@coucouf.fr on Sun Oct 2 19:20:01 2022
    Aurélien COUDERC <libre@coucouf.fr> writes:

    Le 2 octobre 2022 15:20:45 GMT+02:00, Philip Hands <phil@hands.com> a écrit :
    Hi,

    Dear Phil,

    [Please CC me if you want me to see your replies]

    I'd imagine you all saw this bug go past, so I was wondering if the lack
    of reaction is due to it seeming to be Somebody Else's Problem.

    Not at all.

    I have 5.26 in the works with the fix for this bug and thought it could wait until then but it's taking more time than I had anticipated.

    Sune committed the fix to Salsa on top of 5.25.5 today and I'll upload it later today if no one beats me at it.

    That's great :-)

    Cheers, Phil.
    --
    |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd.
    |-| http://www.hands.com/ http://ftp.uk.debian.org/
    |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE3/FBWs4yJ/zyBwfW0EujoAEl1cAFAmM5xe0ACgkQ0EujoAEl 1cC83hAAjLQDIroN7DVxSxufyB4Kq35QYnDIfsFLx7PfVX7FztWp7nQDiAl2UA4+ aHgnNavOkk5/IUY8PbKncQYd/ZG+L/jVS7X4QJHke6kUVNuE141RPHJKPjfAKXJq VWA3YnUtV9I/m35pyngmiGazwNPlPvMItr5iY2VXn7SCy19CZ4G3BzR6ZFC7/fb3 UP4/VWwrf3uNNaqDZG0bX+PS2aoiAY/w7q6YIA38VwVLlc8Kqf3BaB/jW1cpO8bO +AJKg/PTCuM4do6GRkqA+jaAqiY1R8frFfDNZpNAK/QfRUun4qo7ADjHQQuZahVu aGBUAf1w/AKaotzBq7oBHL0H3DXKLfyEWMo86D0C7soOFHXvBTUmWXeRuf5ckZUF nATj1LRakgboRmAjt2EEHlVQaPO2QFpumU3hyp79PipycszZ6lV51jFLZe9x8opm siRPwlhxmyGdzI1SXQJE+G9OG/SiYsVYcvlYc05wcJFCnxwoFLceYZA88FdZiFrD 3msI05FZS0CRdmPloHbKiuZcr8/EkLDoopbPHxsIrj5HGYV+/hlj+lnWRwOEyTQX 0hjGpM1ODR+PW0njVhX/7sp8Xx2tS4fdLNgQyoZTdjBUfjWfWbdBy6/2dvtgzNKo AmutqZv+Hxxq0oN
  • From Philip Hands@21:1/5 to All on Sun Oct 2 23:40:01 2022
    Hi again,

    BTW I should probably mention that I noticed this problem because it
    required a work-around when testing KDE with openQA, since it causes an
    extra prompt making the previous version of the test fail.

    I know others noticed it too, but it's nice that openQA highlighted the
    problem (and also that it maked it easy for me to provide a screenshot).

    The KDE related tests currently being run are:

    1) Installing KDE systems using d-i (tests both a BIOS and UEFI boot):

    https://openqa.debian.net/tests/80159
    https://openqa.debian.net/tests/80178

    (where one can see the encfs warning, tagged as a soft-failure)

    2) Runs a load of KDE apps to the point of seeing their first screen
    come up:

    https://openqa.debian.net/tests/80179

    (this test was actually put together by Fedora, and there are other
    KDE tests we could probably borrow quite easily)

    So, if you have ideas for tests, especially of things that you suspect
    might actually go wrong in future, please say and I'll be happy to
    knock up a test and/or show you how to make your own.

    Cheers, Phil.
    --
    |)| Philip Hands [+44 (0)20 8530 9560] HANDS.COM Ltd.
    |-| http://www.hands.com/ http://ftp.uk.debian.org/
    |(| Hugo-Klemm-Strasse 34, 21075 Hamburg, GERMANY

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEE3/FBWs4yJ/zyBwfW0EujoAEl1cAFAmM6AaEACgkQ0EujoAEl 1cCYLA//a55pkMtIndPTS4cvKl3VaAVlSEjCVWtbLrJlYuNfgQ2tuKSKALCbuZXy oDyf4U5DO/DfNfogHDMySMvmoZpS6o2EdCcZ9GuNzCC0rgjqWYaUKSOqD2g2yTXh NPDgBahEIM12zq2S0kQpb3iWtdtobrw1hPVqEJqMngroZUD9EdQeaf0/xzDpvwer jfJKNjBWSijLLRien70gFiZjsFOtiDHeCVcyMEJtSaf51pgxXSlGz8od3Zq3bcu/ gFrMSdKaPuCIIChWE3oq2IX5eps3wYg79Z+4XHdvEYc91Yy7txMqwEM4l/v/I447 4qZS/UgVNh8+8P8Z0DcEeTVXx05RTbPrmZASFFa2gAmK9n6B25uDg0c7K9qUyMw5 gfj7UPoF/TZS1dHwywdIekpbFwcwn8854M61UFdSvRd0m9uWldRAD09r8AiFygMt R4+x4h3NM5x/xse+G24WvlF3DY8E5Y1OFGD2zY7kMUrG+EvrLmyTF60Q223vcmmj 2IysHd3usJq2VdD/sM7DzF/hDdXPd4neyIx7lU6SC/qXEMk70AiVA3+gtFxggj0/ BkNXJq14ioFr1kSU69hM6zN3Pq+8sWCnKEIzuRfcpenKAcJdiWd73Uw0mxA4GW+n 6g8SbK2FzvUJXbn