You might see a verification screen pop up on more and more Debian web properties. Unfortunately the AI world of today is meeting web hosts that use Perl CGIs and are not built as multi-tiered scalable serving systems. The issues have been at three layers: Apache's serving capacity runs full - with no threads left to serve requests. This means that your connection will sit around for a long time,…
If you are like me that you are installing machines with testing and then go and flip them over to the current stable for a while using APT::Default-Release, you might not be receiving all relevant updates. In fact this setting is kind of discouraged in favor of more extensive pinning configuration. However, the field does support regexps, so instead of just specifying, say, "trixie", you can put…
20 years ago, I got my Debian Developer account. I was 18 at the time, it was Shrove Tuesday and - as is customary - I was drunk when I got the email. There was so much that I did not know - which is also why the process took 1.5 years from the time I applied. I mostly only maintained a package or two. I'm still amazed that Christian Perrier and Joerg Jaspert put sufficient trust in me at that…
debian.org's infrastructure now supports using Security Key-backed SSH keys. DDs (and guests) can use the mail gateway to add SSH keys of the types sk-ecdsa-sha2-nistp256@openssh.com and sk-ssh-ed25519@openssh.com to their LDAP accounts. This was done in support of hardening our infrastructure: Hopefully we can require these hardware-backed keys for sensitive machines in the future, to have some…
When setting up your YubiKey you have the option to require the user to touch the device to authorize an operation (be it signing, decrypting, or authenticating). While web browsers often provide clear prompts for this, other applications like SSH or GPG will not. Instead the operation will just hang without any visual indication that user input is required. The YubiKey itself will blink, but…
As client certificates are on the way out and Debian's SSO solution is effectively not maintained any longer, I switched self-service buildd givebacks over to Salsa authentication. It lives again at https://buildd.debian.org/auth/giveback.cgi . For authorization you still need to be in the "debian" group for now, i.e. be a regular Debian member. For convenience the package status web interface now…
I have voted putting Proposal F first, Proposal B second and everything else after Further Discussion. I think if something truly better than systemd comes around, people in Debian will not stand in the way of people making it work - even despite this GR passing. That's how systemd started out after all. But the fact that we also want to support inferior old ways holds us back. At the point where…
Builds on Debian's build farm sometimes fail transiently. Sometimes those failures are legitimate flakes, for instance when an in-progress build happens to exhaust its resources because of other builds on the same machine. Until now, you always needed to mail the buildd, wanna-build admins or the Release Team directly in order to get the builds re-queued. As an alpha trial I implemented…
I got tired of manually fetching installation images via either FTP or by manually transferring files to z/VM to test s390x installs. Hence it was about time to automate it. Originally I wanted to instrument an installation via vmcp from another instance on the same host but I figured that I cannot really rely on a secondary instance when I need it and went the s3270 / x3270-script way instead.…
Two s390x changes landed in Debian unstable today: A new version of zipl-installer that will infer the root filesystem to pass to the kernel using mapdevfs instead of enforcing a single DASD partition for it. A new version of sysconfig-hardware that contains a hook that activates all configured disks in the initramfs instead of a single one passed in as the root parameter in the kernel…
Two helpful CMS commands to know if the users on the z/VM host you connect to are managed using DIRMAINT: DIRMAINT PW : This will ask you for your current password and then for the new one. This way you can change your own user password instead of having to ask the administrator for it. DIRMAINT REVIEW : If you want to see the directory entry for your user (i.e. the configuration of your VM), you…
If you try to install Debian on System z within z/VM you might be annoyed at the various prompts it shows before it lets you access the network console via SSH. We can do better. From within CMS copy the default EXEC and default PARMFILE: COPYFILE DEBIAN EXEC A DEBAUTO EXEC A COPYFILE PARMFILE DEBIAN A PARMFILE DEBAUTO A Now edit DEBAUTO EXEC A and replace the DEBIAN in 'PUNCH PARMFILE DEBIAN *…
If you intend to buy the HP MicroServer Gen8 as a home server there are a few caveats that I didn't find on the interwebs before I bought the device: Even though the main chassis fan is now fixed in AHCI mode with recent BIOS versions, there is still an annoying PSU fan that's tiny and high frequency. You cannot control it and the PSU seems to be custom-built. The BIOS does not support ACPI S3…
It turns out that my recent woes with pbuilder were all due to libpam-tmpdir being installed (at least two old bug reports exist about this issue: # 576425 and # 725434 ). I rather like my private temporary directory that cannot be accessed by other (potential) users on the same system. Previously I used a hook to fix this up by ensuring that the directory actually exists in the chroot, but…
Axel just said that PDiffs are really useful for stable because it changes seldom. The truth is that there are no PDiffs for stable . I consider this a bug because you need to download a huge blob on every point release even though only few stanzas changed. The real problem of PDiffs is the count that needs to be applied. We run "dinstall" much more often now than we used to and we cannot…
Did you notice that it was gone? It's back now. Phew. Apparently an upgrade to wheezy was scheduled for the passed week-end. This went badly with the RAID controller acting up after the upgrade. So the move to a new machine (or rather VM) was… sped up. And because various policies changed, we needed to move to a dedicated database server with a new authentication scheme, get rid of the /org…
Due to the data loss I blogged about , I had to reverse engineer the encryption used by git-annex for its encrypted special remotes . The file system on which the content lived has a bullet hole of 8 GB in it, which was helpfully discarded by pvmove. It's pretty unhappy about that fact, parts of the git repository are unusable and directories cannot be accessed anymore. git-annex cannot possibly…
If you use LVM with Wheezy on a solid-state drive, you really want to install the latest lvm2 update (i.e. 2.02.95-6, which contains the changes of -5 ). Otherwise, if you set issue_discards=1 in /etc/lvm/lvm.conf , you will experience severe data loss when using pvmove . Happened to me twice, once I didn't care (chroot data being lost), the second time (today) I did. Not fun, especially when the…
Am I the only one who's disappointed with the route Mozilla's taking and left wondering what the direction is? First they killed off the development of Thunderbird because, as we all know, people mainly use webmail these days. Then they presented us their view that the big Certificate Authorities are too big to fail , as CAs gravely violated our trust (c.f. Trustwave and their MitM authority ).…
The Free and Open successor to the Clonk computer game series OpenClonk is now available in Debian sid and Ubuntu raring: just use sudo apt-get install openclonk to install it (backports to Ubuntu precise and quantal can be found in the OpenClonk Releases PPA ). OpenClonk Beyond the Rocks Trailer It's still under development, but as you can see it's also already quite functional. The engine was…
I wondered how to properly maintain an OpenWRT installation that needs to track trunk for one reason or another. For instance the OpenWRT release pace is quite slow and "new" devices or various fixes are only available in this particular branch. Now the OpenWRT project does offer snapshot builds . These are images built with the default config for the particular device type. You can even upgrade…
We just sent out a new call for testing for the next point release of Debian Squeeze . The last one was back in May, hence there are a bunch of updates. Please test the packages in squeeze-proposed-updates on some machines running squeeze if possible, so that we don't screw up your production machines with bad updates in a week. The point release is scheduled for September 29th, i.e. next…
The IPv6 patch set for netcfg (part of debian-installer ) has landed in Debian unstable . In follow-up uploads I diverged from the Ubuntu patch set a little bit: I dropped the use of DUID-LL as the client identifier used by the DHCPv6 client. While basically a good idea, because it's predictable, it's also against the RFC to do that. We simply don't know if the network interface is permanently…
I tried to continue netcfg 's journey to support IPv6 in debian-installer . Matt Palmer wrote a large patch set many moons ago (kudos!) and Colin Watson polished it and included it into Ubuntu. The reason for it not being merged into Debian first was ifupdown . Version 0.7 finally supports IPv6 and only entered Debian unstable by the end of May. Due to a bunch of changes to netcfg, one reason…
With a current daily build of debian-installer you should now be able to install a VM with Debian s390x. I'm told that even installation within hercules works again. d-i's beta 1 for wheezy has a broken busybox and is hence unusable. But there were more issues: zipl-installer was blacklisted from building on s390x by Packages-arch-specific which caused nobootloader to be selected during…