This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------0dIFNtGH2mfHUOtaZRtCduNO
Content-Type: multipart/mixed; boundary="------------3e7BJZdAJqEg79R81gClJI0v"

--------------3e7BJZdAJqEg79R81gClJI0v
Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64

SGVsbG8gcmVsZWFzZSB0ZWFtLA0KDQpJIGhhdmUgYSBidWcgdGFnZ2VkIHNlcmlvdXMgaW4g dGhlIHBhY2thZ2UgbGliZXZlbnQgSSBtYWludGFpbiBbMV0sIEkndmUgDQpiZWVuIHRvbGQg dGhlIHNvbHV0aW9uIGlzIHRvIHN0YXJ0IGEgdHJhbnNpdGlvbiB3b3JrZmxvdy4NCg0KQXMg bWVudGlvbmVkIGluIHRoZSB0cmFuc2l0aW9uIGRvYyBbMl0sIEkgdXBsb2FkZWQgdGhlIGZp eGVkIHBhY2thZ2UgaW4gDQpleHBlcmltZW50YWwsIGJ1dCBJJ20gd29uZGVyaW5nIHdoYXQg ZG9lcyAiQ2hlY2sgdGhlIGF1dG8tZ2VuZXJhdGVkIA0KImF1dG8tPHNvdXJjZT4iIiBtZWFu Lg0KV2lsbCBteSBwYWNrYWdlIGFwcGVhciBvbiB0aGlzIGxpc3QgYXV0b21hdGljYWxseSBv ciBhZnRlciBJIHJlcXVlc3QgYSANCnRyYW5zaXRpb24gc2xvdCBmcm9tIHRoZSByZWxlYXNl IHRlYW0/DQoNClRoYW5rcyBpbiBhZHZhbmNlIGZvciB0aGUgaGVscCwgc29ycnkgZm9yIHRo ZSBub29iIHF1ZXN0aW9uLCB0aGlzIGlzIG15IA0KZmlyc3QgdHJhbnNpdGlvbi4uLg0KDQov Tmljb2xhcw0KDQpbMV0gaHR0cHM6Ly9idWdzLmRlYmlhbi5vcmcvY2dpLWJpbi9idWdyZXBv cnQuY2dpP2J1Zz0xMDIzMjg0DQpbMl0gaHR0cHM6Ly93aWtpLmRlYmlhbi5vcmcvVGVhbXMv UmVsZWFzZVRlYW0vVHJhbnNpdGlvbnMNCg==
--------------3e7BJZdAJqEg79R81gClJI0v
Content-Type: application/pgp-keys; name="OpenPGP_0xFE82139440BD22B9.asc" Content-Disposition: attachment; filename="OpenPGP_0xFE82139440BD22B9.asc" Content-Description: OpenPGP public key
Content-Transfer-Encoding: quoted-printable

-----BEGIN PGP PUBLIC KEY BLOCK-----

xsFNBFmJqr8BEADBhkCFzusIdcIn8V8+Maee1V+GhD/sNS/GuqDL5WwVlrdv6TDr EiiIGvX76fs+F1/wP9z/8P2QVm6pxZG+MGpARmWyYkMyklMpqjuXN8JMutjAM9ym ouEtVcb3CV20AgXU7Qe1M2Dofmg4waRM5vHsLI0gvARgo5Rxxc+DoKS8GApE2nbX B8imFLJ48L1FnDVbQWpIW+mzO7dtMY6XQkpvqtRkYrEfxvVDHD06fG4SIzVF8QL1 iiRHncG+5u24AU1FxKxxFNYUTcQxCQZ5JNHsANmgsWCcheEL15B0eDYrJ7jDPaGi N2Ullh4csO9zlYyfWA84I4CGi3En5C69M7uvOxvyg7LL9GsrAaH51ksR1ksDH41O MSBVkeLSpU8RPudy8bpIsGXNtqpAOFjhGoJz6POggY/HmAJeqRDF1HfjPFFm3dZ7 E0dLR0aPvxTwuzIERRcjKrzMqslLTjgOVUXSfjhCtWPmcRbwCHWR2k/icho20wnE VJsVrbNld/0fMvxenrWSmuwawnDHTSwK5Sy5ec2JQy6qvQ2zJIYrdg0eHur/sURi SbAyNmfoOII9GBTAFm13XkHWbBysppGQVAyowYO2h0JC+6MVxQRndBsCC4jRNiT9 wptl4rOho4GYW4d/smGlCbki/bYdSItbtk4rjHAyl+WYM6Jpy1sZXe7SDQARAQAB zSVOaWNvbGFzIE1vcmEgPG5pY29sYXNAYmFiZWxvdWVzdC5vcmc+wsF3BBMBCAAh BQJZiaq/AhsDBQsJCAcCBhUICQoLAgQWAgMBAh4BAheAAAoJEP6CE5RAvSK5ZTkP /3PN+SPKLKOcgG/C3ZI9KxM93y4AKZ0zUCBtr2QJDt8viFKq3jPsSo6+Rw1UuY2o Dx4wWUXqlsp3NKnvoKWMip6UVVH0XB48iLe4Tiu0PVqIfHB/MIdE/QSYLFZzX0n4 AgTlrho7Hd+S7TZMtf15FKF4/8y5lLVXK86cbZhaOEPcJyb9taT4IVkU5M22aNfu ZAUjexeCsn/em4pjEyREilht8Fo9tND9Nr/w2SOJNAKWZp+JlKR1ok3zsFvEN5rA EsdA9gvQ/5ubs8iXM0KfBHLa0wp/YWRLRrDFoCEqrkZdBetGxJn4G+wNdhb4TTsX HTfb/0Je179uF2jcFawr/DhJb/bKJUB236u2+0e53QufYq8brBqA4aONDCfOVAHV NjazruCKWli2E2lHvJLVQeFkBP2Mo9IiWO8uNdXpK5QUjcipW5t6fxN1beNzJdZL iHVjjVKskVueoLDYtHt0TzPY75I6Bgy/oRz5e1sP6UjYsZs5+ZUFOw7Zii5kXcPD rhXb1sEd9ZvB4f9XdvxtE91haUz9EW63XIvsUYsnjqdTznojBVeLVVnZJKp3RlWF w0o0xT90JuOkA5Pw8oL0GpBRA9vaPi1phs2DCbCRe/U188HkNmhiH1C9dY+J/4h8 IvicjIgTI0+27FPFxp6nMlkH4OgjUHZrbvE9E8SrzonrzsFNBFmJqr8BEADrI5ls tjLaS6IXxH37GWvfPLdjLyTFK5kJqyZkhGNMWHmwmRU3BVrz0M0Tva/a3Z1B+fXJ GzKevQhKMBsrpYhkbKkbMg7vreiWhZjQyy5nvbKA4aMhZ1ckmYWExOk2QiUpTDoL DBN7VEZG+FV9Hw5ZVeH1k5LnbIxxxIGdzK1mxcCBgJodvzHsp1SZefVIKBKLH+y+ scAZDbnDfSUo/1pPgruogskpg67XrtDP/mZxgf7GB0wlrQrrJt9eBuCD5NXIjtl8 KvEIPKTxAlYf/Gu8ZCuu0cwHLl/79WUH6wT35XByAsBMtuG8dHDidj50/XkpP2L6 GE52KYTNoQVv5XoAIzpuwXDxcTML0JjE1EKAfRFeyuuiMncX9dgtRdJGMgN/4HYz IiSvWsjYkgVUFrh/ZlENbE6Dhy4NLqDEBQb5RMIWrO7VVaAKosRysY72G3Z1FmS2 m2dPAlNNLGHESlcLp3nwnNFFneQif4Kf1ZdFMZJCy8D6n+TbuZmY8eMC624Ot5h1 8an0yBWFE8E/XU4yQR6savhhinY1Yc4EKjcNiP4cTrphh4cE7XgMitX+0yc1D9s7 umuiBdqw9VAsyA20NfLZCMxieiGYcgda1WPA5V7jQc3m8G+CJyg762Tb3XyPGBPy 4TDfghpw1RqYf8wYAi8e74wKHck/uAP6R1lc7wARAQABwsFfBBgBCAAJBQJZiaq/ AhsMAAoJEP6CE5RAvSK5Y4AP/Rb0F2lmB6uDu66BhCYX7Z2hcnt4/LZK1hYb6fRO 3mnW8XClntYOGbKoAGAQDS3PrIx2EJkUr5FiWMpnneQPcwfNuL7VlSqlcFfwN+kk jTcsIjrw3KMgGNbjjQ83jCUzidyQ4eg18AKKaxb0NrA8UNRTvtK0ozSThxnzLZ20 nu/mU9NJhcMVx2QzIEUiJK5ag3uXli/r52ILle5Wq9LPxjPEsl0oGlqNMGcCZLr2 0tHXm0XLrSVEenWKL8hjaEudPNdcKMLBWVsp0VIS/di1fsQgwhuJ9C+fwhtqaGsL 5DsKDYhrUo1iKi4avX0f8IdzenQSKFsoJf+t+kHIm5/ZdZ8jMN081RznIvz8p8Bx WOzbg+BZCCkOIsCxypmU9WgMMJ3hXgRa2OIhQZQ3AnBc/U843uU/7HVRMhd4efzj Nw/v1joDd4KEJEHnS/jT/s9jxEyikOtQW9otJBLgZpoEG+9RFCKPu4TV8RB9kZCH OM5lwSwq7CIwwVltF1pMRokm6X7lyclZ4iCEtfZAM6ZuvN/fh1GbIJxft+hIWqDP iG9bPtoXZMArUi1zCaSmFdzba/15+P+B3EyaadYiSjVn9WBhe6syxZ8WYo0ehvJE e42BLGcGRcQl+l2Jt57D3FPDYYJEUkl72sGhhKbrg4YBVfCoWuchD0wXvR9ARXtL
K5H4
=1rnn
-----END PGP PUBLIC KEY BLOCK-----

--------------3e7BJZdAJqEg79R81gClJI0v--

--------------0dIFNtGH2mfHUOtaZRtCduNO--

-----BEGIN PGP SIGNATURE-----

wsF5BAABCAAjFiEEhAWwL8wo75dEyPJT/oITlEC9IrkFAmNoODkFAwAAAAAACgkQ/oITlEC9IrkG Nw/9FTh6lPw3hxai85JjO8vYv80OPVXtUMfJ18dIkHSld6tPYPFqXkNmbNMnFL4j21qiQeBWZr9F M3+sV8fHqxukrKbdVzdd38PP1i8fauWrix6+jD2kw/Tr8/ie8FBWrK3JZ4YaIfwVt8izzXHzwWSG CiLp7vSk5s88umhTzXi+behRYZT/CW0zU42P9Pduq80BDvacryjzk94FLpYz3bowCAQrS2tJ1giA G9ikPSiJHh/DB8jFRj9dWQa7Clewc2wYNGZDDcqG0Uw406/QO3rW7oGL6QjX6AdcRDtrSzJSeSKj M7M0yJG0E4D9x4nGnZllTJmkkCjULCo8WJgwymOi1jr0dV6w7diJWQ3LD7E532ZcJprMM7OzmJVW NnrhL21wMhHOozsqYRsVcwJ2ztWVeYFfixXacqKz8d3s7I9KqKkUyYV7eFsvkEfh9eshYBbdyaPh na5omaAVopGwH3RfpiJNf6wORBXGfIYrnI0OoJozDjWPUdtMu5Bm0JXMXgqMzg+ZeL7h6bkqzznS c2nAxjjmvKR376a6h2z2C7mqFfiYiNYZFQSiCOmO719u3zoWLfK6O0xJiEAz1A9UTJyoRAeJNgtB PPuTezYcYf3VgJi3BQMnjz01VmP5b4UYEBpkevwOTE8XYJw/O3nzOfbOIzRoOpI/qSST3XptlPKe qMk=
=BImT
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Nicholas

On Sun, 6 Nov 2022 at 23:51, Nicolas Mora <nicolas@babelouest.org> wrote:

I have a bug tagged serious in the package libevent I maintain [1], I've
been told the solution is to start a transition workflow.

As mentioned in the transition doc [2], I uploaded the fixed package in experimental, but I'm wondering what does "Check the auto-generated "auto-<source>"" mean.
Will my package appear on this list automatically or after I request a transition slot from the release team?

It should appear on the list automatically, but it won't because the libevent-2.1-7 package name did not change. I suggest that you follow
what Ubuntu did [3] and bump the SONAME and package name for this
transition.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023284
[2] https://wiki.debian.org/Teams/ReleaseTeam/Transitions

Regards
Graham


[3] https://launchpad.net/ubuntu/+source/libevent/2.1.12-stable-5ubuntu1

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-11-07 07:26:40 +0100, Graham Inggs wrote:

Hi Nicholas

On Sun, 6 Nov 2022 at 23:51, Nicolas Mora <nicolas@babelouest.org> wrote:

I have a bug tagged serious in the package libevent I maintain [1], I've been told the solution is to start a transition workflow.

As mentioned in the transition doc [2], I uploaded the fixed package in experimental, but I'm wondering what does "Check the auto-generated "auto-<source>"" mean.
Will my package appear on this list automatically or after I request a transition slot from the release team?

It should appear on the list automatically, but it won't because the libevent-2.1-7 package name did not change. I suggest that you follow
what Ubuntu did [3] and bump the SONAME and package name for this
transition.

Is that really worth the effort for this one missing symbol? I'd just
make sure that is stays around regardless of glibc version.

Best
Sebastian

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1023284
[2] https://wiki.debian.org/Teams/ReleaseTeam/Transitions

Regards
Graham

[3] https://launchpad.net/ubuntu/+source/libevent/2.1.12-stable-5ubuntu1

--
Sebastian Ramacher

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hi Sebastian

On Mon, 7 Nov 2022 at 08:58, Sebastian Ramacher <sramacher@debian.org> wrote:

Is that really worth the effort for this one missing symbol? I'd just
make sure that is stays around regardless of glibc version.

There was a patch proposed in the corresponding Ubuntu bug [1],
re-introducing the symbol, however there was a concern from schopin
(see comment #4):

This patch wouldn't work as intended, as we'd mix arc4random functions
from the vendored sources and from glibc,
each set having their own internal static data.

A test rebuild of reverse-dependencies was done in Ubuntu, and the
transition went ahead.

Regards
Graham


[1] https://bugs.launchpad.net/debian/+source/libevent/+bug/1990941

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Hello,

Thanks for your help!

Le 2022-11-07 à 05 h 44, Graham Inggs a écrit :

A test rebuild of reverse-dependencies was done in Ubuntu, and the
transition went ahead.

I was also told to change the package name, it would also make the
package cleaner.

So uploading to experimental with the name libevent-2.1-12 instead of libevent-2.1-7 would do it? Let's go with it then.

/Nicolas

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-11-07 11:44:31 +0100, Graham Inggs wrote:

Hi Sebastian

On Mon, 7 Nov 2022 at 08:58, Sebastian Ramacher <sramacher@debian.org> wrote:

Is that really worth the effort for this one missing symbol? I'd just
make sure that is stays around regardless of glibc version.

There was a patch proposed in the corresponding Ubuntu bug [1], re-introducing the symbol, however there was a concern from schopin
(see comment #4):

This patch wouldn't work as intended, as we'd mix arc4random functions
from the vendored sources and from glibc,
each set having their own internal static data.

So let's use the glibc provided one over the internal copy. I don't see
the issue. With the rather non-trivial set of libevent reverse
dependencies, I'd like to avoid a lock step transition.

Cheers

A test rebuild of reverse-dependencies was done in Ubuntu, and the
transition went ahead.

Regards
Graham

[1] https://bugs.launchpad.net/debian/+source/libevent/+bug/1990941

--
Sebastian Ramacher

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On 2022-11-07 20:57:44 +0100, Sebastian Ramacher wrote:

On 2022-11-07 11:44:31 +0100, Graham Inggs wrote:

Hi Sebastian

On Mon, 7 Nov 2022 at 08:58, Sebastian Ramacher <sramacher@debian.org> wrote:

Is that really worth the effort for this one missing symbol? I'd just make sure that is stays around regardless of glibc version.

There was a patch proposed in the corresponding Ubuntu bug [1], re-introducing the symbol, however there was a concern from schopin
(see comment #4):

This patch wouldn't work as intended, as we'd mix arc4random functions from the vendored sources and from glibc,
each set having their own internal static data.

So let's use the glibc provided one over the internal copy. I don't see
the issue. With the rather non-trivial set of libevent reverse
dependencies, I'd like to avoid a lock step transition.

Please ignore my mail.

Cheers
--
Sebastian Ramacher

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Le 2022-11-07 à 07 h 31, Nicolas Mora a écrit :

I was also told to change the package name, it would also make the
package cleaner.

So uploading to experimental with the name libevent-2.1-12 instead of libevent-2.1-7 would do it? Let's go with it then.

My mistake, renaming the package name to 2.1-12 isn't a clean solution.

I've looked at the ubuntu debdiff [1] and I think they are smarter than
me, so I suggest a similar change for the package libevent [2]

Do you have feedbacks for this proposed solution?

/Nicolas

[1] https://launchpadlibrarian.net/627597893/libevent_2.1.12-stable-5_2.1.12-stable-5ubuntu1.diff.gz
[2] https://salsa.debian.org/debian/libevent

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)