• Embedded buildpath via rpath using cmake

    From Vagrant Cascadian@21:1/5 to All on Fri Feb 4 01:50:02 2022
    --=-=-=
    Content-Type: text/plain
    Content-Transfer-Encoding: quoted-printable

    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake. I
    found myself slowly edging into a mass bug filing, one bug report at a
    time...

    I ended up submitting a few patches and noting some affected packages:

    https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html

    There are almost certainly packages missing from that list, as it is
    generated by human confirmation...


    In many cases I've tested so far, passing an argument via a
    dh_auto_configure override in debian/rules fixes the issue:

    override_dh_auto_configure:
    dh_auto_configure -- -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON


    Alternately, the experimental debhelper compat level v14 does include a
    fix for these embedded rpaths, though in the current state, passing both -DCMAKE_SKIP_RPATH=ON and -DCMAKE_RPATH_USE_ORIGIN=ON, it triggers build failures 263 packages, according to a test run by Lucas Nussbaum in
    October:

    http://qa-logs.debian.net/2021/10/25/diff.dcsr.txt


    Since debhelper v14 is not finalized yet, I just sent a request to
    debhelper to only pass one of the arguments,
    -DCMAKE_RPATH_USE_ORIGIN=ON, which should significantly reduce the
    number of build failures while still making many packages reproducible
    with debhelper compat v14:

    https://bugs.debian.org/1004939


    I've attached a list of the maintainers of affected packages produced
    with dd-list, getting the list of packages from the above-mentioned reproducible builds issue and diff.dcsr.txt from archive rebuild.

    If you're on the list, would love if you could check if your package
    still builds correctly when passing only
    -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there are already patches in the Debian bug tracking system waiting for you!


    Thanks everyone!


    live well,
    vagrant

    --=-=-Content-Type: text/plain; charset=utf-8
    Content-Disposition: inline; filenameÝ-list.txt
    Content-Transfer-Encoding: quoted-printable

    "Adam C. Powell, IV" <hazelsct@debian.org>
    oce (U)

    A. Maitland Bottoms <bottoms@debian.org>
    gr-funcube (U)
    gr-gsm (U)
    gr-hpsdr (U)
    gr-iqbal
    gr-limesdr (U)
    gr-satellites (U)
    libad9361

    Adam Borowski <kilobyte@angband.pl>
    pmemkv
    vmemcache

    Aigars Mahinovs <aigarius@debian.org>
    dlt-daemon

    Alastair McKinstry <mckinstry@debian.org>
    libtool
    mathgl (U)

    Alberto Luaces Fernández <aluaces@udc.es>
    openscenegraph

    Alessio Di Mauro <alessio@yubico.com>
    yubico-piv-tool (U)

    Alessio Treglia <alessio@debian.org>
    leveldb (U)
    libsoxr (U)

    Alexander GQ Gerasiov <gq@debian.org>
    croaring

    Alexandre Marie <alexandre.marie@synchrotron-soleil.fr>
    ufo-core (U)

    Alf Gaida <agaida@siduction.org>
    juffed (U)
    screengrab (U)

    Andrea Capriotti <capriott@debian.org>
    userbindmount (U)
    vdeplug4 (U)

    Andreas Beckmann <anbe@debian.org>
    pocl (U)

    Andreas Bombe <aeb@debian.org>
    gr-limesdr (U)
    soapyosmo (U)
    soapysdr (U)

    Andreas Rönnquist <gusnan@debian.org>
    allegro5 (U)

    Andreas Tille <tille@debian.org>
    libbpp-seq (U)
    libbpp-seq-omics (U)
    liblemon (U)
    libminc (U)
    libvbz-hdf-plugin (U)
    libzeep (U)
    openmm (U)
    spoa (U)

    Andrew Lee (æŽå¥ç§‹) <ajqlee@debian.org>
    screengrab (U)

    Andrew Pollock <apollock@debian.org>
    log4cplus

    Andrey Rahmatullin <wrar@debian.org>
    librsync

    Andrius Merkys <merkys@debian.org>
    openmm (U)
    openstructure (U)

    Ansgar <ansgar@debian.org>
    dune-common (U)
    dune-geometry (U)
    dune-grid (U)
    dune-grid-glue (U)
    dune-uggrid (U)

    Anthony Fok <foka@debian.org>
    fontforge (U)

    Anton Gladky <gladk@debian.org>
    alglib (U)
    benchmark (U)
    cctz (U)
    kim-api (U)
    libopenshot (U)
    liggghts (U)
    metis (U)
    tetgen (U)
    vtk9 (U)

    Apollon Oikonomopoulos <apoikos@debian.org>
    leatherman (U)

    Arne Bernin <arne@alamut.de>
    libfreenect (U)

    Aron Xu <aron@debian.org>
    fcitx (U)
    libgooglepinyin (U)

    Aurelien Jarno <aurel32@debian.org>
    libftdi
    libftdi1

    Aurélien COUDERC <coucouf@debian.org>
    analitza (U)
    artikulate (U)
    elisa-player (U)
    kdebugsettings (U)
    keditbookmarks (U)
    kget (U)
    libkeduvocdocument (U)
    okteta (U)

    Ayatana Packagers <pkg-ayatana-devel@lists.alioth.debian.org>
    qmenumodel

    Barak A. Pearlmutter <bap@debian.org>
    cppad (U)
    mlpack (U)

    Bartosz Fenski <fenio@debian.org>
    supertux (U)

    Bas Couwenberg <sebastic@debian.org>
    geos (U)
    qgis (U)
    sfcgal (U)

    Ben Burton <bab@debian.org>
    regina-normal

    Benjamin Barenblat <bbaren@debian.org>
    abseil

    Benjamin Drung <bdrung@debian.org>
    libsoxr (U)

    Bjoern Ricks <bjoern.ricks@intevation.de>
    grantlee5 (U)

    Boian Bonev <bbonev@ipacct.com>
    gammu

    Boris Pek <tehnick@debian.org>
    eiskaltdcpp

    Boyuan Yang <byang@debian.org>
    cjson
    fcitx5 (U)
    fcitx5-gtk (U)
    fcitx5-qt (U)
    go-for-it
    libavif (U)
    libime (U)
    libxlsxwriter (U)
    qevercloud
    tidy-html5 (U)
    xcb-imdkit (U)
    zxing-cpp

    Bret Curtis <psi29a@gmail.com>
    recastnavigation (U)

    Carlos Donizete Froes <coringao@riseup.net>
    surgescript (U)

    CESNET <rkrejci@cesnet.cz>
    libyang (U)

    ChangZhuo Chen (陳昌倬) <czchen@debian.org>
    juffed (U)
    screengrab (U)

    Chow Loong Jin <hyperair@debian.org>
    tinyxml2

    Christoph Berg <myon@debian.org>
    gr-limesdr (U)
    gr-satellites (U)
    libcm256cc (U)

    Christoph Junghans <junghans@votca.org>
    votca-csg (U)
    votca-tools (U)

    Christoph Martin <martin@uni-mainz.de>
    nfs-ganesha (U)

    Connor Imes <ckimes@ubuntu.com>
    powercap

    Cristian Greco <cristian@debian.org>
    poco (U)

    Dain Nilsson <dain@yubico.com>
    yubico-piv-tool (U)

    Daniel Kahn Gillmor <dkg@fifthhorseman.net>
    fontforge (U)

    Daniel Schepler <schepler@debian.org>
    kpat (U)
    libkdegames (U)

    David Bremner <bremner@debian.org>
    ledger

    David Lamparter <equinox-debian@diac24.net>
    libyang

    David Prévot <taffit@debian.org>
    cmocka

    Davide Viti <zinosat@tiscali.it>
    fontforge (U)

    Debian Astro Team <debian-astro-maintainers@lists.alioth.debian.org>
    purify
    sopt

    Debian Authentication Maintainers <pkg-auth-maintainers@lists.alioth.debian.org>
    yubico-piv-tool

    Debian Bridges Team <team+bridges@tracker.debian.org>
    libcork
    libcorkipset

    Debian Deep Learning Team <debian-ai@lists.debian.org>
    pthreadpool

    Debian Deepin Packaging Team <pkg-deepin-devel@lists.alioth.debian.org>
    libxlsxwriter (U)

    Debian Fonts Task Force <debian-fonts@lists.debian.org>
    fontforge

    Debian Games Team <pkg-games-devel@lists.alioth.debian.org>
    allegro5
    colobot
    hedgewars
    ogre-1.9
    recastnavigation
    spring
    supertux
    surgescript

    Debian GIS Project <pkg-grass-devel@lists.alioth.debian.org>
    geos
    qgis
    sfcgal

    Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
    evolution
    evolution-ews

    Debian Hamradio Maintainers <debian-hams@lists.debian.org>
    gr-funcube
    gr-gsm
    gr-hpsdr
    gr-limesdr
    gr-satellites
    libcm256cc
    soapyosmo
    soapysdr

    Debian Input Method Team <debian-input-method@lists.debian.org>
    fcitx
    fcitx5
    fcitx5-gtk
    fcitx5-qt
    libgooglepinyin
    libime
    xcb-imdkit

    Debian IoT Maintainers <debian-iot-maintainers@lists.alioth.debian.org>
    hoel
    iddawc
    orcania
    rhonabwy
    ulfius
    yder

    Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>
    alkimia
    gammaray
    kdiagram
    kphotoalbum
    ktorrent
    lensfun
    soundkonverter

    Debian Kolab Maintainers <team+kolab-mantainers@tracker.debian.org>
    libkolabxml

    Debian Krap Maintainers <debian-qt-kde@lists.debian.org>
    grantlee5
    indi

    Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
    camp
    cassiopee
    ciftilib
    ismrmrd
    libbpp-seq
    libbpp-seq-omics
    liblemon
    libminc
    libqes
    libvbz-hdf-plugin
    libvistaio
    libzeep
    spdlog
    spoa

    Debian Med Packaging Team <debian-med-packaging@lists.debian.org>
    maxflow

    Debian Mobcom Maintainers <Debian-mobcom-maintainers@lists.alioth.debian.org>
    freediameter

    Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
    csound
    inkscape
    kissfft
    libavif
    libmysofa
    libopenshot
    libsoxr
    libwebm
    nordlicht
    x265

    Debian OpenCL Maintainers <pkg-opencl-devel@lists.alioth.debian.org>
    pocl

    Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
    ilmbase
    imath

    Debian QA Group <packages@qa.debian.org>
    libcue
    liblaxjson
    wbxml2

    Debian Qt Extras Team <debian-qt-kde@lists.debian.org>
    gcompris-qt

    Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
    akonadi
    akonadi-contacts
    akonadi-import-wizard
    akonadi-mime
    akonadi-notes
    akonadiconsole
    akregator
    analitza
    artikulate
    attica-kf5
    bluez-qt
    clazy
    elisa-player
    k3b
    kalarmcal
    kcmutils
    kcodecs
    kcompletion
    kconfigwidgets
    kcontacts
    kcrash
    kdebugsettings
    kdeclarative
    kdesu
    keditbookmarks
    kget
    kholidays
    kitemmodels
    kitinerary
    kjs
    kldap
    kmbox
    kmediaplayer
    kontact
    kpackage
    kparts
    kpat
    kpkpass
    ksyntax-highlighting
    ktextwidgets
    ktnef
    kuserfeedback
    kwallet-kf5
    kxmlrpcclient
    libkdegames
    libkeduvocdocument
    libkf5calendarsupport
    pim-sieve-editor
    pkg-kde-tools
    plasma-nm
    plasma-thunderbolt
    prison-kf5
    qca2
    syndication
    threadweaver

    Debian Remote Maintainers <debian-remote@lists.debian.org>
    libvncserver

    Debian Robotics Team <team+robotics@tracker.debian.org>
    fastcdr
    foonathan-memory

    Debian Science Maintainers <debian-science-maintainers@alioth-lists.debian.net>
    mlpack

    Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
    asl
    cld2
    clfft
    dart
    docopt.cpp
    dune-common
    dune-geometry
    dune-grid
    dune-grid-glue
    dune-uggrid
    fcl
    gemmlowp
    glbinding
    globjects
    graywolf
    hepmc3
    ignition-common
    ignition-math
    ignition-msgs
    libccd
    liggghts
    mathgl
    metis
    netgen
    nsync
    oce
    orocos-bfl
    primesieve
    ros-rosconsole-bridge
    ros-rospack
    scalapack
    segyio
    simbody
    sleef
    trilinos
    ufo-core
    urdfdom
    visp
    xeus
    xeus-python

    Debian Science Team <debian-science-maintainers@alioth-lists.debian.net>
    cg3
    cppad

    Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>
    alglib
    benchmark
    cctz
    cryptominisat
    kim-api
    meshlab
    nexus
    schroedinger-coordgenlibs
    schroedinger-maeparser
    simage
    tetgen
    vtk9

    Debian SSSD Team <pkg-sssd-devel@lists.alioth.debian.org>
    uid-wrapper

    Debian UBports Team <team+ubports@tracker.debian.org>
    libqtdbusmock (U)
    libqtdbustest (U)
    lomiri-api
    lomiri-thumbnailer
    net-cpp
    qmenumodel (U)

    Debian VirtualSquare Team <virtualsquare@cs.unibo.it>
    userbindmount
    vdeplug4

    Debian X Strike Force <debian-x@lists.debian.org>
    vulkan-loader

    Debian XMPP Maintainers <pkg-xmpp-devel@lists.alioth.debian.org>
    dino-im

    Debian/Kubuntu Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
    okteta
    pulseaudio-qt

    Debichem Team <debichem-devel@lists.alioth.debian.org>
    chemps2
    openmm
    openstructure
    votca-csg
    votca-tools
    votca-xtp

    Denis Barbier <barbier@debian.org>
    oce (U)

    Dennis Braun <d_braun@kabelmail.de>
    csound (U)

    Diane Trout <diane@ghic.org>
    libkolabxml (U)

    Dimitrios Eftaxiopoulos <eftaxi12@otenet.gr>
    mathgl (U)

    Dmitry E. Oboukhov <unera@debian.org>
    hedgewars (U)

    Dmitry Shachnev <mitya57@debian.org>
    pkg-kde-tools (U)

    Dmitry Smirnov <onlyjob@debian.org>
    gnucash

    Dr. Tobias Quathamer <toddy@debian.org>
    libopenshot (U)

    Eduard Bloch <blade@debian.org>
    encfs

    Eugene V. Lyubimkin <jackyf@debian.org>
    cupt

    Fabian Wolff <fabi.wolff@arcor.de>
    z3 (U)

    Fabien Spindler <Fabien.Spindler@inria.fr>
    visp (U)

    Felix Geyer <fgeyer@debian.org>
    qca2 (U)

    Flavien Bridault <fbridault@ircad.fr>
    camp (U)

    Forrest Cahoon <forrest.cahoon@gmail.com>
    csound (U)

    Francesco Paolo Lovergine <frankie@debian.org>
    geos (U)
    qgis (U)

    Georges Khaznadar <georgesk@debian.org>
    enki-aseba

    Gert Wollny <gewo@debian.org>
    maxflow (U)
    vtk9 (U)

    Gert Wollny <gw.fossdev@gmail.com>
    libvistaio (U)

    Ghislain Antony Vaillant <ghisvail@gmail.com>
    ciftilib (U)
    clfft (U)
    docopt.cpp (U)
    glbinding (U)
    globjects (U)
    ismrmrd (U)

    Gianfranco Costamagna <locutusofborg@debian.org>
    cld2 (U)
    cpprest
    dlt-daemon (U)
    hedgewars (U)
    yaml-cpp (U)

    Gijs Molenaar <gijs@pythonic.nl>
    purify (U)
    sopt (U)

    Gordon Ball <gordon@chronitis.net>
    xeus (U)
    xeus-python (U)

    Graham Inggs <ginggs@debian.org>
    trilinos (U)

    Gudjon I. Gudjonsson <gudjon@gudjon.org>
    alglib (U)

    Gürkan Myczko <gurkan@phys.ethz.ch>
    meshlab (U)

    Harlan Lieberman-Berg <hlieberman@debian.org>
    nanomsg

    Henning Glawe <glaweh@debian.org>
    libktoblzcheck (U)

    HepMC developers <hepmc-dev@NOSPAM.cern.ch>
    hepmc3 (U)

    Hideki Yamane <henrich@debian.org>
    fontforge (U)

    Hubert Chathi <uhoreg@debian.org>
    olm (U)

    HÃ¥vard Flaget Aasen <haavard_aasen@yahoo.no>
    c-blosc

    Héctor Orón Martínez <zumbi@debian.org>
    intel-processor-trace (U)

    Iain Lane <laney@debian.org>
    evolution-ews (U)

    IOhannes m zmölnig (Debian/GNU) <umlaeute@debian.org>
    csound (U)
    libmysofa (U)

    Jakub Adam <jakub.adam@ktknet.cz>
    gammaray (U)

    James Cowgill <jcowgill@debian.org>
    mbedtls

    James McCoy <jamessan@debian.org>
    msgpack-c

    Jeremy Bicha <jbicha@debian.org>
    evolution (U)
    evolution-ews (U)

    Jerome Benoit <calculus@rezozer.net>
    primesieve (U)

    Jerome Kieffer <jerome.kieffer@esrf.fr>
    clfft (U)

    Jerome Lebleu <jerome@maroufle.fr>
    rspamd (U)

    Jochen Sprickerhof <jspricke@debian.org>
    orocos-bfl (U)
    poco (U)
    ros-rosconsole-bridge (U)
    ros-rospack (U)

    Johannes 'josch' Schauer <josch@debian.org>
    fuzzylite

    Johannes Schauer <josch@debian.org>
    orocos-bfl (U)

    Jonas Smedegaard <dr@jones.dk>
    cmark
    editorconfig-core
    fontforge (U)
    olm (U)

    Jonathan Carter <jcc@debian.org>
    calamares

    Jordan Justen <jljusten@debian.org>
    piglit

    Jose Luis Rivero <jrivero@osrfoundation.org>
    dart (U)
    fcl (U)
    ignition-common (U)
    ignition-math (U)
    ignition-msgs (U)
    libccd (U)
    simbody (U)
    urdfdom (U)

    Julian Rüth <julian.rueth@fsfe.org>
    cryptominisat (U)

    Julien Dutheil <julien.dutheil@univ-montp2.fr>
    libbpp-seq (U)
    libbpp-seq-omics (U)

    Julien Puydt <jpuydt@debian.org>
    cryptominisat (U)

    Jørgen Kvalsvik <jokva@equinor.com>
    segyio (U)

    Kamal Mostafa <kamal@whence.com>
    hershey-fonts

    Kartik Mistry <kartik@debian.org>
    cg3 (U)

    Keith Packard <keithp@keithp.com>
    cmark-gfm

    Kevin Murray <kdmfoss@gmail.com>
    libqes (U)

    Klas Lindfors <klas@yubico.com>
    yubico-piv-tool (U)

    Krzysztof Burghardt <krzysztof@burghardt.pl>
    poco

    Kurt Kremitzki <kkremitzki@debian.org>
    netgen (U)

    Laszlo Boszormenyi (GCS) <gcs@debian.org>
    gflags
    leveldb
    nng
    snappy
    upb

    Laurent Bigonville <bigon@debian.org>
    evolution (U)

    Leandro Ramos <leandroramos@disroot.org>
    go-for-it (U)

    Leopold Palomo-Avellaneda <leo@alaxarxa.net>
    fcl (U)
    ros-rosconsole-bridge (U)
    ros-rospack (U)

    Lev Lamberov <dogsleg@debian.org>
    swi-prolog

    Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org>
    akonadi-contacts (U)
    akonadi-mime (U)
    akonadi-notes (U)
    kpat (U)
    pkg-kde-tools (U)

    LLVM Packaging Team <pkg-llvm-team@lists.alioth.debian.org>
    z3

    Lucas Nussbaum <lucas@debian.org>
    pajeng (U)

    Lukas Märdian <luk@slyon.de>
    zziplib (U)

    LXQt Packaging Team <pkg-lxqt-devel@lists.alioth.debian.org>
    juffed
    screengrab

    Ma Aiguo <imaiguo@gmail.com>
    libxlsxwriter

    Maarten L. Hekkelman <maarten@hekkelman.com>
    libzeep (U)

    Manuel A. Fernandez Montecelo <mafm@debian.org>
    ogre-1.9 (U)
    openscenegraph (U)

    Mark Purcell <msp@debian.org>
    alkimia (U)
    lensfun (U)
    soundkonverter (U)

    Mark Renouf <mark.renouf@gmail.com>
    libfreenect (U)

    Markus Koschany <apo@debian.org>
    spring (U)

    Martin <debacle@debian.org>
    dino-im (U)

    Martin Quinson <mquinson@debian.org>
    pajeng

    Mathieu Malaterre <malat@debian.org>
    ilmbase (U)

    Matrix Packaging Team <pkg-matrix-maintainers@lists.alioth.debian.org>
    olm

    Matt Palmer <mpalmer@debian.org>
    ledger (U)

    Matteo Cypriani <mcy@lm7.fr>
    qmmp

    Matteo F. Vescovi <mfv@debian.org>
    ilmbase (U)
    imath (U)

    Matthias Maier <tamiko+DEBIAN@kyomu.43-1.org>
    trilinos (U)

    Mattia Biondi <mattiabiondi1@gmail.com>
    userbindmount (U)
    vdeplug4 (U)

    Mattia Rizzolo <mattia@debian.org>
    inkscape (U)

    Mattias Ellert <mattias.ellert@physics.uu.se>
    gfal2
    scitokens-cpp

    Maximiliano Curia <maxy@debian.org>
    grantlee5 (U)
    indi (U)
    pkg-kde-tools (U)
    qca2 (U)

    Micha Lenk <micha@debian.org>
    libktoblzcheck

    Michael Banck <mbanck@debian.org>
    chemps2 (U)
    votca-csg (U)
    votca-tools (U)

    Michael Meskes <meskes@debian.org>
    akonadi-import-wizard (U)
    akonadiconsole (U)
    akregator (U)
    k3b (U)
    kontact (U)
    pim-sieve-editor (U)
    soundkonverter (U)

    Michael R. Crusoe <crusoe@debian.org>
    benchmark (U)
    spdlog (U)

    Mike Gabriel <sunweaver@debian.org>
    libqtdbusmock (U)
    libqtdbustest (U)
    libvncserver (U)
    lomiri-api (U)
    lomiri-thumbnailer (U)
    net-cpp (U)
    qmenumodel (U)

    Mikhail Gusarov <dottedmag@debian.org>
    rspamd (U)

    Miles Lubin <miles.lubin@gmail.com>
    cppad (U)

    Mirek Kratochvil <exa.exa@gmail.com>
    apulse

    Mo Zhou <cdluminate@gmail.com>
    hepmc3 (U)

    Mo Zhou <lumin@debian.org>
    gemmlowp (U)
    nsync (U)
    pthreadpool (U)
    sleef (U)

    Modestas Vainius <modax@debian.org>
    ktorrent (U)
    pkg-kde-tools (U)

    Muammar El Khatib <muammar@debian.org>
    scalapack (U)

    Nathan Osman <nathan@quickmediasolutions.com>
    qhttpengine

    Nicholas Breen <nbreen@debian.org>
    votca-csg (U)
    votca-tools (U)
    votca-xtp (U)

    Nicholas Guriev <guriev-ns@ya.ru>
    rlottie

    Nick Black <dankamongmen@gmail.com>
    notcurses

    Nico Schlömer <nico.schloemer@gmail.com>
    vtk9 (U)

    Nicolas Bourdaud <nicolas.bourdaud@gmail.com>
    libfreenect

    Nicolas Mora <babelouest@debian.org>
    hoel (U)
    iddawc (U)
    json-c
    libical3
    orcania (U)
    rhonabwy (U)
    ulfius (U)
    yder (U)

    nicoo <nicoo@debian.org>
    yubico-piv-tool (U)

    Nilesh Patra <nilesh@debian.org>
    libvbz-hdf-plugin (U)

    Norbert Preining <norbert@preining.info>
    akonadi (U)
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-notes (U)
    akonadiconsole (U)
    akregator (U)
    analitza (U)
    artikulate (U)
    attica-kf5 (U)
    bluez-qt (U)
    elisa-player (U)
    k3b (U)
    kalarmcal (U)
    kcmutils (U)
    kcodecs (U)
    kcompletion (U)
    kconfigwidgets (U)
    kcontacts (U)
    kcrash (U)
    kdebugsettings (U)
    kdeclarative (U)
    kdesu (U)
    keditbookmarks (U)
    kget (U)
    kholidays (U)
    kitemmodels (U)
    kitinerary (U)
    kjs (U)
    kldap (U)
    kmbox (U)
    kmediaplayer (U)
    kontact (U)
    kpackage (U)
    kparts (U)
    kpat (U)
    kphotoalbum (U)
    kpkpass (U)
    ksyntax-highlighting (U)
    ktextwidgets (U)
    ktnef (U)
    kwallet-kf5 (U)
    kxmlrpcclient (U)
    libkdegames (U)
    libkeduvocdocument (U)
    libkf5calendarsupport (U)
    pim-sieve-editor (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    prison-kf5 (U)
    syndication (U)
    threadweaver (U)

    Ole Streicher <olebole@debian.org>
    purify (U)
    sopt (U)

    Olivier Sallou <osallou@debian.org>
    cassiopee (U)
    visp (U)

    Ondřej Surý <ondrej@debian.org>
    brotli (U)
    libyang (U)
    libzip (U)
    tidy-html5 (U)

    Patrick Franz <deltaone@debian.org>
    plasma-nm (U)
    plasma-thunderbolt (U)

    Patrick Gansterer <paroga@paroga.com>
    poco (U)

    Patrick Matthäi <pmatthaei@debian.org>
    kid3

    Patryk Cisek <patryk@debian.org>
    injeqt

    Paul Klos <kolab@klos2day.nl>
    libkolabxml (U)

    Paulo Henrique de Lima Santana (phls) <phls@debian.org>
    kickpass

    Peter Pentchev <roam@debian.org>
    createrepo-c

    Peter Spiess-Knafl <dev@spiessknafl.at>
    libjson-rpc-cpp
    nordlicht (U)

    Petter Reinholdtsen <pere@debian.org>
    gr-gsm (U)

    Philippe Deniel <philippe.deniel@cea.fr>
    nfs-ganesha

    Picca Frédéric-Emmanuel <picca@debian.org>
    ufo-core (U)

    Pino Toscano <pino@debian.org>
    clazy (U)
    grantlee5 (U)
    indi (U)
    kdiagram (U)
    lensfun (U)
    pkg-kde-tools (U)
    plasma-thunderbolt (U)

    Puppet Package Maintainers <pkg-puppet-devel@lists.alioth.debian.org>
    leatherman

    Rafael Laboissière <rafael@debian.org>
    mathgl (U)

    Renzo Davoli <renzo@cs.unibo.it>
    userbindmount (U)
    vdeplug4 (U)

    Rob Browning <rlb@defaultvalue.org>
    emacs

    Robert McGibbon <rmcgibbo@gmail.com>
    openmm (U)

    Roberto C. Sanchez <roberto@connexer.com>
    luabind

    Roger Shimizu <rosh@debian.org>
    libcork (U)
    libcorkipset (U)

    Rogério Brito <rbrito@ime.usp.br>
    fontforge (U)

    Roman OndráÄek <roman@romanondracek.cz>
    paho.mqtt.c

    Ruben Undheim <ruben.undheim@gmail.com>
    freediameter (U)
    graywolf (U)

    Ryan Pavlik <ryan@ryanpavlik.com>
    meshlab (U)

    Sandro Knauß <hefee@debian.org>
    akonadi (U)
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-notes (U)
    akonadiconsole (U)
    akregator (U)
    cmocka (U)
    kalarmcal (U)
    kcontacts (U)
    kitinerary (U)
    kldap (U)
    kmbox (U)
    kontact (U)
    kpkpass (U)
    ktnef (U)
    kuserfeedback (U)
    libkf5calendarsupport (U)
    libkolabxml (U)
    pim-sieve-editor (U)

    Scarlett Clark <sgclark@kde.org>
    clazy (U)

    Scarlett Moore <sgmoore@kde.org>
    k3b (U)
    kuserfeedback (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    pulseaudio-qt (U)

    Scott Howard <showard@debian.org>
    alglib (U)
    zziplib

    Sebastian Ramacher <sramacher@debian.org>
    x265 (U)

    Sebastian Wouters <sebastianwouters@gmail.com>
    chemps2 (U)

    Sebastien Bacher <seb128@debian.org>
    evolution (U)

    Sebastien Badia <sbadia@debian.org>
    rspamd

    Sepi Gair <sepigair@email.cz>
    libxtrxll

    Serge Cohen <serge1cohen@free.fr>
    ufo-core (U)

    Sergio Durigan Junior <sergiodj@debian.org>
    intel-processor-trace (U)
    rspamd (U)

    Shengjing Zhu <zhsj@debian.org>
    fmtlib
    sdbus-cpp

    Simon Quigley <tsimonq2@debian.org>
    gcompris-qt (U)
    yaml-cpp

    Stefan Schörghofer <amd1212@4md.gr>
    libzip

    Steffen Moeller <moeller@debian.org>
    schroedinger-coordgenlibs (U)
    schroedinger-maeparser (U)

    Steve M. Robbins <smr@debian.org>
    libminc (U)
    simage (U)

    Stuart Prescott <stuart@debian.org>
    nexus (U)

    Sudip Mukherjee <sudipm.mukherjee@gmail.com>
    trace-cmd

    Sune Vuorela <debian@pusling.com>
    akonadi (U)

    Sune Vuorela <sune@debian.org>
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-notes (U)
    akonadiconsole (U)
    akregator (U)
    grantlee5 (U)
    keditbookmarks (U)
    kget (U)
    kontact (U)
    kpat (U)
    libkdegames (U)
    okteta (U)
    pim-sieve-editor (U)
    pkg-kde-tools (U)

    Sven Geggus <sven-debian@geggus.net>
    sfcgal (U)

    Taowa <taowa@debian.org>
    dino-im (U)

    Teemu Ikonen <tpikonen@gmail.com>
    meshlab (U)

    The Ayatana Packagers <pkg-ayatana-devel@lists.alioth.debian.org>
    libqtdbusmock
    libqtdbustest

    Thomas Dreibholz <dreibh@iem.uni-due.de>
    hipercontracer

    Thorsten Alteholz <debian@alteholz.de>
    hoel (U)
    nuspell
    orcania (U)
    ulfius (U)
    yder (U)

    Tidy HTML5 <tidy-html5@packages.debian.org>
    tidy-html5

    Timo Aaltonen <tjaalton@debian.org>
    uid-wrapper (U)
    vulkan-loader (U)

    Timo Röhling <roehling@debian.org>
    fastcdr (U)
    foonathan-memory (U)
    tinyexr
    tinyobjloader

    Tino Didriksen <tino@didriksen.cc>
    cg3 (U)

    Tobias Frost <tobi@debian.org>
    log4cplus (U)

    Tobias Hansen <thansen@debian.org>
    allegro5 (U)

    Tomasz Buchert <tomasz@debian.org>
    brotli

    Vasudev Kamath <kamathvasudev@gmail.com>
    editorconfig-core (U)

    Vasudev Kamath <vasudev@copyninja.info>
    fontforge (U)

    Vasyl Gello <vasek.gello@gmail.com>
    kissfft (U)
    libwebm (U)

    Victor Seva <vseva@debian.org>
    intel-processor-trace

    Vincent Cheng <vcheng@debian.org>
    supertux (U)

    Vincent Danjean <vdanjean@debian.org>
    pocl (U)

    William Blough <bblough@debian.org>
    xalan

    Yangfl <mmyangfl@gmail.com>
    yaramod

    Yaroslav Halchenko <debian@onerussian.com>
    libfreenect (U)

    YunQiang Su <syq@debian.org>
    fcitx (U)

    YunQiang Su <wzssyqa@gmail.com>
    libgooglepinyin (U)


    --=-=-=--

    --==-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYfx2MgAKCRDcUY/If5cW qknBAPsFlUcLzKdXxLMl9s3ZeqO6AAYkdhez4AHQ6QJF4HNmjwEArtB036c1Z2MK lTbeAS9o9hfD7aeW9Mk3eZIz+EvvuwI=WaO5
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Seth Arnold@21:1/5 to Vagrant Cascadian on Fri Feb 4 03:30:01 2022
    On Thu, Feb 03, 2022 at 04:41:21PM -0800, Vagrant Cascadian wrote:
    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake. I
    found myself slowly edging into a mass bug filing, one bug report at a time...

    Hello Vagrant, does this represent a security problem?

    I tried to give this a look myself but didn't know what to look for; I
    grabbed a few recent versions of packages:

    http://ftp.debian.org/debian/pool/main/n/nfs-ganesha/nfs-ganesha_3.4-1_amd64.deb
    http://ftp.debian.org/debian/pool/main/v/vmemcache/libvmemcache0_0.8.1-4_amd64.deb
    http://ftp.debian.org/debian/pool/main/f/fontforge/fontforge_20201107~dfsg-4_amd64.deb

    $ find . -type f -exec eu-readelf -d {} \; 2>/dev/null | grep RUNPATH
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]

    Am I on the wrong track?

    Thanks

    -----BEGIN PGP SIGNATURE-----

    iQEzBAABCgAdFiEEQVAQ8bojyMcg37H18yFyWZ2NLpcFAmH8jjUACgkQ8yFyWZ2N LpcSDwf/cfIU7q/thxNiITQud8pU6fqtjD0LHkBxhpKi1OHrHdGcvxAHvs++ovFF KAKO//DOhGeu7mVuhm45ZiFy4d56OCe0wQp6djoCfQ+qqMApAnMIXvxhTQlhSnYg zfFhD5r8pgZjMBBEtDGkhneebdJFArNoSKTo2fSYwzwv6yTdjGqOsSR1LM8Tgpty 27k6kleEOaKovge/SUBVbjRHGu3F8EW2z+TGQkX4PSqyYzg2owcOzF2yBFfaVRLW vBOmrtIjH8G5Bend8yRwraYmvbZCDYEEH1DOQ8jYxUahHTzKQFkSrwKxiCoRqozj bxQjdnBndw4SdsOQfx3Xy8qyiVhiFw==
    =qzow
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Paul Wise@21:1/5 to Vagrant Cascadian on Fri Feb 4 06:10:02 2022
    Vagrant Cascadian wrote:

    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake.

    This seems like the sort of thing that will be an ongoing problem, so
    if it is detectable statically then a lintian warning might be good.

    --
    bye,
    pabs

    https://wiki.debian.org/PaulWise

    -----BEGIN PGP SIGNATURE-----

    iQIzBAABCgAdFiEEYQsotVz8/kXqG1Y7MRa6Xp/6aaMFAmH8tKYACgkQMRa6Xp/6 aaMhYg/8CAg++vJhYNKP8FRY9x/P5PVY0DwXsUjEq/lVOpwxQjh/uV4cLrcy5hCD hFm7PRaCD0AXcCDRTTys6s2hs625+pLBZ1pf4StvUqAXAOGq8edO562bX2cpiqfH tTFilxDu+WcRpmMLSUgtOQtbP8fvsKxOO7vPJ+zeICWEnbWXkF9mNrPrnZWMz+9z L+9L+b0G1QcmMmI1QvZWRFeKmPAQMEdy1BZVCroqOFXAqZRurKBxP/4vkW0CJYeT Bb2Bhh5V0gtoUW/tlM5j3PH2SbcfHcvdmnZOpdoH1ODnM11bPcssHrc35ZMsLfzz RGf6hcra3YRr1q7DiduPlQ9TQVILiXHfyuqysjhr6anidiQVoSvcnW1v4hMyK7oS hdTq7IYel8dTNjSCb6PAqA2tvFmfTijS8K3LN/uoiQkEda74g0EQMYQGRwoqSKoC di3+DNP0lySEdpjtUS8sGC8cWQ6TpguywEM13TtzNKbnBYMDtED8dL2MIhWoWfG2 Syg9iVgxH5v02T3uXrsFh2+IM7/gGREx88+63IoBUlysXAFX9OSX1wekMPvZW488 lQuSf9kSqW9FustM4A78ExTdukjOjJa5bWkRCtPnCrmO5NAsieEmeXxl00v1hGVw bZ0OflZShlLV4u2x1HJLt+c64kbbuWO3lUZe9yfw7oE3egRgUWc=
    =x5R1
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Simon McVittie@21:1/5 to Seth Arnold on Fri Feb 4 12:00:03 2022
    On Fri, 04 Feb 2022 at 02:23:54 +0000, Seth Arnold wrote:
    does this represent a security problem?

    "It depends". (This answer is not specific to CMake, it's equally valid
    for any build system.)

    If the RPATH or RUNPATH points to a trusted directory where write access
    would require root-equivalent privileges, such as somewhere below /usr,
    then it's not a problem.

    Some packages have to do this in order to access private shared libraries, which sounds like a contradiction, but isn't really. Some libraries
    are not sufficiently API- or ABI-stable to be suitable to place them
    in the global search path for the OS as a whole, but do need to be
    shared between a closely cooperating group of programs, either within a
    single package or in several tightly-coupled packages.

    For example, lots of small programs in the systemd package are linked to /lib/systemd/libsystemd-shared-250.so, which contains code that is shared between those programs but is not a stable public API. Statically linking
    that shared code would have resulted in a separate partial copy in every program, which would have made the package much larger, so instead it
    is a private shared library; and to make that work, the programs have
    a RUNPATH pointing to /lib/systemd.

    This RUNPATH is not a security problem with systemd, because to be
    able to exploit it to make these programs execute arbitrary code, an
    attacker would need to be able to write to /lib/systemd - but if the
    attacker can write to /lib/systemd (or, more generally, /usr or /lib),
    then system integrity has already failed.

    Having a RUNPATH set to /usr/lib/ganesha looks like it is similar to
    the systemd case. If it's intentional, then it's almost certainly fine.

    The situation where a RPATH or RUNPATH *does* represent a security problem
    is when the RPATH or RUNPATH points to a directory that might become attacker-controlled. For example, if the RUNPATH of a program "foobar" is
    set to its build directory in /tmp, perhaps /tmp/foobar_1.0_59PnHH,
    then an attacker could create that directory, put their malicious code
    into it, and wait for the victim to run foobar.

    Similarly, if the RUNPATH is /home/fred/builds/foobar-1.0, then
    that isn't a practical problem for most people, but if you happen to
    have an untrusted local user whose home directory is /home/fred, it
    becomes a security vulnerability on that particular system.

    There is a third situation referenced by https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html,
    which is not a security problem, but is a reproducibility problem. It's
    common for executables and libraries to be given a temporary RUNPATH
    pointing to the location of shared libraries in the build directory, so
    that unit tests can be run before the package is installed without needing
    to set the LD_LIBRARY_PATH (in Autotools, this is the --disable-fast-install option; in CMake, it seems to be the default). CMake removes the RUNPATH
    just before installation, so it doesn't become a security problem,
    but that's too late to stop it from affecting the build-ID - and the
    *length* of the build directory can also affect the contents of the
    binary, because when RUNPATHs are removed, it is done by overwriting
    them with zeroes in-place, leaving a run of zeroes with the same length
    as the removed RUNPATH.

    smcv

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Simon McVittie@21:1/5 to Paul Wise on Fri Feb 4 12:00:01 2022
    On Fri, 04 Feb 2022 at 13:07:53 +0800, Paul Wise wrote:
    Vagrant Cascadian wrote:
    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake.

    This seems like the sort of thing that will be an ongoing problem, so
    if it is detectable statically then a lintian warning might be good.

    For packages that (intentionally or unintentionally) still have a RPATH
    or RUNPATH in their installed files, https://lintian.debian.org/tags/custom-library-search-path detects it.
    You'll see that many of them are overridden as being necessary and
    intentional.

    For packages where the RPATH or RUNPATH is temporarily set during build
    (to be able to run unit tests without setting LD_LIBRARY_PATH) but then
    removed before installation with `chrpath -d` or equivalent code in CMake,
    I don't think this is going to be detectable statically, because the
    only traces left in the final binary are:

    - the build-ID will be different, because the RPATH/RUNPATH was part of
    the data that gets hashed to create the build-ID
    - if the length of the build directory changes, then the block of zero
    bytes that previously contained the RPATH/RUNPATH (before it was
    overwritten) will have a different length

    This is the sort of thing that can probably only be detected by literally
    doing two builds (in different directories) and comparing them with
    diffoscope, or possibly by screen-scraping build logs like blhc does.

    smcv

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Roland Clobus@21:1/5 to All on Fri Feb 4 12:40:01 2022
    This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --------------003H7Rp2LVFQcg0MpERzz9O8
    Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: base64

    T24gMDQvMDIvMjAyMiAxMTo1OCwgU2ltb24gTWNWaXR0aWUgd3JvdGU6DQo+IEZvciBwYWNr YWdlcyB3aGVyZSB0aGUgUlBBVEggb3IgUlVOUEFUSCBpcyB0ZW1wb3JhcmlseSBzZXQgZHVy aW5nIGJ1aWxkDQo+ICh0byBiZSBhYmxlIHRvIHJ1biB1bml0IHRlc3RzIHdpdGhvdXQgc2V0 dGluZyBMRF9MSUJSQVJZX1BBVEgpIGJ1dCB0aGVuDQo+IHJlbW92ZWQgYmVmb3JlIGluc3Rh bGxhdGlvbiB3aXRoIGBjaHJwYXRoIC1kYCBvciBlcXVpdmFsZW50IGNvZGUgaW4gQ01ha2Us DQo+IEkgZG9uJ3QgdGhpbmsgdGhpcyBpcyBnb2luZyB0byBiZSBkZXRlY3RhYmxlIHN0YXRp Y2FsbHksIGJlY2F1c2UgdGhlDQo+IG9ubHkgdHJhY2VzIGxlZnQgaW4gdGhlIGZpbmFsIGJp bmFyeSBhcmU6DQo+IA0KPiAtIHRoZSBidWlsZC1JRCB3aWxsIGJlIGRpZmZlcmVudCwgYmVj YXVzZSB0aGUgUlBBVEgvUlVOUEFUSCB3YXMgcGFydCBvZg0KPiAgICB0aGUgZGF0YSB0aGF0 IGdldHMgaGFzaGVkIHRvIGNyZWF0ZSB0aGUgYnVpbGQtSUQNCj4gLSBpZiB0aGUgbGVuZ3Ro IG9mIHRoZSBidWlsZCBkaXJlY3RvcnkgY2hhbmdlcywgdGhlbiB0aGUgYmxvY2sgb2YgemVy bw0KPiAgICBieXRlcyB0aGF0IHByZXZpb3VzbHkgY29udGFpbmVkIHRoZSBSUEFUSC9SVU5Q QVRIIChiZWZvcmUgaXQgd2FzDQo+ICAgIG92ZXJ3cml0dGVuKSB3aWxsIGhhdmUgYSBkaWZm ZXJlbnQgbGVuZ3RoDQoNCkkndmUgd3JpdHRlbiBhIGRldGVjdGlvbiBmb3IgdGhpcyBidWls ZC1JRCBtaXNtYXRjaCBpbiBkaWZmb3Njb3BlIHNvbWUgDQp0aW1lIGFnby4gWzFdDQoNCkl0 IGRvZXMgbm90IHJlcXVpcmUgdHdvIGJ1aWxkcyB0byBkZXRlY3QgYSBtaXNtYXRjaGVkIE5U X0dOVV9CVUlMRF9JRCwgDQpzbyBwZXJoYXBzIGl0IG1ha2Ugc2Vuc2UgdG8gbWlncmF0ZSB0 aGlzIGNvZGUgdG8gbGludGlhbiAoaW4gYWRkaXRpb24gdG8gDQp0aGUgYWxyZWFkeSBtZW50 aW9uZWQgJ2N1c3RvbS1saWJyYXJ5LXNlYXJjaC1wYXRoJy4gWzJdDQoNCldpdGgga2luZCBy ZWdhcmRzLA0KUm9sYW5kIENsb2J1cw0KDQpbMV0gDQpodHRwczovL3NvdXJjZXMuZGViaWFu Lm9yZy9zcmMvZGlmZm9zY29wZS8yMDIvZGlmZm9zY29wZS9jb21wYXJhdG9ycy9lbGYucHkv P2hsPTY0NiNMNjQ2DQpbMl0gaHR0cHM6Ly9saW50aWFuLmRlYmlhbi5vcmcvdGFncy9jdXN0 b20tbGlicmFyeS1zZWFyY2gtcGF0aA0K

    --------------003H7Rp2LVFQcg0MpERzz9O8--

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEUFVLM5Bdj7GSJEb+YsV8aqYUlb0FAmH9Dk0ACgkQYsV8aqYU lb0mXw//XkdEhFRS4snzFtPZfnpUftDd8DvjYpFXeh0XMJWEjDzLlpNaOczqxEKt Rfwu7+r2k9zSZ91pc7ziXWZ+0MExEH2sBPx9P4BNH4tpU9dr+4PtrWx22C4EOZ85 s4JVkOkcKZ0+GTuth+wuMaRb51E7nRMJB+R8N7tx3yDtiKbapLAOylGlTMgu0jzf sM0dMuEiQXTkS1KuBqh/keg58v36Fzg26kOJmYNUz4PoLxPpsPO0/lwOJN2Ji5HB 49JDUU+nizCH5JQjEuJJuCJsLQQ8YdPV0bMaCx4WXBaMJn6apntNXXyidjo+nikE QegzTfidhuddHiMQKQxiqhmOgOZ9d1HYg4CGSaxGTb7ukAn7hLHDxy0tDS5qhwVT ICRBByWvISeGEWQalrnbcgVfqPIiwIDno+wxbcxTjaDnhALRA1BT2+J7cBX2wMJs bQ9HRcI4PWxdm8g3zFj6g4nsQsl72zxiqqSnEwoOBtHUWpnpRG+giIIIjTFnlVC8 196VCMN1aLmVoHohJz6O18n+d7x4ToWZ6F8dayXqpxKJaonfta5TYurmsEauEWeN 24fKQ5g8FgcECRLIYDhERBq1R2DAUFvRfegzMVp24UYYhfRS9DzPXFPPaLYvMLUH oe6KdQ6i7AizCTDacOqS5z0biQEx0aBjC4iFp0aLYfPNlzTl88A=
    =Y7wc
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andreas Ronnquist@21:1/5 to Vagrant Cascadian on Fri Feb 4 14:10:01 2022
    On Thu, 03 Feb 2022 16:41:21 -0800,
    Vagrant Cascadian<vagrant@reproducible-builds.org> wrote:

    I've attached a list of the maintainers of affected packages produced
    with dd-list, getting the list of packages from the above-mentioned >reproducible builds issue and diff.dcsr.txt from archive rebuild.

    If you're on the list, would love if you could check if your package
    still builds correctly when passing only
    -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
    are already patches in the Debian bug tracking system waiting for you!


    allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

    -- Andreas Rönnquist
    mailinglists@gusnan.se
    gusnan@debian.org

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCAAdFiEE2zBuSxD/2Y7021XXGUtjGrLaKIgFAmH9IwIACgkQGUtjGrLa KIgqTw/+IFdFQoCuXRaq3COibOgX6eGC/VSf5FVhn3i5OpDlJA1r6hsLmzrVFRCH K29eiYA7SAkQWEhXmNnSRkGltucvbaNmdKsDTOUvFz/pCi2VeuHW1evz2CHXbv6a 4GKFF/g7T4hsZz+BZkLxMy7LVxWQst6m4I5rKNUE1mYlPUfsMj9CtDzmL8sIsASY eC4+T04qC2DaEWNtUqKhNUu0jLrxUJGsLjM3kLgeKr+0sK+0c5f+O8R+bDGDMcT1 8pxx0/wmCS6Mo6W+6m8DSCEiTrqdlGfjkSv2CTEN2uA4Dq04cX4tGPCLhdnCGbgc PJKvyH4cDvM29/GjF2B/Bh54aNt2CPkD/hvEgKLF7buyT/Ud3/bQcVsWZzSDxS7l XXSBRpTsxOdHnuCdso5xFAox3YIYh0fxpD1Sr5nj7OWvMonrPLaNIqkY6KutfQcj QhIlAMCW658KDwvjadmsBAGdKh79ohNqOvgCKLQfWWIi+83AkyeCun9Z7Ps1nGog V530ICrsQNJNqRGinmCbXLSjr1z3jRJZIABDyMRYndHff+10iS4kmvrSpsTiEZG5 ujc91WzObP8movknHfQTfe/RueXmNWGevJik0MG+6ZZmnklQQPKi5xj4BXGJGU0k y7vgW0Dn9ourcsVJleSRk4vyVAT/ct/NjtBpSvxygFOb1oPXtsg=
    =USKZ
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From =?UTF-8?Q?David_Pr=c3=a9vot?=@21:1/5 to All on Fri Feb 4 14:40:02 2022
    Hi,

    Le 04/02/2022 à 08:58, Andreas Ronnquist a écrit :
    On Thu, 03 Feb 2022 16:41:21 -0800,
    Vagrant Cascadian<vagrant@reproducible-builds.org> wrote:

    If you're on the list, would love if you could check if your package
    still builds correctly when passing only
    -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
    are already patches in the Debian bug tracking system waiting for you!

    allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

    Ditto for cmocka.

    Is there a better place than this debian-devel thread to document what
    works or not?

    Regards

    David

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Vagrant Cascadian@21:1/5 to Paul Wise on Fri Feb 4 18:40:02 2022
    On 2022-02-04, Paul Wise wrote:
    Vagrant Cascadian wrote:

    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake.

    This seems like the sort of thing that will be an ongoing problem, so
    if it is detectable statically then a lintian warning might be good.

    So far I have only figured out how to detect it by building packages and checking if they're reproducible, but if someone can figure out how to
    make it work from lintian, so much the better!

    I believe there is a lintian check for build paths embedded in binaries,
    at least, which will catch this and other issues, but maybe it could be extended to check for this more explicitly...


    live well,
    vagrant

    -----BEGIN PGP SIGNATURE-----

    iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf1jmQAKCRDcUY/If5cW qiFqAPwJd31SdbdOJtc+tCcEI08dCcbCiC+Aw+mM50sMMUus4QEA6HRH6LmIVv+f snmach8quy0V58jaENxslE9dbiw5YA4=
    =ib3f
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Vagrant Cascadian@21:1/5 to Seth Arnold on Fri Feb 4 19:10:02 2022
    On 2022-02-04, Seth Arnold wrote:
    On Thu, Feb 03, 2022 at 04:41:21PM -0800, Vagrant Cascadian wrote:
    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake. I
    found myself slowly edging into a mass bug filing, one bug report at a
    time...

    Hello Vagrant, does this represent a security problem?

    Other than reproducible builds in general providing some security
    properties, I would say not really.


    I tried to give this a look myself but didn't know what to look for; I grabbed a few recent versions of packages:

    http://ftp.debian.org/debian/pool/main/n/nfs-ganesha/nfs-ganesha_3.4-1_amd64.deb

    One thing is checking the reproducible builds results:

    https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/diffoscope-results/nfs-ganesha.html

    Which appear to have reproducibility issues in the unstable tests, where
    build paths are varied, but not in bookworm, where build paths are not
    varied.

    Unfortunately, the diffoscope output linked above does not obviously
    show the build path embedded in the binaries (other than some .py files,
    which may be a separate issue).

    There are a few lines which are non-obvious, but are in my experience a
    sign of different build paths:

    0x000000000000000a·(STRSZ)··············2327·(bytes)
    vs.
    0x000000000000000a·(STRSZ)··············2329·(bytes)

    My going theory is that the length of the build path is embedded in a
    padded value, even though the build path itself is actually stripped,
    perhaps via -ffile-prefix-map=BUILDPATH=. or similar.


    http://ftp.debian.org/debian/pool/main/v/vmemcache/libvmemcache0_0.8.1-4_amd64.deb
    http://ftp.debian.org/debian/pool/main/f/fontforge/fontforge_20201107~dfsg-4_amd64.deb

    $ find . -type f -exec eu-readelf -d {} \; 2>/dev/null | grep RUNPATH
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]
    RUNPATH Library runpath: [/usr/lib/ganesha]

    Am I on the wrong track?

    Because it doesn't often leave obvious traces of the build path in the binaries, it is a bit tricky to test simply by examining the binaries directly... Instead, experimentation seems to be the best way.

    I use reprotest for this, first running a build with reprotest without
    the patch, confirming that it builds at all, and does not build
    reproducibly. Then running reprotest with the patch applied to add -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON in debian/rules, and seeing if it
    builds reproducibly.

    From the source directory, with the build dependencies installed:

    reprotest --verbose --store-dir=$(mktemp -d $HOME/buildresults-XXXXXX) --vary=-all,+build_path -- null


    This should normalize the build as much as possible so that the only
    thing different between the two builds is the build path.

    Then compare the resulting buildresults-*/*.out to see if the second
    build produces significantly less diffoscope output...


    live well,
    vagrant

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf1qTQAKCRDcUY/If5cW qsWDAQCahpr4bOHFmLfNcUxoUKnrKFXxJ/HPYZpi6abpjUgWsgEAhP/o29E83MO2 EwvtjVhtowXVI1qqVTaoZn/HwlGtWwE=Pr4/
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Seth Arnold@21:1/5 to Simon McVittie on Sat Feb 5 03:00:14 2022
    On Fri, Feb 04, 2022 at 10:49:43AM +0000, Simon McVittie wrote:
    CMake removes the RUNPATH
    just before installation, so it doesn't become a security problem,
    but that's too late to stop it from affecting the build-ID - and the
    *length* of the build directory can also affect the contents of the
    binary, because when RUNPATHs are removed, it is done by overwriting
    them with zeroes in-place, leaving a run of zeroes with the same length
    as the removed RUNPATH.

    Aha! This was the piece I was missing. I hadn't figured out that cmake
    was resetting the RUNPATHs along the way, which explains why I didn't
    spot any /nonexistant/whatever/... strings in any of my checks.

    Excellent explanation as usual.

    Thanks

    -----BEGIN PGP SIGNATURE-----

    iQEzBAABCgAdFiEEQVAQ8bojyMcg37H18yFyWZ2NLpcFAmH92QwACgkQ8yFyWZ2N LpeD1wf+P8B6w8ad+RgS6pEA7L1+7BODzRR5ZkkL79bHcNfFjQEnf3ApwlWIwXiL +KrzgY6ECitQGUmoC6fZRrJq8Pl5X0OGl788mmx/iRTZp7YJRASq3YQPDKQ0saCa x8EnUC10avHBtF6dn169KjyLJ/unykEs/bxUJ0rDnt2pglBRCCZ7j4HPJ2d47nGx Vre2ok3hN1UkfVDeq2ucySVXbxjHBDpb+RIUkXKZVcusz7rN90XcwDd5/aUd1YZq SEezoc3CqIhbywuYK/nG0AKe75HwrTM0WsCLZaM0BsunWdWVPj1HxSAs/rD2Xo7P Qa2Y/VGK9OML4ZZpLLkcRWub/ZFaag==
    =Xc4B
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Vagrant Cascadian@21:1/5 to Simon McVittie on Sun Feb 6 02:10:02 2022
    On 2022-02-04, Simon McVittie wrote:
    On Fri, 04 Feb 2022 at 13:07:53 +0800, Paul Wise wrote:
    Vagrant Cascadian wrote:
    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake.

    This seems like the sort of thing that will be an ongoing problem, so
    if it is detectable statically then a lintian warning might be good.

    For packages that (intentionally or unintentionally) still have a RPATH
    or RUNPATH in their installed files, https://lintian.debian.org/tags/custom-library-search-path detects it.
    You'll see that many of them are overridden as being necessary and intentional.

    I was hoping to find a few of the cmake packages on there
    (e.g. /build/PACKAGE-*/PACKAGE-VERSION), but it appears the only ones on
    that list do not use cmake to build...


    For packages where the RPATH or RUNPATH is temporarily set during build
    (to be able to run unit tests without setting LD_LIBRARY_PATH) but then removed before installation with `chrpath -d` or equivalent code in CMake,
    I don't think this is going to be detectable statically, because the
    only traces left in the final binary are:

    - the build-ID will be different, because the RPATH/RUNPATH was part of
    the data that gets hashed to create the build-ID
    - if the length of the build directory changes, then the block of zero
    bytes that previously contained the RPATH/RUNPATH (before it was
    overwritten) will have a different length

    But clearly some of the above is happening...


    This is the sort of thing that can probably only be detected by literally doing two builds (in different directories) and comparing them with diffoscope

    Yeah, that's pretty much the conclusion I came to.


    or possibly by screen-scraping build logs like blhc does.

    That could be an interesting approach, though relies on fairly verbose
    build logs.


    Thanks!


    live well,
    vagrant

    p.s. please CC me and/or reproducible-builds@lists.alioth.debian.org,
    I'm not subscribed to debian-devel.

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf8eVQAKCRDcUY/If5cW quzpAP9GNEk1WIYfF9w2mf/k+Gjj8GeZ/iwyuVDDQqYtKGhWEwEAlM0Ix3XKhu4/ +8bVKAqSIcebbjTYynzI91XnL2bInA4=gKVv
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Vagrant Cascadian@21:1/5 to All on Sun Feb 6 01:40:02 2022
    On 2022-02-04, David Prévot wrote:
    Le 04/02/2022 à 08:58, Andreas Ronnquist a écrit :
    On Thu, 03 Feb 2022 16:41:21 -0800,
    Vagrant Cascadian<vagrant@reproducible-builds.org> wrote:

    If you're on the list, would love if you could check if your package
    still builds correctly when passing only
    -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON. For a few of the packages, there
    are already patches in the Debian bug tracking system waiting for you!

    allegro5 builds fine here when adding -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON.

    Ditto for cmocka.

    Thanks for testing!


    Is there a better place than this debian-devel thread to document what
    works or not?

    The developer's reference suggests mailing debian-devel with a list of
    affected packages/maintainers instead of mass filing bugs, so that's
    what I did (well, after filing lots of bugs/patches already)... :)

    If we want to track the issues, to me it seems like the best way to
    track these issues are bugs with usertags...

    So I guess I'm a bit confused as to the goal of not mass filing
    bugs!

    Maybe the goal is to have as many maintainers address the issue before
    getting bugs.debian.org involved, and only once some time passes,
    proceed to filing actual bugs?


    Another option is to add a comment to the package in:

    https://salsa.debian.org/reproducible-builds/reproducible-notes

    I'll do this for the two mentioned so far.


    live well,
    vagrant

    p.s. Please Cc me and/or reproducible-builds@lists.alioth.debian.org on
    this thread, as I'm not subscribed to debian-devel.

    --=-=-Content-Type: application/pgp-signature; name="signature.asc"

    -----BEGIN PGP SIGNATURE-----

    iHUEARYKAB0WIQRlgHNhO/zFx+LkXUXcUY/If5cWqgUCYf8XYgAKCRDcUY/If5cW qhfvAP4gggVfAZMrW672DYtb+qyCH+MAMRJQBEX7P6ZjeAhkegD/XwxVyAVDB97l YGzv03rLverT+OsfgHfRqehC/+JVaA0óqx
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Maxime Chambonnet@21:1/5 to All on Sun Feb 6 06:00:02 2022
    I don't know really where to add this bit of information in the discussion,
    so I am taking the latest leaf.
    The rpath trend, with or without cmake, is likely to continue as it is being reborn by spack, nix and guix. The points made by smcv about arbitrary
    code execution and reproducibility are interesting: could these be added
    to the "rpath issue" wiki entry? The arguments currently in there hold in
    my opinion little value.
    I am reaching out on spack's slack to try and discuss the former arguments.

    BR, Maxime

    [1] https://wiki.debian.org/RpathIssue

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Vagrant Cascadian@21:1/5 to Vagrant Cascadian on Sun Apr 3 21:20:01 2022
    --=-=-=
    Content-Type: text/plain
    Content-Transfer-Encoding: quoted-printable

    On 2022-02-03, Vagrant Cascadian wrote:
    Over the last several months, I and others have found quite a few
    packages that embed build paths via rpath when building with cmake. I
    found myself slowly edging into a mass bug filing, one bug report at a time...

    I ended up submitting a few patches and noting some affected packages:

    https://tests.reproducible-builds.org/debian/issues/unstable/cmake_rpath_contains_build_path_issue.html

    There are almost certainly packages missing from that list, as it is generated by human confirmation...

    So in the last couple months I kept finding more packages affected by
    this; the above URL now has confirmed 380+ packages affected by this
    issue, a few of which are are now fixed, thanks!

    On those I've tested and confirmed, I've either submitted a patch and/or mentioned in comments for the package in the reproducible builds notes,
    which you can see by clicking on the referenced package in the above
    URL, or searching for the relevent package in:

    https://salsa.debian.org/reproducible-builds/reproducible-notes/-/blob/master/packages.yml


    I don't know for sure that this is a comprehensive list of affected
    packages; I've mostly identified packages that fail to build with build
    path variations and had otherwise no known cause, or used other
    identified issues that apparently had a direct correlation to this
    issue.

    Doing a systematic search for all packages that use cmake to build and
    fail to build reproducibly in unstable or experimental would probably be
    the next step to identify any remaining packages...


    In many cases I've tested so far, passing an argument via a
    dh_auto_configure override in debian/rules fixes the issue:

    override_dh_auto_configure:
    dh_auto_configure -- -DCMAKE_BUILD_RPATH_USE_ORIGIN=ON


    Alternately, the experimental debhelper compat level v14 does include a
    fix for these embedded rpaths, though in the current state, passing both -DCMAKE_SKIP_RPATH=ON and -DCMAKE_RPATH_USE_ORIGIN=ON, it triggers build failures 263 packages, according to a test run by Lucas Nussbaum in
    October:

    http://qa-logs.debian.net/2021/10/25/diff.dcsr.txt


    Since debhelper v14 is not finalized yet, I just sent a request to
    debhelper to only pass one of the arguments,
    -DCMAKE_RPATH_USE_ORIGIN=ON, which should significantly reduce the
    number of build failures while still making many packages reproducible
    with debhelper compat v14:

    https://bugs.debian.org/1004939

    Haven't gotten any comment on this from the debhelper maintainers yet...

    There are a few where -DCMAKE_RPATH_USE_ORIGIN=ON does trigger test
    failures or otherwise causes build failures (some had test suite
    failures without changes), but my off the cuff guess is ~2% of the ~380
    noted packges; less than I could count on both hands using very simple
    methods. This should be significantly less that -DCMAKE_SKIP_RPATH=ON...


    It seems like it is not possible to actually create something like a
    lintian warning for this, as the actual build path is stripped out
    before creating the .deb package; the only result is for the most part a different build id and a few small changes in the binaries. Would, of
    course, be happy to be proven wrong!


    I've added a new list of affected maintainers produced with dd-list with
    the packages marked with the "cmake_rpath_contains_build_path" issue
    that haven't yet been fixed in some way according to tests.reproducible-builds.org.


    Thanks everyone!


    live well,
    vagrant


    --=-=-Content-Type: text/plain; charset=utf-8
    Content-Disposition: inline; filenameÝ-list-cmake-rpath.txt Content-Transfer-Encoding: quoted-printable

    "Adam C. Powell, IV" <hazelsct@debian.org>
    oce (U)

    A. Maitland Bottoms <bottoms@debian.org>
    airspyone-host
    codec2
    gr-fosphor
    gr-funcube (U)
    gr-hpsdr (U)
    gr-iqbal
    gr-osmosdr
    gr-radar
    gr-rds
    hackrf
    libfreesrp
    rtl-sdr
    volk

    Adam Borowski <kilobyte@angband.pl>
    pmdk-convert
    pmemkv

    Adrian Knoth <adi@drcomp.erfurt.thur.de>
    libdrumstick (U)

    Alastair McKinstry <mckinstry@debian.org>
    ecflow
    mathgl (U)

    Alberto Garcia <berto@igalia.com>
    cog

    Alberto Luaces Fernández <aluaces@udc.es>
    openscenegraph

    Alessio Treglia <alessio@debian.org>
    fluidsynth (U)
    libdrumstick (U)

    Alf Gaida <agaida@siduction.org>
    libqtxdg (U)
    lxqt-config (U)
    lxqt-globalkeys (U)
    nomacs (U)
    screengrab (U)

    Andrea Capriotti <capriott@debian.org>
    userbindmount (U)
    vdeplug4 (U)

    Andreas Bombe <aeb@debian.org>
    soapyosmo (U)
    soapysdr (U)

    Andreas Cord-Landwehr <cola@uni-paderborn.de>
    kdevelop-python (U)

    Andreas Metzler <ametzler@debian.org>
    hugin (U)
    libpano13 (U)

    Andreas Rönnquist <gusnan@debian.org>
    allegro5 (U)

    Andreas Tille <tille@debian.org>
    bamtools (U)
    civetweb (U)
    libminc (U)
    openmm (U)
    prime-phylo (U)
    spoa (U)

    Andrew Lee (æŽå¥ç§‹) <ajqlee@debian.org>
    libqtxdg (U)
    lxqt-config (U)
    lxqt-globalkeys (U)
    nomacs (U)
    screengrab (U)

    Andrey Rahmatullin <wrar@debian.org>
    librsync

    Andrius Merkys <merkys@debian.org>
    libemf2svg (U)
    macromoleculebuilder (U)
    openmm (U)

    Antoine Beaupré <anarcat@debian.org>
    slop

    Anton Gladky <gladk@debian.org>
    libopenshot (U)
    liggghts (U)
    metis (U)
    tetgen (U)

    Antonio Ospite <ao2@ao2.it>
    libam7xxx

    Apollon Oikonomopoulos <apoikos@debian.org>
    leatherman (U)

    APT Development Team <deity@lists.debian.org>
    apt

    Arne Bernin <arne@alamut.de>
    libfreenect (U)

    Arne Morten Kvarving <arne.morten.kvarving@sintef.no>
    opm-simulators (U)

    Arnout Engelen <arnouten@bzzt.net>
    libdrumstick (U)

    Aron Xu <aron@debian.org>
    fcitx-qt5 (U)
    opencc (U)

    Asias He <asias@debian.org>
    opencc (U)

    Aurelien Jarno <aurel32@debian.org>
    libftdi
    libftdi1

    Aurélien COUDERC <coucouf@debian.org>
    analitza (U)
    ark (U)
    artikulate (U)
    audiocd-kio (U)
    baloo-kf5 (U)
    baloo-widgets (U)
    bluez-qt (U)
    breeze (U)
    cervisia (U)
    dolphin (U)
    gwenview (U)
    kaccounts-integration (U)
    kactivities-kf5 (U)
    kauth (U)
    kconfig (U)
    kdebugsettings (U)
    kdeclarative (U)
    kdeconnect (U)
    kdecoration (U)
    kdegraphics-mobipocket (U)
    kdeplasma-addons (U)
    kdesu (U)
    kdf (U)
    kemoticons (U)
    kfilemetadata-kf5 (U)
    kget (U)
    kglobalaccel (U)
    kholidays (U)
    khotkeys (U)
    khtml (U)
    kiconthemes (U)
    kidletime (U)
    kinfocenter (U)
    kinit (U)
    kio (U)
    kipi-plugins (U)
    kjs (U)
    kjsembed (U)
    kmix (U)
    kolourpaint (U)
    kompare (U)
    konsole (U)
    kpackage (U)
    kpeople (U)
    krdc (U)
    krfb (U)
    kservice (U)
    ksyntax-highlighting (U)
    ktexteditor (U)
    ktorrent (U)
    kwallet-kf5 (U)
    kwave (U)
    kwayland (U)
    kwin (U)
    kwindowsystem (U)
    layer-shell-qt (U)
    libkscreen (U)
    libksysguard (U)
    milou (U)
    okteta (U)
    okular (U)
    plasma-discover (U)
    plasma-firewall (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    plasma-workspace (U)
    powerdevil (U)
    print-manager (U)
    purpose (U)
    solid (U)
    systemsettings (U)

    Ayatana Packagers <pkg-ayatana-devel@lists.alioth.debian.org>
    qmenumodel

    Barak A. Pearlmutter <bap@debian.org>
    cppad (U)
    webcamoid

    Barry deFreese <bdefreese@debian.org>
    libclaw (U)
    plee-the-bear (U)

    Bas Couwenberg <sebastic@debian.org>
    libkml (U)
    pktools (U)
    spatialindex (U)

    Bastien Roucariès <rouca@debian.org>
    kbibtex (U)

    Ben Burton <bab@debian.org>
    regina-normal

    Bjoern Ricks <bjoern.ricks@intevation.de>
    grantlee5 (U)

    Boris Pek <tehnick@debian.org>
    eiskaltdcpp
    q4wine
    qtcurve (U)

    Boyuan Yang <byang@debian.org>
    fcitx5 (U)
    fcitx5-gtk (U)
    fcitx5-qt (U)
    ffmpegthumbnailer (U)
    go-for-it
    libavif (U)
    libime (U)
    opencc (U)
    taglib (U)
    tidy-html5 (U)

    Bret Curtis <psi29a@gmail.com>
    mygui
    openal-soft (U)
    recastnavigation (U)
    wildmidi

    Bruno "Fuddl" Kleinert <fuddl@tauware.de>
    openal-soft (U)

    Carlos Donizete Froes <coringao@riseup.net>
    surgescript (U)

    CESNET <rkrejci@cesnet.cz>
    libyang (U)

    ChangZhuo Chen (陳昌倬) <czchen@debian.org>
    libqtxdg (U)
    lxqt-config (U)
    lxqt-globalkeys (U)
    nomacs (U)
    screengrab (U)

    Christoph Berg <myon@debian.org>
    dsdcc (U)
    libarcus (U)
    libsavitar (U)

    Connor Imes <ckimes@ubuntu.com>
    powercap

    CrossWire Packaging Team <pkg-crosswire-devel@alioth-lists.debian.net>
    sword

    Daniel Glassey <wdg@debian.org>
    clucene-core (U)
    sword (U)

    Daniel Kahn Gillmor <dkg@fifthhorseman.net>
    rnp

    Daniel Schepler <schepler@debian.org>
    kpat (U)
    ksirk (U)
    libkdegames (U)
    palapeli (U)

    Daniele E. Domenichelli <ddomenichelli@drdanz.it>
    robot-testing-framework (U)

    David Bremner <bremner@debian.org>
    ledger

    David Henningsson <diwic@ubuntu.com>
    fluidsynth (U)

    David Kalnischkies <donkult@debian.org>
    apt (U)

    David Lamparter <equinox-debian@diac24.net>
    libyang

    Debian 3-D Printing Packages <3dprinter-general@lists.alioth.debian.org>
    libarcus
    libsavitar

    Debian Astro Team <debian-astro-maintainers@lists.alioth.debian.org>
    aoflagger

    Debian Astronomy Team <debian-astro-maintainers@lists.alioth.debian.org>
    openvlbi

    Debian Bridges Team <team+bridges@tracker.debian.org>
    libcorkipset

    Debian Chinese Team <chinese-developers@lists.alioth.debian.org>
    opencc (U)

    Debian Deep Learning Team <debian-ai@lists.debian.org>
    onnx

    Debian Fonts Task Force <pkg-fonts-devel@lists.alioth.debian.org>
    woff2

    Debian freedesktop.org maintainers <pkg-freedesktop-maintainers@lists.alioth.debian.org>
    poppler

    Debian Games Team <pkg-games-devel@lists.alioth.debian.org>
    allegro5
    alure
    bullet
    colobot
    darkradiant
    libclaw
    libsfml
    ogre-1.9
    openal-soft
    plee-the-bear
    recastnavigation
    surgescript

    Debian GIS Project <pkg-grass-devel@lists.alioth.debian.org>
    libcitygml
    libkml
    pktools
    spatialindex

    Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
    evolution-ews

    Debian Hamradio Maintainers <debian-hams@lists.debian.org>
    dsdcc
    gr-funcube
    gr-hpsdr
    soapyosmo
    soapysdr
    svxlink

    Debian Input Method Team <debian-input-method@lists.debian.org>
    fcitx-qt5
    fcitx5
    fcitx5-gtk
    fcitx5-qt
    libime
    opencc

    Debian KDE Extras Team <pkg-kde-extras@alioth-lists.debian.net>
    basket

    Debian KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>
    debconf-kde
    kphotoalbum
    qcoro
    qtcurve
    skrooge
    soundkonverter
    telepathy-qt

    Debian Krap Maintainers <debian-qt-kde@lists.debian.org>
    grantlee5
    indi

    Debian Math Team <team+math@tracker.debian.org>
    primecount
    stopt

    Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
    axe-demultiplexer
    bamtools
    cassiopee
    civetweb
    dcmtk
    gifticlib
    ismrmrd
    libgdf
    libminc
    libqes
    prime-phylo
    shasta
    spoa
    vtk-dicom

    Debian Mobcom Maintainers <Debian-mobcom-maintainers@lists.alioth.debian.org>
    freediameter
    osmo-fl2k

    Debian Multimedia Maintainers <debian-multimedia@lists.debian.org>
    chromaprint
    ffmpegthumbnailer
    fluidsynth
    inkscape
    kissfft
    libavif
    libcoverart
    libdrumstick
    libemf2svg
    libgav1
    libmysofa
    libopenshot
    libwebm
    nordlicht
    swami
    taglib
    x265

    Debian Multimedia Maintainers <pkg-multimedia-maintainers@lists.alioth.debian.org>
    glyr

    Debian PhotoTools Maintainers <pkg-phototools-devel@lists.alioth.debian.org>
    field3d
    highway
    hugin
    ilmbase
    imath
    jpeg-xl
    jxrlib
    libpano13
    openimageio

    Debian QA Group <packages@qa.debian.org>
    libdigidoc
    libgroove
    libjdns
    liblastfm
    obexftp
    tcmu

    Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
    akonadi
    akonadi-contacts
    akonadi-import-wizard
    akonadi-mime
    akonadi-search
    akregator
    analitza
    ark
    artikulate
    audiocd-kio
    baloo-kf5
    baloo-widgets
    bluez-qt
    breeze
    calligraplan
    cantor
    cervisia
    clazy
    dolphin
    gwenview
    k3b
    kaccounts-integration
    kactivities-kf5
    kauth
    kcalutils
    kconfig
    kdb
    kdebugsettings
    kdeclarative
    kdeconnect
    kdecoration
    kdegraphics-mobipocket
    kdepim-addons
    kdepim-runtime
    kdeplasma-addons
    kdesu
    kdevelop-python
    kdf
    kemoticons
    kf5-messagelib
    kfilemetadata-kf5
    kget
    kglobalaccel
    kholidays
    khotkeys
    khtml
    kiconthemes
    kidletime
    kinfocenter
    kinit
    kio
    kio-extras
    kipi-plugins
    kiten
    kitinerary
    kjs
    kjsembed
    kldap
    kleopatra
    kmailtransport
    kmix
    knotes
    kolourpaint
    kompare
    konsole
    kontact
    korganizer
    kpackage
    kpat
    kpeople
    krdc
    krfb
    krita
    kseexpr
    kservice
    ksirk
    ksyntax-highlighting
    ktexteditor
    ktorrent
    ktp-accounts-kcm
    ktp-text-ui
    kwallet-kf5
    kwave
    kwayland
    kwin
    kwindowsystem
    layer-shell-qt
    libkcddb
    libkdegames
    libkf5incidenceeditor
    libkf5ksieve
    libkf5mailimporter
    libkgapi
    libkscreen
    libksysguard
    md4c
    milou
    okular
    palapeli
    phonon
    pim-data-exporter
    pim-sieve-editor
    plasma-discover
    plasma-firewall
    plasma-nm
    plasma-thunderbolt
    plasma-workspace
    polkit-qt-1
    powerdevil
    print-manager
    purpose
    qca2
    qt6-3d
    qt6-charts
    qt6-datavis3d
    qt6-lottie
    qt6-quicktimeline
    qt6-scxml
    qt6-sensors
    qt6-serialbus
    qt6-shadertools
    qt6-svg
    qt6-webview
    qtwebkit-opensource-src
    rocs
    solid
    systemsettings

    Debian Robotics Team <team+robotics@tracker.debian.org>
    iceoryx

    Debian Science Maintainers <debian-science-maintainers@lists.alioth.debian.org>
    asl
    clfft
    fasttext
    glbinding
    graywolf
    hepmc3
    ignition-transport
    ignition-transport8
    kbibtex
    liggghts
    mathgl
    metis
    ncrystal
    oce
    opencascade
    opm-simulators
    plfit
    robot-testing-framework
    ros-collada-urdf
    ros-geometry
    ros-nodelet-core
    ros-robot-state-publisher
    ros-rosconsole
    ros-rospack
    segyio
    sentencepiece
    urdfdom
    xeus-python

    Debian Science Team <debian-science-maintainers@alioth-lists.debian.net>
    cppad

    Debian Science Team <debian-science-maintainers@lists.alioth.debian.org>
    meshlab
    nexus
    tetgen

    Debian SSSD Team <pkg-sssd-devel@lists.alioth.debian.org>
    pam-wrapper

    Debian UBports Team <team+ubports@tracker.debian.org>
    content-hub
    deviceinfo
    libqtdbustest (U)
    lomiri-app-launch
    lomiri-thumbnailer
    lomiri-url-dispatcher
    qmenumodel (U)

    Debian VirtualSquare Team <virtualsquare@cs.unibo.it>
    userbindmount
    vdeplug4

    Debian Wine Team <debian-wine@lists.debian.org>
    faudio

    Debian X Strike Force <debian-x@lists.debian.org>
    vulkan-validationlayers

    Debian Xilinx Package Maintainers <team+pkg-xilinx@tracker.debian.org>
    xrt

    Debian/Kubuntu KDE Extras Team <pkg-kde-extras@lists.alioth.debian.org>
    libqapt

    Debian/Kubuntu Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
    okteta

    Debichem Team <debichem-devel@lists.alioth.debian.org>
    macromoleculebuilder
    openmm

    Denis Barbier <barbier@debian.org>
    oce (U)

    Dennis Braun <d_braun@kabelmail.de>
    fluidsynth (U)
    libdrumstick (U)
    swami (U)

    Diane Trout <diane@debian.org>
    telepathy-qt (U)

    Diane Trout <diane@ghic.org>
    kaccounts-integration (U)
    kemoticons (U)
    ktp-accounts-kcm (U)
    ktp-text-ui (U)
    phonon (U)

    Dima Kogan <dkogan@debian.org>
    bullet (U)

    Dimitrios Eftaxiopoulos <eftaxi12@otenet.gr>
    mathgl (U)

    Dmitry Shachnev <mitya57@debian.org>
    qtwebkit-opensource-src (U)

    Dominique Belhachemi <domibel@debian.org>
    bamtools (U)

    Dominique Corbex <dominique@corbex.org>
    sword (U)

    Dr. Tobias Quathamer <toddy@debian.org>
    libopenshot (U)

    Emilio Pozuelo Monfort <pochu@debian.org>
    poppler (U)

    Emmet Hikory <emmet.hikory@gmail.com>
    wildmidi (U)

    Erik Sjolund <erik.sjolund@gmail.com>
    prime-phylo (U)

    Etienne Millon <me@emillon.org>
    glyr (U)

    Fabian Wolff <fabi.wolff@arcor.de>
    z3 (U)

    Fathi Boudra <fabo@debian.org>
    clucene-core

    Federico Ceratto <federico@debian.org>
    dublin-traceroute

    Felix Geyer <fgeyer@debian.org>
    qca2 (U)

    Felix Lechner <felix.lechner@lease-up.com>
    svxlink (U)

    Floris-Andrei Stoica-Marcu <floris.sm@gmail.com>
    libqapt (U)

    Francesco Paolo Lovergine <frankie@debian.org>
    libkml (U)
    pktools (U)
    spatialindex (U)

    Francis Murtagh <francis.murtagh@arm.com>
    armnn

    Francois Mazen <francois@mzf.fr>
    flightcrew

    Gard Spreemann <gspr@nonempty.org>
    clblast

    Gert Wollny <gewo@debian.org>
    dcmtk (U)
    vtk-dicom (U)

    Ghislain Antony Vaillant <ghisvail@gmail.com>
    clfft (U)
    field3d (U)
    glbinding (U)
    ismrmrd (U)

    Gianfranco Costamagna <locutusofborg@debian.org>
    lucene++ (U)

    Gijs Molenaar <gijs@pythonic.nl>
    aoflagger (U)

    Gonéri Le Bouder <goneri@rulezlan.org>
    libclaw (U)
    openal-soft (U)
    plee-the-bear (U)

    Gordon Ball <gordon@chronitis.net>
    xeus-python (U)

    Gregor Riepl <onitake@gmail.com>
    libarcus (U)
    libsavitar (U)

    Gürkan Myczko <gurkan@phys.ethz.ch>
    meshlab (U)

    Gürkan Myczko <tar@debian.org>
    cloudcompare

    Hannes Matuschek <dm3mat@darc.de>
    qdmr

    Harlan Lieberman-Berg <hlieberman@debian.org>
    nanomsg

    Henning Glawe <glaweh@debian.org>
    libktoblzcheck (U)

    HepMC developers <hepmc-dev@NOSPAM.cern.ch>
    hepmc3 (U)

    Hilko Bengen <bengen@debian.org>
    broker

    Iain Lane <laney@debian.org>
    evolution-ews (U)

    IOhannes m zmölnig (Debian/GNU) <umlaeute@debian.org>
    libmysofa (U)

    James Cowgill <jcowgill@debian.org>
    libsfml (U)
    uchardet

    Jaromír Mikeš <mira.mikes@seznam.cz>
    fluidsynth (U)
    swami (U)

    Jeremy Bicha <jbicha@debian.org>
    woff2 (U)

    Jeremy Bicha <jeremy.bicha@canonical.com>
    evolution-ews (U)

    Jerome Benoit <calculus@rezozer.net>
    plfit (U)
    primecount (U)

    Jerome Kieffer <jerome.kieffer@esrf.fr>
    clfft (U)

    Joao Eriberto Mota Filho <eriberto@debian.org>
    obs-advanced-scene-switcher

    Jochen Sprickerhof <jspricke@debian.org>
    ros-collada-urdf (U)
    ros-geometry (U)
    ros-nodelet-core (U)
    ros-robot-state-publisher (U)
    ros-rosconsole (U)
    ros-rospack (U)

    Johannes 'josch' Schauer <josch@debian.org>
    ros-robot-state-publisher (U)

    Johannes Schauer <josch@debian.org>
    ros-collada-urdf (U)

    John Stamp <jstamp@users.sourceforge.net>
    yajl

    Jonas Smedegaard <dr@jones.dk>
    editorconfig-core

    Jonathan Marsden <jmarsden@fastmail.fm>
    sword (U)

    Jose Luis Rivero <jrivero@osrfoundation.org>
    ignition-transport (U)
    ignition-transport8 (U)
    urdfdom (U)

    José Manuel Santamaría Lema <panfaust@gmail.com>
    libqapt (U)

    Julian Andres Klode <jak@debian.org>
    apt (U)

    Julien Jorge <julien.jorge@gamned.org>
    libclaw (U)
    plee-the-bear (U)

    Jørgen Kvalsvik <jokva@equinor.com>
    segyio (U)

    Kai Wasserbäch <curan@debian.org>
    libqapt (U)

    Kamal Mostafa <kamal@whence.com>
    hershey-fonts

    Kentaro Hayashi <kenhys@xdump.org>
    fasttext (U)
    sentencepiece (U)

    Kevin Albertson <kevin.albertson@mongodb.com>
    mongo-cxx-driver (U)

    Kevin Murray <kdmfoss@gmail.com>
    axe-demultiplexer (U)
    libqes (U)

    Kevin Murray <spam@kdmurray.id.au>
    bamtools (U)

    Koichi Akabe <vbkaisetsu@gmail.com>
    tercpp

    Kurt Kremitzki <kkremitzki@debian.org>
    opencascade (U)

    Laszlo Boszormenyi (GCS) <gcs@debian.org>
    nng
    upb

    Leandro Ramos <leandroramos@disroot.org>
    go-for-it (U)

    Lennart Weller <lhw@ring0.de>
    nvidia-texture-tools

    Leopold Palomo-Avellaneda <leo@alaxarxa.net>
    ros-collada-urdf (U)
    ros-geometry (U)
    ros-nodelet-core (U)
    ros-robot-state-publisher (U)
    ros-rosconsole (U)
    ros-rospack (U)

    Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org>
    akonadi-contacts (U)
    akonadi-mime (U)
    kpat (U)
    ksirk (U)
    md4c (U)
    palapeli (U)
    phonon (U)
    qtwebkit-opensource-src (U)

    LLVM Packaging Team <pkg-llvm-team@lists.alioth.debian.org>
    z3

    Loic Minier <lool@dooz.org>
    poppler (U)

    Lu YaNing <dluyaning@gmail.com>
    qt6-3d (U)
    qt6-charts (U)
    qt6-datavis3d (U)
    qt6-lottie (U)
    qt6-scxml (U)
    qt6-sensors (U)
    qt6-serialbus (U)
    qt6-svg (U)
    qt6-webview (U)

    Luca Boccassi <bluca@debian.org>
    stlink

    Luigi Toscano <luigi.toscano@tiscali.it>
    basket (U)

    Lukas Märdian <luk@slyon.de>
    zziplib (U)

    LXQt Packaging Team <pkg-lxqt-devel@lists.alioth.debian.org>
    libqtxdg
    lxqt-config
    lxqt-globalkeys
    nomacs
    screengrab

    Manuel A. Fernandez Montecelo <mafm@debian.org>
    aqsis
    ogre-1.9 (U)
    openscenegraph (U)

    Marcio de Souza Oliveira <marciosouza@debian.org>
    zulucrypt

    Mark Purcell <msp@debian.org>
    basket (U)
    skrooge (U)
    soundkonverter (U)

    Mark Renouf <mark.renouf@gmail.com>
    libfreenect (U)

    Markus Blatt <markus@dr-blatt.de>
    opm-simulators (U)

    Markus Koschany <apo@debian.org>
    bullet (U)

    Mathieu Malaterre <malat@debian.org>
    dcmtk (U)
    highway (U)
    ilmbase (U)
    jpeg-xl (U)
    jxrlib (U)

    Matt Palmer <mpalmer@debian.org>
    ledger (U)

    Matteo F. Vescovi <mfv@debian.org>
    ilmbase (U)
    imath (U)
    openimageio (U)

    Matthias Klumpp <mak@debian.org>
    apper
    debconf-kde (U)
    plasma-discover (U)

    Mattia Biondi <mattiabiondi1@gmail.com>
    userbindmount (U)
    vdeplug4 (U)

    Mattia Rizzolo <mattia@debian.org>
    flightcrew (U)
    inkscape (U)
    sigil

    Mattias Ellert <mattias.ellert@physics.uu.se>
    scitokens-cpp

    Maximiliano Curia <maxy@debian.org>
    debconf-kde (U)
    grantlee5 (U)
    indi (U)
    libqapt (U)
    phonon (U)
    polkit-qt-1 (U)
    qca2 (U)

    Micha Lenk <micha@debian.org>
    libktoblzcheck

    Michael Biebl <biebl@debian.org>
    evolution-ews (U)

    Michael Gilbert <mgilbert@debian.org>
    faudio (U)

    Michael Hanke <michael.hanke@gmail.com>
    gifticlib (U)
    libgdf (U)

    Michael Meskes <meskes@debian.org>
    akonadi-import-wizard (U)
    akregator (U)
    k3b (U)
    knotes (U)
    kontact (U)
    korganizer (U)
    pim-data-exporter (U)
    pim-sieve-editor (U)
    soundkonverter (U)

    Michael R. Crusoe <michael.crusoe@gmail.com>
    bamtools (U)

    Michael Vogt <mvo@debian.org>
    apt (U)

    Michał Zając <quintasan@kubuntu.org>
    ktp-accounts-kcm (U)
    ktp-text-ui (U)
    telepathy-qt (U)

    Mike Gabriel <sunweaver@debian.org>
    content-hub (U)
    deviceinfo (U)
    libqtdbustest (U)
    libsolv
    lomiri-app-launch (U)
    lomiri-thumbnailer (U)
    lomiri-url-dispatcher (U)
    qmenumodel (U)

    Miles Lubin <miles.lubin@gmail.com>
    cppad (U)

    Mo Zhou <cdluminate@gmail.com>
    hepmc3 (U)

    Mo Zhou <lumin@debian.org>
    jsonnet
    onnx (U)

    Modestas Vainius <modax@debian.org>
    phonon (U)
    polkit-qt-1 (U)

    Mongo C++ Driver Team <mongo-cxx-driver-debian@googlegroups.com>
    mongo-cxx-driver

    Nathan Osman <nathan@quickmediasolutions.com>
    qhttpengine

    Nick Black <dankamongmen@gmail.com>
    notcurses

    Nicolas Bourdaud <nicolas.bourdaud@gmail.com>
    libfreenect

    Nobuhiro Iwamatsu <iwamatsu@debian.org>
    xrt (U)

    Norbert Preining <norbert@preining.info>
    akonadi (U)
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-search (U)
    akregator (U)
    analitza (U)
    ark (U)
    artikulate (U)
    audiocd-kio (U)
    baloo-kf5 (U)
    baloo-widgets (U)
    bluez-qt (U)
    breeze (U)
    cantor (U)
    cervisia (U)
    dolphin (U)
    gwenview (U)
    k3b (U)
    kaccounts-integration (U)
    kactivities-kf5 (U)
    kauth (U)
    kcalutils (U)
    kconfig (U)
    kdebugsettings (U)
    kdeclarative (U)
    kdeconnect (U)
    kdecoration (U)
    kdegraphics-mobipocket (U)
    kdepim-addons (U)
    kdepim-runtime (U)
    kdeplasma-addons (U)
    kdesu (U)
    kdf (U)
    kemoticons (U)
    kf5-messagelib (U)
    kfilemetadata-kf5 (U)
    kget (U)
    kglobalaccel (U)
    kholidays (U)
    khotkeys (U)
    khtml (U)
    kiconthemes (U)
    kidletime (U)
    kinfocenter (U)
    kinit (U)
    kio (U)
    kio-extras (U)
    kipi-plugins (U)
    kiten (U)
    kitinerary (U)
    kjs (U)
    kjsembed (U)
    kldap (U)
    kleopatra (U)
    kmailtransport (U)
    kmix (U)
    knotes (U)
    kolourpaint (U)
    kompare (U)
    konsole (U)
    kontact (U)
    korganizer (U)
    kpackage (U)
    kpat (U)
    kpeople (U)
    kphotoalbum (U)
    krdc (U)
    krfb (U)
    krita (U)
    kservice (U)
    ksirk (U)
    ksyntax-highlighting (U)
    ktexteditor (U)
    ktp-accounts-kcm (U)
    ktp-text-ui (U)
    kwallet-kf5 (U)
    kwave (U)
    kwayland (U)
    kwin (U)
    kwindowsystem (U)
    layer-shell-qt (U)
    libkcddb (U)
    libkdegames (U)
    libkf5incidenceeditor (U)
    libkf5ksieve (U)
    libkf5mailimporter (U)
    libkgapi (U)
    libkscreen (U)
    libksysguard (U)
    milou (U)
    okular (U)
    palapeli (U)
    pim-data-exporter (U)
    pim-sieve-editor (U)
    plasma-discover (U)
    plasma-firewall (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    plasma-workspace (U)
    powerdevil (U)
    print-manager (U)
    purpose (U)
    rocs (U)
    solid (U)
    systemsettings (U)

    Ole Streicher <olebole@debian.org>
    aoflagger (U)

    Olivier Sallou <osallou@debian.org>
    cassiopee (U)

    Ondřej Surý <ondrej@debian.org>
    brotli (U)
    libyang (U)
    libyang2
    libzip (U)
    sysrepo
    tidy-html5 (U)

    Osamu Aoki <osamu@debian.org>
    opencc (U)

    Patrick Franz <deltaone@debian.org>
    akonadi (U)
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-search (U)
    akregator (U)
    breeze (U)
    kcalutils (U)
    kdecoration (U)
    kdepim-addons (U)
    kdepim-runtime (U)
    kdeplasma-addons (U)
    kf5-messagelib (U)
    khotkeys (U)
    kinfocenter (U)
    kitinerary (U)
    kldap (U)
    kleopatra (U)
    kmailtransport (U)
    knotes (U)
    kontact (U)
    korganizer (U)
    kwin (U)
    layer-shell-qt (U)
    libkf5incidenceeditor (U)
    libkf5ksieve (U)
    libkf5mailimporter (U)
    libkgapi (U)
    libkscreen (U)
    libksysguard (U)
    md4c (U)
    milou (U)
    pim-data-exporter (U)
    pim-sieve-editor (U)
    plasma-discover (U)
    plasma-firewall (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    plasma-workspace (U)
    powerdevil (U)
    qt6-3d (U)
    qt6-charts (U)
    qt6-datavis3d (U)
    qt6-lottie (U)
    qt6-quicktimeline (U)
    qt6-scxml (U)
    qt6-sensors (U)
    qt6-serialbus (U)
    qt6-shadertools (U)
    qt6-svg (U)
    qt6-webview (U)
    systemsettings (U)

    Patrick Matthäi <pmatthaei@debian.org>
    mlt

    Paulo Henrique de Lima Santana (phls) <phls@debian.org>
    kickpass

    Peter Pentchev <roam@debian.org>
    createrepo-c

    Peter Spiess-Knafl <dev@spiessknafl.at>
    libjson-rpc-cpp
    nordlicht (U)

    Pierre Gruet <pgt@debian.org>
    stopt (U)

    Pino Toscano <pino@debian.org>
    audiocd-kio (U)
    calligraplan (U)
    clazy (U)
    ebook-tools
    grantlee5 (U)
    indi (U)
    kbibtex (U)
    kdb (U)
    kdevelop-python (U)
    kipi-plugins (U)
    kiten (U)
    krita (U)
    kseexpr (U)
    libkcddb (U)
    plasma-firewall (U)
    plasma-thunderbolt (U)
    poppler (U)
    rocs (U)

    Punit Agrawal <punit@debian.org>
    xrt (U)

    Puppet Package Maintainers <pkg-puppet-devel@lists.alioth.debian.org>
    leatherman

    qinxialei <xialeiqin@gmail.com>
    libgav1 (U)

    Rafael Laboissière <rafael@debian.org>
    libgdf (U)
    mathgl (U)

    Reinhard Tartler <siretart@tauware.de>
    chromaprint (U)
    openal-soft (U)

    Renzo Davoli <renzo@cs.unibo.it>
    userbindmount (U)
    vdeplug4 (U)

    Robert Edmonds <edmonds@debian.org>
    avro-c

    Robert McGibbon <rmcgibbo@gmail.com>
    openmm (U)

    Roberto C. Sanchez <roberto@connexer.com>
    mongo-cxx-driver (U)

    Roger A. Light <roger@atchoo.org>
    mosquitto

    Roger Shimizu <rosh@debian.org>
    libcorkipset (U)

    Roland Mas <lolando@debian.org>
    mcpl
    ncrystal (U)

    Roman OndráÄek <roman@romanondracek.cz>
    paho.mqtt.c

    Ross Gammon <rosco2@ubuntu.com>
    libdrumstick (U)

    Ruben Undheim <ruben.undheim@gmail.com>
    freediameter (U)
    graywolf (U)

    Ruben Undheim <rubund@debian.org>
    mrtdreader

    Ryan Pavlik <ryan@ryanpavlik.com>
    meshlab (U)

    Sandro Knauß <hefee@debian.org>
    akonadi (U)
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akonadi-search (U)
    akregator (U)
    kcalutils (U)
    kdepim-addons (U)
    kdepim-runtime (U)
    kf5-messagelib (U)
    kitinerary (U)
    kldap (U)
    kleopatra (U)
    kmailtransport (U)
    knotes (U)
    kontact (U)
    korganizer (U)
    libkf5incidenceeditor (U)
    libkf5ksieve (U)
    libkf5mailimporter (U)
    libkgapi (U)
    pim-data-exporter (U)
    pim-sieve-editor (U)
    qcoro (U)

    Scarlett Clark <sgclark@kde.org>
    clazy (U)

    Scarlett Moore <sgmoore@kde.org>
    breeze (U)
    k3b (U)
    kdecoration (U)
    kdeplasma-addons (U)
    khotkeys (U)
    kinfocenter (U)
    kwin (U)
    libkscreen (U)
    libksysguard (U)
    milou (U)
    plasma-discover (U)
    plasma-firewall (U)
    plasma-nm (U)
    plasma-thunderbolt (U)
    plasma-workspace (U)
    powerdevil (U)
    print-manager (U)
    systemsettings (U)

    Scott Howard <showard@debian.org>
    mygui (U)
    zziplib

    Sebastian Dröge <slomo@debian.org>
    wildmidi (U)

    Sebastian Ramacher <sramacher@debian.org>
    chromaprint (U)
    libcoverart (U)
    x265 (U)

    Sebastien Jodogne <s.jodogne@gmail.com>
    civetweb (U)

    Sepi Gair <sepigair@email.cz>
    libxtrx
    libxtrxdsp
    libxtrxll

    Shayan Doust <hello@shayandoust.me>
    shasta (U)

    Simon Quigley <tsimonq2@debian.org>
    qtwebkit-opensource-src (U)

    Simon Wunderlich <sw@simonwunderlich.de>
    s3d

    Stefan Schörghofer <amd1212@4md.gr>
    libzip

    Stephen Gelman <ssgelm@debian.org>
    opentracing-cpp

    Stephen Kitt <skitt@debian.org>
    faudio (U)

    Steve M. Robbins <smr@debian.org>
    libminc (U)

    Stuart Prescott <stuart@debian.org>
    nexus (U)

    Sune Vuorela <debian@pusling.com>
    akonadi (U)
    basket (U)
    kdepim-runtime (U)

    Sune Vuorela <sune@debian.org>
    akonadi-contacts (U)
    akonadi-import-wizard (U)
    akonadi-mime (U)
    akregator (U)
    ark (U)
    audiocd-kio (U)
    cantor (U)
    cervisia (U)
    grantlee5 (U)
    gwenview (U)
    kdegraphics-mobipocket (U)
    kget (U)
    kiten (U)
    knotes (U)
    kolourpaint (U)
    kompare (U)
    konsole (U)
    kontact (U)
    korganizer (U)
    kpat (U)
    krdc (U)
    krfb (U)
    ksirk (U)
    libkcddb (U)
    libkdegames (U)
    libqapt (U)
    okteta (U)
    palapeli (U)
    pim-data-exporter (U)
    pim-sieve-editor (U)
    print-manager (U)

    Sven Eckelmann <sven@narfation.org>
    s3d (U)

    Sébastien Villemot <sebastien@debian.org>
    grandorgue

    Teemu Hukkanen <tjhukkan@iki.fi>
    hatari

    Teemu Ikonen <tpikonen@gmail.com>
    meshlab (U)

    Teus Benschop <teusjannette@gmail.com>
    sword (U)

    The Ayatana Packagers <pkg-ayatana-devel@lists.alioth.debian.org>
    libqtdbustest

    Thomas Dreibholz <dreibh@iem.uni-due.de>
    rsplib

    Thomas Pierson <contact@thomaspierson.fr>
    kdsoap
    kup-backup

    Thorsten Alteholz <debian@alteholz.de>
    openvlbi (U)
    osmo-fl2k (U)

    Tidy HTML5 <tidy-html5@packages.debian.org>
    tidy-html5

    Timo Aaltonen <tjaalton@debian.org>
    pam-wrapper (U)
    vulkan-validationlayers (U)

    Timo Jyrinki <timo@debian.org>
    qtwebkit-opensource-src (U)

    Timo Röhling <roehling@debian.org>
    iceoryx (U)
    ros-robot-state-publisher (U)

    Tobias Frost <tobi@debian.org>
    cppdb
    darkradiant (U)
    opencascade (U)

    Tobias Hansen <thansen@debian.org>
    allegro5 (U)

    Tobias Hansen <tobias.han@gmx.de>
    alure (U)

    Tomasz Buchert <tomasz@debian.org>
    brotli

    TSUCHIYA Masatoshi <tsuchiya@imc.tut.ac.jp>
    fasttext (U)

    TSUCHIYA Masatoshi <tsuchiya@namazu.org>
    sentencepiece (U)

    Vasudev Kamath <kamathvasudev@gmail.com>
    editorconfig-core (U)

    Vasyl Gello <vasek.gello@gmail.com>
    kissfft (U)
    libwebm (U)

    William Blough <bblough@debian.org>
    soci

    Wookey <wookey@debian.org>
    armnn (U)

    Xavier Warin <xavier.warin@gmail.com>
    stopt (U)

    xiao sheng wen <atzlinux@sina.com>
    opencc (U)

    Yaroslav Halchenko <debian@onerussian.com>
    gifticlib (U)
    libfreenect (U)
    libgdf (U)

    Yukiharu YABUKI <yyabuki@debian.org>
    lxqt-config (U)

    YunQiang Su <syq@debian.org>
    fcitx-qt5 (U)
    opencc (U)

    YunQiang Su <wzssyqa@gmail.com>
    libcitygml (U)


    [continued in next message]

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)