{
  "$type": "site.standard.document",
  "bskyPostRef": {
    "cid": "bafyreiekbwy6uof7x4hax4egoc7walhfl74h35s5zraj3pcktoysf2qhyi",
    "uri": "at://did:plc:46ti67tc37qcmwp2vaynk6fq/app.bsky.feed.post/3mgmwpreihkh2"
  },
  "path": "/~cjwatson/blog/activity-2026-02.html",
  "publishedAt": "2026-03-09T13:13:33.046Z",
  "site": "https://www.chiark.greenend.org.uk",
  "tags": [
    "sponsored",
    "Liberapay",
    "GitHub Sponsors",
    "openssh: Please remove/replace usage of dh_movetousr",
    "CVE-2025-61984",
    "CVE-2025-61985",
    "openssh-server: refuses further connections after having handled PerSourceMaxStartups connections",
    "reported",
    "adding support for Dulwich >= 0.25",
    "CVE-2025-66471",
    "chunked decoding bug",
    "deprecated",
    "genshi",
    "contributed upstream",
    "germinate",
    "mopidy",
    "nose2",
    "pokrok",
    "pylama",
    "python-flask-seeder",
    "python-maggma",
    "python-pybadges",
    "python-scruffy",
    "thumbor",
    "zope.deprecation",
    "flask-dance: FTBFS: No module named ‘pkg_resources’",
    "paramiko: autopkgtest regression on i386",
    "poetry: autopkgtest regression on i386",
    "python-argh",
    "python-django-celery-beat: FTBFS: FAILED t/unit/test_models.py::HumanReadableTestCase::test_long_name",
    "python-maturin: rust-itertools update",
    "python-msrest: FTBFS: FAILED tests/asynctests/test_async_client.py::TestServiceClient::test_client_send",
    "python-typing-inspect",
    "python-datamodel-code-generator: Depends: python3-isort (< 8) but 8.0.0-1 is to be installed",
    "python-typeguard: Mark python3-typeguard Multi-Arch: foreign",
    "wheel: Mark python3-wheel Multi-Arch: foreign",
    "zope.deferredimport: Please make the build reproducible",
    "follow-up fix",
    "manual page symlink",
    "librust-pyo3-ffi-dev: Cannot be installed for foreign architectures",
    "arch-test: Remove build dependency on binutils-mips64el-linux-gnuabi64",
    "debconf: Add BMP version of debian-logo",
    "openssh: Reorder pam_selinux(7) usage",
    "openssh-client: use sysusers.d, drop superflous dependencies",
    "openssh: Stop deleting system user on remove/purge",
    "openssh: Do not link against libcrypt on GNU/Hurd",
    "partman-prep: Align PReP descriptions with other partition types",
    "python-better-exceptions"
  ],
  "textContent": "My Debian contributions this month were all sponsored by Freexian.\n\nYou can also support my work directly via Liberapay or GitHub Sponsors.\n\n## OpenSSH\n\n  * openssh: Please remove/replace usage of dh_movetousr\n\n\n\nI released bookworm and trixie fixes for CVE-2025-61984 and CVE-2025-61985, both allowing code execution via `ProxyCommand` in some cases. The trixie update also included a fix for openssh-server: refuses further connections after having handled PerSourceMaxStartups connections.\n\n## bugs.debian.org administration\n\nGioele Barabucci reported that some messages to the bug tracking system generated by the `bts` command were being discarded. While the regression here was on the client side, I found and fixed a typo in our SpamAssassin configuration that was failing to apply a bonus specifically to `forwarded` commands, mitigating the problem.\n\n## Python packaging\n\nNew upstream versions:\n\n  * aiosmtplib\n  * bitstruct\n  * diff-cover\n  * django-q\n  * isort\n  * multipart\n  * poetry (adding support for Dulwich >= 0.25)\n  * poetry-core\n  * pydantic-settings\n  * python-build\n  * python-certifi\n  * python-datamodel-code-generator\n  * python-flatdict\n  * python-holidays\n  * python-maggma\n  * python-pytokens\n  * python-scruffy\n  * python-urllib3 (fixing CVE-2025-66471 and a chunked decoding bug)\n  * responses\n  * yarsync\n  * zope.component\n  * zope.deferredimport\n\n\n\nPorting away from the deprecated (and now removed from upstream setuptools) `pkg_resources`:\n\n  * genshi (contributed upstream)\n  * germinate\n  * mopidy\n  * nose2\n  * pokrok (contributed upstream)\n  * pylama\n  * python-flask-seeder\n  * python-maggma (contributed upstream)\n  * python-pybadges\n  * python-scruffy (contributed upstream)\n  * thumbor (contributed upstream)\n  * zope.deprecation (contributed upstream a while ago, but there hasn’t been an upstream release yet)\n\n\n\nOther build/test failures:\n\n  * flask-dance: FTBFS: No module named ‘pkg_resources’ (actually fixed by adding a missing dependency to python3-sphinxcontrib.seqdiag)\n  * paramiko: autopkgtest regression on i386 (contributed upstream)\n  * poetry: autopkgtest regression on i386\n  * python-argh\n  * python-django-celery-beat: FTBFS: FAILED t/unit/test_models.py::HumanReadableTestCase::test_long_name\n  * python-maturin: rust-itertools update\n  * python-msrest: FTBFS: FAILED tests/asynctests/test_async_client.py::TestServiceClient::test_client_send (contributed upstream, though not very successfully)\n  * python-typing-inspect\n\n\n\nOther bugs:\n\n  * python-datamodel-code-generator: Depends: python3-isort (< 8) but 8.0.0-1 is to be installed (contributed upstream)\n  * python-typeguard: Mark python3-typeguard Multi-Arch: foreign\n  * wheel: Mark python3-wheel Multi-Arch: foreign\n  * zope.deferredimport: Please make the build reproducible (contributed upstream, with a follow-up fix)\n\n\n\nI added a manual page symlink to make the documentation for `Testsuite: autopkgtest-pkg-pybuild` easier to find.\n\nI backported python-pytest-unmagic and a more recent version of pytest-django to trixie.\n\n## Rust packaging\n\n  * librust-pyo3-ffi-dev: Cannot be installed for foreign architectures\n\n\n\nI also packaged rust-garde and rust-garde-derive, which are part of the pile of work needed to get the ruff packaging back in shape (which is a project I haven’t decided if I’m going to take on for real, but I thought I’d at least chip away at a bit of it).\n\n## Other bits and pieces\n\n  * arch-test: Remove build dependency on binutils-mips64el-linux-gnuabi64 (NMU)\n\n\n\n## Code reviews\n\n  * debconf: Add BMP version of debian-logo (merged and uploaded)\n  * openssh: Reorder pam_selinux(7) usage (merged and uploaded)\n  * openssh-client: use sysusers.d, drop superflous dependencies (merged and uploaded)\n  * openssh: Stop deleting system user on remove/purge (merged and uploaded)\n  * openssh: Do not link against libcrypt on GNU/Hurd (merged and uploaded)\n  * partman-prep: Align PReP descriptions with other partition types (merged)\n  * python-better-exceptions (sponsored upload for Seyed Mohamad Amin Modaresi)\n\n",
  "title": "Colin Watson: Free software activity in February 2026",
  "updatedAt": "2026-03-09T12:22:42.000Z"
}