Hello again debian-hams,

I'm seeking review and feedback with package unixcw v3.6.1-1.

This unixcw update from 3.6.0 to 3.6.1 includes timing fixes, implemented in a new version of libcw8.


I've merged upstream changes into the salsa git repo, and get clean builds in my dev environment (using sbuild or gbp+sbuild, and also with regular dpkg-buildpackage).

However, the salsa unixcw pipeline passes all but one part; it reports a failure with the `blhc' subtask ("build log hardening check", which is new to me).
I welcome feedback or tips on what I may review to correct things, and
progress next steps to upload this package. I'm on #debian-hams if "realtime chat" (UTC-5) may be of value.


https://salsa.debian.org/debian-hamradio-team/unixcw/-/pipelines/621283


https://tracker.debian.org/pkg/unixcw


https://manpages.debian.org/testing/blhc/blhc.1.en.html

regards,
donfede

Fede Grau



-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEmr4kxVySlu8VKlyYL/shsp/kV2QFAmWYjawACgkQL/shsp/k V2S1jQ/+KwqjsE35GeuYFXgaoZF2FAAupmN1K52zPs88Cjx6aOJ3XP4q3wisEsQf IvV6RLv3VZM0Hzb8dqz8TW7RB78ciyKJJeC1g9I7yHnJ4SaOz7k/Yd5yYo0gPUpE No09KeCrWJKlLn986VSsG6Qd5TMxZBWn15FM/XgDsCdtxqAx6A+fImYUkRvHU3b6 x70eq1Ur5/OHpKXlEqR+aYen0vLLECskRPjQMsKvTtg52oqa+uo7JvlEfhxZKkQZ lsc4zOpYB5OHSEXTGY9cDOTR2SWKYV/Qrarn9/PFz2eHNiw5nNFjRxlt7uVlNDFX 0mRVZLcHuSXsMYHEUs6l3MWMX4FQ04gplI+GVhviK7EqquyudoWtJNtckQWhXejQ +pSOeMRV/lBkW+hvQohjQJIaA0WqsCOUPs7W9qLOUXzbFKt0/WVE0cU8mTcX44b7 WxY0JfYse3uuvaZ1kuiuC913JBwkQpil7kNCYd4BoIxfDUHq/2O+BjkfV+2MKz3J WeRwFY+p0sFmvP/7paUJTiW8cbDmscsuS1/hG7mkWPi7QTUR4HLrDMj4u/B88hAx 2Jd0G+X6GPNyC9nmA18hF34hk/pQNgvhuBXjbvm605+R3pXdJjjZvrK7KssAUHD8 8bxnqo48V+KiiLHVEOXjVP0DEVDat/u6QyO4I9feiDeNAgz5hUk=
=HJ3Y
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sat, Jan 06, 2024 at 03:02:21PM +0100, Daniele Forsi wrote:

Hello Federico,

you wrote

the salsa unixcw pipeline passes all but one part; it reports a
failure with the `blhc' subtask ("build log hardening check", which is new to
me).

the issue with bhlc was that configure.ac hardcodes
-D_FORTIFY_SOURCE=1 (both in CFLAGS and in CXXFLAGS) and this
overrides the -D_FORTIFY_SOURCE=2 set by debian/rules with the line:
export DEB_BUILD_MAINT_OPTIONS = hardening=+all

It was hinted by warnings like this in the build log, not in the bhls log: <command-line>: warning: "_FORTIFY_SOURCE" redefined

Please consider merging this branch that I just pushed and that makes
the bhlc test to succeed by removing the the definition of
_FORTIFY_SOURCE in configure.ac: https://salsa.debian.org/debian-hamradio-team/unixcw/-/tree/fix/blhc-test?ref_type=heads

I don't know if this has unwanted side effects, but I briefly ran cw,
cwcp and xvcp without issues.

Hi Fede, hi Daniele,

The patch looks good to me, and the packaging of the update looks good
with one caveat. Because this upload includes an SONAME bump, it's
technically a transition [1] and needs to be uploaded to experimental
and we will need to request a transition slot on the package has
cleared NEW so that cwdaemon transitions correctly.

I looked into the dropped "Provides: libcw6-dev" and #996628 [2], and
agree with that change, although you might note it in the changelog.
I'm not claiming that it's strictly necessary, but perhaps it could help someone working on a Debian derivative or a backport.

Also, and this is very minor, but you can go ahead and set the d/copyright years for your Debian contributions to 2024.

Fede, let me know if you'd like to merge the patch and fix up the
changelog for experimental, or if you would prefer that I do it. Once I
hear back from you, I will sponsor the upload.

Thank you both for the update.

Cheers,
tony

[1] https://wiki.debian.org/Teams/ReleaseTeam/Transitions
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996628

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmWa+MoACgkQIdIFiZdL PpbpAQ//SRoWs3LEnNCa8qtl1H4gdEG36JZJymDUI0suf3WuDG6XsR3MI1NRTRaM ovWgaN5L1zzCpw29aaPHyuW0ye6L8GMc2Gy8RN7q554G4y3sEP3c6p2DQgKZss9L 2chVQW97QABz+yjok/k1+Ysa8NKkgKRwOxjls2qMO0ZjKRZpd6cluR7SDqnemakG 74DbJ/UbHFW+PZXFcF2T+ZSPs1rJ2/cWL8bBlYyXFgyDuCb4PgXF4g5UrtTa2yj+ CvmkJm26XliUX0iDftLHE3kf0fguYIaypAtwLqdo47Q41WsQ7wwqenU11rKev+MM lHuvB0l+WG/82deW33JJ7CNJizt7u0PC3puO0jKdQ9bg60AuFzV3jsq0Uf1vN21F mY2YLjrEviqBobFBBtFo0ZXMfCrbvyLSaMlY/hUDZ9djqyDaBXmb3buCbJAVp2zA Yp+GYlmn++R/msRhixSgaQ6fDtx0PRhL453M2oDNMzT/4lCDTLYiEyHJt9jcgGnW JQD+08A9aZbSIStWAIt1TA7IayCrlRFFFIubDaR0Jw9TgArs9yYHfgnfcf0z7+XM Hipuytkk6UHMgtESNrFPOH/WIoafq+nmHV4kUrA5p1A5Faw5jDxFgh+2D5BObPTT 8ENE3Z5zYCylsrv3lfdg3k4CDCqfCgYF2HwZfRramnI2iBY/uys=
=rSUf
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Sun, Jan 07, 2024 at 11:17:30AM -0800, tony mancill wrote:

On Sat, Jan 06, 2024 at 03:02:21PM +0100, Daniele Forsi wrote:

Hello Federico,

you wrote

the salsa unixcw pipeline passes all but one part; it reports a
failure with the `blhc' subtask ("build log hardening check", which is new to
me).

the issue with bhlc was that configure.ac hardcodes
-D_FORTIFY_SOURCE=1 (both in CFLAGS and in CXXFLAGS) and this
overrides the -D_FORTIFY_SOURCE=2 set by debian/rules with the line:
export DEB_BUILD_MAINT_OPTIONS = hardening=+all

It was hinted by warnings like this in the build log, not in the bhls log: <command-line>: warning: "_FORTIFY_SOURCE" redefined

Please consider merging this branch that I just pushed and that makes
the bhlc test to succeed by removing the the definition of
_FORTIFY_SOURCE in configure.ac: https://salsa.debian.org/debian-hamradio-team/unixcw/-/tree/fix/blhc-test?ref_type=heads

I don't know if this has unwanted side effects, but I briefly ran cw,
cwcp and xvcp without issues.

Hi Fede, hi Daniele,

The patch looks good to me, and the packaging of the update looks good
with one caveat. Because this upload includes an SONAME bump, it's technically a transition [1] and needs to be uploaded to experimental
and we will need to request a transition slot on the package has
cleared NEW so that cwdaemon transitions correctly.

I looked into the dropped "Provides: libcw6-dev" and #996628 [2], and
agree with that change, although you might note it in the changelog.
I'm not claiming that it's strictly necessary, but perhaps it could help someone working on a Debian derivative or a backport.

Also, and this is very minor, but you can go ahead and set the d/copyright years for your Debian contributions to 2024.

Fede, let me know if you'd like to merge the patch and fix up the
changelog for experimental, or if you would prefer that I do it. Once I
hear back from you, I will sponsor the upload.

Thank you both for the update.

Cheers,
tony

[1] https://wiki.debian.org/Teams/ReleaseTeam/Transitions
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=996628

Many thanks for the feedback and fixes all. Green light from my side to merge the branch and progress suggested improvements.


I had seen the "_FORTIFY_SOURCE" alerts in the build logs, but wasn't clear on the cause or fix. Adding this to my notes, thanks Daniele.


ACK tony per the transition request. I've queued up reading the cited
wiki.d.o page, but it may be more efficient for another to progress this instance.

Per the dropped "Provides: libcw6-dev", I was thinking this 3.6.1-1 ("trixie") package would support an upgrade from 3.6.0-5 ("bookworm"), which provides libcw-dev. Not clear how this may be worded in the changelog, but certainly support more information.

Thanks again everyone for all the feedback and support with this package.

73,
donfede



-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEmr4kxVySlu8VKlyYL/shsp/kV2QFAmWbCrwACgkQL/shsp/k V2Tk5xAApZE7W37tapY2ZVZX4yfhOA4xBQFj8NpAJUekCsV4Ta0H71/C0QTRrDQR 6PFb3HxKgVnksBiY39FMwmV0qXy6mtYrJRDCPxEbl8EuEDyNbl/V4xBbd24gi2vN dr/aX7tJv1nQVZydOnE4ibrXBizHV6mjkGH8XAm2gvQ28CurGt0oc932ock56/lj q/2gmCGw8AfNYu4tRVeBsCUE+ugJEK2Rp2PvDtzR5q7txrqE8jhJ+mtbID78yuUk 39SkJ+z+Gk3vVFI00rWf528fXmRyGMybbg6LbF+hwDXcU5kotwkDxwRIzyjvQhWF Xpnh1MesrgsCdbkqaV7X8ODKK7dXNIXD1RVdYKlyn9FvP6AEZVT9iJrHlEzAOjgv ZsT1j7+nzNh5pLNMpzpeNhk4/iLYRhZU+GVIBupNXJP0NrO7VuwEyg96ykkwe5J2 j2tfkWp9P+nWzv5roGXMQZk8zBhY8hhdcfl5d54Tei/P1YQiNH5BxJoAwUMtoSAl iKzHRov97T+AqqHo6H84dwv8QlHr69UcGM5DyUlteSNZOLEjZuWHG3yNqGtus/Np ZRzosBkqjhKyzwJjqJddtUswexPhvTFVE4HFkQNLPqRP4juxy34K42EOPC9mBqVW p367OScsu2k7ZmbC6uTALjahA52uTIPugSblR54OdIUES3U01ug=
=Jpiu
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Re: Federico Grau

Per the dropped "Provides: libcw6-dev", I was thinking this 3.6.1-1 ("trixie")
package would support an upgrade from 3.6.0-5 ("bookworm"), which provides libcw-dev. Not clear how this may be worded in the changelog, but certainly support more information.

If we want to clean up the unixcw packaging, we should move the /usr/share/man/man7/cw.7.gz manpage from libcwX to some other
package. This would remove the need for newer libcwX packages to
conflict with older sonames.

Christoph

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

On Mon, Jan 08, 2024 at 11:15:14AM +0100, Christoph Berg wrote:

Re: Federico Grau

Per the dropped "Provides: libcw6-dev", I was thinking this 3.6.1-1 ("trixie")
package would support an upgrade from 3.6.0-5 ("bookworm"), which provides libcw-dev. Not clear how this may be worded in the changelog, but certainly
support more information.

If we want to clean up the unixcw packaging, we should move the /usr/share/man/man7/cw.7.gz manpage from libcwX to some other
package. This would remove the need for newer libcwX packages to
conflict with older sonames.

Oh, that's a good suggestion. I propose to move it into the "cw" binary package, but will hold off on the upload for a few days in case there
are other suggestions.

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE5Qr9Va3SequXFjqLIdIFiZdLPpYFAmWiGAMACgkQIdIFiZdL PpY1RhAA0nDBFLofpmi6o/tLp6lHwxhHI2sMgDHmepRCYHLTgkx+aA/R0TJbOIkm k0kISR0/ncVxzF3WRE/R2F6T451+atwY6yRE4Xk+/4RDx1XOUTaNdIFY1lvLb4Qz 5Xby5WMaTzkuRzG0bsgZf7W0T+U7Hc/M3yRQitmEu9otmbRXEYgaCP+++LIkmiDE p7bLsLpxW6joPY9CU6tb2ZnGJC1J2wPgc2a8fKmsFEABlUP82QwW4NnFOe+6XN0a t8GGdFxy2lBJKpnA6kH1Qi0u9FYCbZpSSmCMEWYJd3x44OFvQ4jopTazuuAkVpaN 445RX7ejYLNu7ViGS6/LFZi/hENqMWwnQPxNMXyD6E0oAav6pRzCSlEjvYRLq0tE Eudlv55Rb9jd0wjkc0/2mrLwEiA+G6cCRXP4Gq+tl4oHEtSAKzNiEjCqfvBeiwtB d6g6QLsfdNHvTGQp927TSDJy04ZpqgXUksxMMfAbW2ACBX+voZyLLFNnsH65w/T6 OHpc16x1OAJ1/TRcUFjqv3PpufhXVJlZojKZ2nDVF+Fujf6Ah28iGmMeLfI5si/G 0jhuMg0H60P9svzqRC1Hh2Xx8/n616TzNnDAR+5g5iQqN7dIZC2EhzILokiIK4ZZ d6poFvpe3p5Z+TTYwXrsBOewU4emDUICE0cbn0J7+jbK5onE0y8=
=UX3G
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

Re: tony mancill

If we want to clean up the unixcw packaging, we should move the /usr/share/man/man7/cw.7.gz manpage from libcwX to some other
package. This would remove the need for newer libcwX packages to
conflict with older sonames.

Oh, that's a good suggestion. I propose to move it into the "cw" binary package, but will hold off on the upload for a few days in case there
are other suggestions.

Sounds good to me.

Christoph

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)