Sign me up Login

Details about package iputils

Name: iputils (PTS)
Uploader: Petr Vorel <petr.vorel@gmail.com> (Debian QA page)
Description: iputils-ping - Tools to test the reachability of network hosts
iputils-tracepath - Tools to trace the network path to a remote host
iputils-arping - Tool to send ICMP echo requests to an ARP address
iputils-clockdiff - Measure the time difference between networked computers

Package uploads

Upload #1

Information

Version: 3:20250605-1
Uploaded: 2025-07-20 16:57
Source package: iputils_20250605-1.dsc
Distribution: unstable
Section: net
Priority: optional
Homepage: https://github.com/iputils/iputils/
Vcs-Git: https://salsa.debian.org/debian/iputils.git
Vcs-Browser: https://salsa.debian.org/debian/iputils

Changelog

 iputils (3:20250605-1) unstable; urgency=medium
 .
   * NMU
   * New upstream version 20250605
     https://github.com/iputils/iputils/releases/tag/20250605
   * Fixes regression in ping.
   * New upstream version 20250602
     https://github.com/iputils/iputils/releases/tag/20250602
   * Fixes CVE-2025-47268 and CVE-2025-48964
   * debian/rules: Remove unwanted html doc
   * debian/missing-sources: Add missing html (not shipped)

QA information

Comments

  1. Hi Petr,

Debian QA indicates lintian errors, please use sbuild in a minimal chroot and fix them so that an interested sponsor can look into your package.

Regards,
Aryan Karamtoth
Debian Contributor
IRC: SpaciousCoder78
    Needs work Aryan Karamtoth at July 21, 2025, 2:44 a.m. 
  2. Hi Petr,

Since you mention CVEs, I assume you are trying to target trixie with important security fixes?

If that's the case I think you need to create a suitably high severity bug in the BTS (1) to block the release if appropriate, (2) to make sure the package maintainer has a chance to get involved (quickly!) if they can (he may not have seen your MRs) and (3) to refer to from the unblock request for further information.

I'd also suggest filing a pre-approval unblock request as soon as you have the bug, a candidate debdiff and a good justification for taking the new upstream instead of attempting to cherry-pick the targeted fixes. The sooner the better, especially if some collaboration is needed.

Other suggestions:
1) NMU version would be "3:20250605-0.1".
2) Drop the unrelated debian/* changes unless they are intrinsic to taking the new upstream if this is for trixie. Due to the freeze, it's the wrong time to attend to lintian issues!
3) Coalesce the two upstream versions in the changelog - you only mention the one you are bringing in (I think). I would mention key features of both under the consolidated entry but drop the mention of regression fixes if they just reverse regressions from the other version that is consolidated. So I think that just leaves the CVE references.

Hope this helps and good luck - we don't want to lose "ping"!

Andrew
    Needs work Andrew Bower at July 21, 2025, 10:47 p.m.