Dear Maintainer, The version of package "pv" is out of date. The watch file has a wrong website to search, should be .../programs/sources/pv... The search for the VCS repository has a wrong website.
You are correct in stating that (a) the package is out of date and (b) the watch file fails to find the new release... ... but that's not the reason. The reason is the website uses an antique diffie-hellman key: anarcat@angela:pkg-pv$ uscan uscan warn: In watchfile debian/watch, reading webpage https://www.ivarch.com/programs/pv.shtml failed: 500 Can't connect to www.ivarch.com:443 (SSL connect attempt failed error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small) Paradoxically, disabling security on that one (ie. using HTTP) fixes the problem. I'll warn upstream and carry on with updating to the latest for now. Thanks for the heads up!
Hi Andrew, Here is some news from the Debian package! :) I know you sometimes follow the updates in the bugtracker so I am sorry if this is a duplicate for you, but I wanted to let you know that our "new upstream release" scanner has failed to find the latest and greatest pv recently. That was filed as bug 1009330 in Debian (a copy of which follows). I tracked down the problem to an HTTPS configuration. Both curl and Perl's LWP fail to download the homepage to parse for new releases: $ curl -I https://www.ivarch.com/programs/pv.shtml curl: (35) error:141A318A:SSL routines:tls_process_ske_dhe:dh key too small LWP is used by uscan, the software which powers this scanner, and makes this impossible to use. I strongly recommend updating the diffie-hellman key in your web browser configuration. Failing that, I have managed to download the package over cleartext (plain HTTP!) but I would rather avoid that if possible (although the OpenPGP signature checks out, so the risk is small there). Another option I considered would be to parse the GitHub releases instead, but since the tar.gz you provide is different from the one generated from the git-archive command, this is quite error-prone... Thank you for maintaining pv! :) a.
clone 1009330 -1 -2 retitle -1 HTTPS error in watch file severity -1 normal making a new bug for the outdated release, which i'll close soon with an upload (whoohoo!)
close 1009330 thanks Upstream has since then fixed this issue by turning off DH/EDH key exchange (rather unfortunately), but at least it will be HTTPS instead of HTTP. Better than nothing I guess. Hopefully upstream (in CC) will be able to update that server to re-enable ephemeral key exchange (and perfect-forward secrecy), but I don't think that's something that should be tracked in the Debian BTS. a. PS: Andrew, if you want to validate your HTTPS configuration, you can try: https://www.ssllabs.com/ssltest/analyze.html?d=www.ivarch.com&latest You have a "B" rating there. The most significant issues are: * RC4, TLS 1.0 and 1.1 still offered * no forward-secrecy Mozilla also has a test site here: https://observatory.mozilla.org/analyze/www.ivarch.com ... where the site has an "F" score. It includes more stuff than just TLS though, so you may not want to go down that path. They have a configuration file generator you can use though: https://ssl-config.mozilla.org/ A similar, command-line project is testssl.sh: https://testssl.sh/ I attach the output of the latter here.