#1106807 tini: statically linked against glibc without a Built-Using: field

Package:
tini
Source:
tini
Description:
tiny but valid init for containers
Submitter:
Aurelien Jarno
Date:
2025-05-30 19:53:02 UTC
Severity:
normal
Tags:
#1106807#5
Date:
2025-05-29 20:53:33 UTC
From:
To:
Dear maintainer,

The tini package provides /usr/bin/tini-static, which is statically
linked against glibc.

The glibc is mostly is mostly licensed under the LGPL, which requires
that the full source code of the incorporating binary package be made
available.  According to Debian Policy §7.8 [1] such a binary package
MUST list the glibc source package (and possibly others) in the
Built-Using: field.

Regards
Aurelien

[1] https://www.debian.org/doc/debian-policy/ch-relationships.html#additional-source-packages-used-to-build-the-binary-built-using

#1106807#10
Date:
2025-05-30 10:05:04 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
tini, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1106807@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
ChangZhuo Chen (陳昌倬) <czchen@debian.org> (supplier of updated tini package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 30 May 2025 17:41:39 +0800
Source: tini
Architecture: source
Version: 0.19.0-2
Distribution: unstable
Urgency: medium
Maintainer: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Changed-By: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Closes: 1106807
Changes:
 tini (0.19.0-2) unstable; urgency=medium
 .
   [ Janitor ]
   * Fix some issues reported by lintian
 .
   [ ChangZhuo Chen (陳昌倬) ]
   * Add Built-Using: glibc (Closes: #1106807)
   * d/copyright: Update copyright.
Checksums-Sha1:
 661de40ac471cc15e7491803a9053ee75ca665b9 1810 tini_0.19.0-2.dsc
 7c44f87c302b0fc1e7714b6f4a2a3c9ab65198cb 2060 tini_0.19.0-2.debian.tar.xz
 0ab37f66f22657f143e055ef5fa49ae19439636f 6699 tini_0.19.0-2_amd64.buildinfo
Checksums-Sha256:
 0ef257d1de3e53efd68bf0e6457dae06bd1750ae7ae69e45aacebf9efe86def2 1810 tini_0.19.0-2.dsc
 3b853af6ae19ee8287fcbd2e0aa0a9a5aa7a7c292b3d3898b1660e587f539264 2060 tini_0.19.0-2.debian.tar.xz
 d83f6c30e3021fbf5f81357f1e992a9ee4d4e90761f26819614e12594535b18f 6699 tini_0.19.0-2_amd64.buildinfo
Files:
 cb344a69a43381326d860717f83f1080 1810 utils optional tini_0.19.0-2.dsc
 7e652461a6c48f941541e239b0af333c 2060 utils optional tini_0.19.0-2.debian.tar.xz
 bb54b25b1dda586b2dd9f528ec1a0ce5 6699 utils optional tini_0.19.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEEugQ0bcLh/mPHkIeTzGWwzewnXVsFAmg5ff8ACgkQzGWwzewn
XVuINA/0C/QP8W2u3UXyzhU7Uu5jd90T0inOvitbtwpHheDaGiWgBOJwP73KrAut
Fe4ZNfc+WWRZlIm5txqWZFxslZc6oT3KFtfTBy+LH1jUBPCV9/4IBxjFQlI9pskW
p7zKdUUNlCowijl8Yx/SxkwwBjU3RFK0NCF/ZQ2jXXkJL/W1wKVWvwDjp5GyANw/
feQDqEFN+TLdbQAf3dOPM0jSevz+3MJFyRtKbjmwXzA+7QWuWfxfcd25yL0q/g0e
s95umgCnCmdZ7x94kNEwbH9+05JbeMXwY0FK2n6xGLHoY6HWxTjaY43kg+VI2T8H
/h4t3HLnWx511lelWQA86XKxSFiWrKCwHdLafW4tMHHj35KVj3hM7J9ElrsC11/G
fRuDz3f5uKz5+QGefhg699XjLFue4ro1af7OWHo1rXJjBfwHtGAt/oGPoU19Md3u
/pAc4HjQKLTHIm2kBxsmT2HRDTNxSGbgPZ9NdnSE0XXlGC/mPSXeWiESoNG5wbLk
ydNrDdkMAvBrJRlES8RvywJxTTfN/YrDHU3Un2CdwZ0O9aqMgblaA4sMYGGoaO5M
YPUws+WYX3a1iV7gSUgLGETUGRa4+0nxdFNkiDUmdZQsSvzdGhce84HWGwAIVWBk
qoEErCBVZAlTzQVPE5W0+OJWRKSHvB5/DUeFVlF79U/Ow0AvFg==
=3L8/
-----END PGP SIGNATURE-----

#1106807#15
Date:
2025-05-30 12:19:53 UTC
From:
To:
control: reopen -1
control: tag -1 + patch

Hi,

Thanks for the quick fix. Unfortunately, as I wasn't clear enough in the
original bug report, your changes does not fix the issue. Sorry about
that.

Please find attached a patch to fix the issue.

Regards
Aurelien

#1106807#26
Date:
2025-05-30 19:51:22 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
tini, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1106807@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
ChangZhuo Chen (陳昌倬) <czchen@debian.org> (supplier of updated tini package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 31 May 2025 03:26:33 +0800
Source: tini
Architecture: source
Version: 0.19.0-3
Distribution: unstable
Urgency: medium
Maintainer: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Changed-By: ChangZhuo Chen (陳昌倬) <czchen@debian.org>
Closes: 1106807
Changes:
 tini (0.19.0-3) unstable; urgency=medium
 .
   [ Aurelien Jarno ]
   * Fix Built-Using (Closes: #1106807)
Checksums-Sha1:
 242e3671b4192365b3e96c2cef0b1e234de0d31b 1810 tini_0.19.0-3.dsc
 8db958ec8c42165bc11129998da2104f9eba9e77 2192 tini_0.19.0-3.debian.tar.xz
 c5196ebac199f120379b43985ece7526a0baf100 6699 tini_0.19.0-3_amd64.buildinfo
Checksums-Sha256:
 78150db4632acf2a22e1054cfe90703d9597139cbb3e574fcee2142584a414d3 1810 tini_0.19.0-3.dsc
 7ed8726d245e06605df6bc6f0da6c91467b8d370da013637a72e520b61fe5b48 2192 tini_0.19.0-3.debian.tar.xz
 d5a68a93c83ae54f9e9243afe2f373f4aafbaa83b3bbe3c87ec2f3578f18def8 6699 tini_0.19.0-3_amd64.buildinfo
Files:
 57ab6069995fc84ec2466509842f24ae 1810 utils optional tini_0.19.0-3.dsc
 c21731699206af0e1557c026288a9aa1 2192 utils optional tini_0.19.0-3.debian.tar.xz
 c71c647a89c29c450af300668d41e940 6699 utils optional tini_0.19.0-3_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEugQ0bcLh/mPHkIeTzGWwzewnXVsFAmg6BqQACgkQzGWwzewn
XVtVCg//QrJI4nO1ZSl9t3uvtKyFU1CYsH6GefXFOxQ1SeRXFXWRdBxUkgUC2ve3
RNgcUC4/LilLX8pRzlWh1EfKMZWTn8jMzWrkOLjxpwCatau6jtWlTYn/TxJ9AVVh
t4FqGiq7bKnHPX2jbLQV84vWMOOhEQlvNQi8rBW8RExZXrSwqMRFdk+hjnJmljlE
ceHhfH+H3FA5w+XO503XoHudlsPSK38Q3u23fuZRt78kHjHKvdI2d+p0VG3cV7Eb
FoojwSoTEpu5eNSzbN801wFhucL+SyMFh36BILR/Mf7djQoIPLxNjuru5xUuB6vV
6WxqWEJ7THW+3FoIPsqLnSV1/o3jqFJCOJhtoLNtKJUML7gnnNErw7K0KKhXAf8s
+NOA5+zFNDOK7p6RNzi5DfMfi51AMOAQyb1ZDrhTxJ7vWS5yXBxqdUSnrLF/4JCR
CUiNH6qttVwJpt3jYfUj8wpSfyXjV5iowI32sN/TxRcpJDivQ3mOnHsPPrbm6Lfz
LTZOLYs757Ddft9o0fUW2W6Iwg/0G7RRYatlPQMW+Hoo/j/ZFKLOjZgympeqCyKS
d38nlmj6xe0Yx3VN3nrkQpdiv3kEv4QRMNVM4b1MOvI7HeIflTUwSuSJL131G6ro
No24aWvfACRZNybY8xfbtALyy9acixRq+P0ptirPk87PyV/DBSQ=
=4BNJ
-----END PGP SIGNATURE-----