#1143491 dhcpig: new upstream release 2.7.2

Package:
dhcpig
Source:
dhcpig
Submitter:
Kevin Amorin
Date:
2026-08-31 20:31:01 UTC
Severity:
normal
Tags:
#1143491#5
Date:
2026-08-02 20:31:09 UTC
From:
To:
Hi,

Upstream dhcpig has moved on quite a bit since 1.6, and I put together a
packaging update for it. I don't have a Salsa account, so I'm attaching it
here instead of a merge request -- if someone would rather I open one, just
say and I'll get an account sorted.

The short version: 1.x was a single pig.py script, and 2.x is a full
rewrite into an installable, tested package (src/dhcpig/, hatchling, PEP
517), with a small local web UI (dhcpig-web) alongside the CLI. The old pig
compatibility command got dropped upstream in 2.6.0. Changelog has the
details: https://github.com/kamorin/DHCPig/blob/v2.7.2/CHANGELOG.md

Release: https://github.com/kamorin/DHCPig/releases/tag/v2.7.2
Needs Python 3.11+ and scapy >= 2.5 (still the only runtime dependency).
Console scripts are dhcpig and dhcpig-web -- no more pig. Everything in the
package is GPL.

What I touched in the packaging, roughly:

- control: swapped python3-setuptools for pybuild-plugin-pyproject +
python3-hatchling (it's PEP 517 now), python3-all instead of bare python3,
and added python3-pytest/python3-scapy under <!nocheck> so the build
actually runs the upstream test suite. Dropped pkgconf, that was only
needed for the old setup.py. Runtime dep is python3-scapy (>= 2.5) --
deliberately not libpcap0.8, since that got renamed in the 64-bit time_t
transition and doesn't exist under the old name anymore. Bumped
debhelper-compat to 14 and Standards-Version to 4.7.4 while I was in there.
Also rewrote the long description -- the old one still described a
standalone gratuitous-ARP DoS mode that was retired upstream back in 2.3.
- rules: dropped the pig.py rename (the console scripts install themselves
now) and the setup.py clean guard, since there are no patches left that
need it. Wired PYBUILD_TEST_PYTEST so the unit suite runs at build time --
it's all no-root, sendp is monkeypatched, nothing touches a real socket.
Left tests/integration out, same as upstream does by default (needs
CAP_NET_RAW and a veth pair, no buildd has that).
- copyright: one GPL-2+ stanza, plus a separate one for the bundled
fingerprint data (also GPL-2+, sourced from a different upstream project).
- manpages: dhcpig.1 moved to packaging/dhcpig.1 upstream, and I wrote a
dhcpig-web.1 since upstream doesn't have one yet for the web UI.
- tests: the old test-help.sh grepped --help for a URL that 2.x doesn't
print anymore, so it would just fail as-is. Replaced it with three tests --
command-help, python-import, and packaged-assets (checks that the bundled
web/fingerprint files actually load from where they're installed -- not
marked superficial, since both loaders quietly fall back to empty if the
data's missing rather than erroring). None of them touch the network.
- One patch to fix an invalid freedesktop category in the .desktop file.
Everything from the 1.6 patch set is gone -- upstream folded all of it in
already.

I built and tested this in a clean debian:unstable container rather than
just eyeballing it. Full source+binary build, 387 upstream unit tests run
during the build and pass, and lintian on the .changes comes back with:

  W: dhcpig source: no-nmu-in-changelog
  W: dhcpig source: source-nmu-has-incorrect-version-number 2.7.2-1
  P: dhcpig source: maintainer-manual-page [debian/dhcpig-web.1]

The two warnings are just because I'm not a DM/DD signing this, so they'll
go away on a real upload. The pedantic one is about dhcpig-web.1 living
under debian/ instead of upstream -- happy to send it upstream once the
package itself is in good shape.

Installed the built .deb into a clean container afterward and ran the three
autopkgtests by hand -- all pass. None of them send a DHCP packet or open a
listening socket.

For what it's worth: 130,772 bytes download, 522 KiB installed, Depends:
python3-scapy (>= 2.5), python3:any. pristine-tar also reproduces the exact
tarball uscan pulls from GitHub, byte for byte (sha256
8b5801f6c118e7e7072e3f21c85b0ea5e63e03ab61e105a2975a62305da94659) --
checked that from a completely separate clone, not just my working copy.

Since I don't have Salsa access, the branches live on the upstream GitHub
repo instead, using the same debian/master / upstream/latest / pristine-tar
layout the team already uses on Salsa:

https://github.com/kamorin/DHCPig/tree/debian/master
https://github.com/kamorin/DHCPig/tree/upstream/latest
https://github.com/kamorin/DHCPig/tree/pristine-tar
https://github.com/kamorin/DHCPig/releases/tag/upstream%2F2.7.2

To grab it:

  git remote add kamorin https://github.com/kamorin/DHCPig.git
  git fetch kamorin debian/master upstream/latest pristine-tar
upstream/2.7.2
  git checkout kamorin/debian/master
  gbp buildpackage --git-builder=sbuild

(upstream's own master branch is untouched by any of this, for what it's
worth -- these are just extra branches alongside it)

If someone on the team has a few minutes to look this over, I'd appreciate
it -- happy to fix up anything that needs changing. Thanks for keeping this
package going.

#1143491#8
Date:
2026-08-31 20:28:37 UTC
From:
To:
Hello,

Bug #1143491 in dhcpig reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/pkg-security-team/dhcpig/-/commit/50e68f61d8bc9c28f97534360b18221cffb679df
Upstream 2.x is a full rewrite: the single pig.py script is now a Python
package with a subcommand CLI and a stdlib-only local web UI.

Switch the build to pybuild-plugin-pyproject and hatchling, run upstream's
test suite at build time, replace the superficial autopkgtest with that
suite plus a smoke test, document the incompatible command line in NEWS,
add a manual page for dhcpig-web, and give the bundled Satori-derived
fingerprint table its own copyright stanza.
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1143491