Hi Timo, hi all, I have worked on a security upload of sssd to get sssd back into testing. As a result, I have uploaded sssd 2.13.1-1 to DELAYED/7 queue just now targetting unstable, addressing the following CVE issues: https://security-tracker.debian.org/tracker/CVE-2026-6245 https://security-tracker.debian.org/tracker/CVE-2026-12610 https://security-tracker.debian.org/tracker/CVE-2026-14474 https://security-tracker.debian.org/tracker/CVE-2026-14476 I plan to push my changes to a Git repo under my personal account on salsa (as I lack permissions for the sssd-team group): https://salsa.debian.org/sunweaver/sssd (including the release tag debian/2.13.1-1). However, salsa is currently having issues with forking the original sssd-team/sssd repo into my personal name space. So, I will try to push the changes later. Also, as a member of the Debian Edu team (consuming sssd already now, but even more for the Debian Edu 14 release), I'd like to become co-maintainer of sssd in Debian. Thanks! Cheers, Mike
Thanks for working on sssd! Mike Gabriel <sunweaver@debian.org> writes: Salsa invite for 'sunweaver' to become Maintainer of the sssd-team on Salsa. Unless someone objects, I suggest that you push to the real sssd git project instead of your fork. There seems to be nobody else actively working on it anyway. Further: The sssd-team is small, just sssd, ding-libs and the *-wrapper projects: https://salsa.debian.org/sssd-team My focus in the team has been on *-wrapper, and I don't recall anyone else lately contributing to any of these projects. What do you think about moving all of these projects into the /debian/ Salsa namespace? We could also change the Maintainer field to some group with more participators, such as the pkg-security or Debian Commons teams. Both changes may bring more new contributors, as more people will be able to commit improvements and/or feel entitled to work on sssd-related projects. /Simon
Hi all, Yes please! Add me as well, please. There is also a NMU announcement by a new DD, please get in touch with them as well to consider adding them to the team. Yes please. A possible reason for NOT moving is that sssd is somewhat security related and we might not want joe random DD to push to debian/latest. That's at least the reason why sudo is not in the /debian/ Salsa namespace. and named Uploaders. But everything that moves in any direction is better than just staying with the current state. Greetings Marc
Marc Haber <mh+debian-packages@zugschlus.de> writes: What is your Salsa username? I'm not sure how I got maintainer access to the project, so I hope I'm not abusing it by inviting you and others who express interest. Any improvements to the 'sssd' package seems useful though, so pending any objections, let's just proceed. My focus in the sssd-team has been the *-wrapper packages because I use them personally. Do you have a pointer? Wasn't that 'sunweaver'? abuses the powers, the rest of us 1) can clean up the mess by force-pushing restoring things, and 2) that person will have burned their credibility on Salsa. I'm hoping the social pressure to behave will be sufficient. But there is no rush on this, let's see how team-maintainance can work going forward. Indeed. I don't care strongly about any of these packages, and I am happy people step up to help, so just want to promote that. /Simon
Hi Simon, I have pushed those changes this morning and also already the 2.13.1-1 release tag of the package in DELAYED/7. I will leave the upload in DELAYED/7 (6 days left today), so people can review the changes in Git. Fine by me. However, it is now more people with access to the Git group administation UI, so access requests might be processed faster. My main interest is getting sssd back into testing and then tidying it up to some extend (lintian cleanups, address pending MRs, fix remaining CVEs once patches turn up, etc). Thanks, Simon, for reacting on my initiative!
It's Zugschlus. I think we can safely assume that the existing sssd team is defunct. It's Luke Yasuda <jing@jing.rocks>, see #1143947. I agree with that, I just wanted to point out that the team of another security relevant package decided differently (and I was the deciding part in that because I happen to lead that team). Yes, I understand. sssd is important for Debian in an enterprise environment, and I kind of feel responsible as well because sudo recently dropped its -ldap variant and told people to use sssd instead. I don't have much clue about LDAP in the first place though. Greetings Marc
Hi Marc, hi Simon, ;-) Or someone else? That'd be interesting. Valid aspect, Marc. Yeah. No rush is probably good. +1 from me, too. Doing so, currently. ;-) Mike
fre 2026-09-04 klockan 15:43 +0200 skrev Marc Haber: Added to the 'sssd' project, I'm not owner of the group so cannot add you to the group it seems. /Simon
Hi Marc, hi all, Ah, that was you ;-) !!! :-P But I do... ;-) FTR: I have used Luke Yasuda links now for fixing CVE-2026-6874[2-4], as well. I now uploaded sssd 2.13.1-1 (earlier today) and 2.13.1-2 (in the early afternoon) today, fixing all open RC bugs. Thanks to Salvatore for pointing my nose at these issues. (However, I don't receive any mails from dak telling me about those uploads... Something asleep there? Mike