Hi Otto,

I'm a bit disappointed. You told me that mariadb would stop using
libreadline-gplv2-dev in >= 10.4. While that's technically correct, it's
not the whole truth. In 10.5, mariadb has a vendor copy of it. Instead
of actually moving to a recent version, mariadb just added an embedded
code copy. The Debian policy discourages such copies. I don't think it
makes sense to reiterate the reasons.

Please figure out whether you can unembed readline. This may be
difficult to do and you may come to the conclusion that doing so is
infeasible. In that case, please register your copy with the security
tracker to enable the security team supporting mariadb.  Refer to
https://wiki.debian.org/EmbeddedCopies for details.

Helmut

Hello!

There is indeed in the sources extra/readline/.

Looking at upstream commit logs it has been there at least since 2014
(and traces of the same are in Oracle mysql sources too). This is not
something new that has been introduced in 10.5, but rather very old
legacy.

The cmake/readline.cmake file should ensure the system libedit is
always used in Debian.

I will experiment by removing the whole extra/readline/ from the
Debian sources and then file an issue about it upstream.

Hi Otto,

I stand corrected! I only managed to get into this situation by failing
to provide all relevant build-depends. My fault. It really does build
using the system libedit by default as can be seen from the buildd logs.

The only thing that you might want to consider changing is making it
harder to accidentally use the bundled readline.
prefer libedit when libedit is available.

I've attemped adding a "rm -Rf extra/readline" to override_dh_auto_clean
and that seems to just work. When you build a source package after
performing a binary package build you get a pile of warnings abouts
deleted files being ignored as a difference, but I'm used to that from
other packages already. Does that work for you?

Given the above, I see basically two options for moving forward:
 a) Close the bug with no action (as indeed the embedded copy is
    unused).
 b) Delete it during clean.

I'm happy with either choice.

Helmut

Hello!

I've experimented with trying to filter out extra upstream source
directories we don't like automatically in the git-buildpackage step
with filters in
https://salsa.debian.org/mariadb-team/mariadb-10.5/-/commit/f4214a4bee3f4f35ae31746c542cf54bfc9536f7

This would help fix both
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971005 and
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971367

Unfortunately the filter stanzas don't seem to have any effect then
the gbp import is running.

Noting this now down in the issues and will later return to debug why
git-buildpackage does not abide to the filter stanzas.

Dear submitter,

as the package mariadb-10.5 has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see https://bugs.debian.org/1004944

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

Please note that the changes have been done on the master archive and
will not propagate to any mirrors until the next dinstall run at the
earliest.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Scott Kitterman (the ftpmaster behind the curtain)

MR https://salsa.debian.org/mariadb-team/mariadb-server/-/merge_requests/101
would potentially close this issue.

Hello,

Bug #971005 in mariadb reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/mariadb-team/mariadb-server/-/commit/b7a48218608cf7787785eea741e84aed0d72c8ce
------------------------------------------------------------------------
Add Files-Excluded section to d/copyright based on d/rules deletions

Until now unwanted upstream storage engines, precompiled binaries and 3rd
party libraries and components have been removed in debian/rules clean
section, but the proper way to exclude is to filter them out from the
upstream release tarball before including them in Debian to begin with.

Closes: #971005, #971367
Gbp-Dch: full
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/971005

We believe that the bug you reported is fixed in the latest version of
mariadb, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 971005@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Otto Kekäläinen <otto@debian.org> (supplier of updated mariadb package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 29 Aug 2026 19:19:19 +0000
Source: mariadb
Architecture: source
Version: 1:11.8.9+ds-1
Distribution: unstable
Urgency: medium
Maintainer: Debian MySQL Maintainers <pkg-mysql-maint@lists.alioth.debian.org>
Changed-By: Otto Kekäläinen <otto@debian.org>
Closes: 971005 971367 1140151 1140296
Changes:
 mariadb (1:11.8.9+ds-1) unstable; urgency=medium
 .
   [ Otto Kekäläinen ]
   * New upstream maintenance release version 11.8.9. Includes several fixes as
     noted at https://mariadb.com/docs/release-notes/community-server/11.8/11.8.9
     and also the following security issues:
     - CVE-2026-61081
     - CVE-2026-60585
     - CVE-2026-60331
     - CVE-2026-60747
     - CVE-2026-47023
     - CVE-2026-60184
   * Drop patches applied upstream
   * Update server trace to include new parameters and values
     - New option innodb-index-shrink (default TRUE)
   * Clean up d/copyright of files that no longer ship in this release
   * Update Lintian overrides for new upstream version
   * Update maintainer documentation to ensure it is current
   * Skip tests main.mysql_client_test* as they require Internet access
   * Salsa CI: Clean away defunct test jobs and start testing with MySQL 9.7
 .
   [ Luke Yasuda ]
   * d/*.lintian-overrides: fix all the mismatched-override
   * d/mariadb-server.links: drop the use of dh-exec
   * d/control: upgrade debhelper compatibility level to 14
   * d/watch: add +ds suffix
   * Add Files-Excluded section to d/copyright based on d/rules deletions.
     Until now unwanted upstream storage engines, precompiled binaries and 3rd
     party libraries and components have been removed in debian/rules clean
     section, but the proper way to exclude is to filter them out from the
     upstream release tarball before including them in Debian to begin with.
     (Closes: #971005, #971367)
   * d/copyright: drop entries for excluded files
   * d/gbp.conf: do not force check upstream sigs.
     We repack orig tarballs now, leaving this on will cause
     "gbp import-orig --uscan" to fail. uscan already checks the upstream
     signature and gbp does it again and fails, which is not we want.
   * drop unused source lintian overrides
   * drop unused local-options
 .
   [ Dick Hollenbeck ]
   * libmariadb-dev: make Multi-Arch: same co-installable (Closes: #1140296)
   * libmariadb-dev-compat: make Multi-Arch: same co-installable
     (Closes: #1140151)
 .
   [ Daniel Black ]
   * MDEV-39584: links mariadb.org/kb -> mariadb.com/docs
Checksums-Sha1:
 f114f162477ff9b2282988dadc531ce985d2ee88 5396 mariadb_11.8.9+ds-1.dsc
 0ce74570334ff745fbb094b090db199eaebe5f96 42060036 mariadb_11.8.9+ds.orig.tar.xz
 8b2be388aac7078dee76b049d307731508107c3a 302748 mariadb_11.8.9+ds-1.debian.tar.xz
 89033ead6c297bc3300190eec288a6da0608fa09 13742 mariadb_11.8.9+ds-1_source.buildinfo
Checksums-Sha256:
 315f5670a29b9db536c1704fa5ef9ec9e0761258181a1ac7632e4cea10217b0a 5396 mariadb_11.8.9+ds-1.dsc
 af102b8ca599d764b74788a95ce14b737b17441811fea6e49392cf2890d2dc28 42060036 mariadb_11.8.9+ds.orig.tar.xz
 58114dba766cb7922dc0c6d5a8d29a584676487d67ec888ba0c9012e0a7600b9 302748 mariadb_11.8.9+ds-1.debian.tar.xz
 d3e4c2bd92b666eb838c2e34b7caeafb660d3a94fe53b709f633a9c7807a6ce6 13742 mariadb_11.8.9+ds-1_source.buildinfo
Files:
 4a9026f906893210ed8a644242cf1c05 5396 database optional mariadb_11.8.9+ds-1.dsc
 0932c1707fbafb14b180036ccb8624c9 42060036 database optional mariadb_11.8.9+ds.orig.tar.xz
 c7d230209a7fa9a2ddd982b9fb37c5a8 302748 database optional mariadb_11.8.9+ds-1.debian.tar.xz
 35fe965d6dca045cb603ab3c0bf0407a 13742 database optional mariadb_11.8.9+ds-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmbRSsR88dMO0U+RvvthEn87o2ogFAmqVskEACgkQvthEn87o
2oirHxAAroj3xtAHXsKbrg4nPpAReNeeXZdkBKunklVvdgiMqqZdVgMnw9uouiU4
egjKJhwIxpCppIwmApO2rr9FditmqDJ9twhUcRgs4vENCTGyhjToWjw+GbaCMYj6
OtCQxC9g8tc/suElvunlSngu2ax0doM0DbgcqPwYZOlrPU9B9Dixxwb+RMon3yjO
gVtpmKyQjBIT/FL4zXE8zh9xAmb4eZMNjxzDpDG3hM/FPmSOaiUfoSzH7SVj6iR5
KESF2OHc1YHSIMPnzricafcTVsJCpBM3SgDX5qJ8+5l8bXFbR8PmDoj3M1WEzGKr
rMjuNuKbb0xlX0yPNrbTgwYkagQuvq65P8G6ABGn2TdYeb/9o0NRTPZF2ZEgtpZZ
JnPYpgUmjLHa+hrOLQpfNSXw9U47q5OHyuUMoRJMBHXN5qw2YkL6YS6J08rnAYqi
UUVUfX78yGshtP003XTccUodF9K5LEz8dRKgKT80GwKO0O65x0FG6tlAInajBxb0
enblTKAXA3iKbiXCq7bLCAq5PTawzjfMrvMr8IXpIGsMlmnGVOoJ6dyPDHfDJK5f
v+6nDzhsYo4HpwFgk/tmdLG6zOXQrqYQADpEE/RFOWdEvMgag/8EoLpfH6KBi0Kh
JS4Q82bY8OYjVTbECxmQe1YvcoHj23Wmyn3Nl2lWEZgnQq8vHHM=
=iZV1
-----END PGP SIGNATURE-----