security.d.o packages for etch built on sarge

1 msg	Re: [Pkg-kde-extras] Bug#432007: CVE-2007-1799:...
3 msg	Japanese speaker needed for bug #429174/mecab
10 msg	Encrypting drive

security.d.o packages for etch built on sarge
\ (Karol Lewandowski) (25 Jun 2007)
. \ (Karol Lewandowski) (30 Jun 2007)
. . \ Steve Kemp (1 Jul 2007)
. . . \ Jan Hetges (1 Jul 2007)
. . . . \ Marcin Owsiany (2 Jul 2007)
. . . . . \ Marcin Owsiany (2 Jul 2007)
. . . . . . \ Marcin Owsiany (2 Jul 2007)
. . . . . . \ Moritz Muehlenhoff (2 Jul 2007)
. . . . . . . \ Marcin Owsiany (13 Jul 2007)
. . . . . . . . \ Marcin Owsiany (18 Jul 2007)
. . . . . . . . . \ Marcin Owsiany (29 Jul 2007)
. . . . . . . . . . \ Moritz Muehlenhoff (30 Jul 2007)
. . . \ Bernd Zeimetz (1 Jul 2007)
. . . \ (Karol Lewandowski) (1 Jul 2007)
. . . . \ (Karol Lewandowski) (5 Jul 2007)
. . . . . \ Florian Ernst (5 Jul 2007)

17 msg	security idea - bootable CD to check your system
1 msg	Business navigation
4 msg	an issue with recent security advisories
2 msg	etchs aide messing logs
4 msg	Re: [SECURITY] [DSA 1304-1] New Linux kernel 2....
2 msg	PaX - gresec patch
5 msg	kernel-image-2.6.8-4-386 (2.6.8-16sarge7)
3 msg	Packages being kept back after security notices
2 msg	where'd security.debian.org go?
1 msg	[rene: Re: Latest OOo Etch update -7etch1 depen...
2 msg	Latest OOo Etch update -7etch1 depends on diffe...
22 msg	Time to replace MD5?
1 msg	solemnly download
1 msg	Re: [SECURITY] [DSA 1302-1] New freetype packag...
3 msg	UNSUSCRIBE
3 msg	Carl Martell Sippel ist außer Haus.

Subject:	security.d.o packages for etch built on sarge
Group:	Debian-security
From:	(Karol Lewandowski)
Date:	25 Jun 2007

Having this in /etc/apt/sources.list

deb http://ftp.de.debian.org/debian etch main contrib non-free
deb http://security.debian.org/ etch/updates main contrib non-free
deb cdrom:[Debian GNU/Linux 4.0 r0 _Etch_ - Official i386 CD Binary-1 20070407-11:55]/ etch contrib main

I'm unable to install security update for ekg, namely ekg version
1:1.7~rc2-1etch1:

root@bizet:~# apt-cache policy ekg
ekg:
Installed: 1:1.7~rc2-1
Candidate: 1:1.7~rc2-1etch1
Version table:
1:1.7~rc2-1etch1 0
500 http://security.debian.org etch/updates/main Packages
*** 1:1.7~rc2-1 0
500 http://ftp.de.debian.org etch/main Packages
100 /var/lib/dpkg/status

Installing results in broken packages:

root@bizet:~# apt-get install ekg
Reading package lists... Done
Building dependency tree... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.

Since you only requested a single operation it is extremely likely that
the package is simply not installable and a bug report against
that package should be filed.
The following information may help to resolve the situation:

The following packages have unmet dependencies.
ekg: Depends: python2.3 (>= 2.3) but it is not installable
E: Broken packages

Looking at package deps shows differences, see filtered output of
apt-cache showpkg ekg

security.d.o | etch 4.0r0
--------------------------+----------------------
1:1.7~rc2-1etch1 | 1:1.7~rc2-1
--------------------------+----------------------
libc6 (2 2.3.2.ds1-21) | libc6 (2 2.3.6-6)
libncurses5 (2 5.4-1) | libncurses5 (2 5.4-5)
libssl0.9.7 (0 (null)) | libssl0.9.8 (2 0.9.8b-1)
python2.3 (2 2.3) | python2.4 (2 2.3.90)
libglib2.0-0 (2 2.6.0) | libglib2.0-0 (2 2.10.0)

It looks like etch's security updates were built on sarge. python2.3
isn't available in etch making ekg's security update uninstallable.

Additionaly:

root@bizet:~# apt-cache showpkg python2.3
Package: python2.3
Versions:

Reverse Depends:
ekg,python2.3 2.3
dia-libs,python2.3 2.3
blender,python2.3 2.3
python,python2.3 2.3.2-6
python,python2.3 2.3.5-14
Dependencies:
Provides:
Reverse Provides:

root@bizet:~# apt-cache policy blender
blender:
Installed: (none)
Candidate: 2.42a-7
Version table:
2.42a-7 0
500 http://ftp.de.debian.org etch/main Packages
2.37a-1.1etch1 0
500 http://security.debian.org etch/updates/main Packages

Looks like sarge's blender security update somehow made into etch's
Packages list. (I might be totally wrong, too. ;)

(Please CC me)

Thanks.

--
To UNSUBSCRIBE, email to debian-security-REQUEST
with a subject of "unsubscribe". Trouble? Contact listmaster