#37: lintian

Result: Success

Fail on: error

Lintian output

Summary of tags

error: 0
warning: 0
info: 4
pedantic: 2
experimental: 5
overridden: 0
classification: 74

Tags

spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2_amd64.deb

I bash-term-in-posix-shell

'&>' [usr/share/doc/spawn-fcgi/examples/spawn-fcgi_launcher:46]
'&>' [usr/share/doc/spawn-fcgi/examples/spawn-fcgi_launcher:53]

I hardening-no-bindnow

This package provides an ELF binary that lacks the "bindnow" linker flag.

This is needed (together with "relro") to make the "Global Offset Table"
(GOT) fully read-only. The bindnow feature trades startup time for
improved security. Please consider enabling this feature or consider
overriding the tag (possibly with a comment about why).

If you use dpkg-buildflags, you may have to add hardening=+bindnow or
hardening=+all to DEB_BUILD_MAINT_OPTIONS.

The relevant compiler flags are set in LDFLAGS.

Please refer to https://wiki.debian.org/Hardening for details.

Visibility: info
Show-Always: no
Check: binaries/hardening

Lintian did not output a note for this tag [usr/bin/spawn-fcgi]

P maintainer-script-without-set-e

The maintainer script passes -e to the shell on the #! line rather than
using set -e in the body of the script. This is fine for normal operation,
but if the script is run by hand with sh /path/to/script (common in
debugging), -e will not be in effect. It's therefore better to use set -e
in the body of the script.

Please refer to Scripts (Section 10.4) in the Debian Policy Manual for
details.

Visibility: pedantic
Show-Always: no
Check: scripts

Lintian did not output a note for this tag [preinst]

X spelling-error-in-binary

Lintian found a spelling error in the given binary. Lintian has a list of
common misspellings that it looks for. It does not have a dictionary like
a spelling checker does.

If the string containing the spelling error is translated with the help of
gettext or a similar tool, please fix the error in the translations as
well as the English text to avoid making the translations fuzzy. With
gettext, for example, this means you should also fix the spelling mistake
in the corresponding msgids in the *.po files.

You can often find the word in the source code by running:

grep -rw <word> <source-tree>

This tag may produce false positives for words that contain non-ASCII
characters due to limitations in strings.

Visibility: pedantic
Show-Always: no
Check: binaries/spelling
This tag is experimental.

childs children [usr/bin/spawn-fcgi]

C control-tarball-compression-format

C ctrl-script

This package has one or more maintainer scripts (or other executable
control files).

This flags any control file with the executable bit set.

Visibility: classification
Show-Always: no
Check: control-files
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag [preinst]

C data-tarball-compression-format

C mail-contact

This person is a contact in the named group for this package.

Visibility: classification
Show-Always: no
Check: fields/mail-address
Renamed from: maintainer uploader
This tag is a classification. There is no issue in your package.

Maintainer "Jérémy Lal" <kapouer@melix.org>

C maintainer-script-interpreter

Interpreter used in maintainer script or ELF

Visibility: classification
Show-Always: no
Check: scripts
This tag is a classification. There is no issue in your package.

/bin/sh [preinst]

C package-is-maintained-by-individual

The package is maintained by an individual according to the
maintainer/uploaders fields in the debian/control file.

Visibility: classification
Show-Always: no
Check: fields/vcs
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag

C trimmed-field

Architecture amd64
Depends libc6 (>= 2.38)
Description FastCGI process spawner
Allows FastCGI processes to be separated from web server process :
* Easy creation of chmoded socket.
* Privilege separation without needing a suid-binary,
or running a server as root.
* You can restart your web server and the FastCGI applications
without restarting the others.
* You can run them in different chroot()s.
* Running your FastCGI applications doesn’t depend on the web server
you are running, which allows for easier testing of/migration
to other web servers.
Homepage http://redmine.lighttpd.net/projects/spawn-fcgi
Installed-Size 55
Maintainer Jérémy Lal <kapouer@melix.org>
Package spawn-fcgi
Priority optional
Section web
Version 1.6.7~snap-20250301-194725-ga82da4-0.2

spawn-fcgi-dbgsym_1.6.7~snap-20250301-194725-ga82da4-0.2_amd64.deb

C control-tarball-compression-format

C data-tarball-compression-format

C mail-contact

This person is a contact in the named group for this package.

Visibility: classification
Show-Always: no
Check: fields/mail-address
Renamed from: maintainer uploader
This tag is a classification. There is no issue in your package.

Maintainer "Jérémy Lal" <kapouer@melix.org>

C no-ctrl-scripts

The package does not rely on any maintainer scripts (or other executable
control files).

Visibility: classification
Show-Always: no
Check: control-files
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag

C package-is-maintained-by-individual

The package is maintained by an individual according to the
maintainer/uploaders fields in the debian/control file.

Visibility: classification
Show-Always: no
Check: fields/vcs
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag

C trimmed-field

Architecture amd64
Auto-Built-Package debug-symbols
Build-Ids c82b6edf616e72fead061df6a1fc1ccabb3a4f00
Depends spawn-fcgi (= 1.6.7~snap-20250301-194725-ga82da4-0.2)
Description debug symbols for spawn-fcgi
Installed-Size 39
Maintainer Jérémy Lal <kapouer@melix.org>
Package spawn-fcgi-dbgsym
Priority optional
Section debug
Source spawn-fcgi
Version 1.6.7~snap-20250301-194725-ga82da4-0.2

spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2.dsc

I out-of-date-standards-version

The source package refers to a Standards-Version older than the one that
was current at the time the package was created (according to the
timestamp of the latest debian/changelog entry). Please consider updating
the package to current Policy and setting this control field
appropriately.

If the package is already compliant with the current standards, you don't
have to re-upload the package just to adjust the Standards-Version control
field. However, please remember to update this field next time you upload
the package.

See /usr/share/doc/debian-policy/upgrading-checklist.txt.gz in the
debian-policy package for a summary of changes in newer versions of
Policy.

Please refer to
https://www.debian.org/doc/debian-policy/upgrading-checklist.html for
details.

Visibility: info
Show-Always: no
Check: fields/standards-version

4.7.0 (released 2024-04-07) (current is 4.7.2)

P hyphen-in-upstream-part-of-debian-changelog-version

The upstream version in the debian changelog contains one or more hyphens.
While that is okay according to Debian Policy, some tools may croak.

Please refer to Version (Section 5.6.12) in the Debian Policy Manual for
details.

Visibility: pedantic
Show-Always: no
Check: debian/changelog

1.6.7~snap-20250301-194725-ga82da4 [debian/changelog:1]

X debian-watch-does-not-check-openpgp-signature

This watch file does not specify a means to verify the upstream tarball
using a cryptographic signature.

If upstream distributions provides such signatures, please use the
pgpsigurlmangle options in this watch file's opts= to generate the URL of
an upstream OpenPGP signature. This signature is automatically downloaded
and verified against a keyring stored in debian/upstream/signing-key.asc

Of course, not all upstreams provide such signatures but you could request
them as a way of verifying that no third party has modified the code after
its release (projects such as phpmyadmin, unrealircd, and proftpd have
suffered from this kind of attack).

Please refer to the uscan(1) manual page for details.

Visibility: pedantic
Show-Always: no
Check: debian/watch
Renamed from: debian-watch-does-not-check-gpg-signature
debian-watch-may-check-gpg-signature
This tag is experimental.

Lintian did not output a note for this tag [debian/watch]

X prefer-uscan-symlink

Please consider setting USCAN_SYMLINK=rename in your ~/.devscripts
configuration file instead of using the option filenamemangle in
debian/watch.

Please check with your team before making changes to sources you maintain
together. There are circumstances when the filenamemangle option is
better.

Please refer to the uscan(1) manual page for details.

Visibility: pedantic
Show-Always: no
Check: debian/watch
This tag is experimental.

filenamemangle s%(?:.*?)?v?(\d [debian/watch:4]

X update-debian-copyright

The most recent copyright year mentioned for files in ./debian lags behind
the year in the timestamp for the most recent changelog entry.

Visibility: pedantic
Show-Always: no
Check: debian/copyright/dep5
This tag is experimental.

2017 vs 2025 [debian/copyright:9]

X upstream-metadata-file-is-missing

This source package is not Debian-native but it does not have a
debian/upstream/metadata file.

The Upstream MEtadata GAthered with YAml (UMEGAYA) project is an effort to
collect meta-information about upstream projects from any source package.
This file is in YAML format and it is used in to feed the data in the
UltimateDebianDatabase. For example, it can contains the way the authors
want their software be cited in publications and some bibliographic
references about the software.

Please add a debian/upstream/metadata file.

Please refer to https://dep-team.pages.debian.net/deps/dep12/ and
https://wiki.debian.org/UpstreamMetadata for details.

Visibility: pedantic
Show-Always: no
Check: debian/upstream/metadata
This tag is experimental.

Lintian did not output a note for this tag

C debhelper-compat-level

This is the debhelper compat level used specified by this package.

Visibility: classification
Show-Always: no
Check: debhelper
This tag is a classification. There is no issue in your package.

C debhelper-compat-virtual-relation

This package is using the debhelper-compat virtual package as a
build-dependency.

Visibility: classification
Show-Always: no
Check: debhelper
This tag is a classification. There is no issue in your package.

13 [debian/control]

C debian-build-system

This is the build system that Lintian believes the package is using.

Visibility: classification
Show-Always: no
Check: debhelper
This tag is a classification. There is no issue in your package.

dh [debian/rules]

C debian-watch-file-standard

The watch file uses this version standard. The currently known watch file
versions are 2, 3 and 4. Version 1 means it was undeclared.

Please refer to the uscan(1) manual page for details.

Visibility: classification
Show-Always: no
Check: debian/watch/standard
This tag is a classification. There is no issue in your package.

4 [debian/watch]

C mail-contact

This person is a contact in the named group for this package.

Visibility: classification
Show-Always: no
Check: fields/mail-address
Renamed from: maintainer uploader
This tag is a classification. There is no issue in your package.

Maintainer "Jérémy Lal" <kapouer@melix.org>

C package-is-maintained-by-individual

The package is maintained by an individual according to the
maintainer/uploaders fields in the debian/control file.

Visibility: classification
Show-Always: no
Check: fields/vcs
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag

C patch-system

This package uses the specified patch system (eg. "quilt" or "dpatch").

Visibility: classification
Show-Always: no
Check: debian/patches
This tag is a classification. There is no issue in your package.

quilt

C rules-do-not-require-root

The sources can build the installation packages without using fakeroot(1)
or similar.

Please refer to usr/share/doc/dpkg/spec/rootless-builds.txt, debian/rules
and Rules-Requires-Root (Section 4.9.2) in the Debian Policy Manual, and
Rules-Requires-Root (Section 5.6.31) in the Debian Policy Manual for
details.

Visibility: classification
Show-Always: no
Check: debian/control/field/rules-requires-root
Renamed from: rules-does-not-require-root
This tag is a classification. There is no issue in your package.

Lintian did not output a note for this tag [debian/control:10]

C source-format

This is the source format declared in the package.

Visibility: classification
Show-Always: no
Check: debian/source-dir
This tag is a classification. There is no issue in your package.

3.0 (quilt)

C standards-version

The standards version of the package according to Standards-Version field
in the debian/control file.

Visibility: classification
Show-Always: no
Check: fields/standards-version
This tag is a classification. There is no issue in your package.

4.7.0

C trimmed-deb822-field

§1 Build-Depends debhelper-compat (= 13), meson [debian/control:5]
§1 Homepage http://redmine.lighttpd.net/projects/spawn-fcgi [debian/control:9]
§1 Maintainer Jérémy Lal <kapouer@melix.org> [debian/control:2]
§1 Priority optional [debian/control:4]
§1 Rules-Requires-Root no [debian/control:10]
§1 Section web [debian/control:3]
§1 Source spawn-fcgi [debian/control:1]
§1 Standards-Version 4.7.0 [debian/control:6]
§1 Vcs-Browser https://salsa.debian.org/debian/spawn-fcgi [debian/control:7]
§1 Vcs-Git https://salsa.debian.org/debian/spawn-fcgi.git [debian/control:8]
§2 Architecture any [debian/control:13]
§2 Depends ${shlibs:Depends},
${misc:Depends} [debian/control:14]
§2 Description FastCGI process spawner
Allows FastCGI processes to be separated from web server process :
* Easy creation of chmoded socket.
* Privilege separation without needing a suid-binary,
or running a server as root.
* You can restart your web server and the FastCGI applications
without restarting the others.
* You can run them in different chroot()s.
* Running your FastCGI applications doesn’t depend on the web server
you are running, which allows for easier testing of/migration
to other web servers. [debian/control:16]
§2 Package spawn-fcgi [debian/control:12]

C trimmed-field

Architecture any
Binary spawn-fcgi
Build-Depends debhelper-compat (= 13), meson
Checksums-Sha1 6f9bbf7b0869ed6d25e5250d289b90ca22b632d1 11868 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4.orig.tar.xz
ec4b9d8025af9ec8a130abaf428af1f76a3bfc3b 4356 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2.debian.tar.xz
Checksums-Sha256 8c2993a81cf023403c575521fd2fa9b5ebba60bc5ddf71dc330922dcec50d08f 11868 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4.orig.tar.xz
312d1252c554b11c16e851e01bc5e05b53e4f53ff9ffca30810e66559434b04e 4356 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2.debian.tar.xz
Files 8a11b403e079625c32b7f840e07dd8c5 11868 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4.orig.tar.xz
2794aad967b259dd0487ea6bf483426d 4356 spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2.debian.tar.xz
Format 3.0 (quilt)
Homepage http://redmine.lighttpd.net/projects/spawn-fcgi
Maintainer Jérémy Lal <kapouer@melix.org>
Package-List spawn-fcgi deb web optional arch=any
Source spawn-fcgi
Standards-Version 4.7.0
Vcs-Browser https://salsa.debian.org/debian/spawn-fcgi
Vcs-Git https://salsa.debian.org/debian/spawn-fcgi.git
Version 1.6.7~snap-20250301-194725-ga82da4-0.2

C vcs

The package uses the specified VCS (eg. "git") according to the
debian/control file.

Visibility: classification
Show-Always: no
Check: fields/vcs
This tag is a classification. There is no issue in your package.

C vcs-uri

The package uses the specified VCS URI according to the debian/control
file.

Visibility: classification
Show-Always: no
Check: fields/vcs
This tag is a classification. There is no issue in your package.

Git https://salsa.debian.org/debian/spawn-fcgi.git

Description

Lintian run for spawn-fcgi package.

Additional details:

Source packages: spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2
Binary packages: spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2
Executed in environment system.tar.xz
Fail on severity: error
Build architecture: amd64
Target distribution: debian:trixie
Include tags: none
Exclude tags: none

Inputs

Name	Value
Build architecture System architecture for the build environment. Defined as: `build_architecture`	unresolved
Environment Defined as: `environment`	unresolved
Input binary artifacts Defined as: `input_binary_artifacts`	unresolved
Input source artifact Defined as: `input_source_artifact`	unresolved

Workflow information

⬆️ debian_pipeline ( Aborted )
⬆️ QA ( Aborted )
⬆️ lintian ( Completed Success )

Output artifacts

Type Alphabetical order Reverse alphabetical order	Name
Lintian report	lintian: spawn-fcgi, spawn-fcgi-dbgsym
Lintian report	lintian: spawn-fcgi
Debug log	debusine:work-request-debug-logs

Output data

Runtime statistics:
- Duration: 00:00:16
- CPU time: 00:00:19
- Disk space: 941.5 MB
- Memory: 1.7 GB
- Available disk space: 3.9 GB
- Available memory: 7.8 GB
- CPU count: 4
Errors:

Dependencies

Work requests that must be completed before this one can run.

ID Lowest first Highest first	Created Oldest first Newest first	Task type Alphabetical order Reverse alphabetical order	Task Alphabetical order Reverse alphabetical order	Status Alphabetical order Reverse alphabetical order	Result Alphabetical order Reverse alphabetical order
31	7 months, 4 weeks	Worker	sbuild	Completed	Success

Reverse dependencies

This work request is not required by any other one.

Task

Type: Worker. Name: lintian. Internal collection: workflow-29.

Task data

backend: unshare
build_architecture: amd64
environment: debian/match:codename=trixie
exclude_tags: []
fail_on_severity: error
include_tags: []
input:
  binary_artifacts:
  - internal@collections/name:build-amd64
  source_artifact: 21@artifacts
output: {}
target_distribution: debian:trixie

Task data after applying task configuration

backend: unshare
build_architecture: amd64
environment: debian/match:codename=trixie
exclude_tags: []
fail_on_severity: error
include_tags: []
input:
  binary_artifacts:
  - internal@collections/name:build-amd64
  source_artifact: 21@artifacts
output: {}
target_distribution: debian:trixie
task_configuration: 3

Scheduler tags

provided: []
required:
- worker:build-arch:amd64

Input fields

Name	Value
Task configuration Defined as: `task_configuration`	unresolved

Dynamic data

configuration_context: trixie
environment_id: 16
input_binary_artifacts_ids:
- 26
input_source_artifact_id: 21
runtime_context: binary-all+binary-any+source:trixie
subject: spawn-fcgi

Workflow data

{
  "step": "lintian-amd64",
  "display_name": "Lintian for amd64"
}

Event reactions

{}

Output data

{
  "runtime_statistics": {
    "memory": 1841762304,
    "cpu_time": 19,
    "duration": 16,
    "cpu_count": 4,
    "disk_space": 987283456,
    "available_memory": 8333352960,
    "available_disk_space": 4166676480
  }
}

lintian… 29… Completed Success System… stefan 7 months, 4 weeks ago dev-stbuehler-de… 0 minutes 0 minutes Never

#37: lintian

Summary of tags

Tags

spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2_amd64.deb

I bash-term-in-posix-shell

I hardening-no-bindnow

Explanation

P maintainer-script-without-set-e

Explanation

X spelling-error-in-binary

Explanation

C control-tarball-compression-format

C ctrl-script

Explanation

C data-tarball-compression-format

C mail-contact

Explanation

C maintainer-script-interpreter

Explanation

C package-is-maintained-by-individual

Explanation

C trimmed-field

spawn-fcgi-dbgsym_1.6.7~snap-20250301-194725-ga82da4-0.2_amd64.deb

C control-tarball-compression-format

C data-tarball-compression-format

C mail-contact

Explanation

C no-ctrl-scripts

Explanation

C package-is-maintained-by-individual

Explanation

C trimmed-field

spawn-fcgi_1.6.7~snap-20250301-194725-ga82da4-0.2.dsc

I out-of-date-standards-version

Explanation

P hyphen-in-upstream-part-of-debian-changelog-version

Explanation

X debian-watch-does-not-check-openpgp-signature

Explanation

X prefer-uscan-symlink

Explanation

X update-debian-copyright

Explanation

X upstream-metadata-file-is-missing

Explanation

C debhelper-compat-level

Explanation

C debhelper-compat-virtual-relation

Explanation

C debian-build-system

Explanation

C debian-watch-file-standard

Explanation

C mail-contact

Explanation

C package-is-maintained-by-individual

Explanation

C patch-system

Explanation

C rules-do-not-require-root

Explanation

C source-format

Explanation

C standards-version

Explanation

C trimmed-deb822-field

C trimmed-field

C vcs

Explanation

C vcs-uri

Explanation

Description

Inputs

Workflow information

Output artifacts

Output data

Dependencies

Reverse dependencies