Raul Benencia

Debian contributions — July 2026

It’s been a long while since my last Debian contributions log. Life gets busy, interests change, and sometimes it’s necessary to take a break to come back more energized and with new ideas. A few months ago I started giving some love to all the packages I maintain. I was curious to see how much the workflows have changed since the advent of LLMs. Packaging work is mostly mechanical and well defined, making it quite fitting for these tools to process.

Last month I shared some musings on dependencies. With a similar mindset, I tried to focus this batch of Debian work on simplifying the archive. Less is more; packages with virtually no users should be decommissioned to avoid technical debt piling up. Dependencies should be removed if they aren’t strictly necessary.

I’ve worked on the following packages:

  • shoelaces, for automated server bootstrapping. I published version 1.3.2+ds-1 in 2023, and during June 2026 I did some devendoring and uploaded version 1.4.0. I dropped the +ds repack, Bootstrap, jQuery and four Go libraries after upstream replaced them with stdlib and vanilla JS; I also patched Go 1.26’s legacy ServeMux regression (dh-golang builds in GOPATH mode, so method-aware routes 404’d), added the upstream integration suite as an autopkgtest, fixed adduser handling in postinst, closed #1088601. The last package release, 1.4.0-3, fixed my own autopkgtest that was blocking chromium from migrating, #1140021, reported and fixed same-day.

  • foremost, a forensic program to recover lost files. I published version 1.5.7-12, mainly to fix an out-of-bounds read on empty config-file lines (#1132989) where process_line() checked for CRLF without a length guard, so a blank line read before the buffer; plus regular packaging work such as bumping Standards Version, debhelper, adding DEP-3 headers on all patches, updating watch to v5, and a new autopkgtest that carves an embedded HTML payload for foremost to find.

  • pudb, a full-screen, console-based Python3 debugger. I published version 2025.1.5-1 and closed #773262, filed 2014-12-16, by fixing it upstream (inducer/pudb#745, merged 2026-07-12) rather than patching around it. It was a simple fix: --steal-output was the only CLI option with no help string, and it turns out the feature is unimplemented and raises NotImplementedError, so the fix documents it as such; also marked the bad-encoding test patch as not-needed-upstream, refreshed Uploaders, bumped Standards Version, debhelper, and watch file. I also closed 799048 and 934607 as they were old bugs and not reproducible in pudb’s latest version.

  • zenburn-emacs, a low contrast color theme for Emacs. I uploaded version 2.8.0-1 and did some general packaging modernization. Also, I closed bug #1040903 because it had an old backport request for bookworm, an end-of-life release.

  • emacs-posframe, an Emacs library to pop a frame at point. I uploaded package version 1.4.2-1 and did some general packaging modernization: copyright years, section lisp → editors, upstream metadata, S-V bump; earlier updated the Uploaders list (#1019019).

  • themole, a tool to automate SQL injections. Upstream hasn’t provided updates for more than a decade, and a better maintained tool, sqlmap, is available in the Debian archive. I requested themole’s removal in #1141865 to prune the archive.

  • golang-github-justinas-alice, a Go library to manage HTTP middleware. It was a dependency of shoelaces, but was no longer needed since version 1.4.0. I requested its removal in #1140456. I had ITP’d it on 2018 in #913334.

  • golang-github-namsral-flag, a Go library to parse config files. Same as golang-github-justinas-alice, it was a dependency of shoelaces, but was no longer needed since version 1.4.0. I requested its removal in #1140457. Same story; ITP’d on 2018 in #913333.

  • doc-debian, a package with Debian Project documentation and other documents. I filed #1020509 because the Constitution text was outdated.

  • python3-pyglossary, a tool for working with dictionary databases. I filed #1027305 because a simple invocation was crashing with ModuleNotFoundError.

Some concluding words. Most of my recent contributions were done with LLMs’ aid. I know the community is divided by its usage, with many people in favor and others against. I am responsible for the generated code, and I use my best judgment to provide value and avoid bloat. I have done Debian packaging for years now, so I am aware when the results are inadequate. My experience has been positive overall, and I was able to quickly fill up some gaps to produce more resilient packages. I think the community can only benefit if we produce a set of standard skills that codify Debian’s best practices.