Bug#1120262: curl 8.14.1-2+deb13u1 flagged for acceptance

On Sun, Nov 09, 2025 at 11:56:19AM +0100, Paul Gevers wrote:
> Hi,
> 
> On 11/7/25 20:36, Adam D Barratt wrote:
> > Package: curl
> > Version: 8.14.1-2+deb13u1
> > 
> > Explanation: fix buffer over-read issue [CVE-2025-9086]; fix cache poisoning issue [CVE-2025-10148]; fix path traversal issue [CVE-2025-10148]; allow --output to be overridden by --curl-options; fix manpage example for "continue-at"
> 
> 
> https://release.debian.org/proposed-updates/stable.html shows a regression
> (4 tries, the test doesn't seem to have a flaky history) in mpd on s390x.
> Now I'm not really worried that people use mpd on s390x, but it might
> indicate a subtle issue with curl on s390x. Care to have a look? I've CC'd
> the mpd maintainers as they might be able to tell what failure they are
> observing in their test. I also CC'd the s390x porters as they might care
> about curl behavior on s390x.

Migration references are not retried for pu->stable, and when I did so 
manually it also failed:
https://ci.debian.net/packages/m/mpd/stable/s390x/

But this reference failure is in a different test...

Failure also previously happened in testing last month:
https://ci.debian.net/packages/m/mpd/testing/s390x/

After a manual retry mpd reference tests also fail in testing
and bookworm. In unstable it failed on 3rd attempt.

The latter indicates that mpd/s390x is flaky.

> Paul
>...

cu
Adrian