Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1041621 > unrolled thread

Bug#959469: buster-pu: package openssl/1.1.1g-1

Back to article view | Back to linux.debian.bugs.dist

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-09 00:20 +0100
    Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-14 18:50 +0100
      Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-14 19:10 +0100
        Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-14 21:20 +0100
          Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-16 19:20 +0100
            Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-21 21:10 +0100
              Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-22 17:50 +0100
                Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-24 12:30 +0100
                Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-24 13:10 +0100
                Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-25 19:00 +0100
                  Bug#959469: buster-pu: package openssl/1.1.1g-1 Cyril Brulebois <kibi@debian.org> - 2021-01-25 20:10 +0100
                    Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-25 21:10 +0100
        Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-28 00:40 +0100
          Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-29 20:40 +0100
            Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-02-02 00:00 +0100
              Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-02-10 22:00 +0100

#1041621 — Bug#959469: buster-pu: package openssl/1.1.1g-1

On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior wrote:
> On 2020-11-24 20:18:15 [+0000], Adam D. Barratt wrote:
> 
> > At some point, could we please have a combined / single diff between
> > the current 1.1.1d-0+deb10u3 and the proposed 1.1.1h-0+deb10u1 (I
> > assume)?
> 
> Please find attached the diff between 1.1.1d-0+deb10u4 and the proposed
> 1.1.1i-0+deb10u1.
> 
> The i release in unstable managed to migrate to testing. It was blocked
> due to ci by m2crypto and swi-prolog. The swi-prolog issue got fixed in
> unstable (the testuite was updated) and is not an issue in stable (the
> package builds, the testsuite gets ignored).
> The m2crypto issue is a different story and is still open in BTS
> (#977655). I *think* someone added an override or the ci-system was kind
> to Kurt/me and looked the other way :)
> The m2crypto package in stable and bpo will FTBFS with the updated
> openssl package.
> 
> I'm not aware of other issues.

I think there are at least 2 upstream issues since the 1.1.1i
release we want to fix first. As far as I know, they haven't been
fixed upstream yet.


Kurt

[toc] | [next] | [standalone]

#1042509

Hi,

On Fri, 2021-01-08 at 23:59 +0100, Kurt Roeckx wrote:
> On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior
> wrote:
[...]
> > The i release in unstable managed to migrate to testing. It was
> > blocked due to ci by m2crypto and swi-prolog. The swi-prolog issue
> > got fixed in unstable (the testuite was updated) and is not an
> > issue in stable (the package builds, the testsuite gets ignored).
> > The m2crypto issue is a different story and is still open in BTS
> > (#977655). I *think* someone added an override or the ci-system was
> > kind to Kurt/me and looked the other way :)
> > The m2crypto package in stable and bpo will FTBFS with the updated
> > openssl package.
> > 
> > I'm not aware of other issues.
> 
> I think there are at least 2 upstream issues since the 1.1.1i
> release we want to fix first. As far as I know, they haven't been
> fixed upstream yet.

Just to confirm, these are issues that you'd want to have fixed before
adding 1.1.1i to stable, presumably requiring further uploads to
unstable first?

Do you have pointers to upstream issues?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#1042513

On Thu, Jan 14, 2021 at 05:43:00PM +0000, Adam D. Barratt wrote:
> Hi,
> 
> On Fri, 2021-01-08 at 23:59 +0100, Kurt Roeckx wrote:
> > On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior
> > wrote:
> [...]
> > > The i release in unstable managed to migrate to testing. It was
> > > blocked due to ci by m2crypto and swi-prolog. The swi-prolog issue
> > > got fixed in unstable (the testuite was updated) and is not an
> > > issue in stable (the package builds, the testsuite gets ignored).
> > > The m2crypto issue is a different story and is still open in BTS
> > > (#977655). I *think* someone added an override or the ci-system was
> > > kind to Kurt/me and looked the other way :)
> > > The m2crypto package in stable and bpo will FTBFS with the updated
> > > openssl package.
> > > 
> > > I'm not aware of other issues.
> > 
> > I think there are at least 2 upstream issues since the 1.1.1i
> > release we want to fix first. As far as I know, they haven't been
> > fixed upstream yet.
> 
> Just to confirm, these are issues that you'd want to have fixed before
> adding 1.1.1i to stable, presumably requiring further uploads to
> unstable first?

Yes.

> Do you have pointers to upstream issues?

They both got merged today:
commit 76ed0c0ad119569f6e6f6c96b27b76d3b110413b (origin/OpenSSL_1_1_1-stable)
Author: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date:   Mon Dec 28 11:25:59 2020 +0100

    x509_vfy.c: Fix a regression in find_isser()

    ...in case the candidate issuer cert is identical to the target cert.

    Fixes #13739

    Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
    (Merged from https://github.com/openssl/openssl/pull/13749)

commit fb1e2411042f0367c2560e4ec5e4b1189ca9cd45
Author: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date:   Wed Dec 30 09:57:49 2020 +0100

    X509_cmp(): Fix comparison in case x509v3_cache_extensions() failed to due to invalid cert

    This is the backport of #13755 to v1.1.1.
    Fixes #13698

    Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
    (Merged from https://github.com/openssl/openssl/pull/13756)


There are a whole bunch of other issues and pull requests related to
this. I hope this is the end of the regressions in the X509 code.


Kurt

[toc] | [prev] | [next] | [standalone]

#1042530

On 2021-01-14 19:03:37 [+0100], Kurt Roeckx wrote:
> > Do you have pointers to upstream issues?
> 
> There are a whole bunch of other issues and pull requests related to
> this. I hope this is the end of the regressions in the X509 code.

Okay. Please ping once this gets sorted out and I will prepease
unstalbe/stable uploads. The m2crypto issue got resolved in unstable
\o/.

> Kurt

Sebastianc

[toc] | [prev] | [next] | [standalone]

#1042801

On Thu, Jan 14, 2021 at 09:13:49PM +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-14 19:03:37 [+0100], Kurt Roeckx wrote:
> > > Do you have pointers to upstream issues?
> > 
> > There are a whole bunch of other issues and pull requests related to
> > this. I hope this is the end of the regressions in the X509 code.
> 
> Okay. Please ping once this gets sorted out and I will prepease
> unstalbe/stable uploads. The m2crypto issue got resolved in unstable
> \o/.

So I went over the open issues and pull requests, and currently
don't see a reason not to upload it to unstable with those 2
patches. I don't know about any other regressions in 1.1.1.


Kurt

[toc] | [prev] | [next] | [standalone]

#1043749

On 2021-01-16 19:14:53 [+0100], Kurt Roeckx wrote:
> So I went over the open issues and pull requests, and currently
> don't see a reason not to upload it to unstable with those 2
> patches. I don't know about any other regressions in 1.1.1.

The openssl package migrated to testing.
I would prepare the pu package for Buster. Should I post here the
complete diff or an incremental containing only the new patches?
Once the openssl pu is acked I would open a pu for m2crypto. Or should
it be done now? (just asking).

> Kurt

Sebastian

[toc] | [prev] | [next] | [standalone]

#1043848

On Thu, 2021-01-21 at 21:06 +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-16 19:14:53 [+0100], Kurt Roeckx wrote:
> > So I went over the open issues and pull requests, and currently
> > don't see a reason not to upload it to unstable with those 2
> > patches. I don't know about any other regressions in 1.1.1.
> 
> The openssl package migrated to testing.
> I would prepare the pu package for Buster. Should I post here the
> complete diff or an incremental containing only the new patches?

Both would be good, please.

FWIW we're also fighting the clock (yet) again, as we're now a week
away from the freeze for the 10.8 point release. ("Yay"!)

> Once the openssl pu is acked I would open a pu for m2crypto. Or
> should it be done now? (just asking).

Assuming that a patched m2crypto will also build fine against openssl
1.1.1d, then there's no reason that the two shouldn't proceed in
parallel (i.e. feel free to file the m2crypto request already).

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#1044098

[Multipart message — attachments visible in raw view] — view raw

On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> Both would be good, please.

here is the with the two additional patches.

Sebastian

[toc] | [prev] | [next] | [standalone]

#1044105

On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> Assuming that a patched m2crypto will also build fine against openssl
> 1.1.1d, then there's no reason that the two shouldn't proceed in
> parallel (i.e. feel free to file the m2crypto request already).

Yes, it does. Bug filled. Thank you.

> Regards,
> 
> Adam

Sebastian

[toc] | [prev] | [next] | [standalone]

#1044380

On Sun, 2021-01-24 at 12:25 +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> > Both would be good, please.
> 
> Here is the complete diff against the last openssl release in Buster.

Thanks.

I realise that this has been dragging on for quite some time now, and
apologies again for my part in that. My (possibly overly paranoid)
concern right now is that if we aim for including 1.1.1i in 10.8,
there's less than a week of the upload window remaining for any testing
to happen and issues to be flagged up.

While I can't see any reason that packages in general should end up
with dependencies on 1.1.1i specifically, the debian-installer rebuild
for the point release will end up pulling in whichever version of
OpenSSL is in p-u at the time. That implies that we can't simply not
include the update if it's in p-u and blocking issues show up.

KiBi - I'm assuming that it would be much easier for you to check d-i
against the new OpenSSL version if it were already in p-u?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#1044406

[Multipart message — attachments visible in raw view] — view raw

Adam D. Barratt <adam@adam-barratt.org.uk> (2021-01-25):
> KiBi - I'm assuming that it would be much easier for you to check d-i
> against the new OpenSSL version if it were already in p-u?

Not really *much* easier, to be honest. I can definitely build a package
locally given a source debdiff, or slightly better, given a source
package I can run dget against (since we're talking about new upstream
releases, by the looks of it), and do whatever testing with the
generated packages built into d-i and/or fetched from the network as
required (similarly to what's done for the various kernel udebs).

IOW that can be tested before even having to make a decision regarding a
possible acceptance into p-u.


Cheers,
-- 
Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant

[toc] | [prev] | [next] | [standalone]

#1044423

[Multipart message — attachments visible in raw view] — view raw

On 2021-01-25 19:57:18 [+0100], Cyril Brulebois wrote:
> Not really *much* easier, to be honest. I can definitely build a package
> locally given a source debdiff, or slightly better, given a source
> package I can run dget against (since we're talking about new upstream
> releases, by the looks of it), and do whatever testing with the
> generated packages built into d-i and/or fetched from the network as
> required (similarly to what's done for the various kernel udebs).
> 
> IOW that can be tested before even having to make a decision regarding a
> possible acceptance into p-u.

in case it helps, I uploaded
  https://breakpoint.cc/openssl-pu.tar

| $ sha512sum openssl-pu.tar 
| 1a3df2e37aa9312a378046691794bf7d7d72570ed9ade7ffbf50f87c8c8a7dd5e671a7f704fc4f1ebdbada1dda3007a5db24b426deefd33fff39b81e7be38aa3  openssl-pu.tar

containing the source package and amd64 packages.

> Cheers,

Sebastian

[toc] | [prev] | [next] | [standalone]

#1044928

On Thu, Jan 14, 2021 at 07:03:37PM +0100, Kurt Roeckx wrote:
> There are a whole bunch of other issues and pull requests related to
> this. I hope this is the end of the regressions in the X509 code.

So there is something else now:
https://github.com/openssl/openssl/issues/13931
https://github.com/openssl/openssl/pull/13982


Kurt

[toc] | [prev] | [next] | [standalone]

#1045241

On 2021-01-28 00:28:03 [+0100], Kurt Roeckx wrote:
> On Thu, Jan 14, 2021 at 07:03:37PM +0100, Kurt Roeckx wrote:
> > There are a whole bunch of other issues and pull requests related to
> > this. I hope this is the end of the regressions in the X509 code.
> 
> So there is something else now:
> https://github.com/openssl/openssl/issues/13931
> https://github.com/openssl/openssl/pull/13982

So what is the plan here? Upload to unstable and prepare a pu once it
migrate to testing or right away?

> Kurt

Sebastian

[toc] | [prev] | [next] | [standalone]

#1045810

[Multipart message — attachments visible in raw view] — view raw

On 2021-01-29 20:35:52 [+0100], To Kurt Roeckx wrote:
> On 2021-01-28 00:28:03 [+0100], Kurt Roeckx wrote:
> > On Thu, Jan 14, 2021 at 07:03:37PM +0100, Kurt Roeckx wrote:
> > > There are a whole bunch of other issues and pull requests related to
> > > this. I hope this is the end of the regressions in the X509 code.
> > 
> > So there is something else now:
> > https://github.com/openssl/openssl/issues/13931
> > https://github.com/openssl/openssl/pull/13982
> 
> So what is the plan here? Upload to unstable and prepare a pu once it
> migrate to testing or right away?

fed to unstable, migrated to testing. The small diff towards the
previous is attached. I uploaded the whole thing (source package +
amd64 binary) to
	https://breakpoint.cc/openssl-pu.tar

in case someone wants to test.
I think the ship for this pu is sailing without me but I'm ready for the
next cruise :)
The complete diff vs the last package is comming soon.

> > Kurt

Sebastian

[toc] | [prev] | [next] | [standalone]

#1047563

On 2021-02-01 23:50:03 [+0100], To Kurt Roeckx wrote:
> in case someone wants to test.
> I think the ship for this pu is sailing without me but I'm ready for the
> next cruise :)

OpenSSL upstream announced [0] 1.1.1j for next Tuesday with a security
fix classified as MODERATE [1].

[0] https://mta.openssl.org/pipermail/openssl-announce/2021-February/000191.html
[1] https://www.openssl.org/policies/secpolicy.html#moderate

Sebastian

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web