Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.boot > #63330 > unrolled thread

Bug#959469: buster-pu: package openssl/1.1.1g-1

Back to article view | Back to linux.debian.maint.boot

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2020-05-02 21:40 +0200
    Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2020-05-02 22:40 +0200
      Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2020-05-02 23:40 +0200
        Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2020-11-20 18:30 +0100
          Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2020-11-20 21:10 +0100
            Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2020-11-24 21:30 +0100
              Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2020-11-24 22:00 +0100
              Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-09 00:20 +0100
                Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-14 18:50 +0100
                  Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-14 19:10 +0100
                    Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-14 21:20 +0100
                      Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-16 19:20 +0100
                        Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-21 21:10 +0100
                          Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-22 17:50 +0100
                            Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-24 12:30 +0100
                            Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-24 13:10 +0100
                            Bug#959469: buster-pu: package openssl/1.1.1g-1 "Adam D. Barratt" <adam@adam-barratt.org.uk> - 2021-01-25 19:00 +0100
                              Bug#959469: buster-pu: package openssl/1.1.1g-1 Cyril Brulebois <kibi@debian.org> - 2021-01-25 20:10 +0100
                                Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-25 21:10 +0100
                    Bug#959469: buster-pu: package openssl/1.1.1g-1 Kurt Roeckx <kurt@roeckx.be> - 2021-01-28 00:40 +0100
                      Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-01-29 20:40 +0100
                        Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-02-02 00:00 +0100
                          Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-02-10 22:00 +0100
                            Re: Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-03-22 19:50 +0100
                              Bug#959469: buster-pu: package openssl/1.1.1g-1 Sebastian Andrzej Siewior <sebastian@breakpoint.cc> - 2021-03-22 20:00 +0100

Page 1 of 2  [1] 2  Next page →

#63330 — Bug#959469: buster-pu: package openssl/1.1.1g-1

On Sat, 2020-05-02 at 18:36 +0200, Sebastian Andrzej Siewior wrote:
> I'm fairly late, I know.

Just a little. :-( Particularly as OpenSSL builds udebs.

CCing KiBi and -boot so they're aware of the discussion, but this does
come quite late.

> The last update was addressed via DSA providing only a patch for the
> CVE with severity high. This pu updates Buster's OpenSSL version from
> `d' to current `g' fixing CVE-2019-1551 which was earlier skipped due
> to its low severity. 
> The "EOF" bug-fix-regression introduced in `e' is reverted again in
> `g'.
> OpenSSL now checks certificates more strictly. There should be no
> problems with "officially" issued certificats but some certificates
> contain an invalid (combination of) attributes which are now. The `g'
> version is since 25th April in testing and received no bug reports
> but OpenSSL upstream received [0], [1] for custom issued OpenVPN
> certificates.
> Please find attached a compressed debdiff since last security update.
> 
> [0] https://github.com/openssl/openssl/issues/11456
> [1] https://github.com/openssl/openssl/issues/11625

Do we have any feeling for how widespread such certificates might be?
The fact that there have been two different upstream reports isn't
particularly comforting.

Regards,

Adam

[toc] | [next] | [standalone]

#63331

On 2020-05-02 20:32:01 [+0100], Adam D. Barratt wrote:
> On Sat, 2020-05-02 at 18:36 +0200, Sebastian Andrzej Siewior wrote:
> > I'm fairly late, I know.
> 
> Just a little. :-( Particularly as OpenSSL builds udebs.
> 
> CCing KiBi and -boot so they're aware of the discussion, but this does
> come quite late.

Yes, I know. I'm won't cry if this skips this pu, I just couldn't get
earlier to it.

> Do we have any feeling for how widespread such certificates might be?
> The fact that there have been two different upstream reports isn't
> particularly comforting.

This is correct. I don't know if there is tooling that is generating
broken certificates or just some individuals. I updated my two OpenVPN
instances and I saw clients connecting again.

> Regards,
> 
> Adam

Sebastian

[toc] | [prev] | [next] | [standalone]

#63332

On Sat, 2020-05-02 at 22:29 +0200, Sebastian Andrzej Siewior wrote:
> On 2020-05-02 20:32:01 [+0100], Adam D. Barratt wrote:
> > On Sat, 2020-05-02 at 18:36 +0200, Sebastian Andrzej Siewior wrote:
> > > I'm fairly late, I know.
> > 
> > Just a little. :-( Particularly as OpenSSL builds udebs.
> > 
> > CCing KiBi and -boot so they're aware of the discussion, but this
> > does
> > come quite late.
> 
> Yes, I know. I'm won't cry if this skips this pu, I just couldn't get
> earlier to it.

OK. To be honest, at this stage I would be happier looking at this for
10.5 than 10.4.

> > Do we have any feeling for how widespread such certificates might
> > be?
> > The fact that there have been two different upstream reports isn't
> > particularly comforting.
> 
> This is correct. I don't know if there is tooling that is generating
> broken certificates or just some individuals. I updated my two
> OpenVPN instances and I saw clients connecting again.

Thanks for the information.

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#64717

On Sun, 2020-11-15 at 11:29 +0100, Sebastian Andrzej Siewior wrote:
> control: retitle -1 buster-pu: package openssl/1.1.1h-1
> 
> On 2020-05-02 22:34:40 [+0100], Adam D. Barratt wrote:
> > > > Do we have any feeling for how widespread such certificates
> > > > might be?
> > > > The fact that there have been two different upstream reports
> > > > isn't particularly comforting.
> > > 
> > > This is correct. I don't know if there is tooling that is
> > > generating broken certificates or just some individuals. I
> > > updated my two OpenVPN instances and I saw clients connecting
> > > again.
> > 
> > Thanks for the information.
> 
> look at that. I deployed it locally and forgot all about it. Now I
> was going to open a pu for 1.1.1h and noticed that I didn't finish
> this one.
> 
> I hereby propose an update to 1.1.1h.

Predictably we're again quite close to a point release. :-( (One week
from freeze, specifically.)

Looking at the upstream issues regarding certificate validation changes
between 1.1.1e and f/g, #11456 appears to have been addressed already,
but #11625 is still open and looks stalled. Have you seen any more
reports of that issue?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#64720

On 2020-11-20 17:24:30 [+0000], Adam D. Barratt wrote:
> Predictably we're again quite close to a point release. :-( (One week
> from freeze, specifically.)

oh.

> Looking at the upstream issues regarding certificate validation changes
> between 1.1.1e and f/g, #11456 appears to have been addressed already,
> but #11625 is still open and looks stalled. Have you seen any more
> reports of that issue?

Not that I am aware of.

I don't want to rush anything. I have no problem to delay this until
after the point release if you prefer to do so.

> Regards,
> 
> Adam

Sebastian

[toc] | [prev] | [next] | [standalone]

#64746

On Fri, 2020-11-20 at 21:04 +0100, Sebastian Andrzej Siewior wrote:
> On 2020-11-20 17:24:30 [+0000], Adam D. Barratt wrote:
> > Predictably we're again quite close to a point release. :-( (One
> > week from freeze, specifically.)
> 
> oh.

In fairness, given an approximately two month cycle, we're never /that/
far away from a point release. But some points are obviously closer
than others.

> > Looking at the upstream issues regarding certificate validation
> > changes between 1.1.1e and f/g, #11456 appears to have been
> > addressed already, but #11625 is still open and looks stalled. Have
> > you seen any more reports of that issue?
> 
> Not that I am aware of.

OK, thanks.

> I don't want to rush anything. I have no problem to delay this until
> after the point release if you prefer to do so.

That would be preferable at this point, yes, sorry. We should try and
make sure it's sorted soon afterwards though, to avoid things getting
stuck again.

At some point, could we please have a combined / single diff between
the current 1.1.1d-0+deb10u3 and the proposed 1.1.1h-0+deb10u1 (I
assume)?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#64747

On 2020-11-24 20:18:15 [+0000], Adam D. Barratt wrote:
> That would be preferable at this point, yes, sorry. We should try and
> make sure it's sorted soon afterwards though, to avoid things getting
> stuck again.

I will set up an alarm on my side :)

> At some point, could we please have a combined / single diff between
> the current 1.1.1d-0+deb10u3 and the proposed 1.1.1h-0+deb10u1 (I
> assume)?

Sure. I will prepare one tomorrow.

> Regards,
> 
> Adam

Sebastian

[toc] | [prev] | [next] | [standalone]

#65019

On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior wrote:
> On 2020-11-24 20:18:15 [+0000], Adam D. Barratt wrote:
> 
> > At some point, could we please have a combined / single diff between
> > the current 1.1.1d-0+deb10u3 and the proposed 1.1.1h-0+deb10u1 (I
> > assume)?
> 
> Please find attached the diff between 1.1.1d-0+deb10u4 and the proposed
> 1.1.1i-0+deb10u1.
> 
> The i release in unstable managed to migrate to testing. It was blocked
> due to ci by m2crypto and swi-prolog. The swi-prolog issue got fixed in
> unstable (the testuite was updated) and is not an issue in stable (the
> package builds, the testsuite gets ignored).
> The m2crypto issue is a different story and is still open in BTS
> (#977655). I *think* someone added an override or the ci-system was kind
> to Kurt/me and looked the other way :)
> The m2crypto package in stable and bpo will FTBFS with the updated
> openssl package.
> 
> I'm not aware of other issues.

I think there are at least 2 upstream issues since the 1.1.1i
release we want to fix first. As far as I know, they haven't been
fixed upstream yet.


Kurt

[toc] | [prev] | [next] | [standalone]

#65048

Hi,

On Fri, 2021-01-08 at 23:59 +0100, Kurt Roeckx wrote:
> On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior
> wrote:
[...]
> > The i release in unstable managed to migrate to testing. It was
> > blocked due to ci by m2crypto and swi-prolog. The swi-prolog issue
> > got fixed in unstable (the testuite was updated) and is not an
> > issue in stable (the package builds, the testsuite gets ignored).
> > The m2crypto issue is a different story and is still open in BTS
> > (#977655). I *think* someone added an override or the ci-system was
> > kind to Kurt/me and looked the other way :)
> > The m2crypto package in stable and bpo will FTBFS with the updated
> > openssl package.
> > 
> > I'm not aware of other issues.
> 
> I think there are at least 2 upstream issues since the 1.1.1i
> release we want to fix first. As far as I know, they haven't been
> fixed upstream yet.

Just to confirm, these are issues that you'd want to have fixed before
adding 1.1.1i to stable, presumably requiring further uploads to
unstable first?

Do you have pointers to upstream issues?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#65050

On Thu, Jan 14, 2021 at 05:43:00PM +0000, Adam D. Barratt wrote:
> Hi,
> 
> On Fri, 2021-01-08 at 23:59 +0100, Kurt Roeckx wrote:
> > On Fri, Jan 08, 2021 at 11:39:13PM +0100, Sebastian Andrzej Siewior
> > wrote:
> [...]
> > > The i release in unstable managed to migrate to testing. It was
> > > blocked due to ci by m2crypto and swi-prolog. The swi-prolog issue
> > > got fixed in unstable (the testuite was updated) and is not an
> > > issue in stable (the package builds, the testsuite gets ignored).
> > > The m2crypto issue is a different story and is still open in BTS
> > > (#977655). I *think* someone added an override or the ci-system was
> > > kind to Kurt/me and looked the other way :)
> > > The m2crypto package in stable and bpo will FTBFS with the updated
> > > openssl package.
> > > 
> > > I'm not aware of other issues.
> > 
> > I think there are at least 2 upstream issues since the 1.1.1i
> > release we want to fix first. As far as I know, they haven't been
> > fixed upstream yet.
> 
> Just to confirm, these are issues that you'd want to have fixed before
> adding 1.1.1i to stable, presumably requiring further uploads to
> unstable first?

Yes.

> Do you have pointers to upstream issues?

They both got merged today:
commit 76ed0c0ad119569f6e6f6c96b27b76d3b110413b (origin/OpenSSL_1_1_1-stable)
Author: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date:   Mon Dec 28 11:25:59 2020 +0100

    x509_vfy.c: Fix a regression in find_isser()

    ...in case the candidate issuer cert is identical to the target cert.

    Fixes #13739

    Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
    (Merged from https://github.com/openssl/openssl/pull/13749)

commit fb1e2411042f0367c2560e4ec5e4b1189ca9cd45
Author: Dr. David von Oheimb <David.von.Oheimb@siemens.com>
Date:   Wed Dec 30 09:57:49 2020 +0100

    X509_cmp(): Fix comparison in case x509v3_cache_extensions() failed to due to invalid cert

    This is the backport of #13755 to v1.1.1.
    Fixes #13698

    Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
    (Merged from https://github.com/openssl/openssl/pull/13756)


There are a whole bunch of other issues and pull requests related to
this. I hope this is the end of the regressions in the X509 code.


Kurt

[toc] | [prev] | [next] | [standalone]

#65055

On 2021-01-14 19:03:37 [+0100], Kurt Roeckx wrote:
> > Do you have pointers to upstream issues?
> 
> There are a whole bunch of other issues and pull requests related to
> this. I hope this is the end of the regressions in the X509 code.

Okay. Please ping once this gets sorted out and I will prepease
unstalbe/stable uploads. The m2crypto issue got resolved in unstable
\o/.

> Kurt

Sebastianc

[toc] | [prev] | [next] | [standalone]

#65071

On Thu, Jan 14, 2021 at 09:13:49PM +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-14 19:03:37 [+0100], Kurt Roeckx wrote:
> > > Do you have pointers to upstream issues?
> > 
> > There are a whole bunch of other issues and pull requests related to
> > this. I hope this is the end of the regressions in the X509 code.
> 
> Okay. Please ping once this gets sorted out and I will prepease
> unstalbe/stable uploads. The m2crypto issue got resolved in unstable
> \o/.

So I went over the open issues and pull requests, and currently
don't see a reason not to upload it to unstable with those 2
patches. I don't know about any other regressions in 1.1.1.


Kurt

[toc] | [prev] | [next] | [standalone]

#65133

On 2021-01-16 19:14:53 [+0100], Kurt Roeckx wrote:
> So I went over the open issues and pull requests, and currently
> don't see a reason not to upload it to unstable with those 2
> patches. I don't know about any other regressions in 1.1.1.

The openssl package migrated to testing.
I would prepare the pu package for Buster. Should I post here the
complete diff or an incremental containing only the new patches?
Once the openssl pu is acked I would open a pu for m2crypto. Or should
it be done now? (just asking).

> Kurt

Sebastian

[toc] | [prev] | [next] | [standalone]

#65149

On Thu, 2021-01-21 at 21:06 +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-16 19:14:53 [+0100], Kurt Roeckx wrote:
> > So I went over the open issues and pull requests, and currently
> > don't see a reason not to upload it to unstable with those 2
> > patches. I don't know about any other regressions in 1.1.1.
> 
> The openssl package migrated to testing.
> I would prepare the pu package for Buster. Should I post here the
> complete diff or an incremental containing only the new patches?

Both would be good, please.

FWIW we're also fighting the clock (yet) again, as we're now a week
away from the freeze for the 10.8 point release. ("Yay"!)

> Once the openssl pu is acked I would open a pu for m2crypto. Or
> should it be done now? (just asking).

Assuming that a patched m2crypto will also build fine against openssl
1.1.1d, then there's no reason that the two shouldn't proceed in
parallel (i.e. feel free to file the m2crypto request already).

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#65155

[Multipart message — attachments visible in raw view] — view raw

On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> Both would be good, please.

here is the with the two additional patches.

Sebastian

[toc] | [prev] | [next] | [standalone]

#65156

On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> Assuming that a patched m2crypto will also build fine against openssl
> 1.1.1d, then there's no reason that the two shouldn't proceed in
> parallel (i.e. feel free to file the m2crypto request already).

Yes, it does. Bug filled. Thank you.

> Regards,
> 
> Adam

Sebastian

[toc] | [prev] | [next] | [standalone]

#65164

On Sun, 2021-01-24 at 12:25 +0100, Sebastian Andrzej Siewior wrote:
> On 2021-01-22 16:38:28 [+0000], Adam D. Barratt wrote:
> > Both would be good, please.
> 
> Here is the complete diff against the last openssl release in Buster.

Thanks.

I realise that this has been dragging on for quite some time now, and
apologies again for my part in that. My (possibly overly paranoid)
concern right now is that if we aim for including 1.1.1i in 10.8,
there's less than a week of the upload window remaining for any testing
to happen and issues to be flagged up.

While I can't see any reason that packages in general should end up
with dependencies on 1.1.1i specifically, the debian-installer rebuild
for the point release will end up pulling in whichever version of
OpenSSL is in p-u at the time. That implies that we can't simply not
include the update if it's in p-u and blocking issues show up.

KiBi - I'm assuming that it would be much easier for you to check d-i
against the new OpenSSL version if it were already in p-u?

Regards,

Adam

[toc] | [prev] | [next] | [standalone]

#65165

[Multipart message — attachments visible in raw view] — view raw

Adam D. Barratt <adam@adam-barratt.org.uk> (2021-01-25):
> KiBi - I'm assuming that it would be much easier for you to check d-i
> against the new OpenSSL version if it were already in p-u?

Not really *much* easier, to be honest. I can definitely build a package
locally given a source debdiff, or slightly better, given a source
package I can run dget against (since we're talking about new upstream
releases, by the looks of it), and do whatever testing with the
generated packages built into d-i and/or fetched from the network as
required (similarly to what's done for the various kernel udebs).

IOW that can be tested before even having to make a decision regarding a
possible acceptance into p-u.


Cheers,
-- 
Cyril Brulebois (kibi@debian.org)            <https://debamax.com/>
D-I release manager -- Release team member -- Freelance Consultant

[toc] | [prev] | [next] | [standalone]

#65166

[Multipart message — attachments visible in raw view] — view raw

On 2021-01-25 19:57:18 [+0100], Cyril Brulebois wrote:
> Not really *much* easier, to be honest. I can definitely build a package
> locally given a source debdiff, or slightly better, given a source
> package I can run dget against (since we're talking about new upstream
> releases, by the looks of it), and do whatever testing with the
> generated packages built into d-i and/or fetched from the network as
> required (similarly to what's done for the various kernel udebs).
> 
> IOW that can be tested before even having to make a decision regarding a
> possible acceptance into p-u.

in case it helps, I uploaded
  https://breakpoint.cc/openssl-pu.tar

| $ sha512sum openssl-pu.tar 
| 1a3df2e37aa9312a378046691794bf7d7d72570ed9ade7ffbf50f87c8c8a7dd5e671a7f704fc4f1ebdbada1dda3007a5db24b426deefd33fff39b81e7be38aa3  openssl-pu.tar

containing the source package and amd64 packages.

> Cheers,

Sebastian

[toc] | [prev] | [next] | [standalone]

#65172

On Thu, Jan 14, 2021 at 07:03:37PM +0100, Kurt Roeckx wrote:
> There are a whole bunch of other issues and pull requests related to
> this. I hope this is the end of the regressions in the X509 code.

So there is something else now:
https://github.com/openssl/openssl/issues/13931
https://github.com/openssl/openssl/pull/13982


Kurt

[toc] | [prev] | [next] | [standalone]

Page 1 of 2  [1] 2  Next page →

Back to top | Article view | linux.debian.maint.boot

csiph-web