[FFe] upgrade libzip to version 1.5.0

Bug #1674057 reported by tomasz
24
This bug affects 1 person
Affects Status Importance Assigned to Milestone
libzip (Debian)
Fix Released
Unknown
libzip (Ubuntu)
Fix Released
Wishlist
Unassigned

Bug Description

Feature Freeze Justification
============================
This release fixes to two CVE's and most notably has removed its custom AES crypto implementation with using openssl libraries. It is for the security reasons I am requesting this FFe this late in the cycle.

Other Changes:
- A bunch of bug fixes
- A number of new features like bzip2 (this optional and could be disabled for 18.04), improved AES encryption support, some of the new features are other platforms only
- Breaks API (only 1 symbol was removed though), soname bump, so will require a mini transition, all the 24 reverse-depends that I count are in universe. Some are seeded in flavours (see below)
- Build system switched to Cmake in latest release
- Ark will build with libzip support where it didnt before

Testing:
It has a fairly comprehensive test suite, all tests are now passing.

I have run a test rebuild for all the rdepends in ppa:darkxst/libzip. All built successfully, except for 2 packages, cbmc and plume-creater that had unrelated fallout due to gcc7 and other packaging changes (fixed on PPA).

Other Notes:
- Various fixes (rpath, man page syntax, leaky private symbols and pkg-config fixes) have been committed upstream and will be released soon in a 1.5.1 release, cherry-picked patches for now
- I will also push for the update into Debian

Build Logs:
https://launchpadlibrarian.net/363623662/buildlog_ubuntu-bionic-amd64.libzip_1.5.0-0ubuntu1~bionic6_BUILDING.txt.gz

Reverse-depends of libzip4 that are seeded:
ark (from ark) is seeded in:
  kubuntu: daily-live
  lubuntu-next: daily-live
ideviceinstaller is seeded in:
  ubuntu-mate: daily-live
libepub0 is seeded in:
  kubuntu: daily-live
  ubuntustudio: dvd
libpstoedit0c2a is seeded in:
  kubuntu: supported
okular-extra-backends is seeded in:
  kubuntu: daily-live

Upstream Changelog
==================
1.5.0 [2018-03-11]
==================

* Use standard cryptographic library instead of custom AES implementation.
  This also simplifies the license.
* Use `clang-format` to format the source code.
* More Windows improvements.

1.4.0 [2017-12-29]
==================

* Improve build with cmake
* Retire autoconf/automake build system
* Add `zip_source_buffer_fragment()`.
* Add support to clone unchanged beginning of archive (instead of rewriting it).
  Supported for buffer sources and on Apple File System.
* Add support for Microsoft Universal Windows Platform.

1.3.2 [2017-11-20]
==================
* Fix bug introduced in last: zip_t was erroneously freed if zip_close() failed.

1.3.1 [2017-11-19]
==================

* Install zipconf.h into ${PREFIX}/include
* Add zip_libzip_version()
* Fix AES tests on Linux

1.3.0 [2017-09-02]
==================

* Support bzip2 compressed zip archives
* Improve file progress callback code
* Fix zip_fdopen()
* CVE-2017-12858: Fix double free()
* CVE-2017-14107: Improve EOCD64 parsing

1.2.0 [2017-02-19]
==================

* Support for AES encryption (Winzip version), both encryption
  and decryption
* Support legacy zip files with >64k entries
* Fix seeking in zip_source_file if start > 0
* Add zip_fseek() for seeking in uncompressed data
* Add zip_ftell() for telling position in uncompressed data
* Add zip_register_progress_callback() for UI updates during zip_close()

1.1.3 [2016-05-28]
==================

* Fix build on Windows when using autoconf

affects: ubuntu → libzip (Ubuntu)
Revision history for this message
Brian Murray (brian-murray) wrote :

*** This is an automated message ***

This bug is tagged needs-packaging which identifies it as a request for a new package in Ubuntu. As a part of the managing needs-packaging bug reports specification, https://wiki.ubuntu.com/QATeam/Specs/NeedsPackagingBugs, all needs-packaging bug reports have Wishlist importance. Subsequently, I'm setting this bug's status to Wishlist.

Changed in libzip (Ubuntu):
importance: Undecided → Wishlist
Stephen Hope (stevehope)
Changed in libzip (Ubuntu):
status: New → In Progress
assignee: nobody → Stephen Hope (stevehope)
Revision history for this message
Miha Vrhovnik (mvrhov) wrote :

The version shipping with ubuntu is prehistoric. It would be really nice if the library is updated in upcoming 18.04 otherwise the LTS and all components relying on libzip e.g PHP will ship with this version for the next 5 years.

Revision history for this message
Tim Lunn (darkxst) wrote :

From a quick look not sure how feasible this is to get into Bionic this late in the cycle?

Quick Summary of changes (https://libzip.org/news/):
- There is a 1.3.2 build in Debian experimental, but hasnt progressed into unstable yet
- A couple of CVE fixes (these should probably be cherry-picked regardless)
- A bunch of bug fixes
- A number of new features like bzip2, improved AES encryption support, some of the new features are other platforms only
- Breaks API, soname bump, so will require a mini transition, all the 23-odd reverse-depends that I count are in universe though. Have not yet checked if any of these are affected by the API changes or can just be rebuilt.
- they appear to have dropped their custom AES implementation in favour of using openssl (this should be a plus!)
- Build system switched to Cmake in latest release

Revision history for this message
Rik Mills (rikmills) wrote :

No tracker for us yet, but the debian one is here: https://release.debian.org/transitions/html/auto-libzip.html

Jeremy Bícha (jbicha)
Changed in libzip (Ubuntu Bionic):
assignee: Stephen Hope (stevehope) → nobody
Tim Lunn (darkxst)
summary: - [needs packaging] upgrade libzip to version 1.20
+ [FFe] upgrade libzip to version 1.5.0
Tim Lunn (darkxst)
description: updated
Tim Lunn (darkxst)
description: updated
Jeremy Bícha (jbicha)
Changed in libzip (Ubuntu Bionic):
status: In Progress → New
no longer affects: libzip (Ubuntu Bionic)
tags: added: bionic
Tim Lunn (darkxst)
description: updated
Changed in libzip (Debian):
status: Unknown → New
Tim Lunn (darkxst)
description: updated
Revision history for this message
Tim Lunn (darkxst) wrote :

I have been liasing with upstream to sort of the few remaining issues, they have been super responsive, and for the the most part those are fixed upstream, I will update the packaging with upstream fixes once I get back into range of a power point! in the next day or three.

Revision history for this message
Tim Lunn (darkxst) wrote :
description: updated
Revision history for this message
Tim Lunn (darkxst) wrote :

I have created a transition tracker (copied from Debian)
http://people.canonical.com/~ubuntu-archive/transitions/html/libzip.html

Revision history for this message
Tim Lunn (darkxst) wrote :

Packaging should be good to go now, pending FFe approval. All remaining debian/patches are upstream cherry-picks that will be included in next upstream release.

Revision history for this message
Tim Lunn (darkxst) wrote :

I landed this in a silo, at Laney's request.

https://bileto.ubuntu.com/#/ticket/3230

ignition-fuel-tools:s390x is dep wait, as it also is in the archive, everything else built fine on all arches.

Revision history for this message
Tim Lunn (darkxst) wrote :

also includes libzip 1.5.1 release from today

Jeremy Bícha (jbicha)
Changed in libzip (Ubuntu):
status: New → Fix Committed
Revision history for this message
Jeremy Bícha (jbicha) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package libzip - 1.5.1-0ubuntu1

---------------
libzip (1.5.1-0ubuntu1) disco; urgency=medium

  * New upstream release (LP: #1674057) (Closes: #894813)
    - Removes custom AES implementation in favour of using standard crypto libs
  * Build with cmake, autotools support was dropped.
  * Bump debhelper to compat 11
  * debian/control
    - Add Build-dep on libssl-dev and libbz2-dev
  * debian/libzip5.symbols: Update with new symbols
  * debian/rules:
    - Clean up Multi-arch support
    - set dh_missing to --fail-missing
    - Drop flags obsolete with dh 11
    - Strip -Bsymbolic-functions link flag as it causes test failures
  * debian/libzip-dev.install: don't install static lib, its not built now
  * debian/libzip5.lintian-overrides:
    - override possible-gpl-code-linked-with-openssl, libzip is BSD licensed
       only the debian packaging is licensed under GPLv3
  * debian/copyright: Update to reflect removed code

 -- Tim Lunn <email address hidden> Tue, 27 Nov 2018 10:51:36 +1000

Changed in libzip (Ubuntu):
status: Fix Committed → Fix Released
Changed in libzip (Debian):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.