Merge ~adrien/ubuntu/+source/openssl:plucky-lp-2066990 into ubuntu/+source/openssl:ubuntu/devel

[Adrien Nader]

Please review this merge request.

# 📊 PPA
A PPA is available at:
 https://launchpad.net/~adrien/+archive/ubuntu/plucky-openssl-lp-2066990

# 🧪 Autopkgtest results
- ✅ openssl on plucky for amd64 @ 27.11.24 13:31:08
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/amd64/o/openssl/20241127_133108_33cec@/log.gz
- ✅ openssl on plucky for arm64 @ 27.11.24 13:32:34
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/arm64/o/openssl/20241127_133234_67c49@/log.gz
- ✅ openssl on plucky for armhf @ 27.11.24 13:33:42
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/armhf/o/openssl/20241127_133342_477b4@/log.gz
- ✅ openssl on plucky for i386 @ 27.11.24 14:49:43
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/i386/o/openssl/20241127_144943_56cd8@/log.gz
- ✅ openssl on plucky for ppc64el @ 27.11.24 13:36:31
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/ppc64el/o/openssl/20241127_133631_44e0c@/log.gz
- ✅ openssl on plucky for s390x @ 27.11.24 13:31:09
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-plucky-adrien-plucky-openssl-lp-2066990/plucky/s390x/o/openssl/20241127_133109_fceb6@/log.gz

# 🔍 Lintian diff from most recent published package
No relevant lintian change.

[Simon Chopin (schopin)]

It could go as is, but I do have a couple of suggestions to make it even better IMHO ;)

bee7392... by Adrien Nader on 2024-12-13

reconstruct-changelog

[Adrien Nader (adrien)]

I've updated the changelog to make it clearer that an existing patch is modified.

I've kept the message unchanged due to the reason I pointed out earlier: openssl itself inserts an "error:" into the string.

Since there will probably be a change needed for m2crypto's FTBFS (swig + select), maybe we don't want to upload this now. I'll let you be the judge for that but I'd appreciate a +1 in the MR so that I know that no further change will be needed here (except probably to merge changelogs :) ).

[Adrien Nader (adrien)]

For the record, Simon acked the change out-of-band (thanks!). I may also have a fix for m2crypto's FTBFS which doesn't depend on changing openssl and what I said above may not be necessary but I'll only know in a couple days when I do more tests.

diff --git a/debian/changelog b/debian/changelog
index 17f7b45..1907b71 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+openssl (3.4.0-1ubuntu2) plucky; urgency=medium
+
+  * d/p/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch:
+    Extend the patch to print the error encounted when a fallback
+    provider fails loading, e.g. due to FIPS auto-loading (LP: #2066990)
+
+ -- Adrien Nader <[e-mail]>  Fri, 13 Dec 2024 12:44:42 +0100
+
 openssl (3.4.0-1ubuntu1) plucky; urgency=medium
 
   * Merge with Debian unstable (LP: #2044795). Remaining changes:
diff --git a/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch b/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
index d8a18f8..9c7f741 100644
--- a/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
+++ b/debian/patches/fips/crypto-Automatically-use-the-FIPS-provider-when-the-kerne.patch
@@ -78,6 +78,17 @@ provider.
          OSSL_PROVIDER *prov = NULL;
  
          if (!p->is_fallback)
+@@ -1401,6 +1401,10 @@ static int provider_activate_fallbacks(struct provider_store_st *store)
+     }
+  err:
+     CRYPTO_THREAD_unlock(store->lock);
++    if (!ret)
++        fprintf(stderr, "While loading \"%s\" provider: %s\n",
++            (p != NULL ? p->name : "<unknown>"),
++            ERR_error_string(ERR_peek_last_error(), NULL));
+     return ret;
+ }
+ 
 --- a/crypto/provider_local.h
 +++ b/crypto/provider_local.h
 @@ -23,7 +23,7 @@