Merge ~ahasenack/ubuntu/+source/freeradius:oracular-freeradius-replace-radsecret into ubuntu/+source/freeradius:ubuntu/devel

[Andreas Hasenack]

Replace the radsecret perl script with a bash variant to avoid pulling in two new perl dependencies which are in universe and would trigger a component mismatch.

The bug also has two other python suggestions, but I think this is simpler, bar any glaring security vulnerability. I did ask #security internally for a quick check, Got one +1, waiting on another.

Upstream also suggested in our bug to just drop this script, as it's not used internally by anything else, so that's also an option.

The tools I used in the script (base32, td, dd) are in the coreutils package, which is of priority "required", so no new dependency has to be added to the package.

PPA building at https://launchpad.net/~ahasenack/+archive/ubuntu/freeradius

[Mitchell Dzurick (mitchdz)]

Reading the perl function[0] there is error messages indicating checking that enough randomness was gathered (RtlGenRand failed).

/dev/urandom does guarantee non-blocking data, so this should be fine. I just want to point out there is a potential of missing some checks from the perl library, but in this case it should be safe to rely on the device for providing enough data.

[0] - https://manpages.debian.org/testing/libcrypt-urandom-perl/Crypt::URandom.3pm.en.html

[Mitchell Dzurick (mitchdz)]

Overall this gets my +1 too

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, mitchdz
Uploaders: ahasenack, mitchdz
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Test passed.
Debian asked me if I could send this upstream, otherwise debian is reluctant to take this change.

[Andreas Hasenack (ahasenack)]

Upstream PR at https://github.com/FreeRADIUS/freeradius-server/pull/5375.

Even if accepted, it will be a while before a new release, so I'm proceeding with this PR and uploading the package to Oracular.

[Andreas Hasenack (ahasenack)]

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading freeradius_3.2.5+dfsg-2ubuntu1.dsc: done.
  Uploading freeradius_3.2.5+dfsg-2ubuntu1.debian.tar.xz: done.
  Uploading freeradius_3.2.5+dfsg-2ubuntu1_source.buildinfo: done.
  Uploading freeradius_3.2.5+dfsg-2ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index c2b555a..460cd61 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+freeradius (3.2.5+dfsg-2ubuntu1) oracular; urgency=medium
+
+  * Don't depend on perl modules from universe (LP: #2073269):
+    - d/p/replace-radsecret.patch: replace radsecret, which is in perl,
+      with a Bash variant, to avoid pulling in two new perl dependencies
+      which are in Universe
+    - d/control: drop explicit dependency on libconvert-base32-perl and
+      libcrypt-urandom-perl
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 16 Jul 2024 16:30:16 -0300
+
 freeradius (3.2.5+dfsg-2) unstable; urgency=medium
 
   * Fix parallel builds
diff --git a/debian/control b/debian/control
index 7e6523d..5ac6ab8 100644
--- a/debian/control
+++ b/debian/control
@@ -31,7 +31,8 @@ Build-Depends: debhelper-compat (= 13),
                snmp
 Section: net
 Priority: optional
-Maintainer: Debian FreeRADIUS Packaging Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian FreeRADIUS Packaging Team <[e-mail]>
 Uploaders: Mark Hymers <[e-mail]>,
            Sam Hartman <[e-mail]>,
            Bernhard Schmidt <[e-mail]>
@@ -98,8 +99,6 @@ Conflicts: radiusd-livingston, yardradius
 Depends: freeradius-common,
          freeradius-config,
          libfreeradius3 (= ${binary:Version}),
-         libconvert-base32-perl,
-         libcrypt-urandom-perl,
          ${dist:Depends},
          ${misc:Depends},
          ${perl:Depends},
diff --git a/debian/patches/replace-radsecret.patch b/debian/patches/replace-radsecret.patch
new file mode 100644
index 0000000..0cc236d
--- /dev/null
+++ b/debian/patches/replace-radsecret.patch
@@ -0,0 +1,25 @@
+Description: replace radsecret with a Bash variant
+ This avoids adding two perl dependencies which are in Universe, and trigger a
+ component mismatch in Ubuntu.
+ Use 13 bytes instead of 12, due to
+ https://bugs.launchpad.net/ubuntu/+source/freeradius/+bug/2073269/comments/6
+Author: Andreas Hasenack <[e-mail]>
+Bug-Debian: https://bugs.debian.org/1076458
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/freeradius/+bug/2073269
+Last-Update: 2024-07-16
+
+diff --git a/src/main/radsecret b/src/main/radsecret
+index 2a03a2e7bc..8b7b5f0abe 100755
+--- a/src/main/radsecret
++++ b/src/main/radsecret
+@@ -1,7 +1,3 @@
+-#!/usr/bin/env perl
+-#
+-#  A tool which generates strong shared secrets.
+-#
+-use Convert::Base32;
+-use Crypt::URandom();
+-print join('-', unpack("(A4)*", lc encode_base32(Crypt::URandom::urandom(12)))), "\n";
++#!/bin/bash
++data=$(dd if=/dev/urandom bs=1 count=13 2>/dev/null| base32 | tr 'A-Z' 'a-z')
++echo ${data:0:4}-${data:4:4}-${data:8:4}-${data:12:4}-${data:16:4}
diff --git a/debian/patches/series b/debian/patches/series
index 5dfbaa2..b367578 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -6,3 +6,4 @@ debian-local/0010-version.c-disable-openssl-version-check.patch
 dont-install-tests.diff
 snakeoil-certs.diff
 fix-parallel-build.patch
+replace-radsecret.patch