Merge ~ahasenack/ubuntu/+source/libpam-ccreds:artful-libpam-ccreds-init-gcrypt-869166 into ~usd-import-team/ubuntu/+source/libpam-ccreds:ubuntu/devel

[Andreas Hasenack]

Initialize libgcrypt before calling any of its functions. The patch was slightly modified by me to check if the library wasn't initialised already using the advice in "2.4 Initializing the library" of the gcrypt info page. Also see https://lists.gnupg.org/pipermail/gcrypt-devel/2003-August/000458.html for the same advice.

I forwarded the patch via email to <email address hidden>. The bugzilla link at the bottom of their page just redirects back to the main site.

UPDATE Jul 20th: patch was accepted by upstream: https://github.com/PADL/pam_ccreds/commit/3fa53ee374e4712643f988ef74bd6d52a6fe0c12. Upstream also confirmed via email that the software is essentially unmaintained.

Test instructions:
* in an artful container/kvm, install libpam-ccreds:
$ sudo apt install libpam-ccreds

* in one terminal, tail -f /var/log/syslog

* in another terminal, run:
$ sudo cc_test -store any ubuntu ubuntu
pam_cc_store_credentials: Success

* Observe that the syslog file gets this warning:
Jul 20 19:13:59 artful-ccreds-test cc_test: Libgcrypt warning: missing initialization - please fix the application

* Install the fixed package. Build it yourself and install, or add this ppa (you may have to sudo apt install software-properties-common):
$ sudo add-apt-repository -y -u ppa:ahasenack/pam-ccreds-initialize-gcrypt-869166 && sudo apt install libpam-ccreds

* Rerun the cc_test command. This time there should be no warning in syslog. Also, since you ran this command before with the -store action, you can try it now with the -validate action:
$ sudo cc_test -validate any ubuntu ubuntu
pam_cc_validate_credentials: Success

a82dd90... by Andreas Hasenack on 2017-07-20

update-maintainer

[ChristianEhrhardt (paelzer)]

Code, Dep8, Changelog all looks good to me.
Thanks to forward the change as well.
Finally I also tested the proposed fix form the ppa and the fix as well as the steps to trigger were perfect.

Also given the update frequency on this in the past it is unlikely we have to merge this very often. And since Debian knows about the bug all is fine.

Thanks Andreas, approving

review: Approve

[Andreas Hasenack (ahasenack)]

Patch was accepted and merged upstream:

https://github.com/PADL/pam_ccreds/commit/3fa53ee374e4712643f988ef74bd6d52a6fe0c12

cbc9787... by Andreas Hasenack on 2017-07-28

  * d/p/0003-initialize-libgcrypt.patch: updated the DEP3 header noting
    via Applied-Upstream that the patch was accepted.

[Robie Basak (racb)]

I appreciate the attention to detail - Debian and Ubuntu bug references in both the changelog and dep3 header, and the descriptive explanation in the patch. Thanks!

review: Approve

diff --git a/debian/changelog b/debian/changelog
index e13fdae..f72a10d 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,10 @@
+libpam-ccreds (10-6ubuntu1) artful; urgency=medium
+
+  * debian/patches/0003-initialize-libgcrypt.patch: Initialize gcrypt
+    before usage.  Closes: #645229, LP: #869166.
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 20 Jul 2017 14:54:06 -0300
+
 libpam-ccreds (10-6build1) vivid; urgency=medium
 
   * No-change rebuild for the libgcrypt20 transition.
diff --git a/debian/control b/debian/control
index 6c70f42..db04d58 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: libpam-ccreds
 Section: admin
 Priority: extra
-Maintainer: Guido Günther <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Guido Günther <[e-mail]>
 Build-Depends: debhelper (>= 7), autotools-dev, libgcrypt11-dev,  libpam0g-dev, libdb-dev, cdbs
 Standards-Version: 3.8.4
 Homepage: http://www.padl.com/OSS/pam_ccreds.html
diff --git a/debian/patches/0003-initialize-libgcrypt.patch b/debian/patches/0003-initialize-libgcrypt.patch
new file mode 100644
index 0000000..17bc64e
--- /dev/null
+++ b/debian/patches/0003-initialize-libgcrypt.patch
@@ -0,0 +1,33 @@
+Description: Initialize gcrypt before usage
+ Initialize libgcrypt before calling any of its functions.  The patch was
+ slightly modified by Andreas Hasenack to check if the library wasn't
+ initialized already using the advice in "2.4 Initializing the library" of the
+ gcrypt info page. Also see
+ https://lists.gnupg.org/pipermail/gcrypt-devel/2003-August/000458.html for
+ the same advice.
+Author: Juha Sahakangas <[e-mail]>
+Author: Andreas Hasenack <[e-mail]>
+Bug-Debian: https://bugs.debian.org/645229
+Bug-Ubuntu: https://launchpad.net/bugs/869166
+Forwarded: yes, emailed [e-mail]
+Applied-Upstream: https://github.com/PADL/pam_ccreds/commit/3fa53ee374e4712643f988ef74bd6d52a6fe0c12
+Last-Update: 2017-07-28
+
+--- a/cc_lib.c
++++ b/cc_lib.c
+@@ -38,6 +38,15 @@
+ #ifdef HAVE_OPENSSL_OPENSSLCONF_H
+ 	SHA_CTX sha_ctx;
+ #else
++    if (!gcry_control (GCRYCTL_ANY_INITIALIZATION_P)) {
++        if (!gcry_check_version (NULL)) {
++            syslog (LOG_ERR, "pam_ccreds: failed to initialize libgcrypt");
++            return PAM_SERVICE_ERR;
++        }
++        gcry_control (GCRYCTL_DISABLE_SECMEM, 0);
++        gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
++    }
++
+ 	gcry_md_hd_t handle;
+ #endif
+ 	unsigned char T[4];
diff --git a/debian/patches/series b/debian/patches/series
index 9ace237..4ae2da6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,3 @@
 0001-make-sure-we-don-t-overflow-the-data-buffer.patch
 0002-add-minimum_uid-option.patch
+0003-initialize-libgcrypt.patch