Merge ~bryce/ubuntu/+source/dovecot:merge-v1e2.3.19.1adfsg1-2-kinetic into ubuntu/+source/dovecot:debian/sid

[Bryce Harrington]

Merge with Debian's package. I'd held off on merging this due to some earlier build/test failures but these seem resolved now.

By this point most delta has been dropped, the one remaining piece is disabling lto, which was done due to Debian and Ubuntu shipping different default gcc versions. Theoretically we should be able to drop this at some point, but I haven't gotten a successful build locally yet.

PPA with test packages: https://launchpad.net/~bryce/+archive/ubuntu/dovecot-merge-v1e2.3.19.1adfsg1-2

    $ sudo add-apt-repository -yus ppa:bryce/dovecot-merge-v1e2.3.19.1adfsg1-2
    $ sudo apt-get install dovecot-lite

* gnome-terminal
  - lp-test-ppa ppa:bryce/dovecot-merge-v1e2.3.19.1adfsg1-2 --release kinetic --showpass

Usual tags pushed for review:
  - tags/old/debian f3c2e9144
  - tags/new/debian 9b315688d
  - tags/old/ubuntu 7f78e9014
  - tags/logical/1%2.3.16+dfsg1-3ubuntu4 502b33a57
  - tags/reconstruct/1%2.3.16+dfsg1-3ubuntu4 256bf0e77
  - tags/split/1%2.3.16+dfsg1-3ubuntu4 95758b5a7

[Bryce Harrington (bryce)]

Autopkgtest Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-kinetic-bryce-dovecot-merge-v1e2.3.19.1adfsg1-2/?format=plain)
  dovecot @ amd64:
    10.08.22 15:06:21 Log 🗒️ ✅ Triggers: dovecot/1:2.3.19.1+dfsg1-2ubuntu1~kinetic1
  dovecot @ arm64:
    10.08.22 15:16:42 Log 🗒️ ✅ Triggers: dovecot/1:2.3.19.1+dfsg1-2ubuntu1~kinetic1
  dovecot @ armhf:
    10.08.22 15:12:36 Log 🗒️ ✅ Triggers: dovecot/1:2.3.19.1+dfsg1-2ubuntu1~kinetic1
  dovecot @ ppc64el:
    10.08.22 15:07:40 Log 🗒️ ✅ Triggers: dovecot/1:2.3.19.1+dfsg1-2ubuntu1~kinetic1
  dovecot @ s390x:
    10.08.22 15:05:16 Log 🗒️ ✅ Triggers: dovecot/1:2.3.19.1+dfsg1-2ubuntu1~kinetic1

[Sergio Durigan Junior (sergiodj)]

I'll take this one.

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Bryce.

LGTM. Package builds fine, autopkgtest is still OK. The LTO change is really minimal and (unfortunately) a relatively common sight in our packages. It'd be interesting to monitor what will happen in Debian when they switch to GCC 12, and maybe send a report upstream to let them know of this problem, but for now I think it's totally fine to keep things as is.

I verified that the dropped changes are indeed included in this new release.

There's a very small nit in the changelog entry; feel free to address it before uploading.

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: bryce, sergiodj
Uploaders: bryce, sergiodj
MP auto-approved

review: Approve

[Bryce Harrington (bryce)]

Thanks, fix added and branch updated.

stirling: ~/pkg/Dovecot/merge-v1e2.3.19.1adfsg1-2/dovecot-gu$ grep ^Vcs ../dovecot_2.3.19.1+dfsg1-2ubuntu1_source.changes
Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/dovecot
Vcs-Git-Commit: 48e8e18c5f014bdcfc83dd02d452419f0bb75937
Vcs-Git-Ref: refs/heads/merge-v1e2.3.19.1adfsg1-2-kinetic
stirling: ~/pkg/Dovecot/merge-v1e2.3.19.1adfsg1-2/dovecot-gu$ dput ubuntu ../dovecot_2.3.19.1+dfsg1-2ubuntu1_source.changes
Checking signature on .changes
gpg: ../dovecot_2.3.19.1+dfsg1-2ubuntu1_source.changes: Valid signature from E603B2578FB8F0FB
Checking signature on .dsc
gpg: ../dovecot_2.3.19.1+dfsg1-2ubuntu1.dsc: Valid signature from E603B2578FB8F0FB
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading dovecot_2.3.19.1+dfsg1-2ubuntu1.dsc: done.
  Uploading dovecot_2.3.19.1+dfsg1.orig-pigeonhole.tar.gz: done.
  Uploading dovecot_2.3.19.1+dfsg1.orig.tar.gz: done.
  Uploading dovecot_2.3.19.1+dfsg1-2ubuntu1.debian.tar.xz: done.
  Uploading dovecot_2.3.19.1+dfsg1-2ubuntu1_source.buildinfo: done.
  Uploading dovecot_2.3.19.1+dfsg1-2ubuntu1_source.changes: done.
Successfully uploaded packages.

a29a9aa... by Bryce Harrington on 2022-08-12

  * d/control: Build against Lua 5.3 rather than 5.4 for kinetic

3ac1a7a... by Bryce Harrington on 2022-08-12

changelog

[Bryce Harrington (bryce)]

This finally migrated over the weekend, along with a couple other dovecot-* source packages that were depending on it.

 dovecot | 1:2.3.16+dfsg1-3ubuntu2 | jammy
 dovecot | 1:2.3.16+dfsg1-3ubuntu2.1 | jammy-security
 dovecot | 1:2.3.16+dfsg1-3ubuntu2.1 | jammy-updates
 dovecot | 1:2.3.19.1+dfsg1-2ubuntu2 | kinetic

dovecot | 1:2.3.4.1-5+deb10u1~bpo9+1 | stretch-backports
dovecot | 1:2.3.4.1-5+deb10u1~bpo9+1 | stretch-backports-debug
dovecot | 1:2.3.13+dfsg1-2 | stable
dovecot | 1:2.3.13+dfsg1-2+deb11u1 | proposed-updates
dovecot | 1:2.3.13+dfsg1-2+deb11u1 | proposed-updates-debug
dovecot | 1:2.3.19.1+dfsg1-2 | testing
dovecot | 1:2.3.19.1+dfsg1-2 | unstable
dovecot | 1:2.3.19.1+dfsg1-2 | unstable-debug

diff --git a/debian/changelog b/debian/changelog
index 14c1e62..335cec2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,31 @@
+dovecot (1:2.3.19.1+dfsg1-2ubuntu2) kinetic; urgency=medium
+
+  * d/control: Build against Lua 5.3 rather than 5.4 for kinetic
+
+ -- Bryce Harrington <[e-mail]>  Fri, 12 Aug 2022 01:08:37 +0000
+
+dovecot (1:2.3.19.1+dfsg1-2ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971273). Remaining changes:
+    - d/rules: Package references hidden symbols during an LTO link.
+      This needs further investigation.  Until then, disable LTO.
+      Disable Debian's recent enablement of LTO as well,
+      as it FTBFS when building with gcc 11.
+      (LP #1951325)
+  * Dropped:
+    - d/p/OpenSSL3.patch: Workaround to fix EC key handling when building
+      with OpenSSL 3.0.
+      (LP: #1945763)
+      [Fixed in Debian release 1:2.3.19+dfsg1-1]
+    - privilege escalation via multiple passdbs
+      + d/p/CVE-2022-30550.patch: fix handling passdbs with
+        identical driver/args but different mechanisms/username_filter in
+        src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h,
+        src/auth/passdb.c, src/auth/passdb.h.
+      [Fixed in Debian release 1:2.3.19.1+dfsg1-2]
+
+ -- Bryce Harrington <[e-mail]>  Tue, 09 Aug 2022 23:02:29 -0700
+
 dovecot (1:2.3.19.1+dfsg1-2) unstable; urgency=medium
 
   [ Christian Göttsche ]
@@ -67,6 +95,58 @@ dovecot (1:2.3.17.1+dfsg1-1) unstable; urgency=medium
 
  -- Noah Meyerhans <[e-mail]>  Tue, 14 Dec 2021 09:24:23 -0800
 
+dovecot (1:2.3.16+dfsg1-3ubuntu4) kinetic; urgency=medium
+
+  * SECURITY UPDATE: privilege escalation via multiple passdbs
+    - debian/patches/CVE-2022-30550.patch: fix handling passdbs with
+      identical driver/args but different mechanisms/username_filter in
+      src/auth/auth-request.c, src/auth/auth.c, src/auth/auth.h,
+      src/auth/passdb.c, src/auth/passdb.h.
+    - CVE-2022-30550
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 11 Jul 2022 10:21:41 -0400
+
+dovecot (1:2.3.16+dfsg1-3ubuntu3) kinetic; urgency=medium
+
+  * No-change rebuild against libicu71
+
+ -- Steve Langasek <[e-mail]>  Sat, 30 Apr 2022 01:54:59 +0000
+
+dovecot (1:2.3.16+dfsg1-3ubuntu2) jammy; urgency=medium
+
+  * No-change rebuild for icu soname change.
+
+ -- Matthias Klose <[e-mail]>  Wed, 09 Feb 2022 09:13:08 +0100
+
+dovecot (1:2.3.16+dfsg1-3ubuntu1) jammy; urgency=medium
+
+  [ Bryce Harrington ]
+  * Merge with Debian unstable. (LP: #1946855)
+    Remaining changes:
+    - Package references hidden symbols during an LTO link.  This needs further
+      investigation.  Until then, disable LTO.
+  * Dropped:
+    - SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
+      + debian/patches/CVE-2021-29157.patch: improve escaping in
+        src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
+        src/lib-oauth2/test-oauth2-jwt.c.
+      [Included in Debian 1:2.3.13+dfsg1-2]
+    - SECURITY UPDATE: plaintext command injection before STARTTLS
+      + debian/patches/CVE-2021-33515.patch: properly handle command queue in
+        src/lib-smtp/smtp-server-cmd-starttls.c,
+        src/lib-smtp/smtp-server-connection.c.
+      [Included in Debian 1:2.3.13+dfsg1-2]
+  * d/rules: Disable Debian's recent enablement of LTO as well, as it
+    FTBFS when building with gcc 11.
+    (LP: #1951325)
+
+  [ Simon Chopin ]
+  * d/p/OpenSSL3.patch: Workaround to fix EC key handling when building
+    with OpenSSL 3.0.
+    (LP: #1945763)
+
+ -- Bryce Harrington <[e-mail]>  Wed, 17 Nov 2021 13:46:08 -0800
+
 dovecot (1:2.3.16+dfsg1-3) unstable; urgency=medium
 
   * [7b858b6] Fix FTBFS on mips(64)el.  Stacktrace generation on these
@@ -118,6 +198,40 @@ dovecot (1:2.3.13+dfsg1-2) unstable; urgency=high
 
  -- Noah Meyerhans <[e-mail]>  Tue, 20 Jul 2021 08:05:19 -0700
 
+dovecot (1:2.3.13+dfsg1-1ubuntu3) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 17:46:46 -0400
+
+dovecot (1:2.3.13+dfsg1-1ubuntu2) impish; urgency=medium
+
+  * SECURITY UPDATE: incorrectly escapes kid and azp fields in JWT tokens
+    - debian/patches/CVE-2021-29157.patch: improve escaping in
+      src/lib-dict-extra/dict-fs.c, src/lib-oauth2/oauth2-jwt.c,
+      src/lib-oauth2/test-oauth2-jwt.c.
+    - CVE-2021-29157
+  * SECURITY UPDATE: plaintext command injection before STARTTLS
+    - debian/patches/CVE-2021-33515.patch: properly handle command queue in
+      src/lib-smtp/smtp-server-cmd-starttls.c,
+      src/lib-smtp/smtp-server-connection.c.
+    - CVE-2021-33515
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 16 Jun 2021 09:02:15 -0400
+
+dovecot (1:2.3.13+dfsg1-1ubuntu1) hirsute; urgency=medium
+
+  * Package references hidden symbols during an LTO link.  This needs further
+    investigation.  Until then, disable LTO.
+
+ -- Matthias Klose <[e-mail]>  Tue, 30 Mar 2021 17:23:55 +0200
+
+dovecot (1:2.3.13+dfsg1-1build1) hirsute; urgency=high
+
+  * No change rebuild against clucene-core
+
+ -- Balint Reczey <[e-mail]>  Thu, 18 Feb 2021 18:19:47 +0100
+
 dovecot (1:2.3.13+dfsg1-1) unstable; urgency=medium
 
   [ Christian Göttsche ]
diff --git a/debian/control b/debian/control
index 47c8d63..15f8b31 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: dovecot
 Section: mail
 Priority: optional
-Maintainer: Dovecot Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Dovecot Maintainers <[e-mail]>
 Uploaders: Jaldhar H. Vyas <[e-mail]>,
            Jelmer Vernooij <[e-mail]>,
            Apollon Oikonomopoulos <[e-mail]>,
@@ -18,7 +19,7 @@ Build-Depends: debhelper-compat (= 13),
                libexttextcat-dev,
                libicu-dev,
                libldap2-dev,
-               liblua5.4-dev,
+               liblua5.3-dev,
                liblz4-dev,
                liblzma-dev,
                libpam0g-dev,
diff --git a/debian/rules b/debian/rules
index 724068f..403540f 100755
--- a/debian/rules
+++ b/debian/rules
@@ -6,7 +6,7 @@
 SHELL=/bin/bash -O extglob
 PIGEONHOLE_DIR=$(CURDIR)/pigeonhole
 
-export DEB_BUILD_MAINT_OPTIONS=hardening=+all optimize=+lto
+export DEB_BUILD_MAINT_OPTIONS=hardening=+all optimize=-lto
 
 # LP: 1636781 - strip incompatible default linker option
 ifeq ($(shell dpkg-vendor --derives-from Ubuntu && echo yes),yes)