Merge ~bryce/ubuntu/+source/virglrenderer:merge-v0.10.4-1-lunar into ubuntu/+source/virglrenderer:debian/sid

[Bryce Harrington]

All changes drop, so this is rather just a sync proposal.

There are no test cases for the package, but I've uploaded to a PPA to verify the build:
  https://launchpad.net/~bryce/+archive/ubuntu/virglrenderer-merge-v0.10.4-1

For us this is a major version update from 0.9 to 0.10, comprising about a year's worth of fairly active development upstream. It brings in a bunch of fixes including the items we've been carrying patches for.

Debian actually has two versions in sid right now, 0.10.3 and 0.10.4. The latter was just uploaded yesterday so I think it's still just in migration, rather than there being update excuse issues. However even if there are I think we should just return to staying in sync with Debian at this point.

[Christian Ehrhardt  (paelzer)]

Old delta mapped to commits:
673f4d0c1 -> 0.10.0
95e581fd1 -> 0.10.0
b05bb61f4 -> 0.10.0

yep, all changes seem applied upstream and therefore this can be a sync.

review: Approve

[Christian Ehrhardt  (paelzer)]

However, while it looks good here, this recent update
- https://bugs.launchpad.net/ubuntu/+source/virglrenderer/+bug/1993453/comments/2
- https://salsa.debian.org/debian/virglrenderer/-/merge_requests/5
suggests otherwise

But having HW accel there would actually be great, we do not have the skill to support such graphic heavy things for the serve rteam. But it was mentioned it was in main before, maybe the former owning team is willing to continue owning it?
Please dig who that was and ask them.

[Bryce Harrington (bryce)]

On Fri, Jan 06, 2023 at 07:03:01AM -0000, Christian Ehrhardt  wrote:
> However, while it looks good here, this recent update
> - https://bugs.launchpad.net/ubuntu/+source/virglrenderer/+bug/1993453/comments/2
> - https://salsa.debian.org/debian/virglrenderer/-/merge_requests/5
> suggests otherwise
>
> But having HW accel there would actually be great, we do not have the skill to support such graphic heavy things for the serve rteam. But it was mentioned it was in main before, maybe the former owning team is willing to continue owning it?
> Please dig who that was and ask them.
> --
> https://code.launchpad.net/~bryce/ubuntu/+source/virglrenderer/+git/virglrenderer/+merge/435207
> You are the owner of ~bryce/ubuntu/+source/virglrenderer:merge-v0.10.4-1-lunar.

Thanks for the review Christian.

The video acceleration functionality is new in 0.10, so since we
currently carry 0.9, it's not a regression if we use Jeremy's changes to
drop, it at least for the near term while bugs are shaking out in
testing.

libva left main way back in Trusty, and is related part to the
X.org/Wayland stack. I don't think there was really an "owning team"
for it back then, but since it interfaces between desktop and
kernel/graphics it could fall under either team. I can reach out to
Timo Aaltonen who may be better able to advise.

98b7c57... by Bryce Harrington on 2023-01-10

  * d/rules: Disable video acceleration on Ubuntu until libva gets
    repromoted

Pulls in one of the commits from this Debian MR:
https://salsa.debian.org/debian/virglrenderer/-/merge_requests/5

b2faf6d... by Bryce Harrington on 2023-01-10

changelog

[Bryce Harrington (bryce)]

Timo and Jeremy confirmed there does not seem to be any activity around getting libva into main, just a general desire, and it's not clear what team would champion a MIR. Given that server team isn't the right owner for it, I think we should leave it disabled until others take initiative on it. If it becomes requested by our users we can revisit.

[Christian Ehrhardt  (paelzer)]

Thanks Bryce, and sorry for the back and forth that was needed here.
I've planned a candidate that we can revisit for 23.10 and until then can check opinions/responsibilities in further discussion. For this merge it should be ok as-is now.

Except that you currently have an empty 0.10.4-1ubuntu2 on top which is wrong.
Furthermore following the usual "change done on merge" style I'd expect "* d/rules: Disable video acceleration on Ubuntu until libva gets repromoted." as

* Added changes:
  - d/rules: Disable video acceleration on Ubuntu until libva gets repromoted.

Once you resolved those two I'd be +1, so consider uploading unless there is more.

review: Needs Fixing

[Bryce Harrington (bryce)]

Thanks, branch updated with those changes, and package uploaded to lunar:

Vcs-Git: https://git.launchpad.net/~bryce/ubuntu/+source/virglrenderer
Vcs-Git-Commit: b2faf6dfaf9dc1f963fa53aa9d6c4f48e0f803ca
Vcs-Git-Ref: refs/heads/merge-v0.10.4-1-lunar

$ dput ubuntu ../virglrenderer_0.10.4-1ubuntu1_source.changes
D: Setting host argument.
Checking signature on .changes
Checking signature on .dsc
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading virglrenderer_0.10.4-1ubuntu1.dsc: done.
  Uploading virglrenderer_0.10.4.orig.tar.bz2: done.
  Uploading virglrenderer_0.10.4-1ubuntu1.debian.tar.xz: done.
  Uploading virglrenderer_0.10.4-1ubuntu1_source.buildinfo: done.
  Uploading virglrenderer_0.10.4-1ubuntu1_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index 3625bc9..9dfecd2 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,24 @@
+virglrenderer (0.10.4-1ubuntu1) lunar; urgency=medium
+
+  * Merge with Debian unstable (LP: #1993453).
+  * Added changes:
+    - d/rules: Disable video acceleration on Ubuntu until libva gets repromoted.
+  * Dropped:
+    - d/p/lp-1950941*: fix out of bounds check
+      (LP #1950941)
+      [Fixed in upstream release 0.10.0]
+    - out-of-bounds write in read_transfer_data()
+      + d/p/CVE-2022-0135.patch: Add test to resource OOB write
+        and fix it in src/vrend_renderer.c, tests/test_fuzzer_formats.c.
+      [Fixed in upstream release 0.10.0]
+    - info leak in vrend_resource_alloc_buffer()
+      + d/p/CVE-2022-0175.patch: clear memory when allocating a
+        host-backed memory resource in src/vrend_renderer.c,
+        tests/test_virgl_transfer.c.
+      [Fixed in upstream release 0.10.0]
+
+ -- Bryce Harrington <[e-mail]>  Thu, 05 Jan 2023 06:49:25 -0800
+
 virglrenderer (0.10.4-1) unstable; urgency=medium
 
   * New upstream version 0.10.4
@@ -54,6 +75,27 @@ virglrenderer (0.10.0-1) unstable; urgency=medium
   * Enable video backend and add dependency accordingly
  -- Gert Wollny <[e-mail]>  Fri, 02 Sep 2022 17:36:05 +0200
 
+virglrenderer (0.9.1-1~exp1ubuntu2) jammy; urgency=medium
+
+  * SECURITY UPDATE: out-of-bounds write in read_transfer_data()
+    - debian/patches/CVE-2022-0135.patch: Add test to resource OOB write
+      and fix it in src/vrend_renderer.c, tests/test_fuzzer_formats.c.
+    - CVE-2022-0135
+  * SECURITY UPDATE: info leak in vrend_resource_alloc_buffer()
+    - debian/patches/CVE-2022-0175.patch: clear memory when allocating a
+      host-backed memory resource in src/vrend_renderer.c,
+      tests/test_virgl_transfer.c.
+    - CVE-2022-0175
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 28 Feb 2022 14:19:07 -0500
+
+virglrenderer (0.9.1-1~exp1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1959175). Remaining changes:
+    - d/p/lp-1950941*: fix out of bounds check (LP #1950941)
+
+ -- Utkarsh Gupta <[e-mail]>  Fri, 25 Feb 2022 02:23:43 +0530
+
 virglrenderer (0.9.1-1~exp1) experimental; urgency=medium
 
   * New upstream version 0.9.1
@@ -67,6 +109,18 @@ virglrenderer (0.9.0-1~exp1) experimental; urgency=medium
 
  -- Gert Wollny <[e-mail]>  Tue, 06 Apr 2021 15:24:55 +0200
 
+virglrenderer (0.8.2-5ubuntu1) jammy; urgency=medium
+
+  * d/p/lp-1950941*: fix out of bounds check (LP: #1950941)
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 02 Dec 2021 08:34:48 +0100
+
+virglrenderer (0.8.2-5build1) impish; urgency=medium
+
+  * No-change rebuild to build packages with zstd compression.
+
+ -- Matthias Klose <[e-mail]>  Thu, 07 Oct 2021 12:26:08 +0200
+
 virglrenderer (0.8.2-5) unstable; urgency=medium
 
   [ Christian Ehrhardt ]
diff --git a/debian/control b/debian/control
index dc591e6..e7b4a0e 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: virglrenderer
 Section: libs
 Priority: optional
-Maintainer: Gert Wollny <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Gert Wollny <[e-mail]>
 Build-Depends: check,
                debhelper-compat (= 13),
                libdrm-dev,
diff --git a/debian/rules b/debian/rules
index 188f483..d10b629 100755
--- a/debian/rules
+++ b/debian/rules
@@ -4,12 +4,19 @@ include /usr/share/dpkg/buildflags.mk
 export DEB_BUILD_MAINT_OPTIONS = hardening=+all
 export CK_TIMEOUT_MULTIPLIER=100
 
+# libva is not currently in Ubuntu main
+ifeq ($(shell dpkg-vendor --query vendor),Ubuntu)
+VIDEO := -Dvideo=false
+else
+VIDEO := -Dvideo=true
+endif
+
 %:
 	dh $@ --buildsystem=meson
 
 configure-opts = \
 	-Dtests=true \
-	-Dvideo=true \
+	$(VIDEO) \
 
 ifneq (armel, ${DEB_HOST_ARCH})
 # vulkan requires 32bit atomic ints, armel lacks one (#1021861)