Merge ~danilogondolfo/ubuntu/+source/curl:merge-lp2039798-noble into ubuntu/+source/curl:debian/sid

[Danilo Egea Gondolfo]

Autopkgtests results

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/amd64/c/curl/20231101_165114_bce3b@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/arm64/c/curl/20231101_195632_1daa8@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/armhf/c/curl/20231101_164916_1daa8@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/ppc64el/c/curl/20231101_164715_cf364@/log.gz

https://autopkgtest.ubuntu.com/results/autopkgtest-noble-danilogondolfo-curl/noble/s390x/c/curl/20231101_163915_bee22@/log.gz

PPA https://launchpad.net/~danilogondolfo/+archive/ubuntu/curl/

[Sergio Durigan Junior (sergiodj)]

Thanks for the MP, Danilo.

I'm leaving two minor comments regarding the changelog entry, but otherwise it's looking great. Let me know when you address the comments and I'll sponsor the upload.

review: Needs Fixing

[Danilo Egea Gondolfo (danilogondolfo)]

Thank you, Sergio. Just fixed it.

[Sergio Durigan Junior (sergiodj)]

Thanks. Uploaded:

$ dput ssh-ubuntu curl_8.4.0-2ubuntu1_source.changes
  177 D: Setting host argument.
  178 Checking signature on .changes
  179 gpg: /home/sergio/work/curl/curl_8.4.0-2ubuntu1_source.changes: Valid signature from 106DA1C8C3CBBF14
  180 Checking signature on .dsc
  181 gpg: /home/sergio/work/curl/curl_8.4.0-2ubuntu1.dsc: Valid signature from 106DA1C8C3CBBF14
  182 Package includes an .orig.tar.gz file although the debian revision suggests
  183 that it might not be required. Multiple uploads of the .orig.tar.gz may be
  184 rejected by the upload queue management software.
  185 Uploading to ssh-ubuntu (via sftp to upload.ubuntu.com):
  186 Uploading curl_8.4.0-2ubuntu1.dsc: done.
  187 Uploading curl_8.4.0.orig.tar.gz: done.
  188 Uploading curl_8.4.0.orig.tar.gz.asc: done.
  189 Uploading curl_8.4.0-2ubuntu1.debian.tar.xz: done.
  190 Uploading curl_8.4.0-2ubuntu1_source.buildinfo: done.
  191 Uploading curl_8.4.0-2ubuntu1_source.changes: done.
  192 Successfully uploaded packages.

review: Approve

Unmerged commits

c692550... by Danilo Egea Gondolfo on 2023-11-01

Changelog

d553817... by Danilo Egea Gondolfo on 2023-11-01

update-maintainer

ad78cad... by Danilo Egea Gondolfo on 2023-11-01

reconstruct-changelog

10757bf... by Danilo Egea Gondolfo on 2023-11-01

merge-changelogs

9d66e78... by Danilo Egea Gondolfo on 2023-11-01

debian/control

Don't build-depend on python3-impacket on i386 so we can drop it
(and its dependencies) from the i386 partial port. It's only used for
the tests, which do not block the build in any case.

diff --git a/debian/changelog b/debian/changelog
index b69d34a..1e5c29f 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,19 @@
+curl (8.4.0-2ubuntu1) noble; urgency=medium
+
+  * Merge from Debian unstable (LP: #2039798). Remaining changes:
+    - debian/control: Don't build-depend on python3-impacket on i386
+      so we can drop it (and its dependencies) from the i386 partial port.
+      It's only used for the tests, which do not block the build in any case.
+  * Drop patches for CVEs fixed upstream:
+    - debian/patches/CVE-2023-38039.patch
+    - debian/patches/CVE-2023-38545.patch
+    - debian/patches/CVE-2023-38546.patch
+  * Drop delta merged in Debian
+    - debian/tests/control
+    - debian/tests/curl-ldapi-test
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 01 Nov 2023 12:06:23 +0000
+
 curl (8.4.0-2) unstable; urgency=medium
 
   * d/rules: set CURL_PATCHSTAMP to package's version, so it shows up in
@@ -57,6 +73,46 @@ curl (8.2.1-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 25 Aug 2023 20:05:02 +0100
 
+curl (8.2.1-1ubuntu3.1) mantic-security; urgency=medium
+
+  * SECURITY UPDATE: SOCKS5 heap buffer overflow
+    - debian/patches/CVE-2023-38545.patch: return error if hostname too
+      long for remote resolve in lib/socks.c, tests/data/Makefile.inc,
+      tests/data/test728.
+    - CVE-2023-38545
+  * SECURITY UPDATE: cookie injection with none file
+    - debian/patches/CVE-2023-38546.patch: remove unnecessary struct fields
+      in lib/cookie.c, lib/cookie.h, lib/easy.c.
+    - CVE-2023-38546
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 03 Oct 2023 20:03:05 -0400
+
+curl (8.2.1-1ubuntu3) mantic; urgency=medium
+
+  * SECURITY UPDATE: HTTP headers eat all memory
+    - debian/patches/CVE-2023-38039.patch: return error when receiving too
+      large header set in lib/c-hyper.c, lib/cf-h1-proxy.c, lib/http.c,
+      lib/http.h, lib/pingpong.c, lib/urldata.h.
+    - CVE-2023-38039
+
+ -- Marc Deslauriers <[e-mail]>  Mon, 11 Sep 2023 09:05:17 -0400
+
+curl (8.2.1-1ubuntu2) mantic; urgency=medium
+
+  * d/t/control, d/t/curl-ldapi-test: move test-command to an actual
+    test script and add a retry logic (LP: #2030911)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 09 Aug 2023 17:10:40 -0300
+
+curl (8.2.1-1ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Sat, 05 Aug 2023 16:06:26 +0200
+
 curl (8.2.1-1) unstable; urgency=medium
 
   [ Samuel Henrique ]
@@ -97,6 +153,15 @@ curl (7.88.1-11) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 28 Jul 2023 21:11:25 +0100
 
+curl (7.88.1-10ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Fri, 19 May 2023 08:46:54 +0200
+
 curl (7.88.1-10) unstable; urgency=medium
 
   * Add new patches to fix CVEs (closes: #1036239):
@@ -109,6 +174,15 @@ curl (7.88.1-10) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Thu, 18 May 2023 23:43:40 +0100
 
+curl (7.88.1-9ubuntu1) mantic; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Tue, 02 May 2023 08:47:52 +0200
+
 curl (7.88.1-9) unstable; urgency=medium
 
   [ Sergio Durigan Junior ]
@@ -123,6 +197,15 @@ curl (7.88.1-9) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sat, 15 Apr 2023 20:03:44 +0100
 
+curl (7.88.1-8ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 27 Mar 2023 07:50:29 +0200
+
 curl (7.88.1-8) unstable; urgency=medium
 
   [ Samuel Henrique ]
@@ -136,6 +219,15 @@ curl (7.88.1-8) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sun, 26 Mar 2023 11:36:24 +0100
 
+curl (7.88.1-7ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 22 Mar 2023 11:51:25 +0100
+
 curl (7.88.1-7) unstable; urgency=medium
 
   * Bump Standards-Version to 4.6.2
@@ -151,6 +243,15 @@ curl (7.88.1-7) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Tue, 21 Mar 2023 22:39:05 +0000
 
+curl (7.88.1-6ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Mon, 13 Mar 2023 10:10:19 +0100
+
 curl (7.88.1-6) unstable; urgency=medium
 
   * d/rules: Ignore test results from tests that fail on IPv6-only builders
@@ -203,6 +304,22 @@ curl (7.88.1-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Fri, 03 Mar 2023 08:28:19 +0000
 
+curl (7.88.1-1ubuntu1) lunar; urgency=medium
+
+  * Merge from Debian unstable (LP: #2008123). Remaining changes:
+    + Drop patches for CVEs fixed upsteam.
+      - debian/patches/CVE-2023-23914_5-1.patch
+      - debian/patches/CVE-2023-23914_5-2.patch
+      - debian/patches/CVE-2023-23914_5-3.patch
+      - debian/patches/CVE-2023-23914_5-4.patch
+      - debian/patches/CVE-2023-23914_5-5.patch
+      - debian/patches/CVE-2023-23916.patch
+    + Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Danilo Egea Gondolfo <[e-mail]>  Wed, 22 Feb 2023 17:14:26 +0000
+
 curl (7.88.1-1) unstable; urgency=medium
 
   * New upstream version 7.88.1
@@ -217,6 +334,41 @@ curl (7.88.1-1) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Mon, 20 Feb 2023 22:35:53 +0000
 
+curl (7.87.0-2ubuntu2) lunar; urgency=medium
+
+  * SECURITY UPDATE: multiple HSTS issues
+    - debian/patches/CVE-2023-23914_5-1.patch: add sharing of HSTS cache
+      among handles in docs/libcurl/opts/CURLSHOPT_SHARE.3,
+      docs/libcurl/symbols-in-versions, include/curl/curl.h, lib/hsts.c,
+      lib/hsts.h, lib/setopt.c, lib/share.c, lib/share.h, lib/transfer.c,
+      lib/url.c, lib/urldata.h.
+    - debian/patches/CVE-2023-23914_5-2.patch: share HSTS between handles
+      in src/tool_operate.c.
+    - debian/patches/CVE-2023-23914_5-3.patch: handle adding the same host
+      name again in lib/hsts.c.
+    - debian/patches/CVE-2023-23914_5-4.patch: support crlf="yes" for
+      verify/proxy in tests/FILEFORMAT.md, tests/runtests.pl.
+    - debian/patches/CVE-2023-23914_5-5.patch: verify hsts with two URLs in
+      tests/data/Makefile.inc, tests/data/test446.
+    - CVE-2023-23914
+    - CVE-2023-23915
+  * SECURITY UPDATE: HTTP multi-header compression denial of service
+    - debian/patches/CVE-2023-23916.patch: do not reset stage counter for
+      each header in lib/content_encoding.c, lib/urldata.h,
+      tests/data/Makefile.inc, tests/data/test387, tests/data/test418.
+    - CVE-2023-23916
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 17 Feb 2023 08:19:10 -0500
+
+curl (7.87.0-2ubuntu1) lunar; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Don't build-depend on python3-impacket on i386 so we can drop it
+      (and its dependencies) from the i386 partial port.  It's only used for
+      the tests, which do not block the build in any case.
+
+ -- Gianfranco Costamagna <[e-mail]>  Wed, 01 Feb 2023 11:24:47 +0100
+
 curl (7.87.0-2) unstable; urgency=medium
 
   * d/patches: Add new upstream patch to fix regression in setopt/getinfo
@@ -225,6 +377,14 @@ curl (7.87.0-2) unstable; urgency=medium
 
  -- Samuel Henrique <[e-mail]>  Sun, 15 Jan 2023 21:12:09 +0000
 
+curl (7.87.0-1ubuntu1) lunar; urgency=medium
+
+  * Don't build-depend on python3-impacket on i386 so we can drop it 
+    (and its dependencies) from the i386 partial port.  It's only used for
+    the tests, which do not block the build in any case.
+
+ -- Steve Langasek <[e-mail]>  Sun, 08 Jan 2023 00:40:54 +0000
+
 curl (7.87.0-1) unstable; urgency=medium
 
   * New upstream version 7.87.0
diff --git a/debian/control b/debian/control
index 8fd48c5..a39683e 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: curl
 Section: web
 Priority: optional
-Maintainer: Alessandro Ghedini <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Alessandro Ghedini <[e-mail]>
 Uploaders: Samuel Henrique <[e-mail]>,
            Sergio Durigan Junior <[e-mail]>
 Build-Depends:
@@ -27,7 +28,7 @@ Build-Depends:
  locales-all <!nocheck>,
  openssh-server <!nocheck>,
  python3:native <!nocheck>,
- python3-impacket <!nocheck>,
+ python3-impacket [!i386] <!nocheck>,
  gnutls-bin [amd64 arm64 armel armhf i386 mips64el mipsel s390x powerpc ppc64 riscv64] <!nocheck>,
  quilt,
  stunnel4 <!nocheck>,