Merge lp:~nutznboltz-deactivatedaccount/ubuntu/precise/gnutls26/fix-lp926350 into lp:ubuntu/precise/gnutls26

[nutznboltz]

If your account is an LDAP one and your LDAP client connects to its LDAP server via SSL then running setuid programs from your account fail since libgcrypt11 is horribly broken and upstream GnuTLS no longer recommends using it as the backend crypto library:
http://lists.debian.org/debian-legal/2011/02/msg00006.html

In the past it was possible to work around this by using nscd but that work around no longer has any effect.

When I rebuild gnutls26 with nettle I am able to use setuid binaries from my LDAP account which connects via SSL to its LDAP server.

[Colin Watson (cjwatson)]

I understand that this is a problem, but I'm reluctant to accept this particular change unless either libgmp's licensing is relaxed or somebody verifies exhaustively that there is no LGPLv2-only software linked against gnutls26, as per the subthread here:

  http://lists.debian.org/debian-legal/2011/02/msg00013.html

We reluctantly backed off from the idea of switching precise to gnutls28 for similar reasons.

review: Needs Information

Unmerged revisions

35. By nutznboltz on 2012-02-03

Fix LDAP+SSL client use of setuid binaries. (LP: #926350)

=== modified file 'debian/changelog'
--- debian/changelog	2012-01-24 20:05:00 +0000
+++ debian/changelog	2012-02-03 21:55:23 +0000
@@ -1,3 +1,9 @@
+gnutls26 (2.12.14-5ubuntu3) precise; urgency=low
+
+  * Fix LDAP+SSL client use of setuid binaries. (LP: #926350)
+
+ -- Ken Stailey <ksta@oneiric-32>  Fri, 03 Feb 2012 16:44:49 -0500
+
 gnutls26 (2.12.14-5ubuntu2) precise; urgency=low
 
   * Bump the version of gnutls-doc too, for the same reason as gnutls-bin.

=== modified file 'debian/control'
--- debian/control	2012-01-24 18:18:46 +0000
+++ debian/control	2012-02-03 21:55:23 +0000
@@ -7,7 +7,7 @@
  Eric Dorland <[e-mail]>,
  James Westby <[e-mail]>,
  Simon Josefsson <[e-mail]>
-Build-Depends: debhelper (>= 8.1.3), libgcrypt11-dev (>= 1.4.0), zlib1g-dev,
+Build-Depends: debhelper (>= 8.1.3), nettle-dev (>= 2.4), zlib1g-dev,
  cdbs (>= 0.4.93), gtk-doc-tools, texinfo (>= 4.8),
  libtasn1-3-dev (>= 0.3.4-0), autotools-dev, datefudge,
  libp11-kit-dev (>= 0.4), pkg-config, chrpath
@@ -23,7 +23,7 @@
 Provides: gnutls-dev
 Depends: libgnutls26 (= ${binary:Version}), 
  libgnutlsxx27 (= ${binary:Version}),libgnutls-openssl27 (= ${binary:Version}),
- libgcrypt11-dev (>= 1.4.0), libc6-dev | libc-dev, zlib1g-dev,
+ nettle-dev (>= 2.4), libc6-dev | libc-dev, zlib1g-dev,
  libtasn1-3-dev (>= 0.3.4), libp11-kit-dev (>= 0.4), ${misc:Depends}
 Suggests: gnutls-doc, gnutls-bin
 Conflicts: gnutls-dev

=== modified file 'debian/rules'
--- debian/rules	2012-01-24 20:05:00 +0000
+++ debian/rules	2012-02-03 21:55:23 +0000
@@ -6,7 +6,7 @@
 
 DEB_CONFIGURE_EXTRA_FLAGS = --enable-ld-version-script --enable-cxx \
 	--without-lzo --disable-guile \
-	--cache-file=$(CURDIR)/config.cache --with-libgcrypt \
+	--cache-file=$(CURDIR)/config.cache \
 	--with-packager=Debian \
 	--with-packager-bug-reports=http://bugs.debian.org/ \
 	--with-packager-version="$(DEB_VERSION)" \