Merge ~paelzer/ubuntu/+source/nss:bionic-merge-3.36.1-1 into ubuntu/+source/nss:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Hi,
this is a proposal for a merge early in the cosmic cycle.
Early because we intentionally change some defaults.

In Bionic we stepped back and reverted that - see bug 1746947
But since then we have resolved all dependent issues in bug 1747411 (with corosync that is about to be fixed the last one to go).

With the above done we can stop setting the old default DB format in 1746947 and behave like Debian does.

I pushed the usual tags to ease review:
 * [new tag] lp1747411/deconstruct/2%3.35-2ubuntu2 -> lp1747411/deconstruct/2%3.35-2ubuntu2
 * [new tag] lp1747411/new/debian -> lp1747411/new/debian
 * [new tag] lp1747411/old/ubuntu -> lp1747411/old/ubuntu
 * [new tag] lp1747411/logical/2%3.35-2ubuntu2 -> lp1747411/logical/2%3.35-2ubuntu2
 * [new tag] lp1747411/old/debian -> lp1747411/old/debian
 * [new tag] lp1747411/reconstruct/2%3.35-2ubuntu2 -> lp1747411/reconstruct/2%3.35-2ubuntu2

It still is a merge and not a sync for the following reasons:
1. a ppc64el FTBFS that I verified (still occurs for Ubuntu compiler defaults)
2. Debian not yet moving on bug 1744328

So we have overall to pass in order to be good:
1. sync of libqb (https://code.launchpad.net/~paelzer/ubuntu/+source/libqb/+git/libqb/+merge/345212)
2. sync of corosync (https://code.launchpad.net/~paelzer/ubuntu/+source/corosync/+git/corosync/+merge/345184)
3. merge of nss (this MP)

[Christian Ehrhardt  (paelzer)]

FYI - test builds in https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3253/+packages

[Andreas Hasenack (ahasenack)]

+1, delta changes confirmed.

Just a question, though, but which does not impede this merge: shouldn't the ppc64el ftbfs fix only be applied if building for ppc64el? The way it is, it's applying to all architectures, as long as -O3 is used in the compiler flags. I understand this was already part of the delta.

Also, if you want, you could rebase on new/debian and move the -O3 fix to before merge-changelogs. That would tidy it up a bit and make it easy to get a good view of the current delta without changelog noise. Just a comment, again, not impeding the merge in any way.

review: Approve

86708c7... by Christian Ehrhardt  on 2018-05-09

- d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el

Signed-off-by: Christian Ehrhardt <email address hidden>

9c8a37f... by Christian Ehrhardt  on 2018-05-09

changelog: - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el

Signed-off-by: Christian Ehrhardt <email address hidden>

[Christian Ehrhardt  (paelzer)]

I've added both suggestions and pushed the new changes.

Looks like that now which seems to be the commonly used idomatic way to express AND there:
 15 ifneq (,$(filter -O3,$(CFLAGS)))
 16 ifneq (,$(filter $(DEB_HOST_ARCH), ppc64el))
 17 CFLAGS := $(CFLAGS) -Wno-error=maybe-uninitialized
 18 endif
 19 endif
I have the same arch filter in place in another package, so I'm rather convinced it is good.
For safety on the d/rules change I have a rebuild in the same ppa we used so far and it LGTM on build.

I force-pushed (for the re-arrange) the git updates to my branch.

That said this MP here is ready to be uploaded now once corosync is complete.

[Andreas Hasenack (ahasenack)]

Thanks, still +1

review: Approve

[Christian Ehrhardt  (paelzer)]

libdb is complete, now waiting for corosync to be complete as well to push this merge then.

diff --git a/debian/changelog b/debian/changelog
index b5a0128..3936c93 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,20 @@
+nss (2:3.36.1-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/libnss3.links: make freebl3 available as library (LP 1744328)
+      - d/control: add dh-exec to Build-Depends
+      - d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+    - d/rules: when building with -O3 on ppc64el this FTBFS, build with
+      -Wno-error=maybe-uninitialized to avoid that
+  * Dropped changes:
+    - revert switching to SQL default format (LP: 1746947) Dropping this
+      adresses (LP: #1747411) and effectively means we now switch to the new
+      default format after we ensured all depending packages are ready.
+  * Added changes:
+    - d/rules: extended the FTBFS to -O3 on ppc64el to only apply on ppc64el
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 07 May 2018 17:08:46 +0200
+
 nss (2:3.36.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -11,6 +28,25 @@ nss (2:3.36-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sun, 08 Apr 2018 06:53:15 +0900
 
+nss (2:3.35-2ubuntu2) bionic; urgency=medium
+
+  * d/p/lp1746947-revert-switch-default-to-sql.patch: the switch of the
+    default is still causing too much issues in consumers of nss.
+    So until resolved revert the switched default (LP: #1746947)
+
+ -- Christian Ehrhardt <[e-mail]>  Mon, 05 Feb 2018 11:36:07 +0100
+
+nss (2:3.35-2ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+  * Added Changes:
+    - d/libnss3.links: make freebl3 available as library (LP: #1744328)
+      + d/control: add dh-exec to Build-Depends
+      + d/rules: make mkdir tolerate debian/tmp existing (due to dh-exec)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 30 Jan 2018 14:04:20 +0100
+
 nss (2:3.35-2) unstable; urgency=medium
 
   * nss/lib/freebl/Makefile: Build Hacl_Poly1305_64.o on arm64.
@@ -29,6 +65,13 @@ nss (2:3.34.1-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Fri, 05 Jan 2018 20:15:40 +0900
 
+nss (2:3.34-1ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 14 Dec 2017 09:18:47 -0500
+
 nss (2:3.34-1) unstable; urgency=medium
 
   * New upstream release:
@@ -53,6 +96,28 @@ nss (2:3.32-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Mon, 28 Aug 2017 07:39:59 +0900
 
+nss (2:3.32-1ubuntu3) artful; urgency=medium
+
+  * SECURITY UPDATE: Use-after-free in TLS 1.2 generating handshake hashes
+    - debian/patches/CVE-2017-7805.patch: Simplify handling of
+      CertificateVerify in nss/lib/ssl/ssl3con.c, nss/lib/ssl/ssl3prot.h.
+    - CVE-2017-7805
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 29 Sep 2017 12:17:39 -0400
+
+nss (2:3.32-1ubuntu2) artful; urgency=medium
+
+  * Initialise curve variable in a test file, resolves FTBFS.
+
+ -- Dimitri John Ledkov <[e-mail]>  Thu, 24 Aug 2017 07:21:27 -0400
+
+nss (2:3.32-1ubuntu1) artful; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 23 Aug 2017 13:09:20 -0400
+
 nss (2:3.32-1) unstable; urgency=medium
 
   * New upstream release.
@@ -112,6 +177,39 @@ nss (2:3.27.1-1) experimental; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Sat, 19 Nov 2016 08:29:17 +0900
 
+nss (2:3.28.4-0ubuntu2) artful; urgency=medium
+
+  * SECURITY UPDATE: DoS via empty SSLv2 messages
+    - debian/patches/CVE-2017-7502.patch: reject broken v2 records in
+      nss/lib/ssl/ssl3gthr.c, nss/lib/ssl/ssldef.c, nss/lib/ssl/sslimpl.h,
+      added tests to nss/gtests/ssl_gtest/ssl_gather_unittest.cc,
+      nss/gtests/ssl_gtest/ssl_gtest.gyp, nss/gtests/ssl_gtest/manifest.mn,
+      nss/gtests/ssl_gtest/ssl_v2_client_hello_unittest.cc.
+    - CVE-2017-7502
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 16 Jun 2017 08:12:38 -0400
+
+nss (2:3.28.4-0ubuntu1) artful; urgency=medium
+
+  * Updated to upstream 3.28.4 to fix security issues and get a new CA
+    certificate bundle.
+  * SECURITY UPDATE: DES and Triple DES ciphers birthday attack
+    - CVE-2016-2183
+  * SECURITY UPDATE: out-of-bounds write in Base64 decoding
+    - CVE-2017-5461
+  * debian/patches/*.patch: refreshed for new version.
+  * debian/control: bump libnspr4-dev to 4.13.1.
+  * debian/libnss3.symbols: added new symbols.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 27 Apr 2017 13:13:44 -0400
+
+nss (2:3.26.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Marc Deslauriers <[e-mail]>  Fri, 02 Dec 2016 08:48:03 -0500
+
 nss (2:3.26.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -125,6 +223,13 @@ nss (2:3.26-2) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Wed, 21 Sep 2016 10:02:23 +0900
 
+nss (2:3.26-1ubuntu1) yakkety; urgency=medium
+
+  * Merge with Debian; remaining changes:
+    - When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Tue, 06 Sep 2016 14:39:56 +0200
+
 nss (2:3.26-1) unstable; urgency=medium
 
   * New upstream release.
@@ -139,6 +244,12 @@ nss (2:3.26-1) unstable; urgency=medium
 
  -- Mike Hommey <[e-mail]>  Tue, 16 Aug 2016 16:33:15 +0900
 
+nss (2:3.25-1ubuntu1) yakkety; urgency=medium
+
+  * When building with -O3, build with -Wno-error=maybe-uninitialized.
+
+ -- Matthias Klose <[e-mail]>  Thu, 04 Aug 2016 11:36:54 +0200
+
 nss (2:3.25-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index cabbe72..820b70d 100644
--- a/debian/control
+++ b/debian/control
@@ -1,9 +1,11 @@
 Source: nss
 Section: libs
 Priority: optional
-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Maintainers of Mozilla-related packages <[e-mail]>
 Uploaders: Mike Hommey <[e-mail]>
 Build-Depends: debhelper (>= 9.20160403),
+ dh-exec,
  dpkg-dev (>= 1.17.14),
  libnspr4-dev (>= 2:4.12),
  zlib1g-dev,
diff --git a/debian/libnss3.links b/debian/libnss3.links
new file mode 100755
index 0000000..717ff94
--- /dev/null
+++ b/debian/libnss3.links
@@ -0,0 +1,3 @@
+#!/usr/bin/dh-exec
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreebl3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreebl3.so
+usr/lib/${DEB_HOST_MULTIARCH}/nss/libfreeblpriv3.so usr/lib/${DEB_HOST_MULTIARCH}/libfreeblpriv3.so
diff --git a/debian/rules b/debian/rules
index d9ca1d2..81f049f 100755
--- a/debian/rules
+++ b/debian/rules
@@ -12,6 +12,12 @@ $(call lazy,CFLAGS,$$(shell dpkg-buildflags --get CFLAGS))
 $(call lazy,CPPFLAGS,$$(shell dpkg-buildflags --get CPPFLAGS))
 $(call lazy,LDFLAGS,$$(shell dpkg-buildflags --get LDFLAGS))
 
+ifneq (,$(filter -O3,$(CFLAGS)))
+ifneq (,$(filter $(DEB_HOST_ARCH), ppc64el))
+  CFLAGS := $(CFLAGS) -Wno-error=maybe-uninitialized
+endif
+endif
+
 PREPROCESS_FILES := $(wildcard debian/*.in)
 
 $(PREPROCESS_FILES:.in=): %: %.in
@@ -175,7 +181,7 @@ override_dh_strip:
 
 ifeq ($(DEB_HOST_ARCH),$(DEB_BUILD_ARCH))
 	# Check FIPS mode correctly works
-	mkdir debian/tmp
+	mkdir -p debian/tmp
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -create -dbdir debian/tmp < /dev/null
 	LD_LIBRARY_PATH=debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH):debian/libnss3/usr/lib/$(DEB_HOST_MULTIARCH)/nss debian/libnss3-tools/usr/bin/modutil -fips true -dbdir debian/tmp < /dev/null
 endif