Merge ~paelzer/ubuntu/+source/spice:merge-14.2-4-focal into ubuntu/+source/spice:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Bileto ticket: https://bileto.ubuntu.com/#/ticket/3837
PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/3837

Pushed tags to ease review:
To ssh://git.launchpad.net/~paelzer/ubuntu/+source/spice
 * [new tag] lp1852439/logical/0.14.2-0ubuntu2 -> lp1852439/logical/0.14.2-0ubuntu2
 * [new tag] lp1852439/new/debian -> lp1852439/new/debian
 * [new tag] lp1852439/old/debian -> lp1852439/old/debian
 * [new tag] lp1852439/old/ubuntu -> lp1852439/old/ubuntu
 * [new tag] lp1852439/reconstruct/0.14.2-0ubuntu2 -> lp1852439/reconstruct/0.14.2-0ubuntu2
 * [new tag] lp1852439/split/0.14.2-0ubuntu2 -> lp1852439/split/0.14.2-0ubuntu2

[Christian Ehrhardt  (paelzer)]

As a summary, Debian took all we had except the autopkgtest fixes.

Plan (for now): I'll rebase and test those in Focal, once they work I'll open an MP with Debian (they are now on salsa, but were not in the past)

[Christian Ehrhardt  (paelzer)]

Well it is time to revisit the autopkgtest for real.
It is sort of broken as the Debian history shows [1]
I can fix it up to somewhat work.
But also upstream has sort of given up/neglected it [2]

I have submitted my fixes to Debian [3], but if they ack to drop these tests completely I'd want to follow on that.

Note on [4] that amd64 & arm64 are the only arches this worked before, so this isn't a regression.

[1]: https://ci.debian.net/packages/s/spice/
[2]: https://gitlab.freedesktop.org/spice/spice/issues/34
[3]: https://salsa.debian.org/debian/spice/merge_requests/1
[4]: https://bileto.ubuntu.com/excuses/3837/focal.html

[Christian Ehrhardt  (paelzer)]

Marking MP ready for review

[Bryce Harrington (bryce)]

I've run the autopkgtests on the ppa package in lxc, and looked at the failing test-display-streaming test - for me it doesn't even produce output, I guess because there's no $DISPLAY available? The bileto test results log also shows the test failed, although it shows up as a PASS in the excuses results(?!?) Guessing there's some setup work needed to get the remote display registered properly in lxc? (Might be useful for future reviewing to have a paint-by-numbers set of commands to run to get remote display enabled inside an lxc container.)

However, given that test-display-streaming appears to not have been hooked up before, and may not be getting necessary attention upstream, it may make sense to disable it. It looks like this would avoid needing to build some C code, which would also make test run time faster. Given that upstream appears to have an active and well-maintained CI system, the risk of something being missed by excluding this test seems minimal.

That said, given that the purpose of this tool is for accessing a remote desktop, some sort of smoke test to verify graphics are getting generated and transmitted from server to client would be appropriate for acceptance testing. But that seems a different scope than this merge from debian.

Anyway, everything else in the merge LGTM; things I've checked listed below. As to the failed test, while I lean towards disabling it, I don't feel strongly enough on that point to block landing the merge, esp. since it isn't showing up as a fail on the excuses page.

- [√] changelog entry correct, targeted to correct codename
- [√] no major upstream changes to consider
- [√] debian changes look safe
- [√] update-maintainer has been run
- [√] changes forwarded upstream/debian (if appropriate)
- [√] nothing else to drop
- [-] patches match what was proposed upstream
- [-] patches correctly included in debian/patches/series?
- [-] patches have correct DEP3 metadata

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks for the review, yeah we are in sync of dropping the test - I just want to do that "with Debian" hence the MR up there.

[Christian Ehrhardt  (paelzer)]

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/spice
 * [new tag] upload/0.14.2-4ubuntu1 -> upload/0.14.2-4ubuntu1

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading spice_0.14.2-4ubuntu1.dsc: done.
  Uploading spice_0.14.2.orig.tar.bz2: done.
  Uploading spice_0.14.2-4ubuntu1.debian.tar.xz: done.
  Uploading spice_0.14.2-4ubuntu1_source.buildinfo: done.
  Uploading spice_0.14.2-4ubuntu1_source.changes: done.
Successfully uploaded packages.

[Bryce Harrington (bryce)]

This has migrated into focal

diff --git a/debian/changelog b/debian/changelog
index 12c1ac6..fb2aac4 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,34 @@
+spice (0.14.2-4ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable (LP: #1852439). Remaining changes:
+    - d/control: Don't recommend -libav gstreamer plugins since it is in
+      universe
+    - make autopkgtests work again
+      - d/t/automated-tests: spice-common moved into dir subprojects
+      - d/t/automated-tests: option --enable-automated-tests now is always on
+      - d/t/control: make tests more debuggable by allowing stderr
+      - d/t/control: install new test dependency python-pil
+      - d/t/regression-test.py, d/t/base_test.ppm: add file dropped in release
+        tarball but needed for autopkgtests
+      - d/source/include-binaries: allow binary base_test.ppm in package
+  * Added changes:
+    - d/t/automated-tests, d/t/control: make autopkgtests python3 compatible
+  * Dropped Changes (in Debian):
+    - d/control: Don't recommend -ugly gstreamer plugins since it is in universe
+    - d/patches: drop patches being upstream in 0.14.2
+    - new upstream 0.14.2
+    - disable failing test-listen
+    - d/libspice-server1.symbols: update for new symbols in 14.2
+    - d/p/fix-test-qxl-parsing-on-ppc64el-and-armhf.patch: avoid FTBFS due to
+      different handling of high words for constants
+    - d/control: bump build dependency to libspice-protocol-dev >=0.14.0
+  * Dropped Changes (Upstream)
+    - SECURITY UPDATE: Integer overflow and buffer overflow CVE-2017-12194
+    - SECURITY UPDATE: Denial of service CVE-2018-10873
+    - SECURITY UPDATE: off-by-one error in memslot_get_virt CVE-2019-3813
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 13 Nov 2019 15:54:00 +0100
+
 spice (0.14.2-4) unstable; urgency=medium
 
   * disable failing test-listen (Closes: #941006)
@@ -45,6 +76,42 @@ spice (0.14.2-1) unstable; urgency=medium
 
  -- Michael Tokarev <[e-mail]>  Fri, 30 Aug 2019 13:54:00 +0300
 
+spice (0.14.2-0ubuntu2) eoan; urgency=medium
+
+  * Fixup autpkgtest (LP: #1834286)
+    These changes will make the test able to run again, but not output mismatch
+    errors (this matches the behavior before 0.14.2). Upstream discussion
+    started on how to resolve that as a next step, more details at the LP bug.
+    - d/t/automated-tests: spice-common moved into dir subprojects
+    - d/t/automated-tests: option --enable-automated-tests now is always on"
+    - d/t/automated-tests, d/t/control: make tests more debuggable by allowing
+      stderr
+    - d/t/control: install new test dependency python-pil
+    - d/t/base_test.ppm, d/t/regression-test.py: provide test resources from
+      upstream git not part of the released tarball anymore
+    - d/source/include-binaries: allow binary base_test.ppm in package
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 25 Jun 2019 12:59:01 +0200
+
+spice (0.14.2-0ubuntu1) eoan; urgency=medium
+
+  * New upstream release
+    Among many other fixes this will resolve (LP: #1814146)
+    - d/p/disable-failing-test-listen.patch: disable new test that is
+      unreliable in the build environment
+    - d/patches: drop patches being upstream in 0.14.2
+      + debian/patches/CVE-2017-12194-1.patch
+      + debian/patches/CVE-2017-12194-2.patch
+      + debian/patches/CVE-2017-12194-3.patch
+      + debian/patches/CVE-2018-10873.patch
+      + debian/patches/CVE-2019-3813.patch
+    - d/libspice-server1.symbols: update for new symbols in 14.2
+    - d/p/fix-test-qxl-parsing-on-ppc64el-and-armhf.patch: avoid FTBFS due
+      to different handling of high words for constants
+    - d/control: bump build dependency to libspice-protocol-dev >=0.14.0
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 24 May 2019 12:27:26 +0200
+
 spice (0.14.0-1.3) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -67,6 +134,52 @@ spice (0.14.0-1.1) unstable; urgency=medium
 
  -- Salvatore Bonaccorso <[e-mail]>  Sat, 15 Sep 2018 09:15:28 +0200
 
+spice (0.14.0-1ubuntu5) disco; urgency=medium
+
+  * SECURITY UPDATE: off-by-one error in memslot_get_virt
+    - debian/patches/CVE-2019-3813.patch: fix checks in server/memslot.c,
+      add tests to server/tests/test-qxl-parsing.c.
+    - CVE-2019-3813
+  * debian/tests/automated-tests: fix incorrect test name, don't fail on
+    build writing to stderr.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 24 Jan 2019 08:58:10 -0500
+
+spice (0.14.0-1ubuntu4) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Denial of service
+    - debian/patches/CVE-2018-10873.patch:  fix in
+      spice-common/python_modules/demarshal.py,
+   - CVE-2018-10873
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 20 Aug 2018 13:26:02 -0300
+
+spice (0.14.0-1ubuntu3) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Integer overflow and buffer overflow
+    - debian/patches/CVE-2017-12194-1.patch: fix a integer overflow
+      computing sizes in spice-common/python_modules/demarshal.py.
+    - debian/patches/CVE-2017-12194-2.patch: avoid integer overflow
+      in spice-common/python_modules/demarshal.py,
+      spice-common/python_modules/marshal.py.
+    - debian/patches/CVE-2017-12194-3.patch: add tests to verify fix.
+    - CVE-2017-12194
+
+ -- Leonidas S. Barbosa <[e-mail]>  Tue, 22 May 2018 14:53:01 -0300
+
+spice (0.14.0-1ubuntu2) bionic; urgency=high
+
+  * No change rebuild against openssl1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 06 Feb 2018 17:55:31 +0000
+
+spice (0.14.0-1ubuntu1) bionic; urgency=medium
+
+  * Don't recommend -ugly or -libav gstreamer plugins since they
+    are in universe
+
+ -- Jeremy Bicha <[e-mail]>  Wed, 01 Nov 2017 21:55:03 -0400
+
 spice (0.14.0-1) unstable; urgency=medium
 
   * New upstream release
diff --git a/debian/control b/debian/control
index c88a583..7d76b23 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: spice
 Section: misc
 Priority: optional
-Maintainer: Debian QEMU Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian QEMU Team <[e-mail]>
 Uploaders: Michael Tokarev <[e-mail]>
 Build-Depends:
  debhelper (>= 10),
@@ -38,7 +39,6 @@ Multi-Arch: same
 Pre-Depends: ${misc:Pre-Depends}
 Depends: ${misc:Depends}, ${shlibs:Depends}
 Recommends:
- gstreamer1.0-libav,
  gstreamer1.0-plugins-base,
  gstreamer1.0-plugins-good,
 Suggests:
diff --git a/debian/source/include-binaries b/debian/source/include-binaries
new file mode 100644
index 0000000..82c1427
--- /dev/null
+++ b/debian/source/include-binaries
@@ -0,0 +1 @@
+debian/tests/base_test.ppm
diff --git a/debian/tests/automated-tests b/debian/tests/automated-tests
index b672145..2aeb3ec 100644
--- a/debian/tests/automated-tests
+++ b/debian/tests/automated-tests
@@ -1,13 +1,17 @@
 #! /bin/sh
 
-set -e
+set -ex
 
-dh_auto_configure -- --enable-automated-tests \
+dh_auto_configure -- \
     --disable-celt051 \
     --disable-silent-rules \
     --enable-smartcard
-make -C spice-common/common libspice-common.la libspice-common-server.la
+make -C subprojects/spice-common/common libspice-common.la libspice-common-server.la
 make -C server libspice-server.la
 make -C server/tests all
-./server/tests/test_display_streaming  --automated-tests
+cp -av debian/tests/regression-test.py server/tests
+sed -i -e'1s/python/python3/' server/tests/regression-test.py
+cp -av debian/tests/base_test.ppm server/tests
+cd server/tests
+./test-display-streaming  --automated-tests
 
diff --git a/debian/tests/base_test.ppm b/debian/tests/base_test.ppm
new file mode 100644
index 0000000..b28a64d
Binary files /dev/null and b/debian/tests/base_test.ppm differ
diff --git a/debian/tests/control b/debian/tests/control
index c5fff56..204d6db 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,2 +1,3 @@
 Tests: automated-tests
-Depends: @, @builddeps@, spice-client-gtk
+Depends: @, @builddeps@, spice-client-gtk, python3-pil, python3
+Restrictions: allow-stderr
diff --git a/debian/tests/regression-test.py b/debian/tests/regression-test.py
new file mode 100755
index 0000000..81eaecf
--- /dev/null
+++ b/debian/tests/regression-test.py
@@ -0,0 +1,25 @@
+#!/usr/bin/python
+from subprocess import PIPE, Popen
+from PIL import Image
+from PIL import ImageChops
+
+
+def spicy_screenshot():
+    cmd = "spicy-screenshot -h localhost -p 5912 -o output.ppm"
+    p = Popen(cmd, shell=True)
+    p.wait()
+
+def verify():
+    base = Image.open("base_test.ppm")
+    output = Image.open("output.ppm")
+    return ImageChops.difference(base, output).getbbox()
+
+if __name__ == "__main__":
+    spicy_screenshot()
+    diff = verify()
+
+    if diff is None:
+        print("\033[1;32mSUCCESS: No regressions were found!\033[1;m")
+    else:
+        print("\033[1;31mFAIL: Regressions were found!\n\033[1;m"
+              "\033[1;31m      Please, take a look in your code and go fix it!\033[1;m")