Merge ~paelzer/ubuntu/+source/spice:merge-0.14.3-2-HIRSUTE into ubuntu/+source/spice:debian/sid

[Christian Ehrhardt ]

[Christian Ehrhardt  (paelzer)]

Merge tags:
To ssh://git.launchpad.net/~paelzer/ubuntu/+source/spice
 * [new tag] lp9999999/logical/0.14.3-1ubuntu2 -> lp9999999/logical/0.14.3-1ubuntu2
 * [new tag] lp9999999/new/debian -> lp9999999/new/debian
 * [new tag] lp9999999/old/debian -> lp9999999/old/debian
 * [new tag] lp9999999/old/ubuntu -> lp9999999/old/ubuntu
 * [new tag] lp9999999/reconstruct/0.14.3-1ubuntu2 -> lp9999999/reconstruct/0.14.3-1ubuntu2
 * [new tag] lp9999999/split/0.14.3-1ubuntu2 -> lp9999999/split/0.14.3-1ubuntu2

This is mostly dropping changes (as Debian accepted them).
One remains (universe, no MIR wanted).
On that remaining delta I have improved the situation a bit by at least leaving a suggests to help users.

But overall this should be a trivial MP.

PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4324/+packages

[Sergio Durigan Junior (sergiodj)]

I'll take this one.

[Sergio Durigan Junior (sergiodj)]

* Changelog:
  - [√] old content and logical tag match as expected
  - [√] changelog entry correct version and targeted codename
  - [√] changelog entries correct
  - [√] update-maintainer has been run

* Actual changes:
  - [√] no upstream changes to consider
  - [√] no further upstream version to consider
  - [√] debian changes look safe

* Old Delta:
  - [√] dropped changes are ok to be dropped
  - [√] nothing else to drop
  - [√] changes forwarded upstream/debian (if appropriate)

* New Delta:
  - [√] no new patches added
  - [-] patches match what was proposed upstream
  - [-] patches correctly included in debian/patches/series
  - [-] patches have correct DEP3 metadata

* Build/Test:
  - [√] build is ok
  - [√] verified PPA package installs/uninstalls
  - [√] autopkgtest against the PPA package passes
  - [√] sanity checks test fine

Thanks for the MP, Christian.

Everything looks good. I built a local version of the patch successfully, installed it and everything worked OK.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks also LGTM ... uploading

To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/spice
 * [new tag] upload/0.14.3-2ubuntu1 -> upload/0.14.3-2ubuntu1

Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading spice_0.14.3-2ubuntu1.dsc: done.
  Uploading spice_0.14.3-2ubuntu1.debian.tar.xz: done.
  Uploading spice_0.14.3-2ubuntu1_source.buildinfo: done.
  Uploading spice_0.14.3-2ubuntu1_source.changes: done.
Successfully uploaded packages.

[Christian Ehrhardt  (paelzer)]

This is in hirsute

diff --git a/debian/changelog b/debian/changelog
index 8a23c9b..cb0d5a6 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+spice (0.14.3-2ubuntu1) hirsute; urgency=medium
+
+  * Merge with Debian unstable (LP: #9999999). Remaining changes:
+    - d/control: Don't recommend -libav gstreamer plugins since it is in
+      universe. This now downgrades it to a suggest instead of completely
+      removing the dependency.
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 03 Nov 2020 13:07:45 +0100
+
 spice (0.14.3-2) unstable; urgency=medium
 
   [ Christian Ehrhardt ]
@@ -22,6 +31,40 @@ spice (0.14.3-2) unstable; urgency=medium
 
  -- Michael Tokarev <[e-mail]>  Thu, 29 Oct 2020 10:57:02 +0300
 
+spice (0.14.3-1ubuntu2) groovy; urgency=medium
+
+  * SECURITY UPDATE: multiple buffer overflows in QUIC image decoding
+    - debian/patches/CVE-2020-14355-1.patch: check we have some data to
+      start decoding quic image in subprojects/spice-common/common/quic.c.
+    - debian/patches/CVE-2020-14355-2.patch: check image size in
+      quic_decode_begin in subprojects/spice-common/common/quic.c.
+    - debian/patches/CVE-2020-14355-3.patch: check RLE lengths in
+      subprojects/spice-common/common/quic_tmpl.c.
+    - debian/patches/CVE-2020-14355-4.patch: avoid possible buffer overflow
+      in find_bucket in subprojects/spice-common/common/quic_family_tmpl.c.
+    - CVE-2020-14355
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 01 Oct 2020 07:00:18 -0400
+
+spice (0.14.3-1ubuntu1) groovy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1881093). Remaining changes:
+    - d/control: Don't recommend -libav gstreamer plugins since it is in
+      universe
+    - make autopkgtests work again
+      - d/t/automated-tests: spice-common moved into dir subprojects
+      - d/t/automated-tests: option --enable-automated-tests now is always on
+      - d/t/control: make tests more debuggable by allowing stderr
+      - d/t/control: install new test dependency python-pil
+      - d/t/regression-test.py, d/t/base_test.ppm: add file dropped in release
+        tarball but needed for autopkgtests
+      - d/source/include-binaries: allow binary base_test.ppm in package
+  * Dropped changes
+    - d/p/lp-1874054-*: fix rescaling and some crashes (LP: 1874054)
+      [Upstream in 0.14.3]
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 28 May 2020 11:56:04 +0200
+
 spice (0.14.3-1) unstable; urgency=medium
 
   * new upstream version (Closes: #940057, #954629)
@@ -33,6 +76,49 @@ spice (0.14.3-1) unstable; urgency=medium
 
  -- Michael Tokarev <[e-mail]>  Tue, 14 Apr 2020 16:55:25 +0300
 
+spice (0.14.2-4ubuntu3) focal; urgency=medium
+
+  * d/p/lp-1874054-*: fix rescaling and some crashes (LP: #1874054)
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 21 Apr 2020 14:05:18 +0200
+
+spice (0.14.2-4ubuntu2) focal; urgency=medium
+
+  * No-change rebuild for libgcc-s1 package name change.
+
+ -- Matthias Klose <[e-mail]>  Mon, 23 Mar 2020 07:26:08 +0100
+
+spice (0.14.2-4ubuntu1) focal; urgency=medium
+
+  * Merge with Debian unstable (LP: #1852439). Remaining changes:
+    - d/control: Don't recommend -libav gstreamer plugins since it is in
+      universe
+    - make autopkgtests work again
+      - d/t/automated-tests: spice-common moved into dir subprojects
+      - d/t/automated-tests: option --enable-automated-tests now is always on
+      - d/t/control: make tests more debuggable by allowing stderr
+      - d/t/control: install new test dependency python-pil
+      - d/t/regression-test.py, d/t/base_test.ppm: add file dropped in release
+        tarball but needed for autopkgtests
+      - d/source/include-binaries: allow binary base_test.ppm in package
+  * Added changes:
+    - d/t/automated-tests, d/t/control: make autopkgtests python3 compatible
+  * Dropped Changes (in Debian):
+    - d/control: Don't recommend -ugly gstreamer plugins since it is in universe
+    - d/patches: drop patches being upstream in 0.14.2
+    - new upstream 0.14.2
+    - disable failing test-listen
+    - d/libspice-server1.symbols: update for new symbols in 14.2
+    - d/p/fix-test-qxl-parsing-on-ppc64el-and-armhf.patch: avoid FTBFS due to
+      different handling of high words for constants
+    - d/control: bump build dependency to libspice-protocol-dev >=0.14.0
+  * Dropped Changes (Upstream)
+    - SECURITY UPDATE: Integer overflow and buffer overflow CVE-2017-12194
+    - SECURITY UPDATE: Denial of service CVE-2018-10873
+    - SECURITY UPDATE: off-by-one error in memslot_get_virt CVE-2019-3813
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 13 Nov 2019 15:54:00 +0100
+
 spice (0.14.2-4) unstable; urgency=medium
 
   * disable failing test-listen (Closes: #941006)
@@ -80,6 +166,42 @@ spice (0.14.2-1) unstable; urgency=medium
 
  -- Michael Tokarev <[e-mail]>  Fri, 30 Aug 2019 13:54:00 +0300
 
+spice (0.14.2-0ubuntu2) eoan; urgency=medium
+
+  * Fixup autpkgtest (LP: #1834286)
+    These changes will make the test able to run again, but not output mismatch
+    errors (this matches the behavior before 0.14.2). Upstream discussion
+    started on how to resolve that as a next step, more details at the LP bug.
+    - d/t/automated-tests: spice-common moved into dir subprojects
+    - d/t/automated-tests: option --enable-automated-tests now is always on"
+    - d/t/automated-tests, d/t/control: make tests more debuggable by allowing
+      stderr
+    - d/t/control: install new test dependency python-pil
+    - d/t/base_test.ppm, d/t/regression-test.py: provide test resources from
+      upstream git not part of the released tarball anymore
+    - d/source/include-binaries: allow binary base_test.ppm in package
+
+ -- Christian Ehrhardt <[e-mail]>  Tue, 25 Jun 2019 12:59:01 +0200
+
+spice (0.14.2-0ubuntu1) eoan; urgency=medium
+
+  * New upstream release
+    Among many other fixes this will resolve (LP: #1814146)
+    - d/p/disable-failing-test-listen.patch: disable new test that is
+      unreliable in the build environment
+    - d/patches: drop patches being upstream in 0.14.2
+      + debian/patches/CVE-2017-12194-1.patch
+      + debian/patches/CVE-2017-12194-2.patch
+      + debian/patches/CVE-2017-12194-3.patch
+      + debian/patches/CVE-2018-10873.patch
+      + debian/patches/CVE-2019-3813.patch
+    - d/libspice-server1.symbols: update for new symbols in 14.2
+    - d/p/fix-test-qxl-parsing-on-ppc64el-and-armhf.patch: avoid FTBFS due
+      to different handling of high words for constants
+    - d/control: bump build dependency to libspice-protocol-dev >=0.14.0
+
+ -- Christian Ehrhardt <[e-mail]>  Fri, 24 May 2019 12:27:26 +0200
+
 spice (0.14.0-1.3) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -102,6 +224,52 @@ spice (0.14.0-1.1) unstable; urgency=medium
 
  -- Salvatore Bonaccorso <[e-mail]>  Sat, 15 Sep 2018 09:15:28 +0200
 
+spice (0.14.0-1ubuntu5) disco; urgency=medium
+
+  * SECURITY UPDATE: off-by-one error in memslot_get_virt
+    - debian/patches/CVE-2019-3813.patch: fix checks in server/memslot.c,
+      add tests to server/tests/test-qxl-parsing.c.
+    - CVE-2019-3813
+  * debian/tests/automated-tests: fix incorrect test name, don't fail on
+    build writing to stderr.
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 24 Jan 2019 08:58:10 -0500
+
+spice (0.14.0-1ubuntu4) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Denial of service
+    - debian/patches/CVE-2018-10873.patch:  fix in
+      spice-common/python_modules/demarshal.py,
+   - CVE-2018-10873
+
+ -- Leonidas S. Barbosa <[e-mail]>  Mon, 20 Aug 2018 13:26:02 -0300
+
+spice (0.14.0-1ubuntu3) cosmic; urgency=medium
+
+  * SECURITY UPDATE: Integer overflow and buffer overflow
+    - debian/patches/CVE-2017-12194-1.patch: fix a integer overflow
+      computing sizes in spice-common/python_modules/demarshal.py.
+    - debian/patches/CVE-2017-12194-2.patch: avoid integer overflow
+      in spice-common/python_modules/demarshal.py,
+      spice-common/python_modules/marshal.py.
+    - debian/patches/CVE-2017-12194-3.patch: add tests to verify fix.
+    - CVE-2017-12194
+
+ -- Leonidas S. Barbosa <[e-mail]>  Tue, 22 May 2018 14:53:01 -0300
+
+spice (0.14.0-1ubuntu2) bionic; urgency=high
+
+  * No change rebuild against openssl1.1.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 06 Feb 2018 17:55:31 +0000
+
+spice (0.14.0-1ubuntu1) bionic; urgency=medium
+
+  * Don't recommend -ugly or -libav gstreamer plugins since they
+    are in universe
+
+ -- Jeremy Bicha <[e-mail]>  Wed, 01 Nov 2017 21:55:03 -0400
+
 spice (0.14.0-1) unstable; urgency=medium
 
   * New upstream release
diff --git a/debian/control b/debian/control
index d31bb2c..9813c7d 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: spice
 Section: misc
 Priority: optional
-Maintainer: Debian QEMU Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian QEMU Team <[e-mail]>
 Uploaders: Michael Tokarev <[e-mail]>
 Build-Depends:
  debhelper-compat (= 12),
@@ -39,10 +40,10 @@ Multi-Arch: same
 Pre-Depends: ${misc:Pre-Depends}
 Depends: ${misc:Depends}, ${shlibs:Depends}
 Recommends:
- gstreamer1.0-libav,
  gstreamer1.0-plugins-base,
  gstreamer1.0-plugins-good,
 Suggests:
+ gstreamer1.0-libav,
  gstreamer1.0-plugins-ugly,
 Description: Implements the server side of the SPICE protocol
  The Simple Protocol for Independent Computing Environments (SPICE) is