Merge ~sergiodj/ubuntu/+source/ldb:merge-2.2.0-3.1-impish into ubuntu/+source/ldb:debian/sid

[Sergio Durigan Junior]

This is the merge of ldb 2:2.2.0-3.1ubuntu1 from Debian unstable.

It's a relatively simple merge, whose purpose is to consolidate the CVE fixes that have been added as a delta to the Ubuntu package but are now available in the Debian package as well.

When we remove these patches from our delta, the only thing that is left is the one-liner change on d/rules related to bug 1920825. This change was made because dh-exec on hirsute showed different behaviours depending on the value of DEB_BUILD_PROFILES, which was causing a FTBFS on ldb (and other packages). I was able to verify that the build now passes without this modification.

Considering what I wrote above, this means that the package is actually going to become a sync against Debian. But, in the interest of keeping the merge process transparent and following our conventions, I'm filing this MP and requesting a review before pulling the trigger on requestsync.

There's a PPA with the proposed package here:

https://launchpad.net/~sergiodj/+archive/ubuntu/ldb-merge

ldb doesn't have dep8 tests, but I verified that the package still installs OK. Samba depends on ldb, but we won't need to rebuild it because this is a minor update that doesn't involve soname bumps.

[Bryce Harrington (bryce)]

Yep, LGTM, +1 to syncpackage this.

I had looked at ldb yesterday in doing the merge board review and noticed it looked likely to be a small merge. Glad to hear it can return to sync.

review: Approve

[Sergio Durigan Junior (sergiodj)]

Thanks for the review, Bryce. (And yeah, s/requestsync/syncpackage/ in the Description).

I'm double checking with doko if it's OK to drop the dh-exec-related changes; I'll wait for his reply tomorrow and then (likely) proceed with the sync.

[Sergio Durigan Junior (sergiodj)]

I didn't get a reply from doko, so I'm proceeding with the sync. I verified that the package builds fine without the patch in all architectures.

$ syncpackage --force ldb
Loading KWallet
Loading SecretService
Loading Windows
Loading chainer
Loading macOS
Source ldb -> impish/Proposed: current version 2:2.2.0-3ubuntu3, new version 2:2.2.0-3.1
New changes:
ldb (2:2.2.0-3.1) unstable; urgency=medium

  * Non-maintainer upload.
  * ldb_dn: avoid head corruption in ldb_dn_explode (CVE-2020-27840)
    (Closes: #985936)
  * pytests: move Dn.validate test to ldb
  * ldb/attrib_handlers casefold: stay in bounds (CVE-2021-20277)
    (Closes: #985935)
  * ldb: add tests for ldb_wildcard_compare
  * ldb tests: ldb_match tests with extra spaces
  * ldb: Remove tests from ldb_match_test that do not pass

 -- Salvatore Bonaccorso <email address hidden> Fri, 26 Mar 2021 19:52:18 +0100
Sync this package [y|N]? y
Request succeeded; you should get an e-mail once it is processed.

diff --git a/debian/changelog b/debian/changelog
index b29f4fd..acf20d3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,33 @@
+ldb (2:2.2.0-3.1ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+  * Dropped changes
+    - Fix symbols generation (LP: #1920825).  On hirsute, dh-exec is showing
+      different behavior based on the value of DEB_BUILD_PROFILES.  This is
+      causing it to sometimes generate a file with the leading whitespace
+      removed, which is resulting in a bad symbols file.  Set DEB_BUILD_PROFILES
+      to empty gives a good symbols file.
+    [ Not needed anymore; dh-exec has since been fixed.  ]
+    - SECURITY UPDATE: Heap corruption via crafted DN strings
+      + debian/patches/CVE-2020-27840-1.patch: avoid head corruption in
+        ldb_dn_explode in common/ldb_dn.c.
+      + debian/patches/CVE-2020-27840-2.patch: add Dn.validate test to ldb
+        in tests/python/crash.py, wscript.
+      + CVE-2020-27840
+    - SECURITY UPDATE: Out of bounds read in AD DC LDAP server
+      + debian/patches/CVE-2021-20277-1.patch: add tests for
+        ldb_wildcard_compare in tests/ldb_match_test.c.
+      + debian/patches/CVE-2021-20277-2.patch: ldb_match tests with extra
+        spaces in tests/ldb_match_test.c.
+      + debian/patches/CVE-2021-20277-3.patch: remove tests from
+        ldb_match_test that do not pass in tests/ldb_match_test.c.
+      + debian/patches/CVE-2021-20277-4.patch: stay in bounds in
+        common/attrib_handlers.c.
+      + CVE-2021-20277
+    [ Fixed in version 2:2.2.0-3.1 ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 28 Jul 2021 16:24:30 -0400
+
 ldb (2:2.2.0-3.1) unstable; urgency=medium
 
   * Non-maintainer upload.
@@ -12,6 +42,49 @@ ldb (2:2.2.0-3.1) unstable; urgency=medium
 
  -- Salvatore Bonaccorso <[e-mail]>  Fri, 26 Mar 2021 19:52:18 +0100
 
+ldb (2:2.2.0-3ubuntu3) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 17:50:03 -0400
+
+ldb (2:2.2.0-3ubuntu2) hirsute; urgency=medium
+
+  * SECURITY UPDATE: Heap corruption via crafted DN strings
+    - debian/patches/CVE-2020-27840-1.patch: avoid head corruption in
+      ldb_dn_explode in common/ldb_dn.c.
+    - debian/patches/CVE-2020-27840-2.patch: add Dn.validate test to ldb
+      in tests/python/crash.py, wscript.
+    - CVE-2020-27840
+  * SECURITY UPDATE: Out of bounds read in AD DC LDAP server
+    - debian/patches/CVE-2021-20277-1.patch: add tests for
+      ldb_wildcard_compare in tests/ldb_match_test.c.
+    - debian/patches/CVE-2021-20277-2.patch: ldb_match tests with extra
+      spaces in tests/ldb_match_test.c.
+    - debian/patches/CVE-2021-20277-3.patch: remove tests from
+      ldb_match_test that do not pass in tests/ldb_match_test.c.
+    - debian/patches/CVE-2021-20277-4.patch: stay in bounds in
+      common/attrib_handlers.c.
+    - CVE-2021-20277
+
+ -- Marc Deslauriers <[e-mail]>  Tue, 30 Mar 2021 13:00:36 -0400
+
+ldb (2:2.2.0-3ubuntu1) hirsute; urgency=medium
+
+  * Fix symbols generation (LP: #1920825).  On hirsute, dh-exec is showing
+    different behavior based on the value of DEB_BUILD_PROFILES.  This is
+    causing it to sometimes generate a file with the leading whitespace
+    removed, which is resulting in a bad symbols file.  Set DEB_BUILD_PROFILES
+    to empty gives a good symbols file.
+
+ -- Matthias Klose <[e-mail]>  Tue, 30 Mar 2021 16:11:59 +0200
+
+ldb (2:2.2.0-3build1) hirsute; urgency=medium
+
+  * No-change rebuild to build with python3.9 as default.
+
+ -- Matthias Klose <[e-mail]>  Thu, 19 Nov 2020 20:19:08 +0100
+
 ldb (2:2.2.0-3) unstable; urgency=medium
 
   * Upload to unstable
diff --git a/debian/control b/debian/control
index 0d8c475..fdc8e7d 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: ldb
 Section: devel
 Priority: optional
-Maintainer: Debian Samba Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Samba Maintainers <[e-mail]>
 Uploaders: Jelmer Vernooij <[e-mail]>,
            Mathieu Parent <[e-mail]>
 Build-Depends: dh-exec,