Merge ~utkarsh/ubuntu/+source/ruby2.7:merge-ruby2.7-impish into ubuntu/+source/ruby2.7:debian/sid

[Utkarsh Gupta]

Hey,

This is a ruby2.7 merge from debian/sid, basically bumping from
2.7.2-4ubuntu1.1 in hirsute (and now impish) to 2.7.3-2ubuntu1 in impish.

All tests pass in Debian sid and the PPA could be found at:
https://launchpad.net/~utkarsh/+archive/ubuntu/experimental-dump

Let me know if there's anything else needed from my end, but otherwise
requesting you to review and please sponsor the upload. TIA! \o/

[Utkarsh Gupta (utkarsh)]

[Assigning it to Robie based on previous discussions]

[Lucas Kanashiro (lucaskanashiro)]

I am personally interested in ruby, so I'll take a look at this MP.

[Utkarsh Gupta (utkarsh)]

[Re-assigned to Lucas; unassigned Robie]

[Lucas Kanashiro (lucaskanashiro)]

* Changelog:
  - [√] old content and logical tag match as expected
  - [√] changelog entry correct version and targeted codename
  - [√] changelog entries correct
  - [√] update-maintainer has been run

* Actual changes:
  - [√] no upstream changes to consider
  - [√] no further upstream version to consider
  - [√] debian changes look safe

* Old Delta:
  - [√] dropped changes are ok to be dropped
  - [√] nothing else to drop
  - [√] changes forwarded upstream/debian (if appropriate)

* New Delta:
  - [√] no new patches added
  - [-] patches match what was proposed upstream
  - [-] patches correctly included in debian/patches/series
  - [-] patches have correct DEP3 metadata

* Build/Test:
  - [√] build is ok
  - [√] verified PPA package installs/uninstalls
  - [√] autopkgtest against the PPA package passes
  - [√] sanity checks test fine

I did not investigate this LTO issue yet but we should check if this change would make sense to Debian, if it is harmless to Debian we can upstream this change and make it a sync again.

Apart from that, everything LGTM. Do you want me to sponsor this package?

review: Approve

[Utkarsh Gupta (utkarsh)]

Hi Lucas,

Thanks a bunch for reviewing and approving!

> I did not investigate this LTO issue yet but we should check
> if this change would make sense to Debian, if it is harmless
> to Debian we can upstream this change and make it a sync again.

As soon as the SIGSEGV issue is fixed upstream (bug #17052), this
can be dropped from here and it'll eventually become a sync. So
probably just a matter of time, I guess.

> [...] Do you want me to sponsor this package?

Yes, please. Thank you! \o/

[Lucas Kanashiro (lucaskanashiro)]

> As soon as the SIGSEGV issue is fixed upstream (bug #17052), this
> can be dropped from here and it'll eventually become a sync. So
> probably just a matter of time, I guess.

Of course but maybe it makes sense to check that, we do not know when the upstream will fix this bug, the last update of this bug was 9 months ago. I've been always trying to keep ruby as a sync which make our life much easier.

[Lucas Kanashiro (lucaskanashiro)]

Package uploaded, please follow its migration:

$ git push pkg upload/2.7.3-2ubuntu1
Enumerating objects: 22, done.
Counting objects: 100% (22/22), done.
Delta compression using up to 32 threads
Compressing objects: 100% (9/9), done.
Writing objects: 100% (17/17), 2.16 KiB | 2.16 MiB/s, done.
Total 17 (delta 12), reused 12 (delta 8)
To ssh://git.launchpad.net/ubuntu/+source/ruby2.7
 * [new tag] upload/2.7.3-2ubuntu1 -> upload/2.7.3-2ubuntu1
$ dput ubuntu ../ruby2.7_2.7.3-2ubuntu1_source.changes
Checking signature on .changes
gpg: ../ruby2.7_2.7.3-2ubuntu1_source.changes: Valid signature from F823A2729883C97C
Checking signature on .dsc
gpg: ../ruby2.7_2.7.3-2ubuntu1.dsc: Valid signature from F823A2729883C97C
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading ruby2.7_2.7.3-2ubuntu1.dsc: done.
  Uploading ruby2.7_2.7.3-2ubuntu1.debian.tar.xz: done.
  Uploading ruby2.7_2.7.3-2ubuntu1_source.changes: done.
Successfully uploaded packages.

[Bryce Harrington (bryce)]

This has migrated

  - Current Version: 2.7.3-2ubuntu1
  - Proposed Version: None
  - Debian Version: 2.7.3-2
  - New Version: 2.7.3-2ubuntu1

diff --git a/debian/changelog b/debian/changelog
index 8a9a4b0..268efcd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+ruby2.7 (2.7.3-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - LTO appears to cause some issue to SEGV handler. Disable
+      it for now. See https://bugs.ruby-lang.org/issues/17052.
+  * Dropped changes:
+    - debian/patches/CVE-2021-28965.patch: backport fixes from REXML.
+      [Included in 2.7.3-1]
+
+ -- Utkarsh Gupta <[e-mail]>  Wed, 05 May 2021 18:26:16 +0530
+
 ruby2.7 (2.7.3-2) unstable; urgency=medium
 
   * Revert upstream change that breaks building for 32-bit arm
@@ -21,6 +32,22 @@ ruby2.7 (2.7.3-1) unstable; urgency=medium
 
  -- Utkarsh Gupta <[e-mail]>  Sat, 17 Apr 2021 20:12:52 +0530
 
+ruby2.7 (2.7.2-4ubuntu1.1) hirsute-security; urgency=medium
+
+  * SECURITY UPDATE: XML round-trip vulnerability in REXML
+    - debian/patches/CVE-2021-28965.patch: backport fixes from REXML
+      3.2.3.1.
+    - CVE-2021-28965
+
+ -- Marc Deslauriers <[e-mail]>  Thu, 22 Apr 2021 14:27:19 -0400
+
+ruby2.7 (2.7.2-4ubuntu1) hirsute; urgency=medium
+
+  * LTO appears to cause some issue to SEGV handler. Disable it for now.
+    See https://bugs.ruby-lang.org/issues/17052
+
+ -- Matthias Klose <[e-mail]>  Tue, 23 Mar 2021 13:50:56 +0100
+
 ruby2.7 (2.7.2-4) unstable; urgency=medium
 
   [ Antonio Terceiro ]
diff --git a/debian/control b/debian/control
index 1b21bc2..3470afb 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: ruby2.7
 Section: ruby
 Priority: optional
-Maintainer: Debian Ruby Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Ruby Team <[e-mail]>
 Uploaders: Antonio Terceiro <[e-mail]>,
            Lucas Kanashiro <[e-mail]>,
            Utkarsh Gupta <[e-mail]>
diff --git a/debian/rules b/debian/rules
index c2d81ae..1401451 100755
--- a/debian/rules
+++ b/debian/rules
@@ -59,7 +59,10 @@ configure_options += --with-dbm-type=gdbm_compat
 configure_options += --with-compress-debug-sections=no
 
 # hardening and other standard Debian build flags
-export DEB_BUILD_MAINT_OPTIONS = hardening=+bindnow
+
+# LTO appears to cause some issue to SEGV handler.
+# https://bugs.ruby-lang.org/issues/17052
+export DEB_BUILD_MAINT_OPTIONS = hardening=+bindnow optimize=-lto
 configure_options += $(shell dpkg-buildflags --export=configure)
 
 # See: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93808