Ubuntu
krb5 package

krb5: Fail to build against OpenSSL 3.0

Bug #1945795 reported by Simon Chopin
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
krb5 (Ubuntu)
Fix Released
Undecided
Unassigned

Bug Description

Hello,

As part of a rebuild against OpenSSL3, this package failed to build on one or
several architectures. You can find the details of the rebuild at

https://people.canonical.com/~schopin/rebuilds/openssl-3.0.0-impish.html

or for the amd64 failed build, directly at

https://launchpad.net/~schopin/+archive/ubuntu/openssl-3.0.0/+build/22098576/+files/buildlog_ubuntu-impish-amd64.krb5_1.18.3-6.0~ssl3ppa1.1_BUILDING.txt.gz

We're planning to transition to OpenSSL 3.0 for the 22.04 release, and consider
this issue as blocking for this transition.

You can find general migration informations at
https://www.openssl.org/docs/manmaster/man7/migration_guide.html
For your tests, you can build against libssl-dev as found in the PPA
schopin/openssl-3.0.0

Looking into the upstream master branch, I was able to find the following commits
related to OpenSSL3:

https://github.com/krb5/krb5/commit/00de1aad7b3647b91017c7009b0bc65cd0c8b2e0
https://github.com/krb5/krb5/commit/d6bf42279675100e3e4fe7c6e08eef74d49624cb
https://github.com/krb5/krb5/commit/aa9b4a2a64046afd2fab7cb49c346295874a5fb6

Perhaps a simple cherry-pick of those would suffice?

Revision history for this message
Sam Hartman (hartmans) wrote : Re: [Bug 1945795] [NEW] krb5: Fail to build against OpenSSL 3.0

>>>>> "Simon" == Simon Chopin <email address hidden> writes:
    Simon> We're planning to transition to OpenSSL 3.0 for the 22.04
    Simon> release, and consider this issue as blocking for this
    Simon> transition.

I expect things to be fixed in Debian within the next couple of months.

I attach the upstream patch for this issue in case Ubuntu needs to move
faster than Debian.

Revision history for this message
Simon Chopin (schopin) wrote :

Hi Sam,

Quoting Sam Hartman (2021-10-01 16:13:18)
> >>>>> "Simon" == Simon Chopin <email address hidden> writes:
> Simon> We're planning to transition to OpenSSL 3.0 for the 22.04
> Simon> release, and consider this issue as blocking for this
> Simon> transition.
>
> I expect things to be fixed in Debian within the next couple of months.
>
> I attach the upstream patch for this issue in case Ubuntu needs to move
> faster than Debian.

Thank you for this quick response, I appreciate it! I'll probably
prepare an Ubuntu-specific debdiff+PPA just in case, but it would be
really nice to keep in sync with Debian.

Cheers,
Simon

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "0001-Fix-softpkcs11-build-issues-with-openssl-3.0.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Revision history for this message
Simon Chopin (schopin) wrote :

For the record : https://salsa.debian.org/debian/krb5/-/merge_requests/6

I plan on uploading (well, having someone upload) a version of krb5 based off this branch if it hasn't already hit Debian when we start the transition.

Revision history for this message
Simon Chopin (schopin) wrote (last edit ):

I've uploaded a package to

https://launchpad.net/~schopin/+archive/ubuntu/test-ppa/+packages

based on the above MR. autopkgtests against -proposed ran fine on amd64.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Hi, thanks for preparing the package, but to be sponsored the debian/changelog needs a better description than "PPA upload". Could you please update it with an appropriate changelog including the patch name, what the patch does, and a LP tag to this bug?

Thanks!

Revision history for this message
Simon Chopin (schopin) wrote :

When I upload to my test PPA I always add a new entry "PPA upload" to make sure that the whole entry is scrapped, including the ~ppa version suffix. The actual entry is the one before that.

My usual sponsored uploads are based on debdiffs rather than direct PPA versions so this has never be an issue. For future reference, what would be a better way than this? The debdiff seemed too messy to be useful...

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Oh! Right, I didn't notice it was just an extra changelog entry for the ppa.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

ACK on the package. Looks good, uploaded. Thanks!

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package krb5 - 1.19.2-0ubuntu1

---------------
krb5 (1.19.2-0ubuntu1) jammy; urgency=medium

  [ Sam Hartman ]
  * New Upstream version
  * Depend on tex-gyre, Closes: #997407

  [Simon Chopin]
  * d/p/0012-Fix-softpkcs11-build-issues-with-openssl-3.0.patch:
    Cherry-picked from upstream master to fix OpenSSL3 build.
    Closes: #995152, LP: #1945795

 -- Simon Chopin <email address hidden> Tue, 30 Nov 2021 10:54:17 +0100

Changed in krb5 (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.