[Bug 1822069] Re: SRU: Shibboleth SPv3 for bionic

Mon Apr 15 14:51:14 UTC 2019

What about Cosmic? Note that from SRU policy
(https://wiki.ubuntu.com/StableReleaseUpdates), "To avoid regressions on
upgrade, any such feature must then also be added to any newer supported
Ubuntu release."

I'm afraid that this is going to be too time consuming for me to review
- there seem to be additional complications the more I look into it (eg.
Cosmic and the new soname as you mention above). Based on previous
experience I think that the technical difficulties in landing this
safely to existing 18.04 users are going to overwhelm the available
volunteer time available from developers who are able to review it.

You might be better off maintaining a PPA for users on 18.04, or just
recommending the use of Disco once it's released, combined with suitable
automation, tests and CI to ensure that you can roll forward on a six
monthly basis until the next LTS is released. If that seems hard to you,
updating 18.04 seems harder to me.

However I welcome other Ubuntu developers to take a look if they want to
help you getting this landed. I reserve judgement on this being suitable
from an SRU policy perspective. If you do manage to get sponsorship,
keep in mind that finding an SRU team member to review it all again is
still going to a significant challenge.

I've added bug tasks for Bionic and Cosmic - getting the statuses all
correct would be helpful if you want to proceed.

I'm sorry I can't help you further. I hope this doesn't discourage you
from continuing to help with Shobboleth packaging in Ubuntu. Appearing
as a newcomer wanting to do major surgery is your challenge here. I hope
that you'll find that maintaining packaging in the development release,
and landing routine bugfixes in stable releases are much easier.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1822069

Title:
  SRU: Shibboleth SPv3 for bionic

Status in log4shib package in Ubuntu:
  New
Status in opensaml package in Ubuntu:
  New
Status in opensaml2 package in Ubuntu:
  New
Status in shibboleth-resolver package in Ubuntu:
  New
Status in shibboleth-sp package in Ubuntu:
  New
Status in shibboleth-sp2 package in Ubuntu:
  New
Status in xml-security-c package in Ubuntu:
  New
Status in xmltooling package in Ubuntu:
  New
Status in log4shib source package in Bionic:
  New
Status in opensaml source package in Bionic:
  New
Status in opensaml2 source package in Bionic:
  New
Status in shibboleth-resolver source package in Bionic:
  New
Status in shibboleth-sp source package in Bionic:
  New
Status in shibboleth-sp2 source package in Bionic:
  New
Status in xml-security-c source package in Bionic:
  New
Status in xmltooling source package in Bionic:
  New
Status in log4shib source package in Cosmic:
  New
Status in opensaml source package in Cosmic:
  New
Status in opensaml2 source package in Cosmic:
  New
Status in shibboleth-resolver source package in Cosmic:
  New
Status in shibboleth-sp source package in Cosmic:
  New
Status in shibboleth-sp2 source package in Cosmic:
  New
Status in xml-security-c source package in Cosmic:
  New
Status in xmltooling source package in Cosmic:
  New

Bug description:
  [Impact]

  Bionic released with version 2 of the Shibboleth Service Provider (and
  its accompanying dependencies) and with OpenSSL 1.1. However, the SPv2
  isn't compatible with OpenSSL 1.1, only 1.0 (and earlier), and was
  therefore shipped compiled against 1.0. This created a mix of OpenSSL
  and libcurl versions between the Apache module that the Shibboleth SP
  provides (mod_shib) and other modules, thus rendering mod_shib
  uninstallable alongside other modules (that depend on libcurl4)
  because of that conflict. Not being able to use mod_shib and mod_php
  with php-curl -- for example -- together greatly reduces the
  usefulness of the Shibboleth SPv2 in bionic, see LP#1776489. Version 3
  of the Shibboleth SP is compatible with OpenSSL 1.1 and having it
  available for bionic would allow users to install it together with
  other Apache modules.

  Moreover, the SPv2 suffers from a few security issues (LP#1636590)
  which have since been fixed upstream and v2 is no longer supported
  upstream (EOL, LP#1812401).

  I propose to update the following source packages in bionic:
  - shibboleth-sp [not in Bionic] to 3.0.4 (sync request for disco LP#1822055)
  - opensaml [not in Bionic] to 3.0.1 (sync request for disco LP#1823325)
  - xmltooling from 1.6.4-1ubuntu2.1 [Cosmic 3.0.2-1ubuntu1.1] to 3.0.4
  - xml-security-c from 1.7.3-4ubuntu0.1 [Cosmic 2.0.1-1] to 2.0.2
  - log4shib from 1.0.9-3 to 2.0.0
  - shibboleth-resolver from 1.0.0-1build4 to 3.0.0

  [Test Case]

  # apt install apache2 libapache2-mod-shib2
  [...]
  # apt install libapache2-mod-php php-curl
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  Some packages could not be installed. This may mean that you have
  requested an impossible situation or if you are using the unstable
  distribution that some required packages have not yet been created
  or been moved out of Incoming.
  The following information may help to resolve the situation:

  The following packages have unmet dependencies:
   php-curl : Depends: php7.2-curl but it is not going to be installed
  E: Unable to correct problems, you have held broken packages.

  # apt install php7.2-curl
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  Some packages could not be installed. This may mean that you have
  requested an impossible situation or if you are using the unstable
  distribution that some required packages have not yet been created
  or been moved out of Incoming.
  The following information may help to resolve the situation:

  The following packages have unmet dependencies:
   php7.2-curl : Depends: libcurl4 (>= 7.44.0) but it is not going to be installed
  E: Unable to correct problems, you have held broken packages.

  # apt install libcurl4
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  The following packages were automatically installed and are no longer required:
    libcurl3-gnutls libfcgi-bin libfcgi0ldbl liblog4shib1v5 libltdl7 libmemcached11 libodbc1 libssl1.0.0 libxerces-c3.2 libxml-security-c17v5 opensaml2-schemas shibboleth-sp2-common xmltooling-schemas
  Use 'apt autoremove' to remove them.
  The following packages will be REMOVED:
    libapache2-mod-shib2 libcurl3 libsaml9 libshibsp-plugins libshibsp7 libxmltooling7 shibboleth-sp2-utils
  The following NEW packages will be installed:
    libcurl4
  0 upgraded, 1 newly installed, 7 to remove and 0 not upgraded.
  Need to get 214 kB of archives.
  After this operation, 18.7 MB disk space will be freed.
  Do you want to continue? [Y/n] n
  Abort.

  [Regression Potential]
  A new version can, of course, bring new bugs and security vulnerabilities. Catching up to SPv3 would at least give us an upstream-supported version. Shibboleth SP 3.0.4 and its dependencies are, as of this writing, all in Debian testing without any major bug.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/log4shib/+bug/1822069/+subscriptions