[Bug 1822069] Re: SRU: Shibboleth SPv3 for bionic

Tue Apr 16 07:23:36 UTC 2019

On 15/04/2019 16.51, Robie Basak wrote:
> I'm afraid that this is going to be too time consuming for me to
> review - there seem to be additional complications the more I look
> into it (eg. Cosmic and the new soname as you mention above). Based
> on previous experience I think that the technical difficulties in
> landing this safely to existing 18.04 users are going to overwhelm
> the available volunteer time available from developers who are able
> to review it.

You are right that Cosmic must also be taken into account. However, the
situation on Cosmic is much simpler: it already has the SPv3 stack so
the upgrade would boil down to 3.0.2 -> 3.0.4. The only small issue it
that Cosmic is still using the old package names with "2" in them (i.e.
"shibboleth-sp2"), but that can be dealt with Breaks/Replaces to ensure
a smooth upgrade (as I've already done for Debian backports). Is there
something else complicating the SRU for Cosmic you were thinking of?

Can you explain how the new soname is a problem? I think it clearly
separates the new and old libraries.

> You might be better off maintaining a PPA for users on 18.04, or
> just recommending the use of Disco once it's released, combined with
> suitable automation, tests and CI to ensure that you can roll forward
> on a six monthly basis until the next LTS is released. If that seems
> hard to you, updating 18.04 seems harder to me.

Users of the Shibboleth SP software are typically web server operators,
as it is installed alongside Apache httpd. These people completely
ignore non-LTS releases and it is already hard enough to get them to
upgrade from one LTS to the next before its support expires. I've had
way more requests to backport the SPv3 stack to Xenial than I've got for
Bionic (for our PPA at http://pkg.switch.ch/switchaai/). Therefore, I
think it is unrealistic to ask server operators to upgrade their whole
OS every six months just to get a new SP version. I think it is worse to
leave Bionic with a broken Shibboleth SP for four more years than
upgrading it and risk breaking Moonshot (which can be fixed with a
no-change rebuild).

Those who have the "suitable automation, tests and CI" have already
moved past Bionic, I suppose. I want to do something for the rest out there.

> However I welcome other Ubuntu developers to take a look if they want
> to help you getting this landed.

Could you please circulate this internally so someone else may see and
tackle it?

> I've added bug tasks for Bionic and Cosmic - getting the statuses
> all correct would be helpful if you want to proceed.

What would be the correct status then?

> I'm sorry I can't help you further. I hope this doesn't discourage
> you from continuing to help with Shibboleth packaging in Ubuntu.
> Appearing as a newcomer wanting to do major surgery is your challenge
> here. I hope that you'll find that maintaining packaging in the
> development release, and landing routine bugfixes in stable releases
> are much easier.

It is indeed a daunting task for a newcomer. I submitted one security
patch for Shibboleth just before and it went well so I figured I'd
embark on a larger endeavour. :) For me, how packages are maintained in
Ubuntu is still fairly unclear (where is the VCS?)...

  Etienne

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1822069

Title:
  SRU: Shibboleth SPv3 for bionic

Status in log4shib package in Ubuntu:
  New
Status in opensaml package in Ubuntu:
  New
Status in opensaml2 package in Ubuntu:
  New
Status in shibboleth-resolver package in Ubuntu:
  New
Status in shibboleth-sp package in Ubuntu:
  New
Status in shibboleth-sp2 package in Ubuntu:
  New
Status in xml-security-c package in Ubuntu:
  New
Status in xmltooling package in Ubuntu:
  New
Status in log4shib source package in Bionic:
  New
Status in opensaml source package in Bionic:
  New
Status in opensaml2 source package in Bionic:
  New
Status in shibboleth-resolver source package in Bionic:
  New
Status in shibboleth-sp source package in Bionic:
  New
Status in shibboleth-sp2 source package in Bionic:
  New
Status in xml-security-c source package in Bionic:
  New
Status in xmltooling source package in Bionic:
  New
Status in log4shib source package in Cosmic:
  New
Status in opensaml source package in Cosmic:
  New
Status in opensaml2 source package in Cosmic:
  New
Status in shibboleth-resolver source package in Cosmic:
  New
Status in shibboleth-sp source package in Cosmic:
  New
Status in shibboleth-sp2 source package in Cosmic:
  New
Status in xml-security-c source package in Cosmic:
  New
Status in xmltooling source package in Cosmic:
  New

Bug description:
  [Impact]

  Bionic released with version 2 of the Shibboleth Service Provider (and
  its accompanying dependencies) and with OpenSSL 1.1. However, the SPv2
  isn't compatible with OpenSSL 1.1, only 1.0 (and earlier), and was
  therefore shipped compiled against 1.0. This created a mix of OpenSSL
  and libcurl versions between the Apache module that the Shibboleth SP
  provides (mod_shib) and other modules, thus rendering mod_shib
  uninstallable alongside other modules (that depend on libcurl4)
  because of that conflict. Not being able to use mod_shib and mod_php
  with php-curl -- for example -- together greatly reduces the
  usefulness of the Shibboleth SPv2 in bionic, see LP#1776489. Version 3
  of the Shibboleth SP is compatible with OpenSSL 1.1 and having it
  available for bionic would allow users to install it together with
  other Apache modules.

  Moreover, the SPv2 suffers from a few security issues (LP#1636590)
  which have since been fixed upstream and v2 is no longer supported
  upstream (EOL, LP#1812401).

  I propose to update the following source packages in bionic:
  - shibboleth-sp [not in Bionic] to 3.0.4 (sync request for disco LP#1822055)
  - opensaml [not in Bionic] to 3.0.1 (sync request for disco LP#1823325)
  - xmltooling from 1.6.4-1ubuntu2.1 [Cosmic 3.0.2-1ubuntu1.1] to 3.0.4
  - xml-security-c from 1.7.3-4ubuntu0.1 [Cosmic 2.0.1-1] to 2.0.2
  - log4shib from 1.0.9-3 to 2.0.0
  - shibboleth-resolver from 1.0.0-1build4 to 3.0.0

  [Test Case]

  # apt install apache2 libapache2-mod-shib2
  [...]
  # apt install libapache2-mod-php php-curl
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  Some packages could not be installed. This may mean that you have
  requested an impossible situation or if you are using the unstable
  distribution that some required packages have not yet been created
  or been moved out of Incoming.
  The following information may help to resolve the situation:

  The following packages have unmet dependencies:
   php-curl : Depends: php7.2-curl but it is not going to be installed
  E: Unable to correct problems, you have held broken packages.

  # apt install php7.2-curl
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  Some packages could not be installed. This may mean that you have
  requested an impossible situation or if you are using the unstable
  distribution that some required packages have not yet been created
  or been moved out of Incoming.
  The following information may help to resolve the situation:

  The following packages have unmet dependencies:
   php7.2-curl : Depends: libcurl4 (>= 7.44.0) but it is not going to be installed
  E: Unable to correct problems, you have held broken packages.

  # apt install libcurl4
  Reading package lists... Done
  Building dependency tree
  Reading state information... Done
  The following packages were automatically installed and are no longer required:
    libcurl3-gnutls libfcgi-bin libfcgi0ldbl liblog4shib1v5 libltdl7 libmemcached11 libodbc1 libssl1.0.0 libxerces-c3.2 libxml-security-c17v5 opensaml2-schemas shibboleth-sp2-common xmltooling-schemas
  Use 'apt autoremove' to remove them.
  The following packages will be REMOVED:
    libapache2-mod-shib2 libcurl3 libsaml9 libshibsp-plugins libshibsp7 libxmltooling7 shibboleth-sp2-utils
  The following NEW packages will be installed:
    libcurl4
  0 upgraded, 1 newly installed, 7 to remove and 0 not upgraded.
  Need to get 214 kB of archives.
  After this operation, 18.7 MB disk space will be freed.
  Do you want to continue? [Y/n] n
  Abort.

  [Regression Potential]
  A new version can, of course, bring new bugs and security vulnerabilities. Catching up to SPv3 would at least give us an upstream-supported version. Shibboleth SP 3.0.4 and its dependencies are, as of this writing, all in Debian testing without any major bug.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/log4shib/+bug/1822069/+subscriptions