<div dir="ltr">Hi all<div><br></div><div>I have now been able to run the tests and also the abi version checker.</div><div>I think it looks good.</div><div><br></div><div>I could not verify FIPS 140-1 tests due to some device error (I'm running in a chroot so I guess that is the problem) but everything else is working.</div><div><br></div><div>The ABI reports are available here:</div><div><div><br></div><div>nspr:</div><div><a href="http://apt.inguza.net/wheezy-security/nspr/compat_report.html">http://apt.inguza.net/wheezy-security/nspr/compat_report.html</a></div><div><br></div><div>nss:</div><div><a href="http://apt.inguza.net/wheezy-security/nss/compat_report.html">http://apt.inguza.net/wheezy-security/nss/compat_report.html</a></div><div><br></div></div><div>If I do not hear any further objections I'll upload this on early next week</div><div><br></div><div>Best regards</div><div><br></div><div>// Ola</div></div><div class="gmail_extra"><br><div class="gmail_quote">On 21 October 2016 at 23:40, Guido Günther <span dir="ltr"><<a href="mailto:agx@sigxcpu.org" target="_blank">agx@sigxcpu.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Fri, Oct 21, 2016 at 11:16:54PM +0200, Ola Lundqvist wrote:<br>
> Hi Guido<br>
><br>
> Thanks a lot for the information. I'll enable this and will also run<br>
> abi-compliance check tool.<br>
> Is it this [1] one you have used?<br>
><br>
> [1] <a href="https://lvc.github.io/abi-compliance-checker/" rel="noreferrer" target="_blank">https://lvc.github.io/abi-<wbr>compliance-checker/</a><br>
<br>
</span>IIRC I've used the abi-compliance-checker Debian package.<br>
Cheers,<br>
-- Guido<br>
<div class="HOEnZb"><div class="h5"><br>
><br>
> Best regards<br>
><br>
> // Ola<br>
><br>
> On 20 October 2016 at 23:48, Guido Günther <<a href="mailto:agx@sigxcpu.org">agx@sigxcpu.org</a>> wrote:<br>
><br>
> > Hi Ola,<br>
> > On Thu, Oct 20, 2016 at 11:15:29PM +0200, Ola Lundqvist wrote:<br>
> > > Hi LTS team, Mozilla maintainers, Mike and Florian<br>
> > ><br>
> > > I have been working on the security problem reported in nss (and nspr).<br>
> > > <a href="https://security-tracker.debian.org/tracker/TEMP-0000000-583651" rel="noreferrer" target="_blank">https://security-tracker.<wbr>debian.org/tracker/TEMP-<wbr>0000000-583651</a><br>
> > > It is about unprotected environment variables.<br>
> > ><br>
> > > I did a check on what Florian Weimer had done for jessie-security and<br>
> > > the solution there was simply to package the new upstream release. So<br>
> > > I decided to do that approach as well. The advantage with this is that<br>
> > > we will not only have this problem solved, but also a few more.<br>
> > ><br>
> > > TEMP-0000000-583651 (nspr and nss)<br>
> > > CVE-2014-3566<br>
> > > CVE-2014-1490<br>
> > > CVE-2013-1740<br>
> > ><br>
> > > The disadvantage is that we are not playing safe. However it looks<br>
> > > backwards compatible, but you never know.<br>
> > ><br>
> > > So all in all I have produced the following:<br>
> > ><br>
> > > nspr:<br>
> > > <a href="http://apt.inguza.net/wheezy-security/nspr" rel="noreferrer" target="_blank">http://apt.inguza.net/wheezy-<wbr>security/nspr</a><br>
> > > This is essentially a mimic of the jessie-security package changes.<br>
> > ><br>
> > > nss:<br>
> > > <a href="http://apt.inguza.net/wheezy-security/nss" rel="noreferrer" target="_blank">http://apt.inguza.net/wheezy-<wbr>security/nss</a><br>
> > > This is essentially a re-build of the jessie-security package with<br>
> > > changes file kept and only updated with one new entry.<br>
> > ><br>
> > > Call for advice:<br>
> > > 1) Do you have an opinion about the fact that I backport new upstream<br>
> > release?<br>
> ><br>
> > See my discussion with the release team abot this:<br>
> ><br>
> > <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=824872" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-<wbr>bin/bugreport.cgi?bug=824872</a><br>
> ><br>
> > > 2) Will we have a build problem as nss depends on the latest nspr? I<br>
> > > guess I shall upload nspr first.<br>
> ><br>
> > See my runs of the abi compliance checker in the above URL.<br>
> ><br>
> > > 3) Shall I create one DLA covering both packages or shall I just<br>
> > > produce one DLA covering both nspr and nss?<br>
> ><br>
> > The rule is one DLA per package AFAIK.<br>
> ><br>
> > > I think one DLA is the best as both are needed to solve the problem<br>
> > > reported. But maybe that is against some practice. If you think I<br>
> > > shall write two, then please advice me what to write in the DLA for<br>
> > > nspr.<br>
> > ><br>
> > > Call for testing:<br>
> > > 4) As this package can have a rather big impact on lot of other<br>
> > > packages it would be good if all of you install the new version (nss<br>
> > > is the important one) to see if it works for you.<br>
> ><br>
> > See<br>
> ><br>
> > <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806207" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-<wbr>bin/bugreport.cgi?bug=806207</a><br>
> > <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=806639" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-<wbr>bin/bugreport.cgi?bug=806639</a><br>
> > <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809723" rel="noreferrer" target="_blank">https://bugs.debian.org/cgi-<wbr>bin/bugreport.cgi?bug=809723</a><br>
> ><br>
> > that enable the internal test suites and add some autopkgtests. This<br>
> > should help to gain some confidence.<br>
> > Cheers,<br>
> > -- Guido<br>
> ><br>
> > ><br>
> > > I did not produce a debdiff as that diff was way too large to be useful.<br>
> > ><br>
> > > I have installed it myself but I have not been able to verify that the<br>
> > > tools using it is really working. Most are GUI tools and I do not have<br>
> > > a GUI environment to test wheezy in. The libnss3-tools package seems<br>
> > > to work fine to the limit I was able to check.<br>
> > ><br>
> > > I have not tried to reproduce the problem as the report was too vague<br>
> > > to give any good advice on what environment variable that could<br>
> > > actually cause a problem.<br>
> > ><br>
> > > If I do not hear any objections in four days I will upload anyway.<br>
> > ><br>
> > > Thanks in advance<br>
> > ><br>
> > > // Ola<br>
> > ><br>
> > > --<br>
> > > --- Inguza Technology AB --- MSc in Information Technology ----<br>
> > > | <a href="mailto:ola@inguza.com">ola@inguza.com</a> Folkebogatan 26<br>
> > > | <a href="mailto:opal@debian.org">opal@debian.org</a> 654 68 KARLSTAD<br>
> > > | <a href="http://inguza.com/" rel="noreferrer" target="_blank">http://inguza.com/</a> Mobile: <a href="tel:%2B46%20%280%2970-332%201551" value="+46703321551">+46 (0)70-332 1551</a><br>
> > > | gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9<br>
> > ><br>
> ><br>
><br>
><br>
><br>
> --<br>
> --- Inguza Technology AB --- MSc in Information Technology ----<br>
> / <a href="mailto:ola@inguza.com">ola@inguza.com</a> Folkebogatan 26 \<br>
> | <a href="mailto:opal@debian.org">opal@debian.org</a> 654 68 KARLSTAD |<br>
> | <a href="http://inguza.com/" rel="noreferrer" target="_blank">http://inguza.com/</a> Mobile: <a href="tel:%2B46%20%280%2970-332%201551" value="+46703321551">+46 (0)70-332 1551</a> |<br>
> \ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /<br>
> ------------------------------<wbr>------------------------------<wbr>---<br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div><font face="courier new, monospace" size="1"> --- Inguza Technology AB --- MSc in Information Technology ----</font></div><div><font face="courier new, monospace" size="1">/ <a href="mailto:ola@inguza.com" target="_blank">ola@inguza.com</a> Folkebogatan 26 \</font></div><div><font face="courier new, monospace" size="1">| <a href="mailto:opal@debian.org" target="_blank">opal@debian.org</a> 654 68 KARLSTAD |</font></div><div><font face="courier new, monospace" size="1">| <a href="http://inguza.com/" target="_blank">http://inguza.com/</a> Mobile: +46 (0)70-332 1551 |</font></div><div><font face="courier new, monospace" size="1">\ gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9 /</font></div><div><font face="courier new, monospace" size="1"> ---------------------------------------------------------------</font></div></div><div><br></div></div></div></div></div>
</div>