[ Impact ]
Currently, the build of the heimdal package against glibc 2.38 is not possible due to
the fact that strlcat and strlcpy were added to glibc in version 2.38 and heimdal no longer defines its internal version.
We need this fix to build the heimdal package successfully. It's also important to be able to apply security fixes in the future (if needed).
[ Test plan ]
Build the package in a ppa to check that the error is gone and that the package builds successfully.
# Install the package and check it works ok
#0.Prepare a VM or Container. i.e:
# lxc launch ubuntu-daily:mantic Mheimdal
# lxc shell Mheimdal
#1. Install heimtools from heimdal-clients
# apt update && apt upgrade -y
# apt install -y heimdal-clients
#1.1 Check the libraries are installed well
# dpkg -l libroken19-heimdal | grep ii
# dpkg -l libkafs0-heimdal | grep ii
#1.2 Check that the command is not broken (you get a
Usage: : heimtools [--version] [--help] command ..)
# heimtools --help
#2. Install aklog from src:aftools, openafs-krb5 binary package. A rebuild of
aftools against the new heimdal package is needed for this to be
successfull.
# apt install -y openafs-krb5
#2.1 Check that the command is not broken (you don't get a
aklog: symbol lookup error: aklog: undefined symbol: rk_strlcat, version
HEIMDAL_ROKEN_1.0)
# aklog --help
[ Where problems could occur ]
I tried to get a complete list of libraries and binaries that use the symbols affected in this fix (inside and outside the ones provided by src:heimdal itself), but, I don't know if there are other third-party pieces of software outside the archive that depends on these libraries.
If that is the case, when executing, the affected binary will no run and a message like this could appear:
undefined symbol: rk_strlcat, version HEIMDAL_ROKEN_1.0
Could be a disruption in the way the heimdal suite works? Unlikely, but there is always room for it.
It should be fine since the symbols, in this case, are available to all heimdal-dependants libraries in the build. This case could arise if a mix of heimdal libraries (provided by two different versions of src:heimdal) are installed, but this is what the 'Breaks:' that was added in the d/control wants to avoid.
[ Other Info ]
A rebuild of the openafs package against this new version of the libraries provided by this heimdal package is needed.
(bug 2046441).
[ Original Description ]
--------------------------------
See ubuntu-devel thread[1] and mantic rebuild report[2].
dpkg-gensymbols: error: some symbols or patterns disappeared in the symbols file: see diff output below
dpkg-gensymbols: warning: debian/libkafs0-heimdal/DEBIAN/symbols doesn't match completely debian/libkafs0-heimdal.symbols
--- debian/libkafs0-heimdal.symbols (libkafs0-heimdal_7.8.git20221117.28daf24+dfsg-3ubuntu1_amd64)
+++ dpkg-gensymbolshoPgEa 2023-09-05 02:37:15.654111977 +0000
@@ -12,7 +12,7 @@
_kafs_get_cred@Base 1.4.0+git20110226
_kafs_realm_of_cell@Base 1.4.0+git20110226
_kafs_resolve_debug@Base 1.4.0+git20110226
- _kafs_strlcpy@Base 1.4.0+git20110226
+#MISSING: 7.8.git20221117.28daf24+dfsg-3ubuntu1# _kafs_strlcpy@Base 1.4.0+git20110226
k_afs_cell_of_file@Base 1.4.0+git20110226
k_hasafs@Base 1.4.0+git20110226
k_hasafs_recheck@Base 1.4.0+git20110226
dh_makeshlibs: error: failing due to earlier errors
make[1]: *** [debian/rules:18: override_dh_makeshlibs] Error 25
This one might need a fix similar to the krb5 one[3].
1. https://lists.ubuntu.com/archives/ubuntu-devel/2023-September/042784.html
2. https://people.canonical.com/~ginggs/ftbfs-report/test-rebuild-20230830-mantic-mantic.html#ubuntu-server-team
3. https://launchpad.net/ubuntu/+source/krb5/1.20.1-3ubuntu1
Checking if outside the package these symbols are being used by other shared libraries:
* For libkafs0-heimdal: None
libroken19-heimdal: /usr/lib/
root@Nheimdal:~# for s in $(for p in $(apt-cache rdepends libkafs0-heimdal | grep -v heimdal | cut -d':' -f2 | xargs); do for l in $(apt-file list ${p} | grep '.so' | grep lib | cut -d':' -f2| xargs); do readlink -f ${l} ; done; done | sort -u); do nm -D ${s} | grep strlc && apt-file search ${s}; done
root@Nheimdal:~#
* For libroken19-heimdal: libafsauthent2 and libafsrpc2, both form src:openafs
root@Nheimdal:~# for s in $(for p in $(apt-cache rdepends libroken19-heimdal | grep -v heimdal | cut -d':' -f2 | xargs); do for l in $(apt-file list ${p} | grep '.so' | grep lib | cut -d':' -f2| xargs); do readlink -f ${l} ; done; done | sort -u); do nm -D ${s} | grep strlc && apt-file search ${s}; done
U rk_strlcat@
U rk_strlcpy@
libafsauthent2: /usr/lib/
U rk_strlcat@
U rk_strlcpy@
libafsrpc2: /usr/lib/
I will follow the same approach that in [1], for krb5.
[1] https:/
P.S. Sorry for the ugly and no-efficient inline bash, but for the purpose of the fixing I think is OK, and I promise I'll do a pretty script after Xmas (in case that doesn't exist yet, which I couldn't say). for sure).