Diff of the sbuild Installed-Build-Depends from the "good" Hirsute build that produced the nss packages now in the archive and a "bad" Hirsute build done in an up-to-date Hirsute schroot:
--- good 2021-07-21 12:02:03.870339411 +0200 +++ bad 2021-07-21 12:03:20.367850047 +0200 @@ -3,38 +3,39 @@ automake (= 1:1.16.3-2ubuntu1), autopoint (= 0.21-3ubuntu2), autotools-dev (= 20180224.1+nmu1), - base-files (= 11ubuntu16), + base-files (= 11ubuntu19), base-passwd (= 3.5.49), - bash (= 5.1-1ubuntu1), - binutils (= 2.36.1-0ubuntu1), - binutils-common (= 2.36.1-0ubuntu1), - binutils-s390x-linux-gnu (= 2.36.1-0ubuntu1), - bsdextrautils (= 2.36.1-1ubuntu2), - bsdutils (= 1:2.36.1-1ubuntu2), + bash (= 5.1-2ubuntu1), + binutils (= 2.36.1-6ubuntu1), + binutils-common (= 2.36.1-6ubuntu1), + binutils-s390x-linux-gnu (= 2.36.1-6ubuntu1), + bsdextrautils (= 2.36.1-7ubuntu2), + bsdutils (= 1:2.36.1-7ubuntu2), build-essential (= 12.8ubuntu3), - bzip2 (= 1.0.8-4ubuntu2), + bzip2 (= 1.0.8-4ubuntu3), coreutils (= 8.32-4ubuntu2), - cpp (= 4:10.2.0-1ubuntu1), - cpp-10 (= 10.2.1-19ubuntu1), + cpp (= 4:10.3.0-1ubuntu1), + cpp-10 (= 10.3.0-1ubuntu1), dash (= 0.5.11+git20200708+dd9ef66+really0.5.11+git20200708+dd9ef66-5ubuntu1), debconf (= 1.5.74), - debhelper (= 13.3.3ubuntu2), + debhelper (= 13.3.4ubuntu1), debianutils (= 4.11.2), + debugedit (= 1:0.1-0ubuntu2), dh-autoreconf (= 20), - dh-exec (= 0.23.2), + dh-exec (= 0.23.4), dh-strip-nondeterminism (= 1.11.0-1), diffutils (= 1:3.7-3ubuntu1), - dpkg (= 1.20.7.1ubuntu2), - dpkg-dev (= 1.20.7.1ubuntu2), - dwz (= 0.13+20210201-1), + dpkg (= 1.20.9ubuntu1), + dpkg-dev (= 1.20.9ubuntu1), + dwz (= 0.14-1), file (= 1:5.39-3), - findutils (= 4.7.0-1ubuntu2), - g++ (= 4:10.2.0-1ubuntu1), - g++-10 (= 10.2.1-19ubuntu1), - gcc (= 4:10.2.0-1ubuntu1), - gcc-10 (= 10.2.1-19ubuntu1), - gcc-10-base (= 10.2.1-19ubuntu1), - gcc-11-base (= 11-20210207-1ubuntu1), + findutils (= 4.8.0-1ubuntu1), + g++ (= 4:10.3.0-1ubuntu1), + g++-10 (= 10.3.0-1ubuntu1), + gcc (= 4:10.3.0-1ubuntu1), + gcc-10 (= 10.3.0-1ubuntu1), + gcc-10-base (= 10.3.0-1ubuntu1), + gcc-11-base (= 11.1.0-1ubuntu1~21.04), gettext (= 0.21-3ubuntu2), gettext-base (= 0.21-3ubuntu2), grep (= 3.6-1), @@ -43,113 +44,114 @@ hostname (= 3.23), init-system-helpers (= 1.60), intltool-debian (= 0.35.0+20060710.5), - libacl1 (= 2.2.53-10), + libacl1 (= 2.2.53-10ubuntu1), libarchive-zip-perl (= 1.68-1), - libasan6 (= 10.2.1-19ubuntu1), - libatomic1 (= 11-20210207-1ubuntu1), - libattr1 (= 1:2.4.48-6), + libasan6 (= 11.1.0-1ubuntu1~21.04), + libatomic1 (= 11.1.0-1ubuntu1~21.04), + libattr1 (= 1:2.4.48-6build1), libaudit-common (= 1:3.0-2ubuntu1), libaudit1 (= 1:3.0-2ubuntu1), - libbinutils (= 2.36.1-0ubuntu1), - libblkid1 (= 2.36.1-1ubuntu2), - libbz2-1.0 (= 1.0.8-4ubuntu2), - libc-bin (= 2.33-0ubuntu2), - libc-dev-bin (= 2.33-0ubuntu2), - libc6 (= 2.33-0ubuntu2), - libc6-dev (= 2.33-0ubuntu2), + libbinutils (= 2.36.1-6ubuntu1), + libblkid1 (= 2.36.1-7ubuntu2), + libbz2-1.0 (= 1.0.8-4ubuntu3), + libc-bin (= 2.33-0ubuntu5), + libc-dev-bin (= 2.33-0ubuntu5), + libc6 (= 2.33-0ubuntu5), + libc6-dev (= 2.33-0ubuntu5), libcap-ng0 (= 0.7.9-2.2build1), - libcap2 (= 1:2.44-1), - libcc1-0 (= 11-20210207-1ubuntu1), - libcom-err2 (= 1.45.7-1ubuntu1), - libcrypt-dev (= 1:4.4.17-1ubuntu1), - libcrypt1 (= 1:4.4.17-1ubuntu1), - libctf-nobfd0 (= 2.36.1-0ubuntu1), - libctf0 (= 2.36.1-0ubuntu1), - libdb5.3 (= 5.3.28+dfsg1-0.6ubuntu3), - libdebconfclient0 (= 0.256ubuntu1), - libdebhelper-perl (= 13.3.3ubuntu2), - libdpkg-perl (= 1.20.7.1ubuntu2), - libelf1 (= 0.183-1), + libcap2 (= 1:2.44-1build1), + libcc1-0 (= 11.1.0-1ubuntu1~21.04), + libcom-err2 (= 1.45.7-1ubuntu2), + libcrypt-dev (= 1:4.4.17-1ubuntu3), + libcrypt1 (= 1:4.4.17-1ubuntu3), + libctf-nobfd0 (= 2.36.1-6ubuntu1), + libctf0 (= 2.36.1-6ubuntu1), + libdb5.3 (= 5.3.28+dfsg1-0.6ubuntu4), + libdebconfclient0 (= 0.256ubuntu3), + libdebhelper-perl (= 13.3.4ubuntu1), + libdpkg-perl (= 1.20.9ubuntu1), + libdw1 (= 0.183-8), + libelf1 (= 0.183-8), libfile-stripnondeterminism-perl (= 1.11.0-1), - libgcc-10-dev (= 10.2.1-19ubuntu1), - libgcc-s1 (= 11-20210207-1ubuntu1), - libgcrypt20 (= 1.8.7-2ubuntu1), + libgcc-10-dev (= 10.3.0-1ubuntu1), + libgcc-s1 (= 11.1.0-1ubuntu1~21.04), + libgcrypt20 (= 1.8.7-2ubuntu2), libgdbm-compat4 (= 1.19-2), libgdbm6 (= 1.19-2), - libgmp10 (= 2:6.2.1+dfsg-1ubuntu1), - libgomp1 (= 11-20210207-1ubuntu1), - libgpg-error0 (= 1.38-2), + libgmp10 (= 2:6.2.1+dfsg-1ubuntu2), + libgomp1 (= 11.1.0-1ubuntu1~21.04), + libgpg-error0 (= 1.38-2build1), libgssapi-krb5-2 (= 1.18.3-4), - libicu67 (= 67.1-6ubuntu1), - libisl23 (= 0.23-1), - libitm1 (= 11-20210207-1ubuntu1), + libicu67 (= 67.1-6ubuntu2), + libisl23 (= 0.23-1build1), + libitm1 (= 11.1.0-1ubuntu1~21.04), libk5crypto3 (= 1.18.3-4), libkeyutils1 (= 1.6.1-2ubuntu1), libkrb5-3 (= 1.18.3-4), libkrb5support0 (= 1.18.3-4), - liblz4-1 (= 1.9.3-1), - liblzma5 (= 5.2.5-1.0), + liblz4-1 (= 1.9.3-1ubuntu0.1), + liblzma5 (= 5.2.5-1.0build2), libmagic-mgc (= 1:5.39-3), libmagic1 (= 1:5.39-3), - libmount1 (= 2.36.1-1ubuntu2), - libmpc3 (= 1.2.0-1), - libmpfr6 (= 4.1.0-3), + libmount1 (= 2.36.1-7ubuntu2), + libmpc3 (= 1.2.0-1build1), + libmpfr6 (= 4.1.0-3build1), libnsl-dev (= 1.3.0-0ubuntu3), libnsl2 (= 1.3.0-0ubuntu3), libnspr4 (= 2:4.29-1), libnspr4-dev (= 2:4.29-1), - libpam-modules (= 1.3.1-5ubuntu6), - libpam-modules-bin (= 1.3.1-5ubuntu6), - libpam-runtime (= 1.3.1-5ubuntu6), - libpam0g (= 1.3.1-5ubuntu6), - libpcre2-8-0 (= 10.36-2ubuntu1), - libpcre3 (= 2:8.39-13), - libperl5.32 (= 5.32.1-2), + libpam-modules (= 1.3.1-5ubuntu6.21.04.1), + libpam-modules-bin (= 1.3.1-5ubuntu6.21.04.1), + libpam-runtime (= 1.3.1-5ubuntu6.21.04.1), + libpam0g (= 1.3.1-5ubuntu6.21.04.1), + libpcre2-8-0 (= 10.36-2ubuntu5), + libpcre3 (= 2:8.39-13build3), + libperl5.32 (= 5.32.1-3ubuntu2), libpipeline1 (= 1.5.3-1), - libseccomp2 (= 2.4.3-1ubuntu6), - libselinux1 (= 3.1-3), - libsigsegv2 (= 2.13-1), - libsmartcols1 (= 2.36.1-1ubuntu2), - libsqlite3-0 (= 3.34.1-2), - libsqlite3-dev (= 3.34.1-2), - libssl1.1 (= 1.1.1i-3ubuntu1), - libstdc++-10-dev (= 10.2.1-19ubuntu1), - libstdc++6 (= 11-20210207-1ubuntu1), + libseccomp2 (= 2.5.1-1ubuntu1), + libselinux1 (= 3.1-3build1), + libsigsegv2 (= 2.13-1ubuntu1), + libsmartcols1 (= 2.36.1-7ubuntu2), + libsqlite3-0 (= 3.34.1-3), + libsqlite3-dev (= 3.34.1-3), + libssl1.1 (= 1.1.1j-1ubuntu3.1), + libstdc++-10-dev (= 10.3.0-1ubuntu1), + libstdc++6 (= 11.1.0-1ubuntu1~21.04), libsub-override-perl (= 0.09-2), - libsystemd0 (= 247.3-1ubuntu2), - libtinfo6 (= 6.2+20201114-2), - libtirpc-common (= 1.3.1-1), - libtirpc-dev (= 1.3.1-1), - libtirpc3 (= 1.3.1-1), + libsystemd0 (= 247.3-3ubuntu3.4), + libtinfo6 (= 6.2+20201114-2build1), + libtirpc-common (= 1.3.1-1build1), + libtirpc-dev (= 1.3.1-1build1), + libtirpc3 (= 1.3.1-1build1), libtool (= 2.4.6-15), - libubsan1 (= 10.2.1-19ubuntu1), + libubsan1 (= 11.1.0-1ubuntu1~21.04), libuchardet0 (= 0.0.7-1), - libudev1 (= 247.3-1ubuntu2), + libudev1 (= 247.3-3ubuntu3.4), libunistring2 (= 0.9.10-4), - libuuid1 (= 2.36.1-1ubuntu2), - libxml2 (= 2.9.10+dfsg-6.3build1), - libzstd1 (= 1.4.8+dfsg-1), - linux-libc-dev (= 5.10.0-14.15), + libuuid1 (= 2.36.1-7ubuntu2), + libxml2 (= 2.9.10+dfsg-6.3ubuntu0.1), + libzstd1 (= 1.4.8+dfsg-2build2), + linux-libc-dev (= 5.11.0-25.27), login (= 1:4.8.1-1ubuntu8), lsb-base (= 11.1.0ubuntu2), - lto-disabled-list (= 1), + lto-disabled-list (= 7), m4 (= 1.4.18-5), make (= 4.3-4ubuntu1), - man-db (= 2.9.4-1), + man-db (= 2.9.4-2), mawk (= 1.3.4.20200120-2), - ncurses-base (= 6.2+20201114-2), - ncurses-bin (= 6.2+20201114-2), + ncurses-base (= 6.2+20201114-2build1), + ncurses-bin (= 6.2+20201114-2build1), patch (= 2.7.6-7), - perl (= 5.32.1-2), - perl-base (= 5.32.1-2), - perl-modules-5.32 (= 5.32.1-2), + perl (= 5.32.1-3ubuntu2), + perl-base (= 5.32.1-3ubuntu2), + perl-modules-5.32 (= 5.32.1-3ubuntu2), po-debconf (= 1.0.21+nmu1), rpcsvc-proto (= 1.4.2-0ubuntu4), sed (= 4.7-1ubuntu1), sensible-utils (= 0.0.14), - sysvinit-utils (= 2.96-5ubuntu1), - tar (= 1.33+dfsg-1), - util-linux (= 2.36.1-1ubuntu2), - xz-utils (= 5.2.5-1.0), - zlib1g (= 1:1.2.11.dfsg-2ubuntu4), - zlib1g-dev (= 1:1.2.11.dfsg-2ubuntu4) + sysvinit-utils (= 2.96-6ubuntu1), + tar (= 1.34+dfsg-1build1), + util-linux (= 2.36.1-7ubuntu2), + xz-utils (= 5.2.5-1.0build2), + zlib1g (= 1:1.2.11.dfsg-2ubuntu6), + zlib1g-dev (= 1:1.2.11.dfsg-2ubuntu6) -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to nss in Ubuntu. https://bugs.launchpad.net/bugs/1931104 Title: Test of dogtag-pki is failing on s390x vs the nss v3.63 in impish- proposed Status in nss package in Ubuntu: New Bug description: The test of dogtag-pki is failing on the nss 3.63 that is in impish proposed. Example: https://autopkgtest.ubuntu.com/results/autopkgtest-impish/impish/s390x/d/dogtag-pki/20210516_212719_e6522@/log.gz Bad: Installing CA into /var/lib/pki/pki-tomcat. Installation failed: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')) ERROR: ConnectionError: ('Connection aborted.', RemoteDisconnected('Remote end closed connection without response')) File "/usr/lib/python3/dist-packages/pki/server/pkispawn.py", line 575, in main scriptlet.spawn(deployer) File "/usr/lib/python3/dist-packages/pki/server/deployment/scriptlets/configuration.py", line 995, in spawn cert = deployer.setup_cert(client, tag) File "/usr/lib/python3/dist-packages/pki/server/deployment/__init__.py", line 355, in setup_cert return client.setupCert(request) File "/usr/lib/python3/dist-packages/pki/system.py", line 389, in setupCert response = self.connection.post( File "/usr/lib/python3/dist-packages/pki/client.py", line 55, in wrapper return func(self, *args, **kwargs) File "/usr/lib/python3/dist-packages/pki/client.py", line 293, in post r = self.session.post( File "/usr/lib/python3/dist-packages/requests/sessions.py", line 590, in post return self.request('POST', url, data=data, json=json, **kwargs) File "/usr/lib/python3/dist-packages/requests/sessions.py", line 542, in request resp = self.send(prep, **send_kwargs) File "/usr/lib/python3/dist-packages/requests/sessions.py", line 655, in send r = adapter.send(request, **kwargs) File "/usr/lib/python3/dist-packages/requests/adapters.py", line 498, in send raise ConnectionError(err, request=request) >>>> CA spawn failed: Good: nstalling CA into /var/lib/pki/pki-tomcat. Notice: Trust flag u is set automatically if the private key is present. /usr/lib/python3/dist-packages/urllib3/connection.py:455: SubjectAltNameWarning: Certificate for i-dogtag has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/urllib3/urllib3/issues/497 for details.) warnings.warn( ========================================================================== INSTALLATION SUMMARY ========================================================================== ... The good test above was with: ii libnss3:s390x 2:3.61-1ubuntu2 s390x Network Security Service libraries ii 389-ds-base 1.4.4.11-2 s390x 389 Directory Server suite - server Worth to know, the good case test still fails later on with: IOException: SocketException cannot write on socket: Failed to write to socket: (-5938) Encountered end of file. ERROR: CalledProcessError: Command '['pki', '-d', '/etc/pki/pki-tomcat/alias', '-f', '/etc/pki/pki-tomcat/password.conf', '-U', 'https://i-dogtag:8443', 'securitydomain-join', '--session', '4717921475119312283', '--type', 'TKS', '--hostname', 'i-dogtag', '--unsecure-port', '8080', '--secure-port', '8443', 'TKS i-dogtag 8443']' returned non-zero exit status 255. File "/usr/lib/python3/dist-packages/pki/server/pkispawn.py", line 575, in main scriptlet.spawn(deployer) File "/usr/lib/python3/dist-packages/pki/server/deployment/scriptlets/configuration.py", line 1038, in spawn subsystem.join_security_domain( File "/usr/lib/python3/dist-packages/pki/server/subsystem.py", line 1201, in join_security_domain subprocess.check_call(cmd) File "/usr/lib/python3.9/subprocess.py", line 373, in check_call raise CalledProcessError(retcode, cmd) Installation failed: Command failed: pki -d /etc/pki/pki-tomcat/alias -f /etc/pki/pki-tomcat/password.conf -U https://i-dogtag:8443 securitydomain-join --session 4717921475119312283 --type TKS --hostname i-dogtag --unsecure-port 8080 --secure-port 8443 TKS i-dogtag 8443 Please check pkispawn logs in /var/log/pki/pki-tks-spawn.20210607093926.log Well one issue at a time ... the current install issue first. Since it worked with the nss in -release I was upgrading this to the new nss. ii 389-ds-base 1.4.4.11-2 s390x 389 Directory Server suite - server ii libnss3:s390x 2:3.63-1ubuntu1 s390x Network Security Service libraries With this the install fail is reprodicible. So we can switch in/out bad case by up/downgrading libnss3. Comparing those two cases until they reach the first successful install message I've seen a crash: pki-tomcat[37160]: # pki-tomcat[37160]: # A fatal error has been detected by the Java Runtime Environment: pki-tomcat[37160]: # pki-tomcat[37160]: # SIGSEGV (0xb) at pc=0x000003ff9ce9ec02, pid=37160, tid=37246 pki-tomcat[37160]: # pki-tomcat[37160]: # JRE version: OpenJDK Runtime Environment (11.0.12+4) (build 11.0.12-ea+4-Ubuntu-0ubuntu2) pki-tomcat[37160]: # Java VM: OpenJDK 64-Bit Server VM (11.0.12-ea+4-Ubuntu-0ubuntu2, mixed mode, tiered, compressed oops, serial gc, linux-s390x) pki-tomcat[37160]: # Problematic frame: pki-tomcat[37160]: # C [libnss3.so+0x11ec02] pki-tomcat[37160]: # pki-tomcat[37160]: # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %d %P %E" (or dumping to /var/lib/pki/pki-tomcat/core.37160) pki-tomcat[37160]: # pki-tomcat[37160]: # An error report file with more information is saved as: pki-tomcat[37160]: # /var/lib/pki/pki-tomcat/hs_err_pid37160.log pki-tomcat[37160]: # pki-tomcat[37160]: # If you would like to submit a bug report, please visit: pki-tomcat[37160]: # https://bugs.launchpad.net/ubuntu/+source/openjdk-lts pki-tomcat[37160]: # The crash happened outside the Java Virtual Machine in native code. pki-tomcat[37160]: # See problematic frame for where to report the bug. A few extra runs had also shown: # Problematic frame: # C [libnssutil3.so+0x1b60c] PORT_FreeArena_Util+0xc And while I could not get a core dump out as the config required to be changed is written on the fly and then started I was able to find the code. Obviously there has to be a lot of abstraction but plenty of recent changes fixed double frees and dangling pointer values. For example https://github.com/nss-dev/nss/commit/350807b3a70f60928ea3f2bc95fd1795aae9b753 This is all (this and more similar fixes) in 3.66 which is released and in Debian unstable. It might be worth to re-merge that, throw it into a PPA and re-run the tests. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/nss/+bug/1931104/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
