This is a multi-part MIME message sent by reportbug.


Source: curl
Version: 8.5.0-2
Severity: serious
Tags: patch pending
Justification: library ABI skew on upgrade
User: debian-arm@lists.debian.org
Usertags: time-t

Dear maintainer,

As part of the 64-bit time_t transition required to support 32-bit architectures in 2038 and beyond (https://wiki.debian.org/ReleaseGoals/64bit-time), we have identified
curl as a source package shipping runtime libraries whose ABI
either is affected by the change in size of time_t, or could not be
analyzed via abi-compliance-checker (and therefore to be on the safe
side we assume is affected).

To ensure that inconsistent combinations of libraries with their reverse-dependencies are never installed together, it is necessary to
have a library transition, which is most easily done by renaming the
runtime library package.

Since turning on 64-bit time_t is being handled centrally through a change
to the default dpkg-buildflags (https://bugs.debian.org/1037136), it is important that libraries affected by this ABI change all be uploaded close together in time. Therefore I have prepared a 0-day NMU for curl
which will initially be uploaded to experimental if possible, then to
unstable after packages have cleared binary NEW.

Please find the patch for this NMU attached.

If you have any concerns about this patch, please reach out ASAP. Although this package will be uploaded to experimental immediately, there will be a period of several days before we begin uploads to unstable; so if information becomes available that your package should not be included in the transition, there is time for us to amend the planned uploads.



-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.5.0-15-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

diff -Nru curl-8.5.0/debian/changelog curl-8.5.0/debian/changelog
--- curl-8.5.0/debian/changelog 2024-01-30 18:13:57.000000000 +0000
+++ curl-8.5.0/debian/changelog 2023-12-29 18:34:11.000000000 +0000
@@ -1,10 +1,3 @@
-curl (8.5.0-2.1) experimental; urgency=medium
-
- * Non-maintainer upload.
- * Rename libraries for 64-bit time_t transition.
-
- -- Michael Hudson-Doyle <mwhudson@debian.org> Tue, 30 Jan 2024 18:13:57 +0000
-
curl (8.5.0-2) unstable; urgency=medium

* d/p/openldap_fix_an_LDAP_crash.patch: New patch to fix ldap segfault
diff -Nru curl-8.5.0/debian/control curl-8.5.0/debian/control
--- curl-8.5.0/debian/control 2024-01-30 18:13:57.000000000 +0000
+++ curl-8.5.0/debian/control 2023-12-29 18:34:11.000000000 +0000
@@ -42,7 +42,7 @@

Package: curl
Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, libcurl4t64 (= ${binary:Version}) +Depends: ${shlibs:Depends}, ${misc:Depends}, libcurl4 (= ${binary:Version})
Multi-Arch: foreign
Description: command line tool for transferring data with URL syntax
curl is a command li

I believe these are the two cases:

- The public 'struct curl_fileinfo' contains a time_t struct member, used

for

FTP wildcard callbacks.

- The public API curl_getdate() takes a time_t pointer in its second

argument.

If 'time_t' changes size, those two will not be ABI compatible.

Interestingly, the latter is the only one picked up by ABI compliance
checker:

https://adrien.dcln.fr/misc/armhf-time_t/2024-01-17/compat_reports/libcurl4-openssl-dev/lfs_to_time_t/compat_report.html

And because the time_t pointer argument to getdate is unused we could _probably_ get away with ignoring that (a bit sketchy from a purity point
of view but I think ok in practice). OTOH the former (presumably not found because the "curl_fileinfo" type is not found in any public ABI) looks like
a genuine ABI break to me. Hopefully there are not too many "hidden" ABI
breaks like this lurking!

<div dir="ltr"><div>&gt; I believe these are the two cases:<br>&gt; <br>&gt; - The public &#39;struct curl_fileinfo&#39; contains a time_t struct member, used for<br>&gt;   FTP wildcard callbacks.<br>&gt; <br>&gt; - The public API curl_getdate() takes a
time_t pointer in its second argument.<br>&gt; <br>&gt; If &#39;time_t&#39; changes size, those two will not be ABI compatible.<br></div><div><br></div><div>Interestingly, the latter is the only one picked up by ABI compliance checker:</div><div><br></

<a href="https://adrien.dcln.fr/misc/armhf-time_t/2024-01-17/compat_reports/libcurl4-openssl-dev/lfs_to_time_t/compat_report.html">https://adrien.dcln.fr/misc/armhf-time_t/2024-01-17/compat_reports/libcurl4-openssl-dev/lfs_to_time_t/compat_report.

html</a><br><div><br></div><div>And because the time_t pointer argument to getdate is unused we could _probably_ get away with ignoring that (a bit sketchy from a purity point of view but I think ok in practice). OTOH the former (presumably not found
because the &quot;curl_fileinfo&quot; type is not found in any public ABI) looks like a genuine ABI break to me. Hopefully there are not too many &quot;hidden&quot; ABI breaks like this lurking!</div></div>

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)

This is a multi-part MIME message sent by reportbug.


Dear maintainer,

Please find attached a final version of this patch for the time_t
transition. This patch is being uploaded to unstable.

Note that this adds a versioned build-dependency on dpkg-dev, to guard
against accidental backports with a wrong ABI.

Thanks!


-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.5.0-14-generic (SMP w/12 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

diff -Nru curl-8.6.0/debian/changelog curl-8.6.0/debian/changelog
--- curl-8.6.0/debian/changelog 2024-02-19 22:16:17.000000000 +0000
+++ curl-8.6.0/debian/changelog 2024-03-02 07:11:53.000000000 +0000
@@ -1,3 +1,10 @@
+curl (8.6.0-3.1) unstable; urgency=medium
+
+ * Non-maintainer upload.
+ * Rename libraries for 64-bit time_t transition. Closes: #1061992
+
+ -- Steve Langasek <vorlon@debian.org> Sat, 02 Mar 2024 07:11:53 +0000
+
curl (8.6.0-3) unstable; urgency=medium

* d/p/vtls_revert_receive_max_buffer_add_test_case.patch: New patch to fix diff -Nru curl-8.6.0/debian/control curl-8.6.0/debian/control
--- curl-8.6.0/debian/control 2024-02-19 22:16:17.000000000 +0000
+++ curl-8.6.0/debian/control 2024-03-02 07:11:53.000000000 +0000
@@ -5,7 +5,7 @@
Uploaders: Carlos Henrique Lima Melara <charlesmelara@riseup.net>,
Samuel Henrique <samueloph@debian.org>,
Sergio Durigan Junior <sergiodj@debian.org>
-Build-Depends:
+Build-Depends: dpkg-dev (>= 1.22.5),
debhelper-compat (= 13),
autoconf,
automake,
@@ -42,7 +42,7

This is a multi-part message in MIME format...

Your message dated Sat, 02 Mar 2024 07:34:31 +0000
with message-id <E1rgJt9-002jb9-1q@fasolo.debian.org>
and subject line Bug#1061992: fixed in curl 8.6.0-3.1
has caused the Debian Bug report #1061992,
regarding curl: NMU diff for 64-bit time_t transition
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)


--
1061992: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1061992
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

Received: (at submit) by bugs.debian.org; 30 Jan 2024 19:13:55 +0000 X-Spam-Checker-Version: SpamAssassin 3.4.6-bugs.debian.org_2005_01_02
(2021-04-09) on buxtehude.debian.org
X-Spam-Level:
X-Spam-Status: No, score=-9.7 required=4.0 tests=BAYES_00,DKIM_SIGNED,
DKIM_VALID,FOURLA,FROMDEVELOPER,RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H5,
RCVD_IN_MSPIKE_WL,SPF_HELO_PASS,SPF_NONE,T_SCC_BODY_TEXT_LINE,
XMAILER_REPORTBUG autolearn=ham autolearn_force=no
version=3.4.6-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 199; hammy, 150; neutral, 385; spammy,
0. spammytokens: hammytokens:0.000-+--HX-ME-Sender:xms,
0.000-+--sk:taint_o, 0.000-+--sk:TAINT_O, 0.000-+--trixie,
0.000-+--HX-ME-Proxy:xmx
Return-path: <mwhudson@debian.org>
Received: from wout4-smtp.messagingengine.com ([64.147.123.20]:34667)
by buxtehude.debian.org with esmtps (TLS1.3