Control: reassign -1 src:luasocket/20200726-1

Sigh, cut'n'paste fail. Reassigning.

On Sat, Feb 17, 2024 at 11:57:16PM -0800, Steve Langasek wrote:

Source: lua-luv
Version: 1.44.2-0-1
Severity: serious
User: debian-arm@lists.debian.org
Usertags: time-t

Dear maintainers,

Analysis of the archive for the 64-bit time_t transition[0][1] identifies luasocket as an affected package, on the basis that the headers could not
be compiled and analyzed out of the box using abi-compliance-checker[2], so we have to assume it's affected.

However, lua-socket's shlibs file declares a dependency on a library package name that contains no ABI information:

$ cat DEBIAN/shlibs
liblua5.1-mime 2 lua-socket (>= 3.1.0)
liblua5.1-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.1-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.1-socket 2 lua-socket (>= 3.1.0)
liblua5.2-mime 2 lua-socket (>= 3.1.0)
liblua5.2-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.2-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.2-socket 2 lua-socket (>= 3.1.0)
liblua5.3-mime 2 lua-socket (>= 3.1.0)
liblua5.3-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.3-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.3-socket 2 lua-socket (>= 3.1.0)
liblua5.4-mime 2 lua-socket (>= 3.1.0)
liblua5.4-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.4-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.4-socket 2 lua-socket (>= 3.1.0)
$

It is therefore not obvious that we should rename the package to 'lua-sockett64' as part of this transition.

Looking at the archive, there is a package built from the separate lua-sec source package that depends on this library.

Since there is no self-evident thing to do with the library package name here, we will not be handling this package as part of the mass NMUs.
Instead I am filing a serious bug because partial upgrades from bookworm to trixie on 32-bit architectures will result in ABI skew and may result in broken behavior.

Thanks,
--
Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer https://www.debian.org/ slangasek@ubuntu.com vorlon@debian.org

[0] https://wiki.debian.org/ReleaseGoals/64bit-time
[1] https://lists.debian.org/debian-devel/2024/01/msg00041.html
[2] https://adrien.dcln.fr/misc/armhf-time_t/2024-02-16T21%3A19%3A00/logs/lua-socket-dev/base/log.txt

--
Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer https://www.debian.org/ slangasek@ubuntu.com vorlon@debian.org

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErEg/aN5yj0PyIC/KVo0w8yGyEz0FAmXRurEACgkQVo0w8yGy Ez3s9A//UCSvCWavOU1BNtXKld7f2u9/i8qSGsLDer2UmxdDk6R26G3/K/0wXeYa K9qKqVdiiX4uOzjYdPRjdQ1Z4kLJX9Z1gjvsAG1I5eWcXpuq15Djy9DIUbPRwffA /UY8a0YqnGqdciccd4xyAuPcD/rACOYLTw3aF+jo6yLM2iC3OQXE+WXysOojXfrx E3l5fiXlXoFDLF3xKMU/+vRxM2kh0E8Nw3VwjeNcMrNMvSg9F0/QeCEpQml5PpI3 yY0xF0acQqtgZ82b4XlY4mNUzwHWPqgvWq4nMYd92QNxnQdeEPh782OY7/qTRVQk L9W+Gn6I/3/UFBkkTVFWmKRWf9OL/5n2sbgTn6UlAf8cLrFfvX74CghO1utmgMKn /BOYB7DsA/p+ircDjN6WV+pY2JmngFvB8T6ae+kDbe/PtKqjUbRw1SzImWJscyT/ TINsdD4Tq86ZT0vHC6K3TF67jHT3K1KiUcbJj01xlmU7X3Wf1Q5VeE8x/4j/S+tV NCcGlTzDWNstl8ZiPbwNvAFXoEb/0gM0AxTkzulP0Qm8HnRgWCA258sDt0n1cLRW nATeElHeVTOCIlgPnw7I

Source: lua-luv
Version: 1.44.2-0-1
Severity: serious
User: debian-arm@lists.debian.org
Usertags: time-t

Dear maintainers,

Analysis of the archive for the 64-bit time_t transition[0][1] identifies luasocket as an affected package, on the basis that the headers could not
be compiled and analyzed out of the box using abi-compliance-checker[2], so
we have to assume it's affected.

However, lua-socket's shlibs file declares a dependency on a library package name that contains no ABI information:

$ cat DEBIAN/shlibs
liblua5.1-mime 2 lua-socket (>= 3.1.0)
liblua5.1-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.1-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.1-socket 2 lua-socket (>= 3.1.0)
liblua5.2-mime 2 lua-socket (>= 3.1.0)
liblua5.2-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.2-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.2-socket 2 lua-socket (>= 3.1.0)
liblua5.3-mime 2 lua-socket (>= 3.1.0)
liblua5.3-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.3-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.3-socket 2 lua-socket (>= 3.1.0)
liblua5.4-mime 2 lua-socket (>= 3.1.0)
liblua5.4-socket-serial 0 lua-socket (>= 3.1.0)
liblua5.4-socket-unix 2 lua-socket (>= 3.1.0)
liblua5.4-socket 2 lua-socket (>= 3.1.0)
$

It is therefore not obvious that we should rename the package to 'lua-sockett64' as part of this transition.

Looking at the archive, there is a package built from the separate lua-sec source package that depends on this library.

Since there is no self-evident thing to do with the library package name
here, we will not be handling this package as part of the mass NMUs.
Instead I am filing a serious bug because partial upgrades from bookworm to trixie on 32-bit architectures will result in ABI skew and may result in
broken behavior.

Thanks,
--
Steve Langasek Give me a lever long enough and a Free OS Debian Developer to set it on, and I can move the world. Ubuntu Developer https://www.debian.org/ slangasek@ubuntu.com vorlon@debian.org

[0] https://wiki.debian.org/ReleaseGoals/64bit-time
[1] https://lists.debian.org/debian-devel/2024/01/msg00041.html
[2] https://adrien.dcln.fr/misc/armhf-time_t/2024-02-16T21%3A19%3A00/logs/lua-socket-dev/base/log.txt

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEErEg/aN5yj0PyIC/KVo0w8yGyEz0FAmXRuFwACgkQVo0w8yGy Ez3bnw//c9FYtqJAfd1+GsCPDC8SNa50hfbtl6JVHtjXk8/+7CktDm4uOtwKFuZC 9xudcX9xov00jsBRMW0fCCBAn0G8rdPxeYK77mfRiqXU3QlV6WJenwcmyrfXOE8w 1T278+5zH8a/rprvxi2o4OB5X5MZG9CuKRN9uSoM/yqGNt5hbhJP151eTCMQHDnK mwJn75NEUPmiBVIZ7Pdopgqr2DSI9Sm4dDb2OXVowoTu1vmI7eAr+gn4F+5moIrq zN6G+69KDB4ZqLkyIyHqUXjk2Bd4SGGhZqfERIAqW+WURjBtLP25GckF17pqbNxR PePb+gYArU/CejRy6gYTp6FyvH8WY3IRUXq6SaFsHyGOZx7aqOksGjocnewmy