FFe: update to 0.6.0 (MIR requirement)

[Andreas Hasenack]

libcbor is a dependency of libfido2, which is being MIRed in bug #1864439. As such, libcbor was added to the same MIR.

The libcbor MIR was accepted on two conditions:
a) it's updated to 0.6.0[1]
b) its test suite is run at build time[2]

Both of these conditions are met in my linked MP[3]. The most important packaging changes are:
- test suite is run at package build time
- upstream changed the soname in 0.6.0 (ok so far), but in an overzelous way (it made the full 0.6.0 version part of the soname). I talked with upstream and they suggested a patch to make 0.6 part of the soname only. That patch I applied in our package, and had to rename the binary library package to libcbor0.6 (from libcbor0). See the MP[3] for details and links to the conversation with upstream;
- I fixed a ton of lintian issues. Current lintian -I --pedantic output is just:
I: libcbor source: testsuite-autopkgtest-missing
P: libcbor source: file-contains-trailing-whitespace debian/changelog (line 44)

The upstream release notes for each version are at [4]. Our update is from 0.5.0 in focal to 0.6.0 with the above changes. The security team was interested in all the fixes announced in 0.6.0.

One potential issue here is that ubuntu will be shipping a 0.6.0 package which produces a 0.6 version in the soname, whereas the exact same upstream versions uses 0.6.0 in the soname. I asked upstream if they preferred to make a new release. On one hand, upstream agreed[5], but at the same time didn't seem too worried[6]. You, dear release team member reviewer, are welcomed to chime in with what you think should be done :)

PPA with builds: https://launchpad.net/~ahasenack/+archive/ubuntu/openssh-fido/

The only reverse dependency of libcbor is libfido2-1 and libcbor itself in the form of the -dev package.

1. https://bugs.launchpad.net/ubuntu/+source/libfido2/+bug/1864439/comments/7
2. https://bugs.launchpad.net/ubuntu/+source/libfido2/+bug/1864439/comments/9
3. https://code.launchpad.net/~ahasenack/ubuntu/+source/libcbor/+git/libcbor/+merge/381060
4. https://github.com/PJK/libcbor/releases
5. https://github.com/PJK/libcbor/pull/131#issuecomment-602855102
6. https://github.com/PJK/libcbor/issues/52#issuecomment-602864168

[Andreas Hasenack (ahasenack)]

I mistakenly uploaded right after the MP was approved, and forgot to wait for this FFe to be approved as well. Apologies.

"Thankfully" there is a NEW binary due to the soname change, so this won't hit proposed before that is sorted.

[Łukasz Zemczak (sil2100)]

Ok, so I'm generally +1 on this FFe, though the meddling with the soname does worry me a bit. Ideally it would be if upstream could release a 0.6.1 that we'd just pull in as a whole, without carrying some weird delta. Good thing that this doesn't have many build dependencies besides libfido, which we already handle via the MIR anyway - since those big upstream jumps are very risky usually, especially with soname bumps.

Anyway, I'd say let's get this done. But as said, I'd prefer a 0.6.1 pulled in, though I won't block on that.

[Andreas Hasenack (ahasenack)]

Thanks. I subscribed to all upstream activities on this.

[Andreas Hasenack (ahasenack)]

I nudged upstream suggesting a 0.6.1 release with this change would be great. Let's see.

[Andreas Hasenack (ahasenack)]

Upstream released 0.6.1 with the soname changes we incorporated, and clarified how it will be from now on:

https://github.com/PJK/libcbor/releases/tag/v0.6.1

While checking the actual diff, though, looks like more was changed. I asked for clarification in https://github.com/PJK/libcbor/pull/131#issuecomment-604988996

For the moment we are better off with the package I uploaded.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libcbor - 0.6.0-0ubuntu1

---------------
libcbor (0.6.0-0ubuntu1) focal; urgency=medium

  * New upstream version 0.6.0 (LP: #1868609):
    - no need for dfsg since docs/doxygen is no longer shipped
  * d/rules: override auto_configure to enable tests and set the build
    type to "Release" as shown in the upstream build instructions.
  * d/p/skip-custom-allocator-test.patch: skip custom allocator test if
    CBOR_CUSTOM_ALLOC is undefined
  * d/rules: add hardening=+all
  * Fix soname versioning:
    - d/p/clarify-soname-versioning.patch: adjust soname versioning to
      match expectations $MAJOR.$MINOR.$PATCH
    - d/control: rename binary package to match soname 0.6
    - d/control: fix -dev dependency towards its binary lib
    - d/libcbor0.6.install, d/libcbor0.6.symbols: rename to match new soname
    - d/libcbor0.6.symbols: symbols update, add B-D-P field
  * d/libcbor-doc.examples: rename so examples are installed
  * d/control: bump debhelper to 12
  * d/copyright lintian fixes:
    - d/copyright: change url to https
    - d/copyright: remove Files-Excluded since that directory is not
      shipped in the 0.6.0 upstream tarball.
    - d/copyright: removed entry about docs/stylesheets/github-light.css
      as this isn't shipped anymore in the upstream tarball.
  * d/control: set R3 to no
  * d/copyright: add new paragraph for new files in 0.6.0
  * d/control: bump standards-version to 4.5.0 (no changes required)
  * d/watch: remove dfsg mangling

 -- Andreas Hasenack <email address hidden> Wed, 25 Mar 2020 19:22:25 +0000