[FFE] open-vm-tools 12.3.0 for Mantic

[John Wolfe]

[FFE]

12.2.5 -> 12.3.0

Ultimately this change seems relatively innocent. There were a ton of changes
to common files that don’t relate to open-vm-tools that I excluded in this review.

This change should be a sync, and I am comfortable with going through with the sync.

The notable changes are:
- A CVE fix is included
- New feature to allow pre-frozen image
- New feature to allow guest to support host verification with SAML tokens
- Removes the use of gdk-pixbuf-xlib
    - Not very familiar with this utility, git commit says required by Unity so
    maybe an issue for our derivative distributions that use Unity?
- New guest capability to support host verification of SAML tokenchangelog
- Exclude antrea/calico NIC pattern

Full list of Changes
I created a list of functional changes below by going through and removing
anything that was along the lines of “Change to common {source||header}*”,
“Inclusive Terminology”, “copyright update”, there were a lot of these types of
changes littered throughout the changelog.

Functional/bugfix ChangeLog:
- Allow only X509 certs to verify the SAML token signature.
    - Addresses CVE-2023-20900
- Allow pre-Windows 2000 style user logon for Linux Guests.
- Fix build problems with grpc
- Enable hostVerfied SAML token feature in Tools.
- Fix VThreadBase_ForgetSelf using wrong format specifier for VThread_CurID.
- svtminion scripts v1.6 fixes for salt-minion release 3006.0
- Provide alternate method to allow (expected) pre-frozen filesystems when
  taking a quiesced snapshot.
    - New feature to allow pre-fozen filesystems
    - Need to edit tools.conf to enable this feature, set to false by default
    - Not worried since new feature is disabled by default, but it would be
      nice to atleast test this feature
- Removing appUtil library from open-vm-tools.
    - Removes use of gdk-pixbuf-xlib
    - gdk-pixbuf-xlib is current present in Jammy/Lunar/Mantic
- Remove some dead code.
    - Removes VixToolsCheckIfAuthenticationTypeEnabled
    - Deprecated in
      https://github.com/vmware/open-vm-tools/commit/ebed1074323950b03d25b31c54741eaa128c3e0c
- svtminion scripts update for salt 3006 release
- Introduce the new CAP_HOST_VERIFIED_SAML_TOKEN capability.
    - Adds the guest capability to support host verification of SAML token
- Improve POSIX guest identification
    - Just checks if /usr/bin/lsb_release is accessible using `access()`
      before trying to use it, not worried about this change
- Record the usage of VMware Tools version 12.2.5 in vm_tools_version.h
- Record the GA release of VMware Tools 12.2.0.
- Add UNMANAGED InstallStatus value for components
- lib/file: Fix timetools breakage to use memset
- Add antrea and calico interface pattern to GUESTINFO_DEFAULT_IFACE_EXCLUDES.
    - Excludes antrea/calico IP patterns to not clobber k8s IPs.
- lib/file: Improve File_SetTimes
- Remove SSL_NewContext() declaration from sslDirect.h
- Bump the VMware Tools version to 12.3.0 in the "devel" branch.

[Christian Ehrhardt  (paelzer)]

Completed in Debian, if you can please FFE (we'd SRU via MRE anyway) and carry over to mantic.

[Mitchell Dzurick (mitchdz)]

Just realized the bug was set to Triaged. Set to new so ubuntu-release should see it.

[Łukasz Zemczak (sil2100)]

Did you test-build the new version's package somewhere already?

[Mitchell Dzurick (mitchdz)]

Yes, I built it locally with sbuild. Just had empty commits, so requesting a sync.

[Mitchell Dzurick (mitchdz)]

Also did a test-build here in LP - https://launchpad.net/~mitchdz/+archive/ubuntu/open-vm-tools-12.3.0/+packages

[Mitchell Dzurick (mitchdz)]

Also note: the current package in Mantic (2:12.2.5-1ubuntu1) has a security update. Syncing this package to 12.3.0 will include the commit that addresses the CVE, so that does not need to be carried forward if we do this sync.

[Paride Legovini (paride)]

I reviewed the changeset and it looks safe to me. The upstream release notes [1] state that:

  There are no new features in the open-vm-tools 12.3.0 release.
  This is primarily a maintenance release that addresses a few
  critical problems, including: [...]

The previous release is 12.2.5, which is the one we have in Mantic already.

+1 on proceeding with the 12.3.0 sync.

[1] https://github.com/vmware/open-vm-tools/releases

[Bryce Harrington (bryce)]

This bug was fixed in the package open-vm-tools - 2:12.3.0-1
Sponsored for Mitchell Dzurick (mitchdz)

---------------
open-vm-tools (2:12.3.0-1) unstable; urgency=high

  * [4ed4be4] New upstream version 12.3.0
    (Closes: #1050972)
    CVE-2023-20900
    Adressing this CVE also Closes: #1050970
    There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release, details can be found at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  * [779d338] drop d/p/debian/grpc_1.51: no more needed

 -- Christian Ehrhardt <email address hidden> Wed, 06 Sep 2023 09:00:51 +0200

[Bryce Harrington (bryce)]

Thanks, package sync'd:

New changes:
open-vm-tools (2:12.3.0-1) unstable; urgency=high

  * [4ed4be4] New upstream version 12.3.0
    (Closes: #1050972)
    CVE-2023-20900
    Adressing this CVE also Closes: #1050970
    There are no new features in the open-vm-tools 12.3.0 release. This is
    primarily a maintenance release, details can be found at
    https://github.com/vmware/open-vm-tools/blob/stable-12.3.0/ReleaseNotes.md
  * [779d338] drop d/p/debian/grpc_1.51: no more needed

 -- Christian Ehrhardt <email address hidden> Wed, 06 Sep 2023 09:00:51 +0200
Sponsoring this sync for Mitchell Dzurick (mitchdz)
Sync this package [y|N]? y
Request succeeded; you should get an e-mail once it is processed.