ipa-client-install seg faults (s390x)

[Frank Heimes]

SRU Justification:

[ Impact ]

 * If compiled with gcc LTO (Link Time Optimization),
   the package python3-gssapi is causing a segmentation fault
   if used by freeipa (actually ipa-client-install).

 * Hence no ipa-client-install and configuration is possible,
   but this is needed in case centralized authentication against
   IPA servers need to be setup.

[ Test Plan ]

 * Have an Ubuntu Server on s390x installation 22.04, 23.04, 23.10 or noble.

 * Install the freeipa-client to make use of the ipa-client-install,
   that again requires python3-gssapi.

 * Now execute:
   sudo ipa-client-install

 * Using the affected version of python3-gssapi, the ipa-client-install
   call will end in a segmentation fault (on s390x only):
   sudo ipa-client-install
   Segmentation fault

 * Using the fixed version of python3-gssapi, the ipa-client-install
   call will succeed, like:
   This program will set up IPA client.
   Version 4.9.8
   WARNING: conflicting time&date synchronization service 'ntp'
   will be disabled in favor of chronyd
   ...

[ Where problems could occur ]

 * The updated package does not change a single line of code,
   it only removes LTO from the compile options in d/rules.

 * And this modification is for the s390x architecture only.

 * However, this modification, done in d/rules, might be done wrong
   which would break the compile or entire package build.

 * The modification in d/rules was done like in other known cases
   where using LTO is causing issues.

 * A test build (for all major) platforms was done, that also allowed
   a successful test of the PPA build on s390x on jammy
   (using the test plan above):
   https://launchpad.net/~fheimes/+archive/ubuntu/lp2044242

[ Other Info ]

 * It was identified that this affects jammy up to noble.

 * There is an upstream version 1.8.3 of python-gssapi available
   that is even slightly newer than what we have in the archives for
   lunar, mantic and noble, but it is still affected by this issue.
__________

Executing 'ipa-client-install' (package: freeipa-client) is causing a segmentation fault:

ubuntu@server:~$ sudo apt install freeipa-client
ubuntu@server:~$ ipa-client-install
Segmentation fault (core dumped)
ubuntu@server:~$ ls -l /var/crash/
total 2012
-rw-r----- 1 ubuntu ubuntu 2057124 Nov 22 08:22 _usr_sbin_ipa-client-install.1000.crash
ubuntu@server:~$ vi /var/log/syslog
...
Nov 22 08:22:33 server kernel: [ 162.136131] User process fault: interruption code 003b ilc:2 in ext_dce.cpython-310-s390x-linux-gnu.so[3ff8b880000+4000]
Nov 22 08:22:33 server kernel: [ 162.136153] Failing address: 000003ff23f0f000 TEID: 000003ff23f0f800
Nov 22 08:22:33 server kernel: [ 162.136156] Fault in primary space mode while using user ASCE.
Nov 22 08:22:33 server kernel: [ 162.136160] AS:000000009f5581c7 R3:0000000000000024
Nov 22 08:22:33 server kernel: [ 162.136166] CPU: 3 PID: 4294 Comm: ipa-client-inst Not tainted 5.15.0-89-generic #99-Ubuntu
Nov 22 08:22:33 server kernel: [ 162.136169] Hardware name: IBM 2964 N63 400 (z/VM 6.4.0)
Nov 22 08:22:33 server kernel: [ 162.136170] User PSW : 0705200180000000 000003ff23f0f150
Nov 22 08:22:33 server kernel: [ 162.136173] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:1 AS:0 CC:2 PM:0 RI:0 EA:3
Nov 22 08:22:33 server kernel: [ 162.136176] User GPRS: 0f00000100000043 000002aa242fb170 000003ff8b885240 0600000000000000
Nov 22 08:22:33 server kernel: [ 162.136178] 0000000000000080 000002aa242fb170 000003ff8b882c00 000003ff8bde6d70
Nov 22 08:22:33 server kernel: [ 162.136180] 000003ff8bd50450 000003ff8bdbc7b0 000003ff8bd599b0 000003ff8bd599e0
Nov 22 08:22:33 server kernel: [ 162.136182] 000003ff8c8b0f90 000003ff8bdbc7b0 000002aa23f49cac 000003ffe5c745c0
Nov 22 08:22:33 server kernel: [ 162.136189] User Code: Bad PSW.
Nov 22 08:22:33 server kernel: [ 162.136190] Last Breaking-Event-Address:
Nov 22 08:22:33 server kernel: [ 162.136190] [<000003ff8b882c06>] 0x3ff8b882c06
Nov 22 08:22:33 server systemd[986]: Started D-Bus User Message Bus.
Nov 22 08:22:33 server dbus-daemon[4303]: [session uid=1000 pid=4303] AppArmor D-Bus mediation is enabled
...

ProblemType: Bug
DistroRelease: Ubuntu 22.04
Package: freeipa-client 4.9.8-1
ProcVersionSignature: Ubuntu 5.15.0-89.99-generic 5.15.126
Uname: Linux 5.15.0-89-generic s390x
ApportVersion: 2.20.11-0ubuntu82.5
Architecture: s390x
CasperMD5CheckResult: pass
CloudArchitecture: s390x
CloudID: none
CloudName: none
CloudPlatform: none
CloudSubPlatform: config
Date: Wed Nov 22 08:52:47 2023
InstallationDate: Installed on 2023-11-22 (0 days ago)
InstallationMedia: Ubuntu-Server 22.04.2 LTS "Jammy Jellyfish" - Release s390x (20230220.1)
SourcePackage: freeipa
UpgradeStatus: No upgrade log present (probably fresh install)

$ apt-cache policy freeipa-client
freeipa-client:
  Installed: 4.9.8-1
  Candidate: 4.9.8-1
  Version table:
 *** 4.9.8-1 500
        500 http://ports.ubuntu.com/ubuntu-ports jammy/universe s390x Packages
        100 /var/lib/dpkg/status

[Frank Heimes (fheimes)]

Initially this crash happened on 22.04.3, but 23.10 is affected as well.

[Frank Heimes (fheimes)]

$ sudo apport-unpack /var/crash/_usr_sbin_ipa-client-install.0.crash /tmp/crash
$ /tmp/crash
$ DEBUGINFOD_URLS=https://debuginfod.ubuntu.com gdb `cat ExecutablePath` CoreDump
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "s390x-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
"/usr/sbin/ipa-client-install": not in executable format: file format not recognized
[New LWP 1520]

This GDB supports auto-downloading debuginfo from the following URLs:
https://debuginfod.ubuntu.com
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
Core was generated by `/usr/bin/python3 -I /usr/sbin/ipa-client-install'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000003ff3880f150 in ?? ()
(gdb) bt
#0 0x000003ff3880f150 in ?? ()
#1 0x000002aa38849cac in ?? ()
PC not saved
(gdb)

# DEBUGINFOD_URLS=https://debuginfod.ubuntu.com gdb python3
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "s390x-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from python3...
Reading symbols from /usr/lib/debug/.build-id/61/7ec16f82f98e94969fd0f36d71da0a7de8b5fb.debug...
(gdb) run /usr/sbin/ipa-client-install
Starting program: /usr/bin/python3 /usr/sbin/ipa-client-install

This GDB supports auto-downloading debuginfo from the following URLs:
https://debuginfod.ubuntu.com
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/s390x-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x000004000020f150 in ?? ()
(gdb) bt
#0 0x000004000020f150 in ?? ()
#1 0x000002aa00249cac in _PyImport_LoadDynamicModuleWithSpec (fp=<optimized out>,
    spec=<ModuleSpec(name='gssapi.raw._enum_extensions.ext_dce...

[Frank Heimes (fheimes)]

I tried this on a different platform, here ppc64el and ipa-client-install does not seg fault there:
ubuntu@p10d-lpar06:~$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy
ubuntu@p10d-lpar06:~$ arch
ppc64le
ubuntu@p10d-lpar06:~$ sudo ipa-client-install
This program will set up IPA client.
Version 4.9.8
...
And I also found LP tickets where people could run it on amd64.

Hence I strongly believe that this is a s390x specific problem.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Richard Young (ryoung1)]

This issue / the ipa client, is of high importance to our project. We need the centralized authentication against our IPA servers for this potentially large scale deployment of Ubuntu. Without the ipa client functionality we won't be able to use Ubuntu for our project.

[Timo Aaltonen (tjaalton)]

seems like the crasher is in python itself, not something caused by freeipa-client

[Frank Heimes (fheimes)]

Hi Timo, yes, I agree.
Looks like the fault is coming from ext_dce.cpython-310-s390x-linux-gnu.so, that is in python3-gssapi.
But Ubuntu seems to be pretty up to date with python3-gssapi:
 python3-gssapi | 1.6.12-1build2 | jammy/universe | amd64, arm64, armhf, ppc64el, riscv64, s390x
 python3-gssapi | 1.8.2-1build1 | lunar/universe | amd64, arm64, armhf, ppc64el, riscv64, s390x
 python3-gssapi | 1.8.2-1build1 | mantic/universe | amd64, arm64, armhf, ppc64el, riscv64, s390x
There is a v1.8.3 upstream, but not in Debian, and we sync this from debian ...

[Timo Aaltonen (tjaalton)]

right, best to move it to the correct package

[Timo Aaltonen (tjaalton)]

I've uploaded python-gssapi 1.8.3 to the staging ppa

https://launchpad.net/~freeipa/+archive/ubuntu/staging

please test that to see if it changes anything

[Frank Heimes (fheimes)]

Awesome ! Thanks Timo!

I'll just retried it on a jammy system, but it unfortunately still seg. faults:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy
$ apt-cache policy python3-gssapi
python3-gssapi:
  Installed: 1.8.3-0~ppa1
  Candidate: 1.8.3-0~ppa1
  Version table:
 *** 1.8.3-0~ppa1 100
        100 /var/lib/dpkg/status
     1.6.12-1build2 500
        500 http://ports.ubuntu.com/ubuntu-ports jammy/universe s390x Packages
$ sudo ipa-client-install
[sudo] password for ubuntu:
Segmentation fault

And it seems to be still the same issue:

$ sudo apport-unpack /var/crash/_usr_sbin_ipa-client-install.0.crash /tmp/crash
$ cd /tmp/crash
$ DEBUGINFOD_URLS=https://debuginfod.ubuntu.com gdb `cat ExecutablePath` CoreDump
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "s390x-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
"/usr/sbin/ipa-client-install": not in executable format: file format not recognized
[New LWP 7206]

This GDB supports auto-downloading debuginfo from the following URLs:
https://debuginfod.ubuntu.com
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
To make this setting permanent, add 'set debuginfod enabled on' to .gdbinit.
Core was generated by `/usr/bin/python3 -I /usr/sbin/ipa-client-install'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000003ffa4b02804 in ?? ()
(gdb) bt
Python Exception <class 'gdb.error'>: PC not saved
#0 0x000003ffa4b02804 in ?? ()
(gdb) exit
$ DEBUGINFOD_URLS=https://debuginfod.ubuntu.com gdb python3
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "s390x-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from python3...
Reading symbols from /usr/lib/debug/.build-id/61/7ec16f82f98e94969fd0f36d71da0a7de8b5fb.debug...
(gdb) run /usr/sbin/ipa-client-install
Starting program: /usr/bin/python3 /usr/sbin/ipa-client-install

...

[Timo Aaltonen (tjaalton)]

Okay, thanks for testing. filed upstream

https://github.com/pythongssapi/python-gssapi/issues/333

though it might be something lower level still. Feel free to follow-up there

[Frank Heimes (fheimes)]

Thx Timo, you've beaten me - I started to do the same.

I've also tagged IBM, since it's very likely that this is a s390x specific issue.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-12-01 10:09 EDT-------
In short words, PyExc_ImportError at 0x16418c0 is too far away for the 32bit R_390_PC32DBL relocation at 0x3fff6e82608.

I've just commented in the upstream github-issue with more details:
https://github.com/pythongssapi/python-gssapi/issues/333#issuecomment-1836257644

That's it so far. At this point, I don't know how the c-source looks like and which compiler options are used.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2023-12-04 09:21 EDT-------
Seems to be an issue with the Ubuntu gcc (which is configured with --enable-default-pie), some issue in the past with pie in the python3-gssapi Ubuntu package (unfortunately no hint in the debian/changelog file) and that LTO is used by default. In addition there seems to be a bug in s390x part of gcc/linker in this scenario as I assume it works on other architectures.

From debian/rules:
# PIE currently breaks compilation
export DEB_BUILD_MAINT_OPTIONS = hardening=+all,-pie

If I either rebuild the package without disabling pie:
export DEB_BUILD_MAINT_OPTIONS = hardening=+all
or without lto:
export DEB_BUILD_MAINT_OPTIONS = hardening=+all,-pie optimize=-lto

... I can start ipa-client-install as root:
$ ipa-client-install
This program will set up IPA client.
Version 4.10.2

WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd

DNS discovery failed to determine your DNS domain
Provide the domain name of your IPA server (ex: example.com):
=> Stopped here as I don't have an IPA server.

Without lto, the shared library contains this relocation in got-slot:
0000000000004fe0 000000310000000a R_390_GLOB_DAT 0000000000000000 PyExc_ImportError + 0
And the code loads from this relocated got-slot:
lgrl %r14,4fe0

[Frank Heimes (fheimes)]

Great investigation Stefan - I wouldn't have expected that LTO is causing this, since we've introduced it a while ago (and faced issue with it mainly on a different platform, not on s390x).

But I can confirm your investigations.
I've created a test build in PPA, that is available here:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2044242
especially:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2044242/+build/27048724
(This is also to immediately unblock Richard!)

The validation with this updated package, which has LTO disabled for s390x only, was successful:

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy

$ apt-cache policy python3-gssapi
python3-gssapi:
  Installed: (none)
  Candidate: 1.6.12-1build2
  Version table:
     1.6.12-1build2 500
        500 http://ports.ubuntu.com/ubuntu-ports jammy/universe s390x Packages

$ sudo apt install python3-gssapi

$ apt-cache policy python3-gssapi
python3-gssapi:
  Installed: 1.6.12-1build2
  Candidate: 1.6.12-1build2
  Version table:
 *** 1.6.12-1build2 500
        500 http://ports.ubuntu.com/ubuntu-ports jammy/universe s390x Packages
        100 /var/lib/dpkg/status

$ sudo apt install freeipa-client

$ sudo ipa-client-install
Segmentation fault

$ sudo apt install ./python3-gssapi_1.6.12-1ubuntu2.1_s390x.deb

$ apt-cache policy python3-gssapi
python3-gssapi:
  Installed: 1.6.12-1ubuntu2.1
  Candidate: 1.6.12-1ubuntu2.1
  Version table:
 *** 1.6.12-1ubuntu2.1 100
        100 /var/lib/dpkg/status
     1.6.12-1build2 500
        500 http://ports.ubuntu.com/ubuntu-ports jammy/universe s390x Packages

$ sudo ipa-client-install
This program will set up IPA client.
Version 4.9.8

WARNING: conflicting time&date synchronization service 'ntp' will be disabled in favor of chronyd

invalid hostname: not fully qualified
The ipa-client-install command failed. See /var/log/ipaclient-install.log for more information

[Frank Heimes (fheimes)]

Test builds for J to N are available here (and successfully tested):
https://launchpad.net/~fheimes/+archive/ubuntu/lp2044242

The debdiffs are attached.

With that, starting to upload, noble first ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-gssapi - 1.8.2-1ubuntu1

---------------
python-gssapi (1.8.2-1ubuntu1) noble; urgency=medium

  * Disable LTO to avoid seg. fault on s390x. (LP: #2044242)
    - d/rules: disabled lto for s390x only
    - d/control: maintainer changed due to update-maintainer run

 -- Frank Heimes <email address hidden> Wed, 06 Dec 2023 09:15:41 +0100

[Timo Aaltonen (tjaalton)]

Hello Frank, or anyone else affected,

Accepted python-gssapi into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-gssapi/1.8.2-1ubuntu0.23.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Frank, or anyone else affected,

Accepted python-gssapi into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-gssapi/1.8.2-1ubuntu0.23.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

the jammy version probably should be -1ubuntu0.1 instead of -1ubuntu2.1?

[Frank Heimes (fheimes)]

Hmm, we have right now in jammy is:
python-gssapi | 1.6.12-1build2 | jammy/universe | source
Initially I thought I need to keep the 2 (of 1build2).
But just found:
"If no ubuntuX was present before, then set ubuntu0.1 which will represent that there was no Ubuntu delta (0) before this upload which is the first to add a change (.1)."
Which makes me think that the 'build2' part becomes irrelevant for the new version in case of a first modification of a package as part of an SRU for Ubuntu.

Hence I think you are right with you suggestion: '-1ubuntu0.1'.

So would you please reject 1.6.12-1ubuntu2.1 / jammy ?

And I'm uploading a 1.6.12-1ubuntu0.1 for jammy instead.

[Frank Heimes (fheimes)]

1.6.12-1ubuntu0.1 uploaded - waiting for approval

[Timo Aaltonen (tjaalton)]

Hello Frank, or anyone else affected,

Accepted python-gssapi into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/python-gssapi/1.6.12-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

thanks, done

[Frank Heimes (fheimes)]

verification successful on mantic

[Frank Heimes (fheimes)]

verification successful on lunar

[Frank Heimes (fheimes)]

verification successful on jammy

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-gssapi - 1.8.2-1ubuntu0.23.10.1

---------------
python-gssapi (1.8.2-1ubuntu0.23.10.1) mantic; urgency=medium

  * Disable LTO to avoid seg. fault on s390x. (LP: #2044242)
    - d/rules: disabled lto for s390x only
    - d/control: maintainer changed due to update-maintainer run

 -- Frank Heimes <email address hidden> Wed, 06 Dec 2023 09:11:23 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for python-gssapi has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-gssapi - 1.8.2-1ubuntu0.23.04.1

---------------
python-gssapi (1.8.2-1ubuntu0.23.04.1) lunar; urgency=medium

  * Disable LTO to avoid seg. fault on s390x. (LP: #2044242)
    - d/rules: disabled lto for s390x only
    - d/control: maintainer changed due to update-maintainer run

 -- Frank Heimes <email address hidden> Wed, 06 Dec 2023 09:06:10 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-gssapi - 1.6.12-1ubuntu0.1

---------------
python-gssapi (1.6.12-1ubuntu0.1) jammy; urgency=medium

  * Disable LTO to avoid seg. fault on s390x. (LP: #2044242)
    - d/rules: disabled lto for s390x only
    - d/control: maintainer changed due to update-maintainer run

 -- Frank Heimes <email address hidden> Mon, 04 Dec 2023 20:47:03 +0100

[CDE Administration (cdeadmin)]

Note: restored the verification-done verification-done-jammy verification-done-lunar verification-done-mantic keywords which were inadvertently removed by bugproxy earlier.