Provide all available pkcs11 userspace binaries for container consumption

[Dimitri John Ledkov]

[ Impact ]

 * NVIDIA ERD drivers provide userspace libraries for consumption.
 * One of them is pkcs11 plugin compiled against openssl v3 or openssl v1.1 abi
 * A host system only needs one of them, that matches the host os OpenSSL ABI
 * However, if a given host system launches containers of a different releases series, it may require the other abi pkcs11 plugin.
 * It is common to pass userspace libraries from host to container guest (i.e. docker, k8s, lxd all have tooling to do so).
 * Thus to better support running ancient and obsolete containers on modern hostos; or vice versa run modern containers on ancient hostos; ship both variants of the library always in the ERD drivers.
 * Most urgently this affects the longterm ERD driver production branch 535-server
 * Shipping this update as packaging revision only, allows releasing this update without rebuilding LRM packages.

[ Test Plan ]

 * Observe that ERD driver packages ship all available libnvidia-pkcs11-openssl*.so* libraries
 * Check that launching a docker container with userspace libraries passthrough results in both available in the guest
 * Ensuring that matching libssl/libcrypto is available in the guest container, remains exercise for the container operator.

[ Where problems could occur ]

 * Lintian warnings will be generated w.r.t. missing library dependencies
 * One must ensure shlib dependency is not generated for the other library, as those will not be satisfied.

[ Other Info ]

 * All other projects that try to be universal against multiple openssl ABIs typically use dlopen and make appropriate function calls from a single library build. I encourage NVIDIA upstream to adapt this strategy. A C language example of achieving this, licensed under MIT license, is available here https://github.com/golang-fips/openssl

[Brian Murray (brian-murray)]

Hello Dimitri, or anyone else affected,

Accepted nvidia-graphics-drivers-535-server into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nvidia-graphics-drivers-535-server/535.154.05-0ubuntu0.23.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Dimitri, or anyone else affected,

Accepted nvidia-graphics-drivers-535-server into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nvidia-graphics-drivers-535-server/535.154.05-0ubuntu0.22.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Brian Murray (brian-murray)]

Hello Dimitri, or anyone else affected,

Accepted nvidia-graphics-drivers-535-server into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nvidia-graphics-drivers-535-server/535.154.05-0ubuntu0.20.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted nvidia-graphics-drivers-535-server (535.154.05-0ubuntu0.23.10.2) for mantic have finished running.
The following regressions have been reported in tests triggered by the package:

pyopencl/2023.1.1-1 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/mantic/update_excuses.html#nvidia-graphics-drivers-535-server

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Dimitri John Ledkov (xnox)]

535-server is verified on focal and up; it contains correctly two pkcs11 .so libraries.

535 will be fixed with next new upstream release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535-server - 535.154.05-0ubuntu0.20.04.2

---------------
nvidia-graphics-drivers-535-server (535.154.05-0ubuntu0.20.04.2) focal; urgency=medium

  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Tue, 13 Feb 2024 14:09:25 +0000

[Andy Whitcroft (apw)]

The verification of the Stable Release Update for nvidia-graphics-drivers-535-server has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535-server - 535.154.05-0ubuntu0.22.04.2

---------------
nvidia-graphics-drivers-535-server (535.154.05-0ubuntu0.22.04.2) jammy; urgency=medium

  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Tue, 13 Feb 2024 14:07:58 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535-server - 535.154.05-0ubuntu0.23.10.2

---------------
nvidia-graphics-drivers-535-server (535.154.05-0ubuntu0.23.10.2) mantic; urgency=medium

  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Tue, 13 Feb 2024 13:56:53 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535 - 535.161.07-0ubuntu0.20.04.1

---------------
nvidia-graphics-drivers-535 (535.161.07-0ubuntu0.20.04.1) focal; urgency=medium

  * New upstream release (LP: #2054571)
  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Thu, 22 Feb 2024 18:26:30 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535 - 535.161.07-0ubuntu0.22.04.1

---------------
nvidia-graphics-drivers-535 (535.161.07-0ubuntu0.22.04.1) jammy; urgency=medium

  * New upstream release (LP: #2054571)
  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Thu, 22 Feb 2024 18:26:03 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535 - 535.161.07-0ubuntu0.23.10.1

---------------
nvidia-graphics-drivers-535 (535.161.07-0ubuntu0.23.10.1) mantic; urgency=medium

  * New upstream release (LP: #2054571)
  * Install all ABI builds of the libnvidia-pkcs11 plugin for host/container compatibility.
    (LP: #2052967)

 -- Dimitri John Ledkov <email address hidden> Thu, 22 Feb 2024 18:25:32 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535-server - 535.161.07-0ubuntu2

---------------
nvidia-graphics-drivers-535-server (535.161.07-0ubuntu2) noble; urgency=medium

  * remove debian/dkms_nvidia/patches/buildfix_kernel_6.8-nv_drm_ioctls-DRM_UNLOCKED-is-now-the-default-behavi.patch
  * remove debian/dkms_nvidia/patches/buildfix_kernel_6.8-gpl-pfn_valid.patch

 -- Kuba Pawlak <email address hidden> Thu, 29 Feb 2024 18:54:31 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package nvidia-graphics-drivers-535 - 535.161.07-0ubuntu3

---------------
nvidia-graphics-drivers-535 (535.161.07-0ubuntu3) noble; urgency=medium

  * Disable 6.8 buildfix patches
    -debian/dkms_nvidia/patches/buildfix_kernel_6.8-nv_drm_ioctls-DRM_UNLOCKED-is-now-the-default-behavi.patch
    -debian/dkms_nvidia/patches/buildfix_kernel_6.8-gpl-pfn_valid.patch

 -- Ian May <email address hidden> Wed, 28 Feb 2024 16:50:45 -0600