Please convert gnome-keyring to multiarch

Bug #859600 reported by Riku Voipio
450
This bug affects 183 people
Affects Status Importance Assigned to Milestone
gnome-keyring (Debian)
Fix Released
Unknown
gnome-keyring (Ubuntu)
Fix Released
High
Adam Stokes
Precise
Won't Fix
High
Adam Stokes
Quantal
Fix Released
Undecided
Unassigned
Raring
Fix Released
High
Adam Stokes

Bug Description

[Impact]
Several applications are relying on this package as seen in comments 5 and 6.

[Test case]
Attempt to install both i386/amd64 versions of libp11-kit-gnome-keyring and preferably verify if the reported applications in this bug are able to run successfully.

1. Run the command 'wine notepad'. Notice the warning from p11-kit.
2. sudo apt-get install libp11-kit-gnome-keyring:i386
3. Run the command 'wine notepad' again. Notice that the warning is gone.

[Regression Potential]
Minimal, several rdepends build testing have been completed successfully and nothing in the keyring code is attempting to dlopen any hardcoded library paths.

gnome-keyring is still installing libraries to /usr/lib instead of the multarch compatible /usr/lib/$(DEB_HOST_MULTIARCH) directory. The attached patch does the conversion.

Revision history for this message
Riku Voipio (riku-voipio) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu):
status: New → Confirmed
Revision history for this message
dino99 (9d9) wrote :

Actual xsession-error logged on Precise i386:

WARNING: gnome-keyring:: couldn't connect to: /tmp/keyring-qTq8ls/pkcs11: no such file or directory
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh

but this path exist and owned by user (with -rwxrwxr-x rights for pkcs11 file, and drwx------ for the folder). The files: control, gpg, pkcs11 & ssh are all 0 bit long.
So i'm wondering about a timing race.

dino99 (9d9)
tags: added: precise
Revision history for this message
Paweł Buglewicz (illmoded) wrote :

precise;
making a symbolic link doesn't help

Revision history for this message
Tommy Vestermark (tov) wrote :

It seems this package (and dependencies) must be available as a 'gnome-keyring:i386' to get the Limbo game working. See https://bugs.launchpad.net/ubuntu/+bug/1008066

Pretty Please fix :-)

Changed in gnome-keyring (Ubuntu Precise):
milestone: none → ubuntu-12.04.1
Changed in gnome-keyring (Ubuntu):
importance: Undecided → High
Changed in gnome-keyring (Ubuntu Precise):
importance: Undecided → High
status: New → Triaged
Changed in gnome-keyring (Ubuntu):
status: Confirmed → Triaged
Changed in gnome-keyring (Ubuntu Precise):
assignee: nobody → Adam Stokes (adam-stokes)
Changed in gnome-keyring (Ubuntu Precise):
milestone: ubuntu-12.04.1 → ubuntu-12.04.2
description: updated
Changed in gnome-keyring (Ubuntu Precise):
status: Triaged → In Progress
Revision history for this message
Scott Ritchie (scottritchie) wrote :

Is this still in progress? Is it deferred to after Quantal release? (Quantal needs it too I believe)

I've got some Wine apps in the wild that are breaking cause of it (see linked duplicate bugs), plus the aforementioned apps in this report.

Revision history for this message
Adam Stokes (adam-stokes) wrote :

This is on my radar to do but will probably make it in Quantal updates at a later date. I should have some free cycles next week to look more into this issue.

Thank you for your patience
Adam

Revision history for this message
Adam Stokes (adam-stokes) wrote :

rdeps testing

gksu_2.0.2-6ubuntu2-amd64-20121015-1720:Status: successful
gnome-python-desktop_2.32.0+dfsg-2ubuntu1-amd64-20121015-1724:Status: successful
gnome-session_3.6.0-0ubuntu1-amd64-20121015-1729:Status: successful
gvfs_1.14.0-0ubuntu6-amd64-20121015-1733:Status: successful
seahorse_3.6.0-0ubuntu1-amd64-20121015-1740:Status: successful
ubuntu-sso-client_4.0.0-0ubuntu1-amd64-20121015-1746:Status: attempted
virt-manager_0.9.3-1ubuntu2-amd64-20121015-1749:Status: successful

---
This is the error with ubuntu-sso

Traceback (most recent call last):
  File "setup.py", line 328, in <module>
    **extra)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 98, in setup
    __requires(attrs, src_all)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 470, in __requires
    __add_imports(imports, s, attrs)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 404, in __add_imports
    if alias.name and __external_mod(cur_module, alias.name, attrs):
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 353, in __external_mod
    mod = __import__(cur_module + '.' + module)
  File "/«PKGBUILDDIR»/ubuntu_sso/main/__init__.py", line 41, in <module>
    from ubuntu_sso import utils
  File "/«PKGBUILDDIR»/ubuntu_sso/utils/__init__.py", line 44, in <module>
    from ubuntu_sso.logger import setup_logging
  File "/«PKGBUILDDIR»/ubuntu_sso/logger.py", line 48, in <module>
    os.makedirs(unicode_path(LOGFOLDER))
  File "/usr/lib/python2.7/os.py", line 150, in makedirs
    makedirs(head, mode)
  File "/usr/lib/python2.7/os.py", line 150, in makedirs
    makedirs(head, mode)
  File "/usr/lib/python2.7/os.py", line 157, in makedirs
    mkdir(name, mode)
OSError: [Errno 13] Permission denied: '/sbuild-nonexistent'
dh_auto_build: python setup.py build --force returned exit code 1
make: *** [build] Error 1
dpkg-buildpackage: error: debian/rules build gave error exit status 2
Sessions still open, not unmounting
────────────────────────────────────────────────────────────────────────────────
Build finished at 20121015-1749

Thanks

description: updated
Changed in gnome-keyring (Ubuntu):
assignee: nobody → Adam Stokes (adam-stokes)
milestone: none → quantal-updates
Changed in gnome-keyring (Debian):
status: Unknown → New
Revision history for this message
karpa (k-valhalla-age) wrote :

svn also affected:
karp@karp:~/tmp/prj$ svn up
p11-kit: couldn't load module: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory
after upgrade from 11.10 to 12.04

Revision history for this message
Adam Stokes (adam-stokes) wrote :

Thanks I'm going to do a precise diff today so sponsors team can look at them both.

Adam

Changed in gnome-keyring (Ubuntu):
status: Triaged → In Progress
Changed in gnome-keyring (Ubuntu):
milestone: quantal-updates → none
Revision history for this message
Adam Stokes (adam-stokes) wrote :

Packaging changes from precise 3.2 to quantal/raring 3.6.0 will take me some more time to get sorted out for mult-arch.

Changed in gnome-keyring (Ubuntu Precise):
milestone: ubuntu-12.04.2 → precise-updates
Revision history for this message
Luke Yelavich (themuso) wrote :

Your diff for raring doesn't appear to add gnome-keyring-bin as a dependency fo gnome-keyring. I'd add this myself, but there may be a better way to go about this, and you would need to make the same change for precise and quantal as well.

Unsubscribing ubuntu-sponsors for now, please re-subscribe when this is fixed up.

Changed in gnome-keyring (Ubuntu Raring):
status: In Progress → New
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu Quantal):
status: New → Confirmed
Changed in gnome-keyring (Ubuntu):
status: New → Confirmed
Revision history for this message
Steffen Neumann (sneumann) wrote :

Hi, for me the dirty workaround was to download the gnome-keyring_3.2.2-2ubuntu4_i386.deb
from https://launchpad.net/ubuntu/precise/i386/gnome-keyring, and extract just
/usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so and drop it into the right place.
Yours, Steffen

Revision history for this message
Emmanuel Cron (emmanuel-cron) wrote :

Didn't work for me as Spotify still isn't able to validate server certificate:
err:ole:marshal_object couldn't get IPSFactory buffer for interface {00000131-0000-0000-c000-000000000046}
err:ole:marshal_object couldn't get IPSFactory buffer for interface {00000122-0000-0000-c000-000000000046}
err:ole:StdMarshalImpl_MarshalInterface Failed to create ifstub, hres=0x80040155
err:winhttp:netconn_secure_connect couldn't verify server certificate (12045)

Revision history for this message
dobey (dobey) wrote :

I don't think the two proposed debdiffs here are correct for implementing multi-arch for gnome-keyring. While the plug-ins for gnome-keyring itself, and the pam module, could be built as multi-arch, it isn't necessary to do so. In fact, building the gnome-keyring plug-ins (currently in usr/lib/gnome-keyring/devel/*.so) into a Multi-Arch: same package, will result in a broken install if the :i386 package is installed on an x86_64 system, for example, as the gnome-keyring binary package is marked as foreign. Also, there are many non-arch-dependent files left in the gnome-keyring package, which are not installed in arch-dependent directories, resulting in file conflicts between the i386 and x86_64 versions of the package.

Revision history for this message
dobey (dobey) wrote :

This is a better patch to add multi-arch support for gnome-keyring. It moves the p11-kit module to a new package, moves the pam module to multi-arch, and correctly marks the gnome-keyring package as multi-arch foreign, as it includes the main binary, and data files.

Revision history for this message
Andreas Metzler (k-launchpad-downhill-at-eu-org) wrote :

Please be sure to doublecheck compatibilty with p11-kit 0.14 which requires a .module extension for PKCS#11 autoloading while you are making large changes to this package.

Revision history for this message
dobey (dobey) wrote :

Andreas, that seems like it should be a separate patch, and something that should go upstream in GNOME (and possibly is already fixed there), while this multiarch patch currently only affects the packaging.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-keyring - 3.6.2-0ubuntu2

---------------
gnome-keyring (3.6.2-0ubuntu2) raring; urgency=low

  * debian/control:
    - Move the PKCS#11 module into a separate package. (LP: #1094319)
    - Convert to use multi-arch. (LP: #859600)
  * debian/gnome-keyring.install, debian/libp11-kit-gnome-keyring.*:
    - The pkcs11 module needs to be a separate package.
  * debian/libpam-gnome-keyring.install, debian/rules:
    - Use the multi-arch directory for the PAM module.
 -- Rodney Dawes <email address hidden> Mon, 07 Jan 2013 15:03:31 -0500

Changed in gnome-keyring (Ubuntu Raring):
status: Confirmed → Fix Released
Revision history for this message
Scott Ritchie (scottritchie) wrote :

64-bit Wine no longer throws an error message every time it runs with new libp11-kit-gnome-keyring:i386 package installed. Thanks!

Revision history for this message
TomasHnyk (sup) wrote :

Is this going to be fixed for quantal too?

Revision history for this message
torzsmokus (torzsmokus) wrote :

What about precise (said to be LTS)?

Revision history for this message
Tuomas Lähteenmäki (lahtis) wrote :

please fix for ubuntu 12.10 also, i have same bug for 1.5.27 wine versions too.

Revision history for this message
Adam Stokes (adam-stokes) wrote :

I apologize for the delay, all debdiffs are uploaded and proper teams subscribed. I'll check back on its progress next week and push harder for review if not done by next Wednesday.

Thanks
Adam

Revision history for this message
Adam Stokes (adam-stokes) wrote :

s/uploaded/attached to bug/

Revision history for this message
Dmitry Shachnev (mitya57) wrote :

Thanks for the patch, I have two comments about it though:

- d/control is autogenerated, please modify d/control.in instead;
- shouldn't "usr/bin" be removed from gnome-keyring.install now that you moved it to -bin package?

Revision history for this message
Adam Stokes (adam-stokes) wrote :

> - d/control is autogenerated, please modify d/control.in instead;

I only altered control.in, however, I believe d/control was auto-updated during the source package build.

> - shouldn't "usr/bin" be removed from gnome-keyring.install now that you moved it to -bin package?

Nice catch Ill fix that up and re-submit.

Thanks
Adam

Revision history for this message
Adam Stokes (adam-stokes) wrote :

Should be fix in precise debdiff now

Revision history for this message
dobey (dobey) wrote :

Why are you making debdiffs against an older gnome-keyring package, that are incompatible with the changes already in raring?

Revision history for this message
Adam Stokes (adam-stokes) wrote :

My bad, was on autopilot for a moment. The other's still apply I believe.

Thanks
Adam

Revision history for this message
dobey (dobey) wrote :

The quantal debdiff you posted is against an older version as well, as is the precise version. Also, if the proposed debdiffs were pushed out as updates on those platforms, it would break upgrades to the newer Ubuntu versions, as the changes are incompatible.

Revision history for this message
Adam Stokes (adam-stokes) wrote : Re: [Bug 859600] Re: Please convert gnome-keyring to multiarch

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/08/2013 11:02 AM, Rodney Dawes wrote:
> The quantal debdiff you posted is against an older version as well,
> as is the precise version. Also, if the proposed debdiffs were
> pushed out as updates on those platforms, it would break upgrades
> to the newer Ubuntu versions, as the changes are incompatible.
>
Ok ill fix it, Thanks!

- --
Adam Stokes
<email address hidden>
"Don't salt your green beans before you try them,
 some may think you make rash decisions."
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJRYt7UAAoJEBDHSpCZCC2fLWwIAIsybj/QDJmv2xhFqRRQWlF+
sxnR15CtIc1ibU8MLKfR3XIFBTJQbXuWu1eRjQA2t1aDNmKwRrhek9uboTvLlOsJ
2IivsQH/wDscvT5InSiGN0y+0I4pWnfNC6zkoGKxJj3o0S5RfGGpIDSIXHSKW+2T
dpibpVy+thpaV15+O+a+CFKOUOBNmYtbCHvl4AL8aAdrepVeurMQ4GMe2eqSuwnZ
2jMUx8eKe701bTNB0jUAiFY9ODbeGnb2uHSjzNKnFYk/TM3uW+TShs2FyizlNBTc
q9dISHyoiBb6LnSkm8nN/S2VOM0TuUmuAB9f/ZbdrZ2J90GI2gte41FDY7loACs=
=nnBB
-----END PGP SIGNATURE-----

Revision history for this message
dobey (dobey) wrote :

Here's a debdiff for Quantal with the same changes that are in Raring already.

Revision history for this message
Adam Stokes (adam-stokes) wrote :

Hopefully these dont suck :)

Thanks!
Adam

Revision history for this message
dobey (dobey) wrote :

Looks like you are pulling the gnome-keyring from the release pocket, and not from -proposed, as should be. So you now just applied my changes to the release packages, rather than the updated versions that were released on Quantal/Precise. See the Quantal backport patch I attached for the appropriate changes to the latest version on Quantal.

Revision history for this message
Adam Stokes (adam-stokes) wrote :
Revision history for this message
jhansonxi (jhansonxi) wrote :

I'm unsure if an updated package has been released for Ubuntu 12.04 (Precise Pangolin) yet but the currently available version of gnome-keyring:i386 is not installable due to libgcr-3-common not being multiarch (bug #998715).

Revision history for this message
Adam Stokes (adam-stokes) wrote :

Thanks jhansonxi,

I'll see about getting libgcr multiarch this week.

Adam

Revision history for this message
dobey (dobey) wrote :

You wouldn't be able to install gnome-keyring:i386 on x86_64 with these changes in raring either even, without replacing a very large portion of the system with the 32-bit packages. Nor do I see any reason why one would ever want to, either. There's no reason do that.

Changed in gnome-keyring (Ubuntu Quantal):
status: Confirmed → In Progress
Revision history for this message
Martin Pitt (pitti) wrote :

At this point I think we can say that a quantal SRU is out of scope now. Precise has a longer life-time, so keeping that one open.

Changed in gnome-keyring (Ubuntu Quantal):
status: In Progress → Won't Fix
Revision history for this message
dobey (dobey) wrote :

@Martin, Quantal is still supported for almost a full 12 months more. Is it really out of scope to push SRUs to it after only 6 months in? If this were Raring, and there were only a couple months left of support, then I would agree it might be out of scope to push such a change. But given the work here is done, I don't see a good reason to not push it, unless something is actually broken, which I doubt, given the same changes are included in Raring already, and it works fine there. :)

Revision history for this message
Chris Halse Rogers (raof) wrote : Please test proposed package

Hello Riku, or anyone else affected,

Accepted gnome-keyring into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/gnome-keyring/3.2.2-2ubuntu4.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in gnome-keyring (Ubuntu Precise):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
eraserix (eraserix) wrote :

Looks odd, this is gnome-keyring 3.2.2, but libp11-kit-gnome-keyring has in the d/control:
Breaks: gnome-keyring (<< 3.6.2-0ubuntu2~)
Replaces: gnome-keyring (<< 3.6.2-0ubuntu2~)

This two should contain the version of THIS package, e.g. 3.2.2-2ubuntu4.2.

Revision history for this message
eraserix (eraserix) wrote :

And for coinstalling x86_64 and i386 variants, see below. I've added proposed as suggested in https://wiki.ubuntu.com/Testing/EnableProposed.

# sudo apt-get install gnome-keyring:i386/precise-proposed
Reading package lists... Done
Building dependency tree
Reading state information... Done
Selected version '3.2.2-2ubuntu4.2' (Ubuntu:12.04/precise-proposed [i386]) for 'gnome-keyring:i386'
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 gnome-keyring:i386 : Depends: libcap-ng0:i386 but it is not going to be installed
                      Depends: libgck-1-0:i386 (>= 2.91.1) but it is not going to be installed
                      Depends: libgcr-3-1:i386 (>= 3.2.2) but it is not going to be installed
                      Depends: libcap2-bin:i386 but it is not going to be installed
                      Recommends: libp11-kit-gnome-keyring:i386 but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Revision history for this message
Adam Conrad (adconrad) wrote :

Removed from precise-proposed due to the above regression. Please fix and reupload with a bumped version number.

tags: added: verification-failed
removed: verification-needed
Adam Conrad (adconrad)
Changed in gnome-keyring (Ubuntu Precise):
status: Fix Committed → In Progress
Revision history for this message
Didier Roche-Tolomelli (didrocks) wrote :

Please resuscrbibe the sponsoring team once fixed. Thanks :)

Revision history for this message
eraserix (eraserix) wrote :

Looks like sid has quite a bit of changes to gnome-keyring compared with what's in precise, but multiarch is not one of them. However, the wine version in sid does not seem to suffer this problem with the library. 'wine notepad' only gives me an error in precise, but not in sid. sid has wine 1.4.1.

Revision history for this message
eraserix (eraserix) wrote :

Why change pam/gnome-keyring to mutliarch if it would be enough to just split of the pkcs11 package and make it multiarch?

Revision history for this message
dobey (dobey) wrote :

@eraserix have you looked at the diff? That's exactly what is done in 13.04, and what the diff is meant to backport to the older releases..

Revision history for this message
eraserix (eraserix) wrote : Re: [Bug 859600] Re: Please convert gnome-keyring to multiarch

Yes, I did. But I don't see why gnome-keyring is marked as Multi-Arch:
foreign and libpam-gnome-keyring is converted to Mutli-Arch: same. As
I see it, it is sufficient to make 'libp11-kit-gnome-keyring' as
Multi-Arch: same and be done with it. To resolve the warning from wine
you would have to explicitly install the new libp11-kit package for
i386. I hope I'll get around to posting a working patch for 12.04
later today.

BTW, how is the new libp11-kit-gnome-keyring supposed to find it's way
to the affected users? Will wine declare a dependency on
libp11-kit-gnome-keyring:i386 or something?

On Mon, Jun 24, 2013 at 2:14 AM, Rodney Dawes <email address hidden> wrote:
> @eraserix have you looked at the diff? That's exactly what is done in
> 13.04, and what the diff is meant to backport to the older releases..
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/859600
>
> Title:
> Please convert gnome-keyring to multiarch
>
> Status in “gnome-keyring” package in Ubuntu:
> Fix Released
> Status in “gnome-keyring” source package in Precise:
> In Progress
> Status in “gnome-keyring” source package in Quantal:
> Won't Fix
> Status in “gnome-keyring” source package in Raring:
> Fix Released
> Status in “gnome-keyring” package in Debian:
> New
>
> Bug description:
> [Impact]
> Several applications are relying on this package as seen in comments 5 and 6.
>
> [Test case]
> Attempt to install both i386/amd64 versions and preferably verify if the reported applications in this bug are able to run successfully
>
> [Regression Potential]
> Minimal, several rdepends build testing have been completed successfully and nothing in the keyring code is attempting to dlopen any hardcoded library paths.
>
> gnome-keyring is still installing libraries to /usr/lib instead of the
> multarch compatible /usr/lib/$(DEB_HOST_MULTIARCH) directory. The
> attached patch does the conversion.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/859600/+subscriptions

Revision history for this message
Graham Inggs (ginggs) wrote :

@eraserix: gnome-keyring is marked Multi-Arch: foreign so that, for example, an amd64 gnome-keyring can satisfy an i386 package's dependency on it.

The version numbers in Breaks and Replaces look wrong to me too.

As jhansonxi wrote in comment 48, libp11-kit-gnome-keyring:i386 won't be installable until gcr is multi-arch.

Revision history for this message
eraserix (eraserix) wrote :

So, my take ;). This patch just splits the pkcs11 library away from gnome-keyring binary package and leaves the rest of the packages alone.

I still don't see the use case for doing more, the warning when wine is started will be gone with this patch. And as far as I can tell, libgcr is still not multiarch on raring.

For the testcase, I'd say this should be something like that:
[Test case]
(on an amd64 system)
1. Run the command 'wine notepad'. Notice the warning from p11-kit.
2. sudo apt-get install libp11-kit-gnome-keyring:i386
3. Run the command 'wine notepad' again. Notice that the warning is gone.

Revision history for this message
Graham Inggs (ginggs) wrote :

I also had a go at this today. :)

I built a gnome-keyring package for Precise in my PPA:
https://launchpad.net/~ginggs/+archive/sru

It is adam-stokes' last attempt plus the following changes:
    - Change gnome-keyring's Recommends on libp11-kit-gnome-keyring
      to Depends.
    - Change libp11-kit-gnome-keyring's Breaks and Replaces on
      gnome-keyring to (<< ${binary:Version}).

@eraserix: I agree that installing libp11-kit-gnome-keyring:i386 is correct for the test case, not gnome-keyring:i386 as it contains the executables and is not co-installable.

Revision history for this message
Graham Inggs (ginggs) wrote :

@eraserix: as for how is the new libp11-kit-gnome-keyring supposed to find it's way
to the affected users?

Both wine and cups got updates in Raring to Recommends and Depends the new libp11-kit-gnome-keyring respectively:

wine1.4 (1.4.1-0ubuntu5) raring; urgency=low

  * Add new libp11-kit-gnome-keyring package to recommends
    - Should fix a few apps (LP: #859600)

 -- Scott Ritchie <email address hidden> Tue, 12 Feb 2013 17:12:01 -0800

cups (1.6.2-1ubuntu2) raring; urgency=low

  * debian/control: Added libp11-kit-gnome-keyring to the dependencies of
    the cups-binary package (LP: #1157904).

 -- Till Kamppeter <email address hidden> Wed, 20 Mar 2013 19:58:01 +0100

I guess these will need to be SRU'd as well.

I'm still inclined to have gnome-keyring Depends on libp11-kit-gnome-keyring, at least for these SRUs.

Revision history for this message
Scott Ritchie (scottritchie) wrote :

Yes, I've been holding back on a Wine SRU because I wanted it to integrate this fix.

Similarly, I will also want to backport wine1.6 to precise when it releases within a few weeks, and it would be very nice to have this done by then.

eraserix (eraserix)
description: updated
Revision history for this message
eraserix (eraserix) wrote :

I've updated the description with more specific instructions on how to test this SRU.

As for Depends vs Recommends from debian policy manual:
The Depends field should be used if the depended-on package is required for the depending package to provide a significant amount of functionality.

The Recommends field should list packages that would be found together with this one in all but unusual installations.

I'm kind of inclined to stay with recommends. I can still store passwords in the keyring without the pkcs11 library, no?

@graham: Thanks for the info about how the new multiarched package finds its way to the users.

Revision history for this message
Graham Inggs (ginggs) wrote :

For the gnome-keyring package to be considered multi-arch in Precise, surely libgck and libgcr need to be multi-arch as well?
Then we can close LP: #998715 for Precise in this SRU.

My other concern is what will happen when someone picks up libp11-kit-gnome-keyring in Precise and then upgrades to Quantal?
Quantal's gnome-keyring will overwrite libp11-kit-gnome-keyring because its Breaks and Replaces are on a lower version of gnome-keyring. If this gets SRU'd for Precise, surely it must get SRU'd for Quantal as well?

Revision history for this message
eraserix (eraserix) wrote :

So, the solution imagined here is not to fix the two duplicates of this bug, but to introduce a new feature, namely make every library in gnome-keyring multiarch? What's to be gained by this?

Revision history for this message
dobey (dobey) wrote :

OK. Everyone, just relax. First of all, this bug is not for the p11kit issue. That bug is #1094319 as clearly mentioned in the changelog entry. This bug is specifically about enabling Multi-Arch for the gnome-keyring source package, so that some of its binaries may be co-installable as needed. While I had fixed both bugs at the same time in Raring, they are not the same issue.

And on top of that, the gcr source package being converted to Multi-Arch is another separate issue. Please do not conflate them all into being the same bug. They are separate issues, even if they have dependencies on one another.

The update issue is another issue on top of those, which will also need to be carefully considered, and which means all of these fixes will need to be SRUed into Quantal first, indeed. Or we simply maintain the status quo in Precise and Quantal for these 3 issues, as it is a non-fatal issue, and only a slight annoyance, only when using certain software which requires use of 32-bit pieces while running on 64-bit. I see no good reason to force N complex updates upon the user base, to fix a very minor annoyance (which isn't this bug anyway).

Revision history for this message
Graham Inggs (ginggs) wrote :

I've built another gnome-keyring package for Precise in my PPA that I hope fixes all three issues (multi-arch gnome-keyring, multi-arch gcr and split libp11-kit-gnome-keyring).

The test case (on an x86_64 system) would be something like:

$ wine notepad
You should see the error message:
p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

$ sudo apt-get install libp11-kit-gnome-keyring:i386
$ wine notepad
The p11kit error no longer appears.

$ sudo apt-get install libgcr-3-1:i386
The following packages are installed: libgck-1-0:i386 libgcr-3-1:i386 and libgcr-3-common

I can attach a debdiff if needed.

Revision history for this message
Scott Ritchie (scottritchie) wrote :

To be clear the error message isn't the annoyance part, it's that it's a real error that does prevent some apps from running (and there's no way to make them run on 64-bit at all in current precise).

Revision history for this message
eraserix (eraserix) wrote :

@graham: I think the usual way to do this is that you crate a debdiff to the current version in precise. Attach it to this bugreport and subscribe ubuntu-sponsors when done. Name/Version of the patch should be something like that:

gnome-keyring_3.2.2-2ubuntu4.3.precise.debdiff

Revision history for this message
Graham Inggs (ginggs) wrote :

I will be able to work on this and gcr again in a couple of days' time. Hopefully early next week I'll attach debdiffs.
In the meantime, you are welcome to test gnome-keyring from my PPA.

Revision history for this message
Graham Inggs (ginggs) wrote :

This is Rodney's Quantal patch from comment #41 with the following changes:
The gnome-keyring package depends on libp11-kit-gnome-keyring instead of recommends.
The libp11-kit-gnome-keyring package now breaks and replaces gnome-keying (<< ${binary:Version}).

I believe this needs to be fixed in Quantal before it can be fixed in Precise so that the upgrade path is not broken.

Revision history for this message
Graham Inggs (ginggs) wrote :

This patch for Precise includes the same changes as in the Quantal patch above, and includes the multi-arch changes in the gcr package from Saucy ( see LP: #859600).

Revision history for this message
Graham Inggs (ginggs) wrote :

Marking 'new' in Quantal and Precise.

Changed in gnome-keyring (Ubuntu Precise):
status: In Progress → New
Changed in gnome-keyring (Ubuntu Quantal):
status: Won't Fix → In Progress
Revision history for this message
Dimitri John Ledkov (xnox) wrote :

@Adam Conrad (adconrad)
Updated SRU uploaded into precise-proposed queue.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu Precise):
status: New → Confirmed
Revision history for this message
Michael Terry (mterry) wrote :

OK, quick update on status for Quantal and Precise. The Quantal patch was never uploaded to the archive. The Precise patch was uploaded by xnox, but was rejected because of the ${binary:Version} issue below.

I've just uploaded a modified patch from comment 75 to Quantal only. I'd like to get Quantal landed before doing Precise, because as people have mentioned, the upgrade path gets complicated otherwise.

Here are the changes I made to Graham's Quantal patch:
- You shouldn't specify Breaks or Replaces lines with automatically generated versions like ${binary:Version}. This means that every time the package is built, it will say it breaks previous versions. Instead, just hardcode the version that you put in debian/changelog.
- When using DEB_HOST_MULTIARCH, please also make sure to manually set it [1] as recommended in the multiarch conversion doc [2]. This is because while normally the buildd will set it for us, it's not a requirement. For example, when dep8 tests rebuild the source, the variable is not set for us. Not likely an issue in practice , but still good to do.
- No need for quantal-proposed in the changelog entry. You can just say quantal now and LP will do the right thing. Minor point, but just saying.
- No need to manually add multiarch-support to the Pre-Depends line. It comes in via the ${misc:Pre-Depends} bit. Again, minor point.

So let's see how the Quantal upload goes.

[1] DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
[2] https://wiki.debian.org/Multiarch/Implementation

Revision history for this message
Stéphane Graber (stgraber) wrote : Please test proposed package

Hello Riku, or anyone else affected,

Accepted gnome-keyring into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/gnome-keyring/3.6.1-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in gnome-keyring (Ubuntu Quantal):
status: In Progress → Fix Committed
tags: removed: verification-failed
tags: added: verification-needed
Revision history for this message
Graham Inggs (ginggs) wrote :

I ran 'wine notepad' and saw the following:

p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

I installed gnome-keyring and libp11-kit-gnome-keyring:i386 from quantal-proposed.
I ran 'wine notepad' again and did not see the p11-kit warning.

tags: added: verification-done
removed: verification-needed
Revision history for this message
Graham Inggs (ginggs) wrote :

@mterry: thanks for the fixes and the upload.

I can update my patch for precise, but as it stands, it also converts gcr, which was split out of gnome-keyring into its own package in quantal, to multiarch.
Before we can convert gnome-keyring (including gcr) to multiarch in precise, we would first need to convert gcr to multiarch in raring and quantal, see LP: #998715.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-keyring - 3.6.1-0ubuntu1.1

---------------
gnome-keyring (3.6.1-0ubuntu1.1) quantal; urgency=low

  * Backport the following changes from gnome-keyring in Raring:
    - Move the PKCS#11 module into a separate package. (LP: #1094319)
    - Convert gnome-keyring to multi-arch. (LP: #859600)
 -- Graham Inggs <email address hidden> Sat, 06 Jul 2013 11:07:07 +0200

Changed in gnome-keyring (Ubuntu Quantal):
status: Fix Committed → Fix Released
Revision history for this message
Brian Murray (brian-murray) wrote : Update Released

The verification of the Stable Release Update for gnome-keyring has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
eraserix (eraserix) wrote :

Is it really still important to be able to upgrade from 12.04 to 12.10? 12.04 is supported for 3 more years, 12.10 for something like a month. Once 14.04 is out, you will be able to upgrade from 12.04 directly.

Revision history for this message
Carl Fletcher (caf4926) wrote :

I'm guessing this is related from Mint 17.3

p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/p11-kit-trust.so: /usr/lib/i386-linux-gnu/pkcs11/p11-kit-trust.so: cannot open shared object file: No such file or directory
p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

Revision history for this message
Graham Inggs (ginggs) wrote :

@caf4926: this should be fixed in trusty (and mint 17).
Please check if these packages installed.

apt-cache policy p11-kit-modules:i386
apt-cache policy libp11-kit-gnome-keyring:i386

If not, install them.

sudo apt-get install p11-kit-modules:i386 libp11-kit-gnome-keyring:i386

Changed in gnome-keyring (Debian):
status: New → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote :

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

Changed in gnome-keyring (Ubuntu Precise):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.