Sync p11-kit 0.7-2 (main) from Debian unstable (main) for multiarch support

[Anders Kaseorg]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

 affects ubuntu/p11-kit
 status confirmed
 importance wishlist
 subscribe ubuntu-archive
 done

Please sync p11-kit 0.7-2 (main) from Debian unstable (main)

Explanation of the Ubuntu delta and why it can be dropped:

The Debian package is based on p11-kit 0.2-0ubuntu1 from Ubuntu. I
think the one notable Ubuntu change since then is

  * debian/rules
    - Added --with-module-path to work around (LP: #828756)

No idea whether that’s still needed.

The important change in Debian is multiarch support, which is required
in precise because libgnutls26 (which is Multi-Arch: same) has a new
dependency on libp11-kit0.

Changelog entries since current precise version 0.6-0ubuntu2:

p11-kit (0.7-2) unstable; urgency=low

  * 20_path_max.diff Fix FTBFS on GNU/Hurd due to missing PATH_MAX (Thanks,
    Pino Toscano). Closes: #643601

 -- Andreas Metzler <email address hidden> Wed, 28 Sep 2011 19:22:40 +0200

p11-kit (0.7-1) unstable; urgency=low

  * New upstream version.
    + Expand p11-kit config variables correctly. Closes: #642041

 -- Andreas Metzler <email address hidden> Tue, 27 Sep 2011 19:14:47 +0200

p11-kit (0.6-1) unstable; urgency=low

  * New upstream version.
  * [lintian] Fix syntax error in debian/copyright.

 -- Andreas Metzler <email address hidden> Thu, 15 Sep 2011 19:23:23 +0200

p11-kit (0.4-2) unstable; urgency=low

  * Add Build-Depends-Package safeguard to symbol file.

 -- Andreas Metzler <email address hidden> Fri, 26 Aug 2011 18:12:25 +0200

p11-kit (0.4-1) experimental; urgency=low

  * Fix typo in package description. (Thanks, Aputsiaq Janussen)
    Closes: #638226
  * New upstream version.
  * Update symbol file.
  * Ship pkcs11.conf.example in /usr/share/doc/.

 -- Andreas Metzler <email address hidden> Fri, 19 Aug 2011 11:23:56 +0200

p11-kit (0.3-2) unstable; urgency=low

  * Upload to unstable.

 -- Andreas Metzler <email address hidden> Sun, 14 Aug 2011 13:08:15 +0200

p11-kit (0.3-1) experimental; urgency=low

  * Upload to Debian. (LP: #819939) Closes: #636938
  * Add watch file.
  * Convert to multi-arch:
   + configure with --libdir=\$${prefix}/lib/$(DEB_HOST_MULTIARCH), update
     *.install accordingly.
   + Bump debhelper b-d to 8.1.3 (for ${misc:Pre-Depends}).
   + runtime library is Multi-Arch: same with Pre-Depends:
     ${misc:Pre-Depends}, -bin is Multi-Arch: foreign, -dev remains
     unchanged.
  * Bump libp11-kit0 Priority to standard, libp11-kit-dev Priority to
    optional, since these are future libgnutls(-dev) rdeps.
  * [control] Drop Section setting from libp11-kit0 stanza to make lintian
    --pedantic happy.
  * Build with --disable-silent-rules.
  * Add Vcs-Svn and Vcs-Browser fields.
  * New upstream version, does not contain Apache 2.0 licensed code anymore.
  * Add info for p11-kit/pkcs11.h to debian/copyright, drop Apache 2.0 license
    bits.

 -- Andreas Metzler <email address hidden> Sun, 07 Aug 2011 18:15:10 +0200

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.17 (GNU/Linux)

iQGcBAEBCAAGBQJOnjroAAoJEN/zqzdPFvc6eRQL/RqBoRbJa3UKlUshMC+g+6eu
vA2RBl8gd1XzhhKTzJnHbF4LytDXP/jLKynJEXo8Ct84czimAnizzVm7mtQqHuYi
QNYsSIa2glDECmbncKV7cJ9MFWr5hD2n6bqBZ2GX4i3w9wV5SCZQJHrHkt3HhKyX
QZjnv2RFHwq86SDPNPS1v99vbgsptjfkfty8QFUeZe4f2YyigVP6ZTih7973f+SP
v1l32hbsoJTKGi8Ir1cLKFiSxzLRaWdGrCMTxi1FuOywbu2HfUfehwmvMEHqEG5R
7gqlR01TCwUBgprGlQYMJsiR5Sbx3+4oE5YFPaa3pMEM8TgH70RsfcA4wz6GfYT5
9HM39pI5ZNtQgxf+Tuq/e4Z/Lc6bwHRmX9rU3pYh8aeh/w+szwGl7JhdneOh48la
w6UfhnuR1j5uD0EKfXXygI7TOErmJ0CtFLX6SymtfmkbO06Xk+krb/vQQf68VVKa
DWdcy6SkHvbv4icA3E+5YtvWH9tvP7JQP6ws/zqeWQ==
=8TjS
-----END PGP SIGNATURE-----

[Micah Gersten (micahg)]

This needs sponsorship. Please don't subscribe ubuntu-archive, but rather ubuntu-sponsors.

[Anders Kaseorg (andersk)]

(Yeah, I made a typo with requestsync, sorry.)

I did a test build in my PPA, and now I get this warning whenever I use apt-get:

p11-kit: couldn't load module: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

The gnome-keyring package still puts this file at /usr/lib/pkcs11/gnome-keyring-pkcs11.so. This is what --with-module-path was for, so I guess we’ll need to preserve that.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Steve Langasek (vorlon)]

> This is what --with-module-path was for, so I guess we’ll need
> to preserve that.

Except that this should really be a per-arch search path anyway, so we should probably coordinate a transition here to the new location (using Breaks:), or else update p11-kit to support looking in both the old and new paths.

I've opened Debian bug #645959 for this so we can get the Debian maintainer's input. Anders, could you work with him to come up with an appropriate transition for this? I'm happy to sponsor the uploads.

[Steve Langasek (vorlon)]

In fact, I've gone ahead and synced p11-kit as-is. The gnome-keyring integration will be known broken until we solve the search path issue, but we have time to sort that out - it's more critical at this point to be able to install the gnutls library stack in precise for multiarch.

[Andreas Metzler (k-launchpad-downhill-at-eu-org)]

See thread starting on http://lists.freedesktop.org/archives/p11-glue/2011-October/000075.html For the time being the problem of diverging module path seems to be limited to gnome-keyring. i.e. if gnome-keyring moved the module the problem would be solved. As a workaround it might make sense to points p11-kit to to the old directory until that happens.

[Steve Langasek (vorlon)]

On Mon, Oct 24, 2011 at 05:28:04PM -0000, Andreas Metzler wrote:
> See thread starting on
> http://lists.freedesktop.org/archives/p11-glue/2011-October/000075.html
> For the time being the problem of diverging module path seems to be
> limited to gnome-keyring. i.e. if gnome-keyring moved the module the
> problem would be solved. As a workaround it might make sense to points
> p11-kit to to the old directory until that happens.

What about other consumers of pkcs11 modules? This is the point: if
/usr/lib/pkcs11 is an interface shared by multiple consumers of these
modules (meaning: if p11-kit is not the only thing which uses
gnome-keyring-module), then coordinating between gnome-keyring-module and
p11-kit is not sufficient to ensure a smooth upgrade. gnome-keyring-module
should be kept in /usr/lib/pkcs11 until *all* of the consumers have been
updated to know about the multiarch path, which means all of them should
look in both paths on at least a transitional basis.

Maybe upstream doesn't want that patch, but I think it's the right thing for
Debian and Ubuntu to do during the transition.

--
Steve Langasek Give me a lever long enough and a Free OS
Debian Developer to set it on, and I can move the world.
Ubuntu Developer http://www.debian.org/
<email address hidden> <email address hidden>

[Jeremy Bícha (jbicha)]

Current version of p11-kit in Precise is 0.10-1.

p11-kit (0.7-2) unstable; urgency=low

  * 20_path_max.diff Fix FTBFS on GNU/Hurd due to missing PATH_MAX (Thanks,
    Pino Toscano). Closes: #643601

 -- Andreas Metzler <<email address hidden> (ametzler) > Wed, 28 Sep 2011 19:22:40 +0200