cvsps chokes on servers that print more than one "M" response to "version" command

[Richard Hansen]

[Impact]

If the CVS server prints more than one "M" response line to the "version" command, cvsps (in --cvs-direct mode) prints "cvs_direct: protocol error reading version" and fails to read the repository.

For example, cvsps does not like the following exchange:

Client: version
Server: M Concurrent Versions System (CVS) 1.12.13 (client/server)
Server: M with CVSACL Patch 1.2.5 (cvsacl.sourceforge.net)
Server: ok

(Note: cvsps has been deprecated upstream in favor of cvs-fast-export, but it is still used by 'git cvsimport'.)

[Test Case]

Download and run the attached test script. The output looks like this if the installed version of cvsps has the bug:

  cvs_direct initialized to CVSROOT /foo
  cvs_direct: protocol error reading version
  ERROR: cvsps does not appear to work with multi-line version strings

and it looks like this if the bug has been fixed:

  cvs_direct initialized to CVSROOT /foo
  test passed

[Regression Potential]

No immediately obvious risks.

[Richard Hansen (rhansen)]

Attached is a debdiff that includes a patch to fix this bug.

[Richard Hansen (rhansen)]

I have uploaded fixed packages for vivid, utopic, and trusty to my PPA:
https://launchpad.net/~a7x/+archive/ubuntu/bug1413084

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "debdiff for vivid" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Brian Murray (brian-murray)]

The debdiff could use a couple of changes, the package version should not be 2.1-6build1+bug1413084.0 but rather 2.1-6ubuntu1. Additionally, it'd be good if you were to follow the patch tagging guidelines at http://dep.debian.net/deps/dep3/. This isn't as important for SRUs but is very helpful when fixing bugs in the development release and adding patches that will prevent automatic sync'ing.

[Brian Murray (brian-murray)]

Once you've made the changes I suggested I'll be happy to sponsor the patch.

[Richard Hansen (rhansen)]

Here's a revised debdiff. The diff is the same as the tip commit of the lp:~a7x/ubuntu/vivid/cvsps/bug1413084 bzr branch, which I have proposed for merging (I hope that is correct procedure...).

THANK YOU SO MUCH for sponsoring!

It would be great to SRU this. Do you think that would be acceptable? (After it has been merged into vivid, of course.)

[Brian Murray (brian-murray)]

I've uploaded this to Vivid. Yes, we can SRU this please make sure to update the bug description following http://wiki.ubuntu.com/StableReleaseUpdates.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cvsps - 2.1-6ubuntu1

---------------
cvsps (2.1-6ubuntu1) vivid; urgency=medium

  * Discard extra "M" response lines when reading the server's
    version. (LP: #1413084)
 -- Richard Hansen <email address hidden> Wed, 11 Feb 2015 12:13:52 -0800

[Richard Hansen (rhansen)]

Attached is a script that can be used to test whether cvsps has been fixed or not.

[Richard Hansen (rhansen)]

Attached is a debdiff for utopic.

[Richard Hansen (rhansen)]

Attached is a debdiff for trusty.

[Brian Murray (brian-murray)]

I've sponsored both the trusty and utopic debdiffs. Thanks for working on this!

[Chris J Arges (arges)]

Hello Richard, or anyone else affected,

Accepted cvsps into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cvsps/2.1-6ubuntu0.14.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Richard, or anyone else affected,

Accepted cvsps into utopic-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cvsps/2.1-6ubuntu0.14.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Richard Hansen (rhansen)]

I added a plain verification-done tag (in addition to verification-done-trusty and verification-done-utopic) in case there are scripts/queries that won't find this bug without it.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cvsps - 2.1-6ubuntu0.14.10.1

---------------
cvsps (2.1-6ubuntu0.14.10.1) utopic; urgency=medium

  * Discard extra "M" response lines when reading the server's
    version. (LP: #1413084)
 -- Richard Hansen <email address hidden> Wed, 11 Feb 2015 12:13:52 -0800

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for cvsps has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package cvsps - 2.1-6ubuntu0.14.04.1

---------------
cvsps (2.1-6ubuntu0.14.04.1) trusty; urgency=medium

  * Discard extra "M" response lines when reading the server's
    version. (LP: #1413084)
 -- Richard Hansen <email address hidden> Wed, 11 Feb 2015 12:13:52 -0800