Ubuntu

Please convert gnome-keyring to multiarch

Reported by Riku Voipio on 2011-09-26
446
This bug affects 180 people
Affects Status Importance Assigned to Milestone
gnome-keyring (Debian)
New
Unknown
gnome-keyring (Ubuntu)
High
Adam Stokes
Precise
High
Adam Stokes
Quantal
Undecided
Unassigned
Raring
High
Adam Stokes

Bug Description

[Impact]
Several applications are relying on this package as seen in comments 5 and 6.

[Test case]
Attempt to install both i386/amd64 versions of libp11-kit-gnome-keyring and preferably verify if the reported applications in this bug are able to run successfully.

1. Run the command 'wine notepad'. Notice the warning from p11-kit.
2. sudo apt-get install libp11-kit-gnome-keyring:i386
3. Run the command 'wine notepad' again. Notice that the warning is gone.

[Regression Potential]
Minimal, several rdepends build testing have been completed successfully and nothing in the keyring code is attempting to dlopen any hardcoded library paths.

gnome-keyring is still installing libraries to /usr/lib instead of the multarch compatible /usr/lib/$(DEB_HOST_MULTIARCH) directory. The attached patch does the conversion.

Riku Voipio (riku-voipio) wrote :
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu):
status: New → Confirmed
dino99 (9d9) wrote :

Actual xsession-error logged on Precise i386:

WARNING: gnome-keyring:: couldn't connect to: /tmp/keyring-qTq8ls/pkcs11: no such file or directory
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh
GNOME_KEYRING_CONTROL=/tmp/keyring-qTq8ls
GPG_AGENT_INFO=/tmp/keyring-qTq8ls/gpg:0:1
SSH_AUTH_SOCK=/tmp/keyring-qTq8ls/ssh

but this path exist and owned by user (with -rwxrwxr-x rights for pkcs11 file, and drwx------ for the folder). The files: control, gpg, pkcs11 & ssh are all 0 bit long.
So i'm wondering about a timing race.

dino99 (9d9) on 2012-04-29
tags: added: precise
Paweł Buglewicz (illmoded) wrote :

precise;
making a symbolic link doesn't help

Tommy Vestermark (tov) wrote :

It seems this package (and dependencies) must be available as a 'gnome-keyring:i386' to get the Limbo game working. See https://bugs.launchpad.net/ubuntu/+bug/1008066

Pretty Please fix :-)

Changed in gnome-keyring (Ubuntu Precise):
milestone: none → ubuntu-12.04.1
Changed in gnome-keyring (Ubuntu):
importance: Undecided → High
Changed in gnome-keyring (Ubuntu Precise):
importance: Undecided → High
status: New → Triaged
Changed in gnome-keyring (Ubuntu):
status: Confirmed → Triaged
Changed in gnome-keyring (Ubuntu Precise):
assignee: nobody → Adam Stokes (adam-stokes)
Changed in gnome-keyring (Ubuntu Precise):
milestone: ubuntu-12.04.1 → ubuntu-12.04.2
description: updated
Changed in gnome-keyring (Ubuntu Precise):
status: Triaged → In Progress
Scott Ritchie (scottritchie) wrote :

Is this still in progress? Is it deferred to after Quantal release? (Quantal needs it too I believe)

I've got some Wine apps in the wild that are breaking cause of it (see linked duplicate bugs), plus the aforementioned apps in this report.

Adam Stokes (adam-stokes) wrote :

This is on my radar to do but will probably make it in Quantal updates at a later date. I should have some free cycles next week to look more into this issue.

Thank you for your patience
Adam

Adam Stokes (adam-stokes) wrote :

rdeps testing

gksu_2.0.2-6ubuntu2-amd64-20121015-1720:Status: successful
gnome-python-desktop_2.32.0+dfsg-2ubuntu1-amd64-20121015-1724:Status: successful
gnome-session_3.6.0-0ubuntu1-amd64-20121015-1729:Status: successful
gvfs_1.14.0-0ubuntu6-amd64-20121015-1733:Status: successful
seahorse_3.6.0-0ubuntu1-amd64-20121015-1740:Status: successful
ubuntu-sso-client_4.0.0-0ubuntu1-amd64-20121015-1746:Status: attempted
virt-manager_0.9.3-1ubuntu2-amd64-20121015-1749:Status: successful

---
This is the error with ubuntu-sso

Traceback (most recent call last):
  File "setup.py", line 328, in <module>
    **extra)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 98, in setup
    __requires(attrs, src_all)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 470, in __requires
    __add_imports(imports, s, attrs)
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 404, in __add_imports
    if alias.name and __external_mod(cur_module, alias.name, attrs):
  File "/usr/lib/python2.7/dist-packages/DistUtilsExtra/auto.py", line 353, in __external_mod
    mod = __import__(cur_module + '.' + module)
  File "/«PKGBUILDDIR»/ubuntu_sso/main/__init__.py", line 41, in <module>
    from ubuntu_sso import utils
  File "/«PKGBUILDDIR»/ubuntu_sso/utils/__init__.py", line 44, in <module>
    from ubuntu_sso.logger import setup_logging
  File "/«PKGBUILDDIR»/ubuntu_sso/logger.py", line 48, in <module>
    os.makedirs(unicode_path(LOGFOLDER))
  File "/usr/lib/python2.7/os.py", line 150, in makedirs
    makedirs(head, mode)
  File "/usr/lib/python2.7/os.py", line 150, in makedirs
    makedirs(head, mode)
  File "/usr/lib/python2.7/os.py", line 157, in makedirs
    mkdir(name, mode)
OSError: [Errno 13] Permission denied: '/sbuild-nonexistent'
dh_auto_build: python setup.py build --force returned exit code 1
make: *** [build] Error 1
dpkg-buildpackage: error: debian/rules build gave error exit status 2
Sessions still open, not unmounting
────────────────────────────────────────────────────────────────────────────────
Build finished at 20121015-1749

Thanks

description: updated
Changed in gnome-keyring (Ubuntu):
assignee: nobody → Adam Stokes (adam-stokes)
milestone: none → quantal-updates
Changed in gnome-keyring (Debian):
status: Unknown → New
karpa (k-valhalla-age) wrote :

svn also affected:
karp@karp:~/tmp/prj$ svn up
p11-kit: couldn't load module: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/x86_64-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory
after upgrade from 11.10 to 12.04

Adam Stokes (adam-stokes) wrote :

Thanks I'm going to do a precise diff today so sponsors team can look at them both.

Adam

Changed in gnome-keyring (Ubuntu):
status: Triaged → In Progress
Changed in gnome-keyring (Ubuntu):
milestone: quantal-updates → none
Adam Stokes (adam-stokes) wrote :

Packaging changes from precise 3.2 to quantal/raring 3.6.0 will take me some more time to get sorted out for mult-arch.

Changed in gnome-keyring (Ubuntu Precise):
milestone: ubuntu-12.04.2 → precise-updates
Luke Yelavich (themuso) wrote :

Your diff for raring doesn't appear to add gnome-keyring-bin as a dependency fo gnome-keyring. I'd add this myself, but there may be a better way to go about this, and you would need to make the same change for precise and quantal as well.

Unsubscribing ubuntu-sponsors for now, please re-subscribe when this is fixed up.

Changed in gnome-keyring (Ubuntu Raring):
status: In Progress → New
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu Quantal):
status: New → Confirmed
Changed in gnome-keyring (Ubuntu):
status: New → Confirmed
Steffen Neumann (sneumann) wrote :

Hi, for me the dirty workaround was to download the gnome-keyring_3.2.2-2ubuntu4_i386.deb
from https://launchpad.net/ubuntu/precise/i386/gnome-keyring, and extract just
/usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so and drop it into the right place.
Yours, Steffen

Emmanuel Cron (emmanuel-cron) wrote :

Didn't work for me as Spotify still isn't able to validate server certificate:
err:ole:marshal_object couldn't get IPSFactory buffer for interface {00000131-0000-0000-c000-000000000046}
err:ole:marshal_object couldn't get IPSFactory buffer for interface {00000122-0000-0000-c000-000000000046}
err:ole:StdMarshalImpl_MarshalInterface Failed to create ifstub, hres=0x80040155
err:winhttp:netconn_secure_connect couldn't verify server certificate (12045)

Rodney Dawes (dobey) wrote :

I don't think the two proposed debdiffs here are correct for implementing multi-arch for gnome-keyring. While the plug-ins for gnome-keyring itself, and the pam module, could be built as multi-arch, it isn't necessary to do so. In fact, building the gnome-keyring plug-ins (currently in usr/lib/gnome-keyring/devel/*.so) into a Multi-Arch: same package, will result in a broken install if the :i386 package is installed on an x86_64 system, for example, as the gnome-keyring binary package is marked as foreign. Also, there are many non-arch-dependent files left in the gnome-keyring package, which are not installed in arch-dependent directories, resulting in file conflicts between the i386 and x86_64 versions of the package.

Rodney Dawes (dobey) wrote :

This is a better patch to add multi-arch support for gnome-keyring. It moves the p11-kit module to a new package, moves the pam module to multi-arch, and correctly marks the gnome-keyring package as multi-arch foreign, as it includes the main binary, and data files.

Please be sure to doublecheck compatibilty with p11-kit 0.14 which requires a .module extension for PKCS#11 autoloading while you are making large changes to this package.

Rodney Dawes (dobey) wrote :

Andreas, that seems like it should be a separate patch, and something that should go upstream in GNOME (and possibly is already fixed there), while this multiarch patch currently only affects the packaging.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-keyring - 3.6.2-0ubuntu2

---------------
gnome-keyring (3.6.2-0ubuntu2) raring; urgency=low

  * debian/control:
    - Move the PKCS#11 module into a separate package. (LP: #1094319)
    - Convert to use multi-arch. (LP: #859600)
  * debian/gnome-keyring.install, debian/libp11-kit-gnome-keyring.*:
    - The pkcs11 module needs to be a separate package.
  * debian/libpam-gnome-keyring.install, debian/rules:
    - Use the multi-arch directory for the PAM module.
 -- Rodney Dawes <email address hidden> Mon, 07 Jan 2013 15:03:31 -0500

Changed in gnome-keyring (Ubuntu Raring):
status: Confirmed → Fix Released
Scott Ritchie (scottritchie) wrote :

64-bit Wine no longer throws an error message every time it runs with new libp11-kit-gnome-keyring:i386 package installed. Thanks!

TomasHnyk (sup) wrote :

Is this going to be fixed for quantal too?

torzsmokus (torzsmokus) wrote :

What about precise (said to be LTS)?

Tuomas Lähteenmäki (lahtis) wrote :

please fix for ubuntu 12.10 also, i have same bug for 1.5.27 wine versions too.

Adam Stokes (adam-stokes) wrote :

I apologize for the delay, all debdiffs are uploaded and proper teams subscribed. I'll check back on its progress next week and push harder for review if not done by next Wednesday.

Thanks
Adam

Adam Stokes (adam-stokes) wrote :

s/uploaded/attached to bug/

Dmitry Shachnev (mitya57) wrote :

Thanks for the patch, I have two comments about it though:

- d/control is autogenerated, please modify d/control.in instead;
- shouldn't "usr/bin" be removed from gnome-keyring.install now that you moved it to -bin package?

Adam Stokes (adam-stokes) wrote :

> - d/control is autogenerated, please modify d/control.in instead;

I only altered control.in, however, I believe d/control was auto-updated during the source package build.

> - shouldn't "usr/bin" be removed from gnome-keyring.install now that you moved it to -bin package?

Nice catch Ill fix that up and re-submit.

Thanks
Adam

Adam Stokes (adam-stokes) wrote :

Should be fix in precise debdiff now

Rodney Dawes (dobey) wrote :

Why are you making debdiffs against an older gnome-keyring package, that are incompatible with the changes already in raring?

Adam Stokes (adam-stokes) wrote :

My bad, was on autopilot for a moment. The other's still apply I believe.

Thanks
Adam

Rodney Dawes (dobey) wrote :

The quantal debdiff you posted is against an older version as well, as is the precise version. Also, if the proposed debdiffs were pushed out as updates on those platforms, it would break upgrades to the newer Ubuntu versions, as the changes are incompatible.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/08/2013 11:02 AM, Rodney Dawes wrote:
> The quantal debdiff you posted is against an older version as well,
> as is the precise version. Also, if the proposed debdiffs were
> pushed out as updates on those platforms, it would break upgrades
> to the newer Ubuntu versions, as the changes are incompatible.
>
Ok ill fix it, Thanks!

- --
Adam Stokes
<email address hidden>
"Don't salt your green beans before you try them,
 some may think you make rash decisions."
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJRYt7UAAoJEBDHSpCZCC2fLWwIAIsybj/QDJmv2xhFqRRQWlF+
sxnR15CtIc1ibU8MLKfR3XIFBTJQbXuWu1eRjQA2t1aDNmKwRrhek9uboTvLlOsJ
2IivsQH/wDscvT5InSiGN0y+0I4pWnfNC6zkoGKxJj3o0S5RfGGpIDSIXHSKW+2T
dpibpVy+thpaV15+O+a+CFKOUOBNmYtbCHvl4AL8aAdrepVeurMQ4GMe2eqSuwnZ
2jMUx8eKe701bTNB0jUAiFY9ODbeGnb2uHSjzNKnFYk/TM3uW+TShs2FyizlNBTc
q9dISHyoiBb6LnSkm8nN/S2VOM0TuUmuAB9f/ZbdrZ2J90GI2gte41FDY7loACs=
=nnBB
-----END PGP SIGNATURE-----

Rodney Dawes (dobey) wrote :

Here's a debdiff for Quantal with the same changes that are in Raring already.

Adam Stokes (adam-stokes) wrote :

Hopefully these dont suck :)

Thanks!
Adam

Rodney Dawes (dobey) wrote :

Looks like you are pulling the gnome-keyring from the release pocket, and not from -proposed, as should be. So you now just applied my changes to the release packages, rather than the updated versions that were released on Quantal/Precise. See the Quantal backport patch I attached for the appropriate changes to the latest version on Quantal.

jhansonxi (jhansonxi) wrote :

I'm unsure if an updated package has been released for Ubuntu 12.04 (Precise Pangolin) yet but the currently available version of gnome-keyring:i386 is not installable due to libgcr-3-common not being multiarch (bug #998715).

Adam Stokes (adam-stokes) wrote :

Thanks jhansonxi,

I'll see about getting libgcr multiarch this week.

Adam

Rodney Dawes (dobey) wrote :

You wouldn't be able to install gnome-keyring:i386 on x86_64 with these changes in raring either even, without replacing a very large portion of the system with the 32-bit packages. Nor do I see any reason why one would ever want to, either. There's no reason do that.

Changed in gnome-keyring (Ubuntu Quantal):
status: Confirmed → In Progress
Martin Pitt (pitti) wrote :

At this point I think we can say that a quantal SRU is out of scope now. Precise has a longer life-time, so keeping that one open.

Changed in gnome-keyring (Ubuntu Quantal):
status: In Progress → Won't Fix
Rodney Dawes (dobey) wrote :

@Martin, Quantal is still supported for almost a full 12 months more. Is it really out of scope to push SRUs to it after only 6 months in? If this were Raring, and there were only a couple months left of support, then I would agree it might be out of scope to push such a change. But given the work here is done, I don't see a good reason to not push it, unless something is actually broken, which I doubt, given the same changes are included in Raring already, and it works fine there. :)

Hello Riku, or anyone else affected,

Accepted gnome-keyring into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/gnome-keyring/3.2.2-2ubuntu4.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in gnome-keyring (Ubuntu Precise):
status: In Progress → Fix Committed
tags: added: verification-needed
eraserix (eraserix) wrote :

Looks odd, this is gnome-keyring 3.2.2, but libp11-kit-gnome-keyring has in the d/control:
Breaks: gnome-keyring (<< 3.6.2-0ubuntu2~)
Replaces: gnome-keyring (<< 3.6.2-0ubuntu2~)

This two should contain the version of THIS package, e.g. 3.2.2-2ubuntu4.2.

eraserix (eraserix) wrote :

And for coinstalling x86_64 and i386 variants, see below. I've added proposed as suggested in https://wiki.ubuntu.com/Testing/EnableProposed.

# sudo apt-get install gnome-keyring:i386/precise-proposed
Reading package lists... Done
Building dependency tree
Reading state information... Done
Selected version '3.2.2-2ubuntu4.2' (Ubuntu:12.04/precise-proposed [i386]) for 'gnome-keyring:i386'
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 gnome-keyring:i386 : Depends: libcap-ng0:i386 but it is not going to be installed
                      Depends: libgck-1-0:i386 (>= 2.91.1) but it is not going to be installed
                      Depends: libgcr-3-1:i386 (>= 3.2.2) but it is not going to be installed
                      Depends: libcap2-bin:i386 but it is not going to be installed
                      Recommends: libp11-kit-gnome-keyring:i386 but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Adam Conrad (adconrad) wrote :

Removed from precise-proposed due to the above regression. Please fix and reupload with a bumped version number.

tags: added: verification-failed
removed: verification-needed
Adam Conrad (adconrad) on 2013-06-05
Changed in gnome-keyring (Ubuntu Precise):
status: Fix Committed → In Progress
Didier Roche (didrocks) wrote :

Please resuscrbibe the sponsoring team once fixed. Thanks :)

eraserix (eraserix) wrote :

Looks like sid has quite a bit of changes to gnome-keyring compared with what's in precise, but multiarch is not one of them. However, the wine version in sid does not seem to suffer this problem with the library. 'wine notepad' only gives me an error in precise, but not in sid. sid has wine 1.4.1.

eraserix (eraserix) wrote :

Why change pam/gnome-keyring to mutliarch if it would be enough to just split of the pkcs11 package and make it multiarch?

Rodney Dawes (dobey) wrote :

@eraserix have you looked at the diff? That's exactly what is done in 13.04, and what the diff is meant to backport to the older releases..

Yes, I did. But I don't see why gnome-keyring is marked as Multi-Arch:
foreign and libpam-gnome-keyring is converted to Mutli-Arch: same. As
I see it, it is sufficient to make 'libp11-kit-gnome-keyring' as
Multi-Arch: same and be done with it. To resolve the warning from wine
you would have to explicitly install the new libp11-kit package for
i386. I hope I'll get around to posting a working patch for 12.04
later today.

BTW, how is the new libp11-kit-gnome-keyring supposed to find it's way
to the affected users? Will wine declare a dependency on
libp11-kit-gnome-keyring:i386 or something?

On Mon, Jun 24, 2013 at 2:14 AM, Rodney Dawes <email address hidden> wrote:
> @eraserix have you looked at the diff? That's exactly what is done in
> 13.04, and what the diff is meant to backport to the older releases..
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/859600
>
> Title:
> Please convert gnome-keyring to multiarch
>
> Status in “gnome-keyring” package in Ubuntu:
> Fix Released
> Status in “gnome-keyring” source package in Precise:
> In Progress
> Status in “gnome-keyring” source package in Quantal:
> Won't Fix
> Status in “gnome-keyring” source package in Raring:
> Fix Released
> Status in “gnome-keyring” package in Debian:
> New
>
> Bug description:
> [Impact]
> Several applications are relying on this package as seen in comments 5 and 6.
>
> [Test case]
> Attempt to install both i386/amd64 versions and preferably verify if the reported applications in this bug are able to run successfully
>
> [Regression Potential]
> Minimal, several rdepends build testing have been completed successfully and nothing in the keyring code is attempting to dlopen any hardcoded library paths.
>
> gnome-keyring is still installing libraries to /usr/lib instead of the
> multarch compatible /usr/lib/$(DEB_HOST_MULTIARCH) directory. The
> attached patch does the conversion.
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/gnome-keyring/+bug/859600/+subscriptions

Graham Inggs (ginggs) wrote :

@eraserix: gnome-keyring is marked Multi-Arch: foreign so that, for example, an amd64 gnome-keyring can satisfy an i386 package's dependency on it.

The version numbers in Breaks and Replaces look wrong to me too.

As jhansonxi wrote in comment 48, libp11-kit-gnome-keyring:i386 won't be installable until gcr is multi-arch.

eraserix (eraserix) wrote :

So, my take ;). This patch just splits the pkcs11 library away from gnome-keyring binary package and leaves the rest of the packages alone.

I still don't see the use case for doing more, the warning when wine is started will be gone with this patch. And as far as I can tell, libgcr is still not multiarch on raring.

For the testcase, I'd say this should be something like that:
[Test case]
(on an amd64 system)
1. Run the command 'wine notepad'. Notice the warning from p11-kit.
2. sudo apt-get install libp11-kit-gnome-keyring:i386
3. Run the command 'wine notepad' again. Notice that the warning is gone.

Graham Inggs (ginggs) wrote :

I also had a go at this today. :)

I built a gnome-keyring package for Precise in my PPA:
https://launchpad.net/~ginggs/+archive/sru

It is adam-stokes' last attempt plus the following changes:
    - Change gnome-keyring's Recommends on libp11-kit-gnome-keyring
      to Depends.
    - Change libp11-kit-gnome-keyring's Breaks and Replaces on
      gnome-keyring to (<< ${binary:Version}).

@eraserix: I agree that installing libp11-kit-gnome-keyring:i386 is correct for the test case, not gnome-keyring:i386 as it contains the executables and is not co-installable.

Graham Inggs (ginggs) wrote :

@eraserix: as for how is the new libp11-kit-gnome-keyring supposed to find it's way
to the affected users?

Both wine and cups got updates in Raring to Recommends and Depends the new libp11-kit-gnome-keyring respectively:

wine1.4 (1.4.1-0ubuntu5) raring; urgency=low

  * Add new libp11-kit-gnome-keyring package to recommends
    - Should fix a few apps (LP: #859600)

 -- Scott Ritchie <email address hidden> Tue, 12 Feb 2013 17:12:01 -0800

cups (1.6.2-1ubuntu2) raring; urgency=low

  * debian/control: Added libp11-kit-gnome-keyring to the dependencies of
    the cups-binary package (LP: #1157904).

 -- Till Kamppeter <email address hidden> Wed, 20 Mar 2013 19:58:01 +0100

I guess these will need to be SRU'd as well.

I'm still inclined to have gnome-keyring Depends on libp11-kit-gnome-keyring, at least for these SRUs.

Scott Ritchie (scottritchie) wrote :

Yes, I've been holding back on a Wine SRU because I wanted it to integrate this fix.

Similarly, I will also want to backport wine1.6 to precise when it releases within a few weeks, and it would be very nice to have this done by then.

eraserix (eraserix) on 2013-06-25
description: updated
eraserix (eraserix) wrote :

I've updated the description with more specific instructions on how to test this SRU.

As for Depends vs Recommends from debian policy manual:
The Depends field should be used if the depended-on package is required for the depending package to provide a significant amount of functionality.

The Recommends field should list packages that would be found together with this one in all but unusual installations.

I'm kind of inclined to stay with recommends. I can still store passwords in the keyring without the pkcs11 library, no?

@graham: Thanks for the info about how the new multiarched package finds its way to the users.

Graham Inggs (ginggs) wrote :

For the gnome-keyring package to be considered multi-arch in Precise, surely libgck and libgcr need to be multi-arch as well?
Then we can close LP: #998715 for Precise in this SRU.

My other concern is what will happen when someone picks up libp11-kit-gnome-keyring in Precise and then upgrades to Quantal?
Quantal's gnome-keyring will overwrite libp11-kit-gnome-keyring because its Breaks and Replaces are on a lower version of gnome-keyring. If this gets SRU'd for Precise, surely it must get SRU'd for Quantal as well?

eraserix (eraserix) wrote :

So, the solution imagined here is not to fix the two duplicates of this bug, but to introduce a new feature, namely make every library in gnome-keyring multiarch? What's to be gained by this?

Rodney Dawes (dobey) wrote :

OK. Everyone, just relax. First of all, this bug is not for the p11kit issue. That bug is #1094319 as clearly mentioned in the changelog entry. This bug is specifically about enabling Multi-Arch for the gnome-keyring source package, so that some of its binaries may be co-installable as needed. While I had fixed both bugs at the same time in Raring, they are not the same issue.

And on top of that, the gcr source package being converted to Multi-Arch is another separate issue. Please do not conflate them all into being the same bug. They are separate issues, even if they have dependencies on one another.

The update issue is another issue on top of those, which will also need to be carefully considered, and which means all of these fixes will need to be SRUed into Quantal first, indeed. Or we simply maintain the status quo in Precise and Quantal for these 3 issues, as it is a non-fatal issue, and only a slight annoyance, only when using certain software which requires use of 32-bit pieces while running on 64-bit. I see no good reason to force N complex updates upon the user base, to fix a very minor annoyance (which isn't this bug anyway).

Graham Inggs (ginggs) wrote :

I've built another gnome-keyring package for Precise in my PPA that I hope fixes all three issues (multi-arch gnome-keyring, multi-arch gcr and split libp11-kit-gnome-keyring).

The test case (on an x86_64 system) would be something like:

$ wine notepad
You should see the error message:
p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

$ sudo apt-get install libp11-kit-gnome-keyring:i386
$ wine notepad
The p11kit error no longer appears.

$ sudo apt-get install libgcr-3-1:i386
The following packages are installed: libgck-1-0:i386 libgcr-3-1:i386 and libgcr-3-common

I can attach a debdiff if needed.

Scott Ritchie (scottritchie) wrote :

To be clear the error message isn't the annoyance part, it's that it's a real error that does prevent some apps from running (and there's no way to make them run on 64-bit at all in current precise).

eraserix (eraserix) wrote :

@graham: I think the usual way to do this is that you crate a debdiff to the current version in precise. Attach it to this bugreport and subscribe ubuntu-sponsors when done. Name/Version of the patch should be something like that:

gnome-keyring_3.2.2-2ubuntu4.3.precise.debdiff

Graham Inggs (ginggs) wrote :

I will be able to work on this and gcr again in a couple of days' time. Hopefully early next week I'll attach debdiffs.
In the meantime, you are welcome to test gnome-keyring from my PPA.

Graham Inggs (ginggs) wrote :

This is Rodney's Quantal patch from comment #41 with the following changes:
The gnome-keyring package depends on libp11-kit-gnome-keyring instead of recommends.
The libp11-kit-gnome-keyring package now breaks and replaces gnome-keying (<< ${binary:Version}).

I believe this needs to be fixed in Quantal before it can be fixed in Precise so that the upgrade path is not broken.

Graham Inggs (ginggs) wrote :

This patch for Precise includes the same changes as in the Quantal patch above, and includes the multi-arch changes in the gcr package from Saucy ( see LP: #859600).

Graham Inggs (ginggs) wrote :

Marking 'new' in Quantal and Precise.

Changed in gnome-keyring (Ubuntu Precise):
status: In Progress → New
Changed in gnome-keyring (Ubuntu Quantal):
status: Won't Fix → In Progress
Dimitri John Ledkov (xnox) wrote :

@Adam Conrad (adconrad)
Updated SRU uploaded into precise-proposed queue.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in gnome-keyring (Ubuntu Precise):
status: New → Confirmed
Michael Terry (mterry) wrote :

OK, quick update on status for Quantal and Precise. The Quantal patch was never uploaded to the archive. The Precise patch was uploaded by xnox, but was rejected because of the ${binary:Version} issue below.

I've just uploaded a modified patch from comment 75 to Quantal only. I'd like to get Quantal landed before doing Precise, because as people have mentioned, the upgrade path gets complicated otherwise.

Here are the changes I made to Graham's Quantal patch:
- You shouldn't specify Breaks or Replaces lines with automatically generated versions like ${binary:Version}. This means that every time the package is built, it will say it breaks previous versions. Instead, just hardcode the version that you put in debian/changelog.
- When using DEB_HOST_MULTIARCH, please also make sure to manually set it [1] as recommended in the multiarch conversion doc [2]. This is because while normally the buildd will set it for us, it's not a requirement. For example, when dep8 tests rebuild the source, the variable is not set for us. Not likely an issue in practice , but still good to do.
- No need for quantal-proposed in the changelog entry. You can just say quantal now and LP will do the right thing. Minor point, but just saying.
- No need to manually add multiarch-support to the Pre-Depends line. It comes in via the ${misc:Pre-Depends} bit. Again, minor point.

So let's see how the Quantal upload goes.

[1] DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
[2] https://wiki.debian.org/Multiarch/Implementation

Hello Riku, or anyone else affected,

Accepted gnome-keyring into quantal-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/gnome-keyring/3.6.1-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in gnome-keyring (Ubuntu Quantal):
status: In Progress → Fix Committed
tags: removed: verification-failed
tags: added: verification-needed
Graham Inggs (ginggs) wrote :

I ran 'wine notepad' and saw the following:

p11-kit: couldn't load module: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: /usr/lib/i386-linux-gnu/pkcs11/gnome-keyring-pkcs11.so: cannot open shared object file: No such file or directory

I installed gnome-keyring and libp11-kit-gnome-keyring:i386 from quantal-proposed.
I ran 'wine notepad' again and did not see the p11-kit warning.

tags: added: verification-done
removed: verification-needed
Graham Inggs (ginggs) wrote :

@mterry: thanks for the fixes and the upload.

I can update my patch for precise, but as it stands, it also converts gcr, which was split out of gnome-keyring into its own package in quantal, to multiarch.
Before we can convert gnome-keyring (including gcr) to multiarch in precise, we would first need to convert gcr to multiarch in raring and quantal, see LP: #998715.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package gnome-keyring - 3.6.1-0ubuntu1.1

---------------
gnome-keyring (3.6.1-0ubuntu1.1) quantal; urgency=low

  * Backport the following changes from gnome-keyring in Raring:
    - Move the PKCS#11 module into a separate package. (LP: #1094319)
    - Convert gnome-keyring to multi-arch. (LP: #859600)
 -- Graham Inggs <email address hidden> Sat, 06 Jul 2013 11:07:07 +0200

Changed in gnome-keyring (Ubuntu Quantal):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for gnome-keyring has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

eraserix (eraserix) wrote :

Is it really still important to be able to upgrade from 12.04 to 12.10? 12.04 is supported for 3 more years, 12.10 for something like a month. Once 14.04 is out, you will be able to upgrade from 12.04 directly.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.