[22.04 FEAT] [LDP2025] Upgrade openssl-ibmca to latest version (crypto) (2.2.1)

[bugproxy]

Upgrade to newest version of openssl-ibmca v 2.2.1

Available here: https://github.com/opencryptoki/openssl-ibmca/

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Frank Heimes (fheimes)]

I've created a debdiff for the new version.

[Frank Heimes (fheimes)]

I've also compiled the new package successfully using this PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp1958419

[Frank Heimes (fheimes)]

I did a local build incl. test runs and got the following results:
============================================================================
Testsuite summary for openssl-ibmca 2.2.1
============================================================================
# TOTAL: 34
# PASS: 27
# SKIP: 2
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 5
============================================================================
See test/test-suite.log
Please report to <email address hidden>

I checked these results with upstream and got the information that:
1) the des and 3des errors are known with openssl 3.0
   the config should load the legacy provider here,
   since openssl 3 sees des and 3des as deprecated
   and moved it to the legacy-provider
2) the fact that loadtest and threadtest got skipped is due to our outdated (crypto) hardware

So this is expected (and similar to a test run with the previous version 2.2.0).

[Simon Chopin (schopin)]

Nice work. I'll try to fix the tests and fully enable them at build time, then if I succeed I'll upload the result to the archive. However, I'd rather not upload a package with known test failures.

[bugproxy (bugproxy)]

https://launchpad.net/~fheimes/+archive/ubuntu/1958419

[Simon Chopin (schopin)]

OK, so I've managed to fix *most* of the tests, but the 3DES-ECB one still fails. I'm still investigating it, but the investigation is a bit slow due to having to go through a PPA every time I change something :)

I'm using https://launchpad.net/~schopin/+archive/ubuntu/test-ppa/+packages for those following at home.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2022-01-24 06:22 EDT-------
For the DES tests, you can simply skip them with openssl 3.0. The 3des-ecb for some reason unknown to me needs an iv with openssl 3.0 just to ignore it. But if it is not there, openssl 3.0 complains. I am in the process of fixing this and also incorporate some changes regarding the configuration update process and the recently release libica version 4.0.

[Frank Heimes (fheimes)]

Oh, theer is also a new libica (4.0), guess we need to have a look at it ...

[Simon Chopin (schopin)]

Uploaded this version with the 3DES-EBC test disabled.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openssl-ibmca - 2.2.1-0ubuntu1

---------------
openssl-ibmca (2.2.1-0ubuntu1) jammy; urgency=medium

  * New upstream release. LP: #1958419

  [Simon Chopin]
  * d/p/testconf-openssl3.patch: fix the test suite against OpenSSL 3.0
  * d/p/disable-3des-ecb-test.patch: Temporarily disable a failing test
  * d/rules: make the build fail if the tests fail

 -- Frank Heimes <email address hidden> Thu, 20 Jan 2022 15:44:47 +0100