qemu 1.7 should build-depend on libfdt-dev higher than 1.4.0

Bug #1295072 reported by Ballock on 2014-03-20
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
device-tree-compiler (Debian)
Fix Released
Unknown
device-tree-compiler (Ubuntu)
High
Unassigned
Precise
High
Unassigned
Quantal
High
Unassigned
Trusty
Undecided
Unassigned
qemu (Ubuntu)
Low
Unassigned
Precise
Undecided
Unassigned
Quantal
Undecided
Unassigned
Trusty
Undecided
Unassigned

Bug Description

==================================
Impact: libfdt-dev is unusable
Fix: we use the patch from debian wheezy to export the needed .h file.
Test case: download qemu package from trusty, remove the "<< 1.4.0" versioning from the libfdt-dev dependency, and try to build
Regression Potential there should be none, we simply export another .h file.
==================================

The configure scripts checks for fdt by looking at libfdt_env.h

configure:2610: #include <libfdt_env.h>

This file only exists in libfdt-dev version 1.4.0 and onwards, so it makes sense to specify build-dependency on that version. Otherwise, configure fails with:
    error_exit "DTC not present. Your options:" \
        " (1) Preferred: Install the DTC devel package" \
        " (2) Fetch the DTC submodule, using:" \
        " git submodule update --init dtc"

Ballock (ballock) on 2014-03-20
summary: - qemu 1.7 depends on libfdt higher than 1.4.0
+ qemu 1.7 build-depends on libfdt higher than 1.4.0
summary: - qemu 1.7 build-depends on libfdt higher than 1.4.0
+ qemu 1.7 shoudl build-depend on libfdt-dev higher than 1.4.0
summary: - qemu 1.7 shoudl build-depend on libfdt-dev higher than 1.4.0
+ qemu 1.7 should build-depend on libfdt-dev higher than 1.4.0
Robie Basak (racb) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Trusty only ships qemu 1.7 and libfdt-dev 1.4, and the libfdt-dev in Saucy was also 1.4. So I'm not sure this should be necessary. But I don't see any harm in it, so I'll leave it to somebody closer to these packages to decide.

Changed in qemu (Ubuntu):
importance: Undecided → Medium
Serge Hallyn (serge-hallyn) wrote :

I'd like to keep debian/control as in-sync as possible with debian. So I'd
prefer that this be done through debian. Since this won't change the
availability of libfdt > 1.4.0 in older releases, I don't see that this really
helps.

Can you please explain what you are trying to do, where and how you
are building qemu?

Changed in qemu (Ubuntu):
status: New → Incomplete

It was a minor glitch I noticed during backporting qemu 1.7 to precise.

It's more like an FYI, I managed to get this running myself. If you feel
it's wrong to specify the exact version requirement, that's fine, let's
forget it.

Cheers,
Ballock

2014-03-20 15:49 GMT+01:00 Serge Hallyn <email address hidden>:

> I'd like to keep debian/control as in-sync as possible with debian. So I'd
> prefer that this be done through debian. Since this won't change the
> availability of libfdt > 1.4.0 in older releases, I don't see that this
> really
> helps.
>
> Can you please explain what you are trying to do, where and how you
> are building qemu?
>
> ** Changed in: qemu (Ubuntu)
> Status: New => Incomplete
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1295072
>
> Title:
> qemu 1.7 should build-depend on libfdt-dev higher than 1.4.0
>
> Status in "qemu" package in Ubuntu:
> Incomplete
>
> Bug description:
> The configure scripts checks for fdt by looking at libfdt_env.h
>
> configure:2610: #include <libfdt_env.h>
>
> This file only exists in libfdt-dev version 1.4.0 and onwards, so it
> makes sense to specify build-dependency on that version. Otherwise,
> configure fails with:
> error_exit "DTC not present. Your options:" \
> " (1) Preferred: Install the DTC devel package" \
> " (2) Fetch the DTC submodule, using:" \
> " git submodule update --init dtc"
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/1295072/+subscriptions
>

Serge Hallyn (serge-hallyn) wrote :

Thanks - this'll bite the cloud archives as well so let's go ahead and make the change. I will make the change in the ubuntu-virt/candidate ppa first, so it will land in trusty when qemu 2.0 goes into the archive.

Changed in qemu (Ubuntu):
status: Incomplete → Confirmed
importance: Medium → Low
Changed in qemu (Ubuntu):
status: Confirmed → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package qemu - 2.0.0~rc1+dfsg-0ubuntu1

---------------
qemu (2.0.0~rc1+dfsg-0ubuntu1) trusty; urgency=medium

  * Merge 2.0.0-rc1
  * debian/rules: consolidate ppc filter entries.
  * Move qemu-system-arch64 into qemu-system-arm
  * debian/patches/define-trusty-machine-type.patch: define a trusty machine
    type, currently the same as pc-i440fx-2.0, to put is in a better position
    to enable live migrations from trusty onward. (LP: #1294823)
  * debian/control: build-dep on libfdt >= 1.4.0 (LP: #1295072)
  * Merge latest upstream git to commit dc9528f
  * Debian/rules:
    - remove -enable-uname-release=2.6.32
    - don't make the aarch64 target Ubuntu-specific.
  * Remove patches which are now upstream:
    - fix-smb-security-share.patch
    - slirp-smb-redirect-port-445-too.patch
    - linux-user-Implement-sendmmsg-syscall.patch (better version is upstream)
    - signal-added-a-wrapper-for-sigprocmask-function.patch
    - ubuntu/signal-sigsegv-protection-on-do_sigprocmask.patch
    - ubuntu/Don-t-block-SIGSEGV-at-more-places.patch
    - ubuntu/ppc-force-cpu-threads-count-to-be-power-of-2.patch
  * add link for /usr/share/qemu/bios-256k.bin
  * Remove all linaro patches.
  * Remove all arm64/ patches. Many but not all are upstream.
  * Remove CVE-2013-4377.patch which is upstream.
  * debian/control-in: don't make qemu-system-aarch64 ubuntu-specific
 -- Serge Hallyn <email address hidden> Tue, 25 Feb 2014 22:31:43 -0600

Changed in qemu (Ubuntu):
status: Fix Committed → Fix Released

It looks like libfte-dev before 1.4 was merely unusable because the mentioned file - libfdt_env.h - is included by the main libfdt.h too, even in version 1.3, so if libfdt_env.h is missing, libfdt-dev is simply unusable. At least that's what it was on debian, see http://bugs.debian.org/706137 . So I think it is not qemu who should depend on >=1.4 libfdt-dev, but qemu should depend on _working_ libfdt-dev.

BTW, how this bug is related to CVE-2013-4377?

Serge Hallyn (serge-hallyn) wrote :

Yes, thanks Michael, as we discussed on irc this needs to be fixed in device-tree-compiler in precise (and quantal).

Once that is done we can remove the versioned dependency in trusty qemu.

Changed in device-tree-compiler (Ubuntu):
status: New → Triaged
status: Triaged → Fix Released
Changed in device-tree-compiler (Ubuntu Precise):
status: New → Triaged
Changed in device-tree-compiler (Ubuntu Quantal):
status: New → Triaged
Changed in device-tree-compiler (Ubuntu):
importance: Undecided → High
Changed in qemu (Ubuntu Precise):
status: New → Invalid
Changed in qemu (Ubuntu Quantal):
status: New → Invalid
Changed in device-tree-compiler (Ubuntu Precise):
importance: Undecided → High
Changed in device-tree-compiler (Ubuntu Quantal):
importance: Undecided → High
Changed in device-tree-compiler (Ubuntu Precise):
status: Triaged → Confirmed
Changed in device-tree-compiler (Ubuntu Quantal):
status: Triaged → Confirmed
Serge Hallyn (serge-hallyn) wrote :

Hm, the CVE link was added by a (errant?) bot... I removed the link.

Serge Hallyn (serge-hallyn) wrote :

Re-marking confirmed for qemu to remind us that we must remove the version from the libfdt-dev dependency for qemu.

description: updated
Changed in qemu (Ubuntu):
status: Fix Released → Confirmed
Changed in device-tree-compiler (Debian):
status: Unknown → Fix Released

Hello Ballock, or anyone else affected,

Accepted device-tree-compiler into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/device-tree-compiler/1.3.0-2ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in device-tree-compiler (Ubuntu Precise):
status: Confirmed → Fix Committed
tags: added: verification-needed
tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package device-tree-compiler - 1.3.0-2ubuntu1

---------------
device-tree-compiler (1.3.0-2ubuntu1) precise-proposed; urgency=medium

  * libfdt-dev: Missing header file prevents the library usage
    Thanks Domenico Andreoli (Closes: #706137) (LP: #1295072)
 -- Serge Hallyn <email address hidden> Tue, 08 Apr 2014 11:13:12 -0500

Changed in device-tree-compiler (Ubuntu Precise):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for device-tree-compiler has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package qemu - 2.0.0~rc1+dfsg-0ubuntu4

---------------
qemu (2.0.0~rc1+dfsg-0ubuntu4) utopic; urgency=medium

  * debian/control: drop the versioning requirement from libfdt-dev
    build-dependency, as it is longer needed (LP: #1295072)
 -- Serge Hallyn <email address hidden> Wed, 30 Apr 2014 10:03:08 -0500

Changed in qemu (Ubuntu):
status: Confirmed → Fix Released

Hello Ballock, or anyone else affected,

Accepted qemu into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/qemu/2.0.0+dfsg-2ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in qemu (Ubuntu Trusty):
status: New → Fix Committed
tags: removed: verification-done
tags: added: verification-needed
Sebastien Bacher (seb128) wrote :

Could somebody confirm the fix so the update can be moved to -updates?

Sebastien Bacher (seb128) wrote :

looking at the changes the build-depends version is indeed unversionned in the update

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package qemu - 2.0.0+dfsg-2ubuntu1.1

---------------
qemu (2.0.0+dfsg-2ubuntu1.1) trusty-proposed; urgency=low

  * remove alternatives for qemu: different architectures
    aren't really alternatives and never had been (LP: #1316829)
  * debian/rules: install the proper /etc/init/qemu-kvm.conf (LP: #1315402)
  * debian/control: drop the versioning requirement from libfdt-dev
    build-dependency, as it is longer needed (LP: #1295072)
 -- Serge Hallyn <email address hidden> Wed, 07 May 2014 17:31:39 -0500

Changed in qemu (Ubuntu Trusty):
status: Fix Committed → Fix Released
Rolf Leggewie (r0lf) wrote :

quantal has seen the end of its life and is no longer receiving any updates. Marking the quantal task for this ticket as "Won't Fix".

Changed in device-tree-compiler (Ubuntu Quantal):
status: Confirmed → Won't Fix
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.