[SRU] New upstream microrelease .NET 6.0.30 and SDK 6.0.130

[Mateus Rodrigues de Morais]

[Impact]

 * This correspond to an upstream microrelease (Microsoft Patch Tuesday microrelease) released on May 14th, 2024.

 * It is beneficial for our LTS users to have access to the latest .NET stack.

[Test Case]

 * The package should build successfully in mantic-proposed and jammy-proposed.

 * The packages should be installable on mantic and jammy
   on amd64 and arm64 architectures.

 * Autopackage tests should pass.

 * The usual manual tests that have been seen in the previous microreleases
   LP: #2057699, #1996499, #1983380, #2011807 (see Test Case section there).

   Note: The need for manual testing has been largely reduced, because the
         autopkgtests improvements far exceeds the coverage provided by the
         mentioned manual test plans.

[Regression Potential]

 * The upstream testing routine is usually satisfactory, but there is always a risk of something breaking.

[Other]

* dotnet6 was removed from the current development release.
  See LP: #2044511 for details.

* dotnet6 has a build requirement on the .git folder, currently present
  in the source tree.

* 6.0.30 is the version number of the .NET Runtime and 6.0.130 is the version
  number of the .NET SDK. The package version only refers to the SDK version
  number.

* We are only building the 6.0.1xx feature band, because this is the only
  feature band that allows building from source. See explanation of feature
  bands: https://learn.microsoft.com/en-us/dotnet/core/releases-and-support#feature-bands-sdk-only

* Overview of how dotnet is versioned: https://learn.microsoft.com/en-us/dotnet/core/versions/

[Mateus Rodrigues de Morais (mateus-morais)]

Jammy package available in PPA: https://launchpad.net/~mateus-morais/+archive/ubuntu/dotnet6
Mantic package available in PPA: https://launchpad.net/~mateus-morais/+archive/ubuntu/dotnet6-mantic

PPA autopkgtests are passing for both Jammy and Mantic:

- jammy/amd64: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-mateus-morais-dotnet6/jammy/amd64/d/dotnet6/20240522_140023_74ae7@/log.gz
- jammy/arm64: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-mateus-morais-dotnet6/jammy/arm64/d/dotnet6/20240522_151810_4d932@/log.gz

- mantic/amd64: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-mateus-morais-dotnet6-mantic/mantic/amd64/d/dotnet6/20240522_161356_b84bf@/log.gz
- mantic/arm64: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-mateus-morais-dotnet6-mantic/mantic/arm64/d/dotnet6/20240522_150626_aad43@/log.gz

[Nick Rosbrook (enr0n)]

I sponsored these uploads. Waiting in the unapproved queue.

[Timo Aaltonen (tjaalton)]

Hello Mateus, or anyone else affected,

Accepted dotnet6 into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.130-0ubuntu1~23.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Timo Aaltonen (tjaalton)]

Hello Mateus, or anyone else affected,

Accepted dotnet6 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/dotnet6/6.0.130-0ubuntu1~22.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted dotnet6 (6.0.130-0ubuntu1~23.10.1) for mantic have finished running.
The following regressions have been reported in tests triggered by the package:

dotnet6/6.0.130-0ubuntu1~23.10.1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/mantic/update_excuses.html#dotnet6

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted dotnet6 (6.0.130-0ubuntu1~22.04.1) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

dotnet6/6.0.130-0ubuntu1~22.04.1 (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#dotnet6

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Mateus Rodrigues de Morais (mateus-morais)]

SRU Verification Results:

* Executed Test Case as described in #1983380 (bug mentioned in Test Case section)

  - All commands executed as expected.

* Autopkgtest Results:

  - The only test that failed was 'release-version-sane', but the failure was not introduced by this upload. The test failed because it currently expects the packaged .NET version to be the same as the latest upstream .NET version. As there has already been another (Windows-only) upstream release (6.0.31), the test fails.
  - We have worked on modifying this test to a more realistic scenario that compares the current package version against any upstream current or previous versions, which will be released on the next .NET monthly update in July.
  - All the other tests were either SKIP (by design) or PASS.

[Launchpad Janitor (janitor)]

This bug was fixed in the package dotnet6 - 6.0.132-0ubuntu1~23.10.1

---------------
dotnet6 (6.0.132-0ubuntu1~23.10.1) mantic-security; urgency=medium

  * New upstream release.
  * SECURITY UPDATE: denial of service
    - CVE-2024-38095: Denial of service in parsing X.509 Content and
      ObjectIdentifiers.
  * debian/eng/build-dotnet-tarball.sh: SECURITY_PARTNERS_REPOSITORY
    connection method updated.

 -- Nishit Majithia <email address hidden> Wed, 03 Jul 2024 09:25:05 +0530

[Launchpad Janitor (janitor)]

This bug was fixed in the package dotnet6 - 6.0.132-0ubuntu1~22.04.1

---------------
dotnet6 (6.0.132-0ubuntu1~22.04.1) jammy-security; urgency=medium

  * New upstream release
  * SECURITY UPDATE: denial of service
    - CVE-2024-38095: Denial of service in parsing X.509 Content and
      ObjectIdentifiers.
  * debian/eng/build-dotnet-tarball.sh: SECURITY_PARTNERS_REPOSITORY
    connection method updated.

 -- Nishit Majithia <email address hidden> Thu, 04 Jul 2024 10:23:31 +0530