Please unblock package mbedtls
[ Reason ]
Upstream released a new LTS bugfix version, and I'd like to have it in
bookworm. Since mbedtls is a crypto library and backporting single commits can
be dangerous, importing new versions is the safest and most appropriate thing
to do, especially since the upstream developers do a pretty good job in
maintaining LTS versions for a long time.
[ Impact ]
If not granted, Debian will release with a somewhat vulnerable/buggy version of
a widely used crypto library.
[ Tests ]
I've manually reviewed the changelog and diffs of the new release, tested it
locally with the upstream test suite and autopkgtest, and it has passed all the
CI checks on Salsa (repo available at
<https://salsa.debian.org/debian/mbedtls>).
[ Risks ]
Risks should be low, as upstream usually does a good job with backporting. The
"only" issue is that between 2.28.2 and 2.28.3 they have adopted a new code
style, and reformatted the whole codebase accordingly; this means that the
debdiff is huge, even though the changes are only a few. To make reviewing
easier for me and you too, I've prepared three git diffs that exclude the
upstream commits that reformatted the code, and another one that adds the
string "\emptydescription" to many documentation strings in the source files.
As upstream also always backports test code along with fixes, these diffs only
include changes from the include/ and library/ directories, since that's where
the code that gets into the binary packages resides.
.
The diffs were generated with these commands:
.
$ git clone https://github.com/Mbed-TLS/mbedtls.git
$ cd mbedtls
$ git diff v2.28.2..160df1d13621ca3ee70e1fa19d0da88398da9683~1 include/
library/
$ git diff
b37f6c1b95815d39fea26b2a17e318602eefe709..b361e04207831f753a29d6036361d4447aaaa3bc~1
include/ library/
$ git diff 7a5168e90db359e17e72591cb5ddb06ef5f0388f..v2.28.3 include/
library/
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
I mistakenly uploaded the new mbedtls version to unstable because I didn't
realize it was a key package, and thought that a regular 20 days of waiting
would suffice. This is also my first unblock request, so please be clement with
me, thanks! :D
Also, the debdiff is not directly attached to this email to avoid hitting the
size limit of the mailing list. You can find it here:
<https://bin.snopyta.org/?b47ce8f3107c9a0a#92ZuUuxNvi8AWA1bVTPXCDFxakvxG1XUgcguoLnQKVcw>
unblock mbedtls/2.28.2-1