#1111893 courier-imap: After upgrade courier-imap-ssl fails to start

Package:
courier-imap
Source:
courier-imap
Description:
Courier mail server - IMAP server
Submitter:
Erik de Castro Lopo
Date:
2025-08-25 17:55:02 UTC
Severity:
normal
#1111893#3
Date:
2025-08-23 11:06:43 UTC
From:
To:
Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

After an upgrade, it seems the version of GNU TLS was upgraded to a version
not comtible with courier-imap-ssl.

Eg:
   sudo /etc/init.d/courier-imap-ssl status
  ○ courier-imap-ssl.service - Courier IMAP Daemon (SSL)
       Loaded: loaded (/usr/lib/systemd/system/courier-imap-ssl.service; enabled; preset: enabled)
       Active: inactive (dead) since Sat 2025-08-23 20:54:18 AEST; 3s ago
     Duration: 18.104s
   Invocation: 0524e1d78eef491e98a660569b38c8a8
      Process: 1667711 ExecStart=/usr/lib/courier/imapd-ssl start (code=exited, status=0/SUCCESS)
      Process: 1667763 ExecStop=/usr/lib/courier/imapd-ssl stop (code=exited, status=0/SUCCESS)
     Main PID: 1667723 (code=exited, status=0/SUCCESS)
     Mem peak: 2.5M
          CPU: 63ms

  Aug 23 20:53:59 ada systemd[1]: Starting courier-imap-ssl.service - Courier IMAP Daemon (SSL)...
  Aug 23 20:53:59 ada systemd[1]: Started courier-imap-ssl.service - Courier IMAP Daemon (SSL).
  Aug 23 20:54:02 ada imapd-ssl[1667723]: GnuTLS version mismatch
  Aug 23 20:54:02 ada imapd-ssl[1667723]: GnuTLS version mismatch
  Aug 23 20:54:06 ada imapd-ssl[1667723]: GnuTLS version mismatch
  Aug 23 20:54:06 ada imapd-ssl[1667723]: GnuTLS version mismatch
  Aug 23 20:54:18 ada systemd[1]: Stopping courier-imap-ssl.service - Courier IMAP Daemon (SSL)...
  Aug 23 20:54:18 ada systemd[1]: courier-imap-ssl.service: Deactivated successfully.
  Aug 23 20:54:18 ada systemd[1]: Stopped courier-imap-ssl.service - Courier IMAP Daemon (SSL).

   * What led up to the situation?

Just a normal `apt-get update && apt-get upgrade`.
   * What exactly did you do (or not do) that was effective (or
     ineffective)?

I am going to try to figure out which version os GNU TLS was running
before and manually downgrade.


*** End of the template - remove these template lines ***
#1111893#8
Date:
2025-08-23 11:23:43 UTC
From:
To:
Erik de Castro Lopo wrote:

Thought it would be easy to figure out what had changed but I was mistaken.

Erik
#1111893#13
Date:
2025-08-23 18:15:53 UTC
From:
To:
version

Does it relate to the recent upload of gnutls28?

https://tracker.debian.org/pkg/gnutls28

It is not supposed to involve an incompatible library change.  If it does this
bug should probably be reassigned to the gnutls28 package.

Have you rebooted your system to make sure that a mismatched version of the
library is not cached?
#1111893#18
Date:
2025-08-23 22:29:13 UTC
From:
To:
Soren Stoutner wrote:


I must admit I am a little surprised, but yes, a reboot did fix this. In over 25
years of using Debian as my main OS, I don't think I have encountered something
like this before.

Erik
#1111893#23
Date:
2025-08-23 23:22:37 UTC
From:
To:
I am going to reassign this bug to gnutls28.  There might be a way they can
prevent this problem without requiring a reboot.
#1111893#32
Date:
2025-08-23 23:22:37 UTC
From:
To:
I am going to reassign this bug to gnutls28.  There might be a way they can
prevent this problem without requiring a reboot.
#1111893#37
Date:
2025-08-23 23:28:36 UTC
From:
To:
I am also lowering the severity of this bug to normal, given that a reboot fixes the problem.
#1111893#44
Date:
2025-08-24 09:31:43 UTC
From:
To:
Control: reassign -1 courier-imap 5.0.13+1.0.16-3
Control: found -1 5.2.11+1.4.1-6

Hello Soeren,

thanks for maintaining courier.

This is an issue on the courier side. Looking at the source code we
find (in both oldstable and current version):
libs/tcpd/libcouriergnutls.c
if (gnutls_check_version(LIBGNUTLS_VERSION) == NULL)
	{
		fprintf(stderr, "GnuTLS version mismatch\n");

And LIBGNUTLS_VERSION is defined in /usr/include/gnutls/compat.h
#define LIBGNUTLS_VERSION GNUTLS_VERSION
and /usr/include/gnutls/gnutls.h
#define GNUTLS_VERSION "3.8.10"

So when you compile courier against e.g. 3.8.10 and run it against
gnutls 3.8.9 it will run
gnutls_check_version(3.8.10)
and fail, although 3.8.9 and 3.8.10 are ABI compliant.

(And at the time the bug submitter restarted courier by rebootting gnutls
had been upgrade and the error went away.)

You should not run gnutls_check_version against the gnutls version
installed at compile time but against the gnutls version you actually
need.

cu Andreas
#1111893#55
Date:
2025-08-25 17:53:31 UTC
From:
To:
Andreas,

Thank you for taking the time to provide a detailed analysis of the problem.  I will consult
with Courier’s upstream maintainer and resolve the issue.
#1111893#58
Date:
2025-08-25 17:53:31 UTC
From:
To:
Andreas,

Thank you for taking the time to provide a detailed analysis of the problem.  I will consult
with Courier’s upstream maintainer and resolve the issue.