10:08 a.m.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Bug ID: 2154347
Summary: Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
Product: Fedora
Version: rawhide
Status: NEW
Component: Package Review
Assignee: nobody(a)fedoraproject.org
Reporter: benson_muite(a)emailplus.org
QA Contact: extras-qa(a)fedoraproject.org
CC: package-review(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
spec:
https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora...
srpm:
https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora...
Description:
Mbed TLS is a light-weight open source cryptographic and SSL/TLS
library written in C. Mbed TLS makes it easy for developers to include
cryptographic and SSL/TLS capabilities in their (embedded)
applications with as little hassle as possible.
Fedora Account System Username: fed500
This package is for version of mbedtls, version 2 is already packaged. They
currently conflict, which needs to be resolved
HTML documentation is causing some errors. May remove this.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
10:09 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Benson Muite <benson_muite(a)emailplus.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|0 |updated
--- Comment #0 has been edited ---
spec:
https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora...
srpm:
https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora...
Description:
Mbed TLS is a light-weight open source cryptographic and SSL/TLS
library written in C. Mbed TLS makes it easy for developers to include
cryptographic and SSL/TLS capabilities in their (embedded)
applications with as little hassle as possible.
Fedora Account System Username: fed500
This package is for version 3 of mbedtls, version 2 is already packaged. They
currently conflict, which needs to be resolved
HTML documentation is causing some errors. May remove this.
--
You are receiving this mail because:
You are on the CC list for the bug.
You are always notified about changes to this product and component
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
5:02 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Neal Gompa <ngompa13(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ngompa13(a)gmail.com
Doc Type|--- |If docs needed, set a value
--- Comment #1 from Neal Gompa <ngompa13(a)gmail.com> ---
Why are we doing this instead of upgrading the main one? Did you try to see if
this is necessary?
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
5:02 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Neal Gompa <ngompa13(a)gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Flags| |fedora-review?
Assignee|nobody(a)fedoraproject.org |ngompa13(a)gmail.com
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
11:33 p.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #2 from Benson Muite <benson_muite(a)emailplus.org> ---
The two versions seem to be currently maintained and updated:
https://github.com/Mbed-TLS/mbedtls/releases
It is unclear how many packages would break if only version 3 is available.
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
11:57 p.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #3 from Benson Muite <benson_muite(a)emailplus.org> ---
Ubuntu and Suse have version 2 in their repositories:
https://packages.ubuntu.com/search?keywords=mbedtls&searchon=names&am...
https://software.opensuse.org/package/mbedtls
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
7:14 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #4 from Neal Gompa <ngompa13(a)gmail.com> ---
Well, we should try in a COPR then, right?
There aren't a lot of packages that link to mbedtls in Fedora:
[root@94bd36f45bc2 /]# dnf repoquery --whatrequires mbedtls --qf "%{SOURCERPM}"
Last metadata expiration check: 0:08:48 ago on Thu Dec 22 13:03:39 2022.
dislocker-0.7.3-8.fc37.src.rpm
dolphin-emu-5.0.16380-7.fc38.src.rpm
freeopcua-0-36.20220717.bd13aee.fc38.src.rpm
gauche-0.9.11-3.fc37.src.rpm
godot-3.4.5-1.fc37.src.rpm
haxe-4.2.5-3.fc37.src.rpm
imhex-1.25.0-1.fc38.src.rpm
julia-1.8.2-2.fc38.src.rpm
lighttpd-1.4.67-1.fc38.src.rpm
mbedtls-2.28.1-1.fc38.src.rpm
nekovm-2.3.0-10.fc38.src.rpm
openrgb-0.8-2.fc38.src.rpm
retroarch-1.14.0-1.fc38.src.rpm
secvarctl-0.3-4.fc37.src.rpm
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
9:19 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #5 from Benson Muite <benson_muite(a)emailplus.org> ---
Ok. Version 2.28 is an LTS and there are very many breaking changes going to
version 3:
https://github.com/Mbed-TLS/mbedtls/blob/development/docs/3.0-migration-g...
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
2:03 p.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Bill Roberts <bill.roberts(a)arm.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Assignee|nobody(a)fedoraproject.org |bill.roberts(a)arm.com
CC| |bill.roberts(a)arm.com
--- Comment #8 from Bill Roberts <bill.roberts(a)arm.com> ---
So, We can't just update the old mbedtls package as we need to do a
side-by-side transition as mbedtls 3.6 (current LTS) is NOT compatible at an
API and ABI layer with the older mbedtls 2.28.x LTS versions. Another, rather
unfortunate thing, is that upstream only follows semantic versioning guidelines
with respect to API and break ABI at whim. Additionally, they historically miss
soname updates. Ie they may break ABI, and not bump major soversion. With all
of this in mind, it means they they could create a 3.7 LTS whenever, and to
move to that LTS would also be an API and ABI breaking change. With all of this
in mind, I propose that we create an mbedtls-3.6 package, which will provide
the updates for that LTS branch. As they move to the next LTS version, we can
do mbedtls-3.7. We namespace out the include directories, shared libraries,
cmake snippets, docs, etc. This way older versions of mbedtls can be installed
side by side with newer versions.
So I am in favor of going to mbedtls-3.6 package name to give us the most
flexibility with a challenging versioning scheme adopted by upstream.
I am proposing the following:
SRPM:
https://github.com/billatarm/mbedtls3.6/releases/download/3.6.0-b0/mbedtl...
SPEC: https://github.com/billatarm/mbedtls3.6/blob/3.6.0-b0/mbedtls3.6.spec
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
12:18 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #9 from Benson Muite <benson_muite(a)emailplus.org> ---
This seems reasonable to me. Do you still want to do the review or open a new
review
request that would make you the main maintainer, and I can do the review?
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
11:10 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #10 from Bill Roberts <bill.roberts(a)arm.com> ---
(In reply to Benson Muite from comment #9)
This seems reasonable to me. Do you still want to do the review or
open a
new review
request that would make you the main maintainer, and I can do the review?
Done: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2282603
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
11:59 a.m.
New subject: [Bug 2154347] Review Request: mbedtls3 - Light-weight cryptographic
and SSL/TLS library
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Benson Muite <benson_muite(a)emailplus.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |DUPLICATE
Status|NEW |CLOSED
Last Closed| |2024-05-22 16:59:06
--- Comment #11 from Benson Muite <benson_muite(a)emailplus.org> ---
*** This bug has been marked as a duplicate of bug 2282603 ***
--
You are receiving this mail because:
You are always notified about changes to this product and component
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=rep...
12
days inactive
535
days old
package-review@lists.fedoraproject.org
11 comments
1 participants
participants (1)
-
bugzilla＠redhat.com