https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Bug ID: 2154347 Summary: Review Request: mbedtls3 - Light-weight cryptographic and SSL/TLS library Product: Fedora Version: rawhide Status: NEW Component: Package Review Assignee: nobody@fedoraproject.org Reporter: benson_muite@emailplus.org QA Contact: extras-qa@fedoraproject.org CC: package-review@lists.fedoraproject.org Target Milestone: --- Classification: Fedora
spec: https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora-ra... srpm: https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora-ra...
Description: Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible.
Fedora Account System Username: fed500
This package is for version of mbedtls, version 2 is already packaged. They currently conflict, which needs to be resolved
HTML documentation is causing some errors. May remove this.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Benson Muite benson_muite@emailplus.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Comment|0 |updated
--- Comment #0 has been edited ---
spec: https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora-ra... srpm: https://download.copr.fedorainfracloud.org/results/fed500/mbedtls3/fedora-ra...
Description: Mbed TLS is a light-weight open source cryptographic and SSL/TLS library written in C. Mbed TLS makes it easy for developers to include cryptographic and SSL/TLS capabilities in their (embedded) applications with as little hassle as possible.
Fedora Account System Username: fed500
This package is for version 3 of mbedtls, version 2 is already packaged. They currently conflict, which needs to be resolved
HTML documentation is causing some errors. May remove this.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Neal Gompa ngompa13@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ngompa13@gmail.com Doc Type|--- |If docs needed, set a value
--- Comment #1 from Neal Gompa ngompa13@gmail.com --- Why are we doing this instead of upgrading the main one? Did you try to see if this is necessary?
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Neal Gompa ngompa13@gmail.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Flags| |fedora-review? Assignee|nobody@fedoraproject.org |ngompa13@gmail.com
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #2 from Benson Muite benson_muite@emailplus.org --- The two versions seem to be currently maintained and updated: https://github.com/Mbed-TLS/mbedtls/releases It is unclear how many packages would break if only version 3 is available.
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #3 from Benson Muite benson_muite@emailplus.org --- Ubuntu and Suse have version 2 in their repositories: https://packages.ubuntu.com/search?keywords=mbedtls&searchon=names&s... https://software.opensuse.org/package/mbedtls
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #4 from Neal Gompa ngompa13@gmail.com --- Well, we should try in a COPR then, right?
There aren't a lot of packages that link to mbedtls in Fedora:
[root@94bd36f45bc2 /]# dnf repoquery --whatrequires mbedtls --qf "%{SOURCERPM}" Last metadata expiration check: 0:08:48 ago on Thu Dec 22 13:03:39 2022. dislocker-0.7.3-8.fc37.src.rpm dolphin-emu-5.0.16380-7.fc38.src.rpm freeopcua-0-36.20220717.bd13aee.fc38.src.rpm gauche-0.9.11-3.fc37.src.rpm godot-3.4.5-1.fc37.src.rpm haxe-4.2.5-3.fc37.src.rpm imhex-1.25.0-1.fc38.src.rpm julia-1.8.2-2.fc38.src.rpm lighttpd-1.4.67-1.fc38.src.rpm mbedtls-2.28.1-1.fc38.src.rpm nekovm-2.3.0-10.fc38.src.rpm openrgb-0.8-2.fc38.src.rpm retroarch-1.14.0-1.fc38.src.rpm secvarctl-0.3-4.fc37.src.rpm
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #5 from Benson Muite benson_muite@emailplus.org --- Ok. Version 2.28 is an LTS and there are very many breaking changes going to version 3: https://github.com/Mbed-TLS/mbedtls/blob/development/docs/3.0-migration-guid...
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Bill Roberts bill.roberts@arm.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Assignee|nobody@fedoraproject.org |bill.roberts@arm.com CC| |bill.roberts@arm.com
--- Comment #8 from Bill Roberts bill.roberts@arm.com --- So, We can't just update the old mbedtls package as we need to do a side-by-side transition as mbedtls 3.6 (current LTS) is NOT compatible at an API and ABI layer with the older mbedtls 2.28.x LTS versions. Another, rather unfortunate thing, is that upstream only follows semantic versioning guidelines with respect to API and break ABI at whim. Additionally, they historically miss soname updates. Ie they may break ABI, and not bump major soversion. With all of this in mind, it means they they could create a 3.7 LTS whenever, and to move to that LTS would also be an API and ABI breaking change. With all of this in mind, I propose that we create an mbedtls-3.6 package, which will provide the updates for that LTS branch. As they move to the next LTS version, we can do mbedtls-3.7. We namespace out the include directories, shared libraries, cmake snippets, docs, etc. This way older versions of mbedtls can be installed side by side with newer versions.
So I am in favor of going to mbedtls-3.6 package name to give us the most flexibility with a challenging versioning scheme adopted by upstream.
I am proposing the following: SRPM: https://github.com/billatarm/mbedtls3.6/releases/download/3.6.0-b0/mbedtls-3... SPEC: https://github.com/billatarm/mbedtls3.6/blob/3.6.0-b0/mbedtls3.6.spec
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #9 from Benson Muite benson_muite@emailplus.org --- This seems reasonable to me. Do you still want to do the review or open a new review request that would make you the main maintainer, and I can do the review?
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
--- Comment #10 from Bill Roberts bill.roberts@arm.com --- (In reply to Benson Muite from comment #9)
This seems reasonable to me. Do you still want to do the review or open a new review request that would make you the main maintainer, and I can do the review?
Done: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=2282603
https://bugzilla.redhat.com/show_bug.cgi?id=2154347
Benson Muite benson_muite@emailplus.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |DUPLICATE Status|NEW |CLOSED Last Closed| |2024-05-22 16:59:06
--- Comment #11 from Benson Muite benson_muite@emailplus.org ---
*** This bug has been marked as a duplicate of bug 2282603 ***
package-review@lists.fedoraproject.org