Bug#959881: libssh2-1: Please upgrade to 1.9: ECDSA and memory leaks

[Benjamin Riefenstahl]

I did some more digging and than made a bug report with Curl upstream
here: .  This produced a
commit there that makes my test work much better.

The glibc function mallinfo still says that a couple of bytes go missing
now and than, but valgrind says it can't find anything.  I also repeated
the test 2 times and watched the memory in htop and it didn't grow,
so I will assume this is an error with mallinfo.

Thank you for your attention and your patience.

Regards, benny

Bug#959881: libssh2-1: Please upgrade to 1.9: ECDSA and memory leaks

[Benjamin Riefenstahl]

I have just tested in a Docker container on sid and with that version
(libssh2-1 1.9.0-3) ECDSA works (makes sense when I look at the
changelog).  The memory leak is still there.

Bug#959881: Fwd: libssh2-1: Please upgrade to 1.9: ECDSA and memory leaks

[Benjamin Riefenstahl]

Hi Nicolas,

Nicolas Mora writes:
> libssh2 1.9 has been uploaded to unstable, can you check if the
> problems are fixed now?

Sorry for taking so long, I just now found the time to test this.  Sad
to say that both the memory leak and the problem with ECDSA still exist,
when I run our test in a container with Debian testing and libssh2-1
1.9.0-2.

I'm especially puzzled by the ECDSA key failure.  The OpenSSH server
seems to ok with the key (although it does say "Postponed publickey"
after "Accepted key"), so maybe this is a problem on the client side.
>From libcurl I get the CURL error code 67 "Login denied".  I'm not sure
how to debug this, libcurl's debugging facilities do not give any output
here.  Is it possible to use libssh2_trace with libcurl and the Debian
packages?

Regards,
Benjamin Riefenstahl

-- 
Service-Owner Entwicklung
mecom Medien-Communikations-Gesellschaft mbH
Mittelweg 143, 20148 Hamburg
Tel: +49 40 411332 801
Fax: +49 40 451962
http://www.mecom.de
Registergericht Hamburg, HRB 43177
Geschäftsführung: Barbara Bliefert, Norbert Schmidt-Banasch
Unseren Hinweis zum Datenschutz finden Sie hier: 
https://www.dpa.com/de/datenschutzerklaerung

Bug#959881: libssh2-1: Please upgrade to 1.9: ECDSA and memory leaks

[Benjamin Riefenstahl]

Package: libssh2-1
Version: 1.8.0-2.1
Severity: normal

Dear Maintainer,

We are using libcurl for SFTP in our own software.  Libcurl in turn
relies on libssl2 for this feature.  We already use libcurl for HTTP and
HTTPS, so we would like to stick with that level so we have more common
code.

We have a tool containing our code for testing.  With that we tested
support for ECDSA client keys.  This works with the OpenSSH tool "sftp",
but not with our software.  When we compare the server debug log
(OpenSSH in debug mode, level debug3) with what we get from running the
sftp tool, the authentification sequence stops earlier, before reaching
success.

We also have a unit test that runs our code in a loop and that shows
memory leaks.

Scanning the changelogs of libssh2, it seems that there are important
updates for both of these problems in libssh2 in the current version
1.9.  So before investigating further, we would like to ask, when we can
expect that version to come to Debian and if there is something we can
do to help.

Regards,
Benjamin Riefenstahl, mecom GmbH


-- System Information:
Debian Release: 10.3
  APT prefers stable-debug
  APT policy: (500, 'stable-debug'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-8-amd64 (SMP w/8 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 
(charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libssh2-1 depends on:
ii  libc62.28-10
ii  libgcrypt20  1.8.4-5
ii  zlib1g   1:1.2.11.dfsg-1

libssh2-1 recommends no packages.

libssh2-1 suggests no packages.

-- no debconf information

-- 
mecom Medien-Communikations-Gesellschaft mbH
Mittelweg 143, D 20148 Hamburg
Tel: +49 40 411332 801
Fax: +49 40 451962
http://www.mecom.de
Registergericht Hamburg, HRB 43177
Geschäftsführung: Barbara Bliefert, Norbert Schmidt-Banasch

Bug#819341: Updated patch

[Benjamin Riefenstahl]

Hi Stéphane,

> Binary packages have a cost. They are useful when [...]

Ok, that's your domain, I don't know nothing about the policies here.

> My remark was not related to the python version. I was just wondering if
> unison-fsmonitor could be provided by existing packages instead.

Sure.  My primary interest is just that it is installable somehow, so
that we do not have to continue to build our own at some point.  I was
just taking what John Lenton had already been offering and tweaking it.

Anyway, let me know if I can be of further help.

Thanks,
benny

Bug#819341: Updated patch

[Benjamin Riefenstahl]

Hi Stéphane,

> Is there any practical benefit in adding a new binary package?

What is the problem with binary packages?

If you are asking, why not the python version instead, I already said

> The Python version of fsmonitor does seem to be flaky, the OCaml
> version seems better.  I prefer it to be packaged in Debian.

To be more specific, the Python version did not work well enough in our
use case, while the OCaml does what we want.

benny

Bug#819341: Updated patch

[Benjamin Riefenstahl]

Hi Stephane,

See attached a new patch, that adds only the native fsmonitor.

Thanks, benny

>From edac8a2918aed0eba453a2580d5f2e7f7c0f3ced Mon Sep 17 00:00:00 2001
From: Benjamin Riefenstahl 
Date: Tue, 19 Feb 2019 11:10:38 +0100
Subject: [PATCH] Add package unison-fsmonitor.  (Closes: #819341)

This patch is based on work by John Lenton  as
posted to the bug #819341.

Changes since then:

* Drop package unison-fsmonitor-python.

* Fix doc list for unison-fsmonitor.  Unison-fsmonitor should not
  contain another copy of the docs, so fix up DEB_INSTALL_DOCS
  accordingly.

* Make sure that unison-fsmontor is the same version as the base
  package.  The interface between unison and its helper is private and
  subject to change, so make sure that both use the same version.
---
 debian/control  | 31 +--
 debian/rules|  4 +++-
 debian/unison-fsmonitor.install |  2 ++
 3 files changed, 34 insertions(+), 3 deletions(-)
 create mode 100644 debian/unison-fsmonitor.install

diff --git a/debian/control b/debian/control
index 18a42b0..0f1f48e 100644
--- a/debian/control
+++ b/debian/control
@@ -20,7 +20,7 @@ Homepage: http://www.cis.upenn.edu/~bcpierce/unison/
 Package: unison
 Architecture: any
 Depends: ${shlibs:Depends}, ${ocaml:Depends}, ${misc:Depends}
-Recommends: ssh-client | openssh-client
+Recommends: ssh-client | openssh-client, unison-fsmonitor
 Suggests: unison-all
 Replaces: ${F:OtherUnison}
 Breaks: ${F:OtherUnison}
@@ -49,7 +49,7 @@ Architecture: any
 Depends: ${shlibs:Depends}, ${ocaml:Depends}, ${misc:Depends}
 Replaces: ${F:OtherUnisonGtk}
 Breaks: ${F:OtherUnisonGtk}
-Recommends: ssh-askpass, ssh-client | openssh-client
+Recommends: ssh-askpass, ssh-client | openssh-client, unison-fsmonitor
 Suggests: unison-all-gtk
 Description: file-synchronization tool for Unix and Windows with GTK+ interface
  Unison is a file-synchronization tool for Unix and Windows, written
@@ -72,3 +72,30 @@ Description: file-synchronization tool for Unix and Windows with GTK+ interface
  handling of the replicas and its private structures.
  .
  This package adds the optional GTK+ interface.
+
+Package: unison-fsmonitor
+Architecture: any
+Depends: ${shlibs:Depends}, ${ocaml:Depends}, ${misc:Depends},
+ unison (= ${binary:Version}) | unison-gtk (= ${binary:Version})
+Description: file-synchronization tool for Unix and Windows with GTK+ interface
+ Unison is a file-synchronization tool for Unix and Windows, written
+ in OCaml. It allows two replicas of a collection of files and
+ directories to be stored on different hosts (or different disks
+ on the same host), modified separately, and then brought up to
+ date by propagating the changes in each replica to the other.
+ .
+ Unison offers several advantages over various synchronization methods
+ such as CVS, Coda, rsync, Intellisync, etc. Unison can run on and
+ synchronize between Windows and many UNIX platforms. Unison requires
+ no root privileges, system access or kernel changes to function. Unison
+ can synchronize changes to files and directories in both directions,
+ on the same machine, or across a network using ssh or a direct
+ socket connection.
+ .
+ Transfers are optimised using a version of the rsync protocol,
+ making it ideal for slower links. Unison has a clear and precise
+ specification, and is resilient to failure due to its careful
+ handling of the replicas and its private structures.
+ .
+ This package adds the optional unison-fsmonitor helper program to
+ detect changes with "unison -repeat watch".
diff --git a/debian/rules b/debian/rules
index 7b76a24..40492c2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -80,7 +80,9 @@ endif
 
 UISTYLE := $(shell dpkg --compare-versions 2.10 ge $(VERSION) && echo gtk || echo gtk2)
 
-DEB_INSTALL_DOCS_ALL := BUGS.txt TODO.txt unison-manual.txt -X unison.doc-base.in
+DEB_INSTALL_DOCS_DEFAULT = -X unison.doc-base.in
+DEB_INSTALL_DOCS_unison = BUGS.txt TODO.txt unison-manual.txt -X unison.doc-base.in
+DEB_INSTALL_DOCS_unison-gtk = $(DEB_INSTALL_DOCS_unison)
 
 DEB_INSTALL_CHANGELOGS_ALL := NEWS
 
diff --git a/debian/unison-fsmonitor.install b/debian/unison-fsmonitor.install
new file mode 100644
index 000..d1b769e
--- /dev/null
+++ b/debian/unison-fsmonitor.install
@@ -0,0 +1,2 @@
+unison-fsmonitor /usr/bin/
+
-- 
2.7.4


-- 
mecom Medien-Communikations-Gesellschaft mbH

Mittelweg 143, D 20148 Hamburg

Tel: +49 40 411332 801

Fax: +49 40 451962

http://www.mecom.de

Registergericht Hamburg, HRB 43177

Geschäftsführung: Barbara Bliefert, Norbert Schmidt-Banasch

Bug#819341: Ping and updated patches

[Benjamin Riefenstahl]

Stéphane Glondu writes:
> Isn't python-foo (here, python-unison-fsmonitor) the naming convention
> for stuff implemented in Python?

No idea, is it?  ;-)

> Also, why provide both versions? How, as a user, do I choose between
> them? The descriptions are not very explanatory...

In theory both should work, I have not seen the author to prefer one or
the other (I have not looked very hard, though).  I tried to use the
Python script (it was ok for me to just install the one script from the
source), but it did not work reliably for me.  Once the packaging is
automated, the Python script is probably not needed any more in Debian,
so we could just drop that one from the patch.  Let me know, if I you
want a modified patch.

Bug#819341: Ping and updated patches

[Benjamin Riefenstahl]

ull
+++ b/debian/unison-fsmonitor-python.install
@@ -0,0 +1,2 @@
+fsmonitor.py /usr/bin/
+
diff --git a/debian/unison-fsmonitor.install b/debian/unison-fsmonitor.install
new file mode 100644
index 000..d1b769e
--- /dev/null
+++ b/debian/unison-fsmonitor.install
@@ -0,0 +1,2 @@
+unison-fsmonitor /usr/bin/
+
-- 
2.7.4

>From d867d69f083f2fac3ac6fad7334cf0082a2dbc44 Mon Sep 17 00:00:00 2001
From: Benjamin Riefenstahl 
Date: Tue, 19 Feb 2019 11:12:40 +0100
Subject: [PATCH 2/2] Fix doc list for unison-fsmonitor and
 unison-fsmonitor-python.

The Python module unison-fsmonitor-python is marked "indep", so it
will not build the documentation files and they will be missing when
building.  But than these packages should probably not contain another
copy of the docs anyway, so fix up DEB_INSTALL_DOCS accordingly.
---
 debian/rules | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/debian/rules b/debian/rules
index 7b76a24..40492c2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -80,7 +80,9 @@ endif
 
 UISTYLE := $(shell dpkg --compare-versions 2.10 ge $(VERSION) && echo gtk || echo gtk2)
 
-DEB_INSTALL_DOCS_ALL := BUGS.txt TODO.txt unison-manual.txt -X unison.doc-base.in
+DEB_INSTALL_DOCS_DEFAULT = -X unison.doc-base.in
+DEB_INSTALL_DOCS_unison = BUGS.txt TODO.txt unison-manual.txt -X unison.doc-base.in
+DEB_INSTALL_DOCS_unison-gtk = $(DEB_INSTALL_DOCS_unison)
 
 DEB_INSTALL_CHANGELOGS_ALL := NEWS
 
-- 
2.7.4