Upgrade Cargo to 0.67.1

Bug #2005123 reported by Zixing Liu
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
cargo (Ubuntu)
Fix Released
Undecided
Zixing Liu

Bug Description

Upgrade Cargo to 0.67.1. This version properly addresses CVE-2022-46176 and does not require patching.

Changed in cargo (Ubuntu):
assignee: nobody → Liu Shuyu (liushuyu-011)
Revision history for this message
Simon Chopin (schopin) wrote :

Hi!

I'm guessing from https://bugs.launchpad.net/ubuntu/+source/rustc/+bug/2005122 that the package has been uploaded to the same PPA.

However, I would also assume that https://git.launchpad.net/~canonical-foundations/ubuntu/+source/cargo/log/?h=merge-0.67 is where the code is at, but the version numbers aren't the same. Please clarify this, and in the future post this information up-front :)

The version numbers seems wrong. I'd use the following:

`0.61.1+ds0ubuntu1-0ubuntu1`

The first ubuntu1 is to indicate the origin of the source repack, while the `-0ubuntu1` in the packaging version is because there's a baked-in assumption that plain `-N` packaging versions are for Debian uploads.

I won't do any further review until the situation is clarified.

Please mention the bug in the changelog.

Revision history for this message
Zixing Liu (liushuyu-011) wrote :

This should have been addressed now.

Revision history for this message
Simon Chopin (schopin) wrote :
Download full text (12.9 KiB)

Alright. It looks fairly good, but lintian seems fairly angry:

E: cargo changes: inconsistent-maintainer Simon Chopin <email address hidden> (changes vs. source) Ubuntu Developers <email address hidden>
W: cargo source: debian-watch-not-mangling-version opts="filenamemangle=s%(?:.*?)?v?(\d[\d.]*)\.tar\.gz%cargo-$1.tar.gz%" https://github.com/rust-lang/cargo/tags (?:.*?/)?v?(\d[\d.]*)\.tar\.gz [debian/watch:4]
W: cargo-doc: embedded-javascript-library please use libjs-normalize [usr/share/doc/cargo/doc/normalize.css]
W: cargo source: file-without-copyright-information vendor/num-traits/.cargo-checksum.json [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/Cargo.toml [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/LICENSE-APACHE [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/LICENSE-MIT [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/README.md [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/RELEASES.md [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/build.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/debian/patches/dont-run-mipsel-failing-doctests.diff [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/debian/patches/series [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/bounds.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/cast.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/float.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/identities.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/int.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/lib.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/macros.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/checked.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/euclid.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/inv.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/mod.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/mul_add.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/overflowing.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/saturating.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/ops/wrapping.rs [debian/copyright]
W: cargo source: file-without-copyright-information vendor/num-traits/src/pow.rs [debian/copyright]
W: cargo ...

Revision history for this message
Simon Chopin (schopin) wrote :

Given the looming feature freeze, I fixed the lintian issues myself and upload the package to the archive.

Changed in cargo (Ubuntu):
status: New → Fix Committed
Revision history for this message
Zixing Liu (liushuyu-011) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cargo - 0.68.0+ds0ubuntu1-0ubuntu1

---------------
cargo (0.68.0+ds0ubuntu1-0ubuntu1) lunar; urgency=medium

  * Update to Cargo 0.68.0 (LP: #2007608)
    - d/s/debian-cargo-vendor: Add a step to remove windows-sys
      and their friends from vendored sources
    - d/debcargo-conf.patch: Rebase patches
    - d/control: Bump rustc requirements
    - d/control: Update vendored sources information
    - d/copyright: update copyright information for vendored dependencies
    - d/vendor-tarball-unsuspicious.txt: update unsuspicious list to include
      some newly added source files
  * vendor: removed windows-sys and its related libraries from the tree
    to avoid including questionably licensed binary blobs from Microsoft
  * d/p/2901-ubuntu-is-terminal-remove-windows-sys.patch: a new patch to
    remove the windows-sys dependency from the is-terminal library
  * d/p/2900-ubuntu-remove-miow-dependency.patch: add a new patch to
    remove the miow dependency from Cargo to avoid introducing windows-sys
    into the vendor tree (windows-sys is a transitive dependency of miow)
  * .gitignore: only ignore the top-level target folder so that any tests
    called "target" will still be included in the source tree

 -- Zixing Liu <email address hidden> Fri, 17 Feb 2023 00:28:52 -0700

Changed in cargo (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.