[Bug 1944403] Re: FIPS cannot be enabled on non usrmerged 20.04 systems

2021-09-21 Thread Dimitri John Ledkov
if we can't fix fips version of libgcrypt in focal, we must add a
maintainer script somewhere else to copy the hmac from /lib to /usr/lib.
I.e. a fixup in ua tool or ubuntu-fips package.

** Also affects: libgcrypt (Ubuntu)
   Importance: Undecided
   Status: New

** Changed in: libgcrypt (Ubuntu)
   Importance: Undecided => Critical

** Changed in: libgcrypt (Ubuntu)
 Assignee: (unassigned) => The FIPS-CC-STIG (fips-cc-stig)

** Information type changed from Public to Private

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1944403

Title:
  FIPS cannot be enabled on non usrmerged 20.04 systems

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libgcrypt/+bug/1944403/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1944403] Re: FIPS cannot be enabled on non usrmerged 20.04 systems

2021-09-21 Thread Dimitri John Ledkov
an .hmac for a matching soname, should be shipped in the same location
as recorded for a given deb in the dpkg database.

In bionic,
# dpkg -L libgcrypt20 | grep so.20.2.1
/lib/x86_64-linux-gnu/libgcrypt.so.20.2.1

Thus bionic gcrypt hmac file should be under /lib

In focal,
# dpkg -L libgcrypt20 | grep .so.20.2.5
/usr/lib/x86_64-linux-gnu/libgcrypt.so.20.2.5

Thus focal gcrypt hmac file should be under /usr/lib

It seems a bug in whatever creates or ships gcrypt hmac file that it got
generated under /lib instead of /usr/lib on focal+

It is prohibited to depend/install usrmerge package on focal, and force
convert installations to usrmerged. We have only enabled and did this by
default in hirsute. Doing so on earlier releases may break the system
badly, depending on how hold the running systemd is.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1944403

Title:
  FIPS cannot be enabled on non usrmerged 20.04 systems

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/libgcrypt/+bug/1944403/+subscriptions


-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs