[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
This bug was fixed in the package deja-dup - 42.9-1ubuntu3 --- deja-dup (42.9-1ubuntu3) jammy; urgency=medium * debian/patches/git-goauth-deprecation.patch: - update the oauth workflow, the local redirection currently used by deja-dup is being deprcated by Google and will stop working. Thanks Michael Terry providing us backports of the fix! (lp: #1973816) -- Sebastien Bacher Fri, 20 May 2022 16:20:58 +0200 ** Changed in: deja-dup (Ubuntu Jammy) Status: Fix Committed => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
42.9-1ubuntu3 is working as intended ** Tags removed: verification-needed verification-needed-jammy ** Tags added: verification-done verification-done-jammy -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
The fix for this is stuck in kinetic-proposed on a component mismatch, so I'm changing the status to Fix Committed to reflect that. If the upload is pulled from kinetic-proposed then we'll end up with a higher version in Jammy than in Kinetic so I think it's important to correctly note that it hasn't landed yet. ** Changed in: deja-dup (Ubuntu Jammy) Status: New => Fix Committed ** Tags added: verification-needed verification-needed-jammy -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
** Changed in: deja-dup (Debian) Status: Unknown => New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011355 ** Bug watch added: Debian Bug tracker #1011355 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011355 ** Also affects: deja-dup (Debian) via https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1011355 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
yes please, stable update in Debian require even more paperwork than Ubuntu SRUs and having a bug to reference is part of it :) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
Looks like Debian stable is using 42.7 right now - should I file a bug on the Debian side to track that too? -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
** Description changed: - Hello! I'm the maintainer of Deja Dup. I was recently made aware that - Google is removing an oauth workflow that Deja Dup uses, in September. + * Impact + + The method Deja-Dup is using to authentificate to google account will + stop working in september. + + * Test case + + Configure deja-dup to do backups on a google drive account. After + confirming the authorization through the web browser it should be + possible to start the backup. + + Check on the webview that the files are correctly added. + + Restore some data and unsure that's working. + + * Regression + + The codepath is used for oauth authentification and integration with the + system mimetype. Check that the webbrowser auth workflow works as + expected, testing deb and snap based browsers + + -- + + + Hello! I'm the maintainer of Deja Dup. I was recently made aware that Google is removing an oauth workflow that Deja Dup uses, in September. Here's their blog post about it: https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html Here's the upstream bug about switching to a new oauth flow: https://gitlab.gnome.org/World/deja-dup/-/issues/222 I've released version 43.3 with a new oauth workflow. This basically switches us from redirecting the oauth page to a local http://localhost:/ page being served by deja-dup and instead has the browser launch a custom URI like 'com.googlecontent.xxx:/oauth2redirect?code=yyy', which then launches deja-dup and gives it the correct oauth token. The key differences for packagers is just to note that now deja-dup will register itself as a handler for those weird URI schemes (they are specific to deja-dup, as they include its client ids for the service). I think this deserves a backport to all supported releases. I can whip up a patch for you in a bit, just wanted to get this registered as an issue. To be a bit more specific about what will break: - Existing users that have already granted deja-dup access to Google will continue to work without any issue. - In August, users will see a warning on the oauth screen. - And then in September, any new attempt to connect deja-dup to Google will not work. ** Description changed: * Impact The method Deja-Dup is using to authentificate to google account will stop working in september. * Test case Configure deja-dup to do backups on a google drive account. After confirming the authorization through the web browser it should be possible to start the backup. Check on the webview that the files are correctly added. Restore some data and unsure that's working. - * Regression + * Regression potential The codepath is used for oauth authentification and integration with the system mimetype. Check that the webbrowser auth workflow works as expected, testing deb and snap based browsers -- - - Hello! I'm the maintainer of Deja Dup. I was recently made aware that Google is removing an oauth workflow that Deja Dup uses, in September. + Hello! I'm the maintainer of Deja Dup. I was recently made aware that + Google is removing an oauth workflow that Deja Dup uses, in September. Here's their blog post about it: https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html Here's the upstream bug about switching to a new oauth flow: https://gitlab.gnome.org/World/deja-dup/-/issues/222 I've released version 43.3 with a new oauth workflow. This basically switches us from redirecting the oauth page to a local http://localhost:/ page being served by deja-dup and instead has the browser launch a custom URI like 'com.googlecontent.xxx:/oauth2redirect?code=yyy', which then launches deja-dup and gives it the correct oauth token. The key differences for packagers is just to note that now deja-dup will register itself as a handler for those weird URI schemes (they are specific to deja-dup, as they include its client ids for the service). I think this deserves a backport to all supported releases. I can whip up a patch for you in a bit, just wanted to get this registered as an issue. To be a bit more specific about what will break: - Existing users that have already granted deja-dup access to Google will continue to work without any issue. - In August, users will see a warning on the oauth screen. - And then in September, any new attempt to connect deja-dup to Google will not work. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
Doh, I forgot to reference the bug in the changelog but I've updated to 43.3 Debian and Ubuntu Kinetic https://launchpad.net/ubuntu/+source/deja-dup/43.3-1ubuntu1 SRU to come next, I will start with 22.04 to get some more feedback before SRUing to older series Testing here without a configured account it worked fine to auth to my google account and do a backup and restore ** Changed in: deja-dup (Ubuntu) Status: Triaged => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
OK, I've made a little wiki page about this issue for distro maintainers (no real new information, but it does have links to patches at the bottom). The patches should cover all affected versions that Ubuntu supports (40.7, 42.8, and 42.9). https://wiki.gnome.org/Apps/DejaDup/GoogleAuthChange2022 (hmm, how do I make that a link?) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1973816] Re: Deja Dup's Google support will break in September 2022 for versions < 43.3
Thanks Michael for the headsup. We will update to 43 for Kinetic now that the LTS is out we plan to go with the current version of the GNOME libraries but backports of the changes to older series would be welcome as we will need to do SRUs. I think it makes sense for you as an upstream to probably do 42 which is the last GTK3 supported version and it's probably on us to backport to older version as needed. ** Changed in: deja-dup (Ubuntu) Importance: Undecided => High ** Changed in: deja-dup (Ubuntu) Assignee: (unassigned) => Sebastien Bacher (seb128) ** Changed in: deja-dup (Ubuntu) Status: New => Triaged -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1973816 Title: Deja Dup's Google support will break in September 2022 for versions < 43.3 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/deja-dup/+bug/1973816/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
