I haven't heard back from anyone who's had a chance to try the PPA packages, and I don't want to leave this regression sitting in noble- updates any longer while I wait. So I'm going to do the revert of the libp11 SRU first and follow up with the openssl side afterwards.
With the revert, the original segfault, reported in LP: #2158304 and also in LP: #2119094 (where a couple of people ran into it with Google Cloud KMS and DigiCert signing setups), will come back. It's not a nice trade either way, but this regression breaking something people already had working seems worse to me than a crash that's been there since noble was released. From the investigation done so far, the segfault issue reported in LP: #2158304 does not seem like a libp11 problem at all. OpenSSL 3.0.12 and 3.0.13 carry a change (2b74e753) that ends up clearing the engine binding on the key that ENGINE_load_private_key() hands back, and that quietly drops libp11's reference to the engine. If the application then releases its own reference once it has the key, which is what sbsign and osslsigncode do, the PKCS#11 context gets torn down while the key is still being used. Upstream reverted that change in 3.0.14, and noble is the only release we still support that has it. Jammy's version is older than the change, and everything newer already has the revert. What libp11 does instead is register the engine as the process-wide default for RSA and EC, and that's what breaks EAP-TLS here. Upstream's suggestion is to backport the OpenSSL revert and drop the workaround, which is what Debian ended up doing for bookworm as well (see https://bugs.debian.org/1074764), fixed in openssl 3.0.13-1~deb12u2 on 2024-07-05 with the same commit, three days after it was reported. Christian had suggested the same commit in comment #6 of bug 2119094. I've run both halves here against SoftHSM2 and against a YubiHSM 2. With the pre-SRU libp11 sbsign segfaults, with the released SRU it signs fine but this regression turns up, with just the openssl revert it signs fine and there's no regression, and with both it's clean. If anyone does get a chance to try the PPA packages against their own PKCS#11 module, I'd still really appreciate it. ** Bug watch added: Debian Bug tracker #1074764 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1074764 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2163152 Title: EAP-TLS Wi-Fi broken with TPM-backed PKCS#11 keys after upgrade to 0.4.12-1.1ubuntu1 To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/libp11/+bug/2163152/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
