Feature Freeze Exception: Update opendht to 3.0.0

Bug #2038600 reported by Amin Bandali
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
opendht (Ubuntu)
Won't Fix
Undecided
Unassigned

Bug Description

opendht 3.0.0 contains many bug fixes and improvements over the currently packaged 2.4.12, and it would be great if an exception could be granted to upload 3.0.0 to mantic.

The reason a feature freeze exception is required is due to the SONAME bump due to upstream switching a few function signatures in their API to use an improved logging system.

As of now, the only reverse dependency for this library is jami (ring), which has a new version compatible with the opendht API change already released and ready. The latest release of jami, in turn, also includes many bug fixes (including some security fixes) and improvements.

I maintain both of these packages in Debian as a Debian Maintainer, both up-to-date in Debian unstable with latest upstream release; and having tested and used them myself, I believe the latest version of both packages to be in good shape for inclusion in mantic's universe.

opendht upstream release notes since 2.4.12:

v2.5.0

- dht: improved transmission of large amounts of values (>64 KB) for a single key, by transmitting them in separate messages with independent retransmission logic
- docker: added official Alpine Linux-based images, much lighter than Ubuntu-based images (about 30 MB vs 800 MB)
- build/cmake: removed OPENDHT_STATIC and OPENDHT_SHARED options. Use the standard BUILD_SHARED_LIBS option instead
- build/cmake: removed OPENDHT_TESTS option. Use the standard BUILD_TESTING option instead
- build/cmake: now using CTest
- build/meson: added experimental support for the Meson build system
- build/autotools: the Autotools build system is now deprecated and shall be removed when Meson support is considered stable

v2.6.0

- dht: added early announce/listen mechanism, significantly reducing the time taken for the first values to be published or received for a new search, without major trade-off.
- dht: fixed an issue that was causing invalid transaction IDs to be occasionally used
- dht: changed user agent to "o2"
- dhtinterface: added setOnPublicAddressChanged to listen for public address changes
- dhtrunner: added Context::publicAddressChangedCb to make use of the new API
- log: new logger API using {fmt}
- http: added static method Request::url_encode to encode url parameters.
- docker: Alpine image now based on Alpine 3.18
- build/meson: build dhtchat, dhtscanner

v2.6.0.4

- Fix Python binding with latest Cython version

v3.0.0

- Bump SONAME due to recent logging API change

Revision history for this message
Amin Bandali (bandali) wrote :
Amin Bandali (bandali)
description: updated
Revision history for this message
Łukasz Zemczak (sil2100) wrote :

Hello Amin! Thank you for filling in the FFe. It feels like a useful upload to do, but sadly this is too late. We just had Final Freeze, which is a very important freeze to have - at this point we stabilize the archive to prepare for next week's release.

How severe are the security fixes included in this release?

Revision history for this message
Amin Bandali (bandali) wrote :

Hello Łukasz, thank you for your reply.

The CVEs affecting jami (ring) 20230206.0~ds2-1.3:

https://security-tracker.debian.org/tracker/source-package/ring

See the 'bookworm' column.

I believe they're all in jami's vendored copy of pjsip, and most have a relatively high score.

All things considered, I believe it would be beneficial for our users if we instead include the latest jami 20230922.0~ds1-1 (from Debian unstable) in mantic (which needs opendht 3.0.0). As mentioned above, I maintain both of these packages in Debian and believe their latest versions from unstable to be in good shape for consideration for inclusion in mantic. And as I'm regularly in touch and work with upstream, I'd be happy to help with their maintenance in Ubuntu and help fix any potential issues.

opendht 3.0.0 would be a tiny transition (it has only one other reverse dep, jami, which has no reverse deps) which as mentioned above was already successfully completed in Debian unstable. But since neither of the two packages are seeded, even if I could upload them shortly after the next week's release (as an SRU) that would also be helpful.

Thank you again for considering this request.

Amin Bandali (bandali)
Changed in opendht (Ubuntu):
status: New → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.