Bug#1036231: mbedtls: please update to 3.4.0 for cmake support

[Matthias Geiger]

Package: mbedtls
Severity: wishlist
X-Debbugs-Cc: matthias....@tutanota.de

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Dear Maintainer,

please update mbedtls to 3.4.0 . The 3.x release track includes the .cmake file
I'd need for another library I'm trying to package.

regards,

werdahias


- -- System Information:
Debian Release: 12.0
APT prefers testing-security
APT policy: (500, 'testing-security'), (500, 'testing'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.3.2-surface (SMP w/8 CPU threads; PREEMPT)
Kernel taint flags: TAINT_CRAP
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

-----BEGIN PGP SIGNATURE-----

iQJUBAEBCgA+FiEEwuGmy/3s5RGopBdtGL0QaztsVHUFAmRlHGggHG1hdHRoaWFz
LmdlaWdlcjEwMjRAdHV0YW5vdGEuZGUACgkQGL0QaztsVHXZHRAAu7fQZU2yxqsc
0ZTISQWZkc8DQBnFEb0Jm0Krq4n7PPbmC6RS+JhnubB5XISRbtyx6M44boa7APHM
8CooKCTQwyDwGXPAM0MeW0Wf6RNnYoZjWAPcigboIj2ntdYdcDo46AovE2BNFaw5
TkoPmV1gMPpVngZHsAO4hc6AIHHF5U7XIKCuNcg6kwGoFCYtIIuTD74ZPjZT6PU6
ysfD4VHTWc2CuUixxYhZ/z8OZjJKL8OcUZQdc020cUZ7A9t/8soxSeKUW7rnXi18
XgNPjUlV8hS3By1CHlbD6FcD+vm7L+9PwDCiTxw3OUU7MfQnke/yPn1OF3WotEck
dz+lofuYb9SuwA3Mw2EP96eHPAjPWg/GXhUobtmjXp2g4CQ370Dl9xbzbvfrJsIv
Kk1waZ3ZgIP6Xq14be/eOIqMVF6OqYNrAdUy2AXfvG6NlaqEheGXa0gjKJlVSn5s
tfM5NYLHbH3f/3GxTVnymnHbY151BJeXTAErZKS8rAPEIFqwMrTSyvM+OKLhBec4
YcyI48maM4nCq5QGQ5ouCrUQHNnPTNDGW4FVCKCcxlVmw16dL5QsVJXow1rum/46
X5MU9pYErU4r9h7miY4bupO7ZWzIwtrWYSCdIMM+Cxdt8MMBnwZARLyLIrzVT8ue
IQsXYtUqK9RCnJ/U9xHov2YyKCwmUss=
=w0ps
-----END PGP SIGNATURE-----

[Andrea Pappacoda]

Il giorno mer 17 mag 2023 alle 20:26:52 +02:00:00, Matthias Geiger
<matthias....@tutanota.de> ha scritto:

> please update mbedtls to 3.4.0 . The 3.x release track includes the
> .cmake file
> I'd need for another library I'm trying to package.

Hi Matthias, thanks for the report.

I'd love to package the 3.x branch, but there currently isn't any LTS
release for it; the latest LTS is 2.28.x. I'm not going to package
non-LTS versions in Debian, since they don't fit nicely with the stable
release scheme.

If what you need for your package is just CMake dependency discovery,
and not any library feature specific to the 3.x branch, what you could
do instead is to patch the upstream build script to make use of a Find
module which doesn't rely on .cmake Config files being available.

I currently do this for the yuzu package, which also depends on
mbedtls. You can find my FindMbedTLS.cmake here:
<https://github.com/yuzu-emu/yuzu/pull/7044/files>

That file is tuned to yuzu's needs, i.e. it checks for the non-default
CMAC support and only looks for the mbedcrypto library. If you can
point me to the upstream project I'd be able to suggest a more
appropriate file, or even send a patch upstream.

Thanks again for your report! I'll wait for your reply :)

[Philippe Coval]

Package: mbedtls
Followup-For: Bug #1036231

Dear Maintainer,

cmake support is also desirabe on current version.

I just suggested the idea upstream for 2.28 branch:

https://github.com/Mbed-TLS/mbedtls/issues/298#issuecomment-1694199841#

I think it would worth upstreaming a patch for providing the extra file,

Feel free to join IRC #debian-iot if there is a need to coordinate

ps: May this ticket title changed to just support cmake in current version

-- System Information:
Debian Release: 10.13
APT prefers oldoldstable-updates
APT policy: (500, 'oldoldstable-updates'), (500, 'oldoldstable')
Architecture: armhf (armv7l)

Kernel: Linux 5.15.93-sunxi (SMP w/2 CPU cores)
Kernel taint flags: TAINT_CRAP
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8), LANGUAGE=en_US (charmap=UTF-8) (ignored: LC_ALL set to en_US.UTF-8)

[Jakob Haufe]

On Wed, 17 May 2023 21:51:44 +0200 Andrea Pappacoda <and...@pappacoda.it> wrote:

> I'd love to package the 3.x branch, but there currently isn't any LTS
> release for it; the latest LTS is 2.28.x. I'm not going to package
> non-LTS versions in Debian, since they don't fit nicely with the stable
> release scheme.

I think that ship has sailed. According to [1], 2.28.x will be supported
until the end of 2024, so it will be EOL during the bookworm stable period.

Would you be open to package 3.x for experimental so ITPs depending on it can
progress?

If you intend to have 2.x around for longer, maybe a separate source package
(mbedtls3 ?) is necessary to allow packaging them in parallel.

Cheers,
sur5r

[1] https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7

--
ceterum censeo microsoftem esse delendam.