[Bug 1948748] Re: [MIR] swtpm

[Christian Ehrhardt ]

Thanks Seth,
these tpm things are rather new so exposure to testing is low in general.
You are right, but I think we do not only need what you spotted.

In fact while reading this I found that upstream (Thanks Stefan) maintains great stable branches.
I think we should consider taking in
- https://github.com/stefanberger/libtpms/releases/tag/v0.9.1
- https://github.com/stefanberger/libtpms/releases/tag/v0.9.2
- https://github.com/stefanberger/libtpms/releases/tag/v0.9.3
- plus the patch you've found
- a ppc64 build fix from debian / upstream #297

I'll try to prepare this so that someone else review and ack (or
disagree). None of this needs a FFe IMHO all just fixes - we'll want to
hold back the actual upload until beta-freeze is over, but that does not
prevent to prepare the fixes.

In addition to reduce delta one day I filed:
- https://github.com/stefanberger/libtpms/pull/305

I have prepared that in:
PPA: https://launchpad.net/~paelzer/+archive/ubuntu/libtpms-jammy-0.9.3
MR: https://code.launchpad.net/~paelzer/ubuntu/+source/libtpms/+git/libtpms/+merge/417854

P.S. this will also resolve the fact that it is - so far - missing on
ppc64

Please anyone review and/or consume it from that PPA and let me know if
you are +1 on an upload of that.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gnutls28 in Ubuntu.
https://bugs.launchpad.net/bugs/1948748

Title:
  [MIR] swtpm

Status in autogen package in Ubuntu:
  Won't Fix
Status in gnutls28 package in Ubuntu:
  Won't Fix
Status in libtpms package in Ubuntu:
  New
Status in swtpm package in Ubuntu:
  In Progress

Bug description:
  [Availability]
  Available in universe in jammy.

  [Rationale]
  Needed in order to provide TPM functionality to VMs through kvm/libvirt; should be a Recommends: of qemu-system-x86

  [Security]
  Several security bugs found and fixed in libtpms this year http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=libtpms

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3746 currently
  remains unfixed in the version present in jammy (DoS bug).

  [Quality assurance]
  Limited history: package not present in Debian, and only in Ubuntu since jammy.

  [UI standards]
  N/A

  [Dependencies]
  swtpm and libtpms; no further dependencies outside of main.

  [Standards compliance]
  OK

  [Maintenance]
  To be maintained by the Foundations Team.

  [Background information]
  N/A

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/autogen/+bug/1948748/+subscriptions