Ubuntu
cargo package

rustc 1.63 and cargo 0.64 required by firefox 108

Bug #1995096 reported by Rico Tzschichholz
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
cargo (Ubuntu)
Fix Released
Undecided
Canonical Foundations Team
Bionic
Fix Released
Undecided
Canonical Foundations Team
Focal
Fix Released
Undecided
Canonical Foundations Team
Jammy
Fix Released
Undecided
Canonical Foundations Team
Kinetic
Fix Released
Undecided
Canonical Foundations Team
Lunar
Fix Released
Undecided
Canonical Foundations Team
rustc (Ubuntu)
Fix Released
Undecided
Canonical Foundations Team
Bionic
Fix Released
Undecided
Canonical Foundations Team
Focal
Fix Released
Undecided
Canonical Foundations Team
Jammy
Fix Released
Undecided
Canonical Foundations Team
Kinetic
Fix Released
Undecided
Canonical Foundations Team
Lunar
Fix Released
Undecided
Canonical Foundations Team

Bug Description

Firefox 108+ requires rustc 1.63 and cargo 0.64 to build¹.

The beta phase for Firefox 108.0 begins on 2022-11-14 and release candidates will be available from 2022-12-05.

We will need these in Ubuntu 23.04 and all supported releases: bionic, focal, jammy, kinetic.

¹ https://bugzilla.mozilla.org/show_bug.cgi?id=1797869

Rust toolchain upgrades are usually relatively safe from a FTBFS point of view, since new releases are subjected to a crater run, crater being a tool that compiles the entirety of the crates.io packages.

See original description

CVE References

Olivier Tilloy (osomon)
Changed in cargo (Ubuntu Bionic):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in cargo (Ubuntu Focal):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in cargo (Ubuntu Jammy):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in cargo (Ubuntu Kinetic):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in cargo (Ubuntu Lunar):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in rustc (Ubuntu Bionic):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in rustc (Ubuntu Focal):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in rustc (Ubuntu Jammy):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in rustc (Ubuntu Kinetic):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Changed in rustc (Ubuntu Lunar):
assignee: nobody → Canonical Foundations Team (canonical-foundations)
Rico Tzschichholz (ricotz)
description: updated
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cargo (Ubuntu Bionic):
status: New → Confirmed
Changed in cargo (Ubuntu Focal):
status: New → Confirmed
Changed in cargo (Ubuntu Jammy):
status: New → Confirmed
Changed in cargo (Ubuntu Kinetic):
status: New → Confirmed
Changed in cargo (Ubuntu):
status: New → Confirmed
Changed in rustc (Ubuntu Bionic):
status: New → Confirmed
Changed in rustc (Ubuntu Focal):
status: New → Confirmed
Changed in rustc (Ubuntu Jammy):
status: New → Confirmed
Changed in rustc (Ubuntu Kinetic):
status: New → Confirmed
Changed in rustc (Ubuntu):
status: New → Confirmed
Revision history for this message
Simon Chopin (schopin) wrote :

I guess I forgot to mention here that the builds are available in the rust-updates PPA, as usual:

https://launchpad.net/~ubuntu-mozilla-security/+archive/ubuntu/rust-updates

My bad :)

Olivier Tilloy (osomon)
Changed in cargo (Ubuntu Bionic):
status: Confirmed → Fix Committed
Changed in cargo (Ubuntu Focal):
status: Confirmed → Fix Committed
Changed in cargo (Ubuntu Jammy):
status: Confirmed → Fix Committed
Changed in cargo (Ubuntu Kinetic):
status: Confirmed → Fix Committed
Changed in cargo (Ubuntu Lunar):
status: Confirmed → Fix Committed
Changed in rustc (Ubuntu Bionic):
status: Confirmed → Fix Committed
Changed in rustc (Ubuntu Focal):
status: Confirmed → Fix Committed
Changed in rustc (Ubuntu Jammy):
status: Confirmed → Fix Committed
Changed in rustc (Ubuntu Kinetic):
status: Confirmed → Fix Committed
Changed in rustc (Ubuntu Lunar):
status: Confirmed → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rustc - 1.63.0+dfsg0ubuntu1-0ubuntu2

---------------
rustc (1.63.0+dfsg0ubuntu1-0ubuntu2) lunar; urgency=medium

  * d/control: fix wrong dependencies on previous release

 -- Simon Chopin <email address hidden> Thu, 01 Dec 2022 16:58:41 +0100

Changed in rustc (Ubuntu Lunar):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cargo - 0.64.0ubuntu1-0ubuntu1

---------------
cargo (0.64.0ubuntu1-0ubuntu1) lunar; urgency=medium

  * New upstream release (LP: #1995096):
    - Update vendored sources info
  * Bump the libgit2-related crates to get libgit2 1.5.0 bindings
  * make_orig_multi.sh: only use xz for vendor orig tarball on Ubuntu

 -- Simon Chopin <email address hidden> Tue, 29 Nov 2022 15:05:19 +0100

Changed in cargo (Ubuntu Lunar):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rustc - 1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1

---------------
rustc (1.65.0+dfsg0ubuntu1-0ubuntu0.22.04.1) jammy; urgency=medium

  * Backport to jammy (LP: #2000839)
  * Comment out vendored source tracking

 -- Simon Chopin <email address hidden> Fri, 20 Jan 2023 18:17:44 +0100

Changed in rustc (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rustc - 1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04

---------------
rustc (1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.20.04) focal; urgency=medium

  * Update the vendored LLVM 15 to the latest bugfix release to fix ppc64el
    build.
  * Cherry-pick upstream patch to fix FTBFS on ppc64el and arm64

 -- Simon Chopin <email address hidden> Wed, 25 Jan 2023 18:02:05 +0100

Changed in rustc (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cargo - 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.22.04

---------------
cargo (0.66.0+ds0ubuntu0.libgit2-0ubuntu0.22.04) jammy; urgency=medium

  * Backport to Jammy (LP: #2000839)
  * Re-enable libgit2 vendoring:
    - d/control: remove libgit2-dev and libhttp-parser-dev from B-D
    - include Rust provided patches to fix CVE-2022-46176
  * Remove the need of dh-cargo

 -- Zixing Liu <email address hidden> Wed, 18 Jan 2023 13:42:34 -0700

Changed in cargo (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cargo - 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04

---------------
cargo (0.66.0+ds0ubuntu0.libgit2-0ubuntu0.18.04) bionic; urgency=medium

  * Backport to Bionic (LP: #2000839)
  * Re-enable libgit2 vendoring:
    - d/control: remove libgit2-dev and libhttp-parser-dev from B-D
    - include Rust provided patches to fix CVE-2022-46176
  * Remove the need of dh-cargo
  * Downgrade the debhelper requirements

 -- Zixing Liu <email address hidden> Wed, 18 Jan 2023 13:42:34 -0700

Changed in cargo (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package rustc - 1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04

---------------
rustc (1.65.0+dfsg0ubuntu1~llvm2-0ubuntu0.18.04) bionic; urgency=medium

  * Update the vendored LLVM 15 to the latest bugfix release to fix ppc64el
    build.
  * Cherry-pick upstream patch to fix FTBFS on ppc64el and arm64

 -- Simon Chopin <email address hidden> Wed, 25 Jan 2023 18:02:05 +0100

Changed in rustc (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cargo - 0.66.0+ds0ubuntu0.libgit2-0ubuntu0.20.04

---------------
cargo (0.66.0+ds0ubuntu0.libgit2-0ubuntu0.20.04) focal; urgency=medium

  * Backport to Focal (LP: #2000839)
  * Re-enable libgit2 vendoring:
    - d/control: remove libgit2-dev and libhttp-parser-dev from B-D
    - include Rust provided patches to fix CVE-2022-46176
  * Remove the need of dh-cargo

 -- Zixing Liu <email address hidden> Wed, 18 Jan 2023 13:42:34 -0700

Changed in cargo (Ubuntu Focal):
status: Fix Committed → Fix Released
Rico Tzschichholz (ricotz)
Changed in cargo (Ubuntu Kinetic):
status: Fix Committed → Fix Released
Changed in rustc (Ubuntu Kinetic):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.