[SRU] VirtualBox needs Security Patches

Fixes available here https://launchpad.net/~costamagnagianfranco/+archive/ubuntu/autoconf/+packages

I uploaded them in unapproved queue

Please look at bug: 1736116 for an SRU template

Sadly this is not something I am willing to accept in this state as an SRU with my SRU reviewer hat on. The bug is missing the standard SRU template information, with a detailed test case to be performed and the regression potential analysis. Sure, we all know that the recent security patches should be present in every stable series, but this does not warrant us skipping the usual SRU policy. Both uploads generally are new major upstream releases, composed of a huge diff (13 MB for xenial). Letting this in without a plan of testing that would make sure users are not broken with a jump like this is not acceptable.

There does not seem to be a long-standing MRE for virtualbox, so we're also missing all the essential information that would allow us to accept an upload like this. Does virtualbox provide a sufficient test coverage for all the changes introduced? How is the autopkgtest coverage for the package? Please refer to the microreleases section of the policy for all the info we'd need to have in easily consumable format [1].

In other cases this bug might require an ACK from a technical board member as well.

That being said, for now I cannot accept it until all the criteria are fulfilled.

[1] https://wiki.ubuntu.com/StableReleaseUpdates#New_upstream_microreleases

The bare minimum, I suppose, would be to provide us with some general set of test steps testers should perform to check if anything that's not already broken regressed or not. The related bug with 4.13 kernels seems to impact xenial with the HWE stack - but since the regular 4.4 kernels still work, I guess we'd need to define a set of general tests that should be performed after the package lands in -proposed to get an overall feel of whether things seem to work as expected.

Could you provide such a test case? I guess that would make the SRU minimal-compliant enough for me to accept it.

Thanks!

Hello, the MRE has been discussed many times, e.g. I did the same work a lot of times, including describing the MRE exception paperwork.

e.g. LP: #1594493
LP: #1629870 (here you can see why the upstream testsuite is better than autopkgtests)
LP: #1674819
LP: #1683965
LP: #1729568

If we compare the debdiff I got uploaded for trusty, the debdiff is even worse

diff from 4.3.10-dfsg-1 (in Debian) to 4.3.34-dfsg-1+deb8u1ubuntu1.14.04.1 (13.0 MiB)

Also xenial has been bumped from 5.0.18 to 5.0.40, just in 4 minor updates, but the debdiff between what is in release, and what is in updates is scary too.

Just to be clear on all the above scary debdiffs, the TOTAL number of bugs opened because of them is...

ONE :)
(I named the virtualbox and virtualbox-hwe file init files with the same alias, so installing them without purging the other one resulted in a init system warning).
I fixed that one in a minor update, as soon as I found out the root cause for it.

If we consider the upstream debdiff, ZERO new bugs found.

That said, I understand the rationale for having a reproducing testcase, while security fixes don't need it usually, I can say that the case for testing is:

- install a xenial/artful guest machine.
  - check if 3d works, both enabled and disabled.
  - check if other guest machines still work, e.g. Windows/Other linuxes
  - check if 3d with HWE stack still work, reboot and see if everything works as expected.
  - run xenial with old and new hwe kernels, it should boot in both cases

  ^^ do the same with virtualbox-guest-additions-iso package, after removing the guest* apt stuff

This way you can test the guest stuff

- install virtualbox inside that xenial/artful guest machine, and install another linux inside that VM.
  - everything should run as expected, except for being slow (a VM inside a VM needs a lot of powerful hardware)

This is the testsuite I usually run, before asking for an SRU/MRE accept.

I also ask a lot of colleagues to test my ppa, and their machines, so I can say I'm happy with the upload, even before filing the paperwork.

That said, upstream has a really serious (not public) testsuite, they run it with the packages their provide, and this is the best reason for sticking with upstream new releases, instead of just cherry-picking new patches, because I don't want to diverge from their code, this makes regressions easier to track/reproduce, and fixes to be applied.

I never got a regression, even if in all the cases I was scared about the debdiffs, and I really think even with this upload we will be safe to go.

I case the package goes in proposed, I'll test artful in my laptop (I still run artful here :p )
and xenial with the VM I usually use.

I'll report back all the new testing done, if you care, but honestly the tests we will need, will come as new bug reports in a matter of *minutes* after the upload goes in proposed
(virtualbox is a really strange package, each time I mess up with something, it really takes minutes to get the first bug report in Debian or Ubuntu).
I can't test different hardware/CPU vendors (specially because of such CVEs), but I think monitoring new bug reports is the best way we can test i...

BTW, bugs like LP: #1754991 can be probably also considered duplicated of this one, so confirming their fix will be sufficient to confirm also this one (the Spectre/Meltdown kernel fixes needs to be followed by virtualbox changes too)

Ok, this is now more clear to me from the SRU-team's POV, thanks. During verification please briefly describe some of the test-cases you have performed and I'll be on cloud nine.

Hello Lonnie, or anyone else affected,

Accepted virtualbox into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox/5.1.34-dfsg-0ubuntu1.17.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-guest-additions-iso into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-guest-additions-iso/5.1.34-0ubuntu1.17.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I am for now not accepting the virtualbox-ext-pack for artful as I first would like to get confirmation about something: looking at the debian/control and debian/rules version variables, those seem to be using the 5.1.32 version string while the package itself is versioned as 5.1.34. Is that a mistake? Or is that intentional?

Hello Lonnie, or anyone else affected,

Accepted virtualbox into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox/5.1.34-dfsg-0ubuntu1.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-hwe into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-hwe/5.1.34-dfsg-0ubuntu1.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

@sil2100 thanks!

>I am for now not accepting the virtualbox-ext-pack for artful as I first would like to get confirmation about something: looking at the debian/control and debian/rules version variables, those seem to be using the 5.1.32 version string while the package itself is versioned as 5.1.34. Is that a mistake? Or is that intentional?

it is an useless variable. we use DEB_VERSION_UPSTREAM and not that variable to compute runtime dependencies.

that variable is used only to create a new fake tarball, just to import-orig --pristine-tar it
VERSION=5.1.32
tarball:
        mkdir virtualbox-ext-pack_$(VERSION)
        tar cJvf virtualbox-ext-pack_$(VERSION).orig.tar.xz virtualbox-ext-pack_$(VERSION)
        rm -rf virtualbox-ext-pack_$(VERSION)
        mv virtualbox-ext-pack_$(VERSION).orig.tar.xz ..

so, I can bump it, or you can accept the current one, the resulting deb will be just the same!
let me know if you want to reject and I'll quickly reupload

Hello Lonnie, or anyone else affected,

Accepted kbuild into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/kbuild/1:0.1.9998svn2814+dfsg-2~ubuntu16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-guest-additions-iso into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-guest-additions-iso/5.1.34-0ubuntu1.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-ext-pack into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-ext-pack/5.1.34-0ubuntu1.17.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-ext-pack into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-ext-pack/5.1.34-0ubuntu1.16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox/5.1.34-dfsg-0ubuntu1.17.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-guest-additions-iso into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-guest-additions-iso/5.1.34-0ubuntu1.16.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox/5.1.34-dfsg-0ubuntu1.16.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-hwe into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-hwe/5.1.34-dfsg-0ubuntu1.16.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Test results will be reported on #1736116

Hello,
The package virtualbox-ext-pack (5.1.34-0ubuntu1.16.04.1) from xenial-proposed install the version 5.1.32 of the VirtualBox Extension Pack, instead of the 5.1.34.

term.log:

Paramétrage de virtualbox-ext-pack (5.1.34-0ubuntu1.16.04.1) ...
virtualbox-ext-pack: downloading: http://download.virtualbox.org/virtualbox/5.1.32/Oracle_VM_VirtualBox_Extension_Pack-5.1.32.vbox-extpack
The file will be downloaded into /usr/share/virtualbox-ext-pack
License accepted.
0%...10%...20%...30%...40%...50%...60%...70%...80%...90%...100%
Successfully installed "Oracle VM VirtualBox Extension Pack".

oops, fixed and reuploaded

Hello Lonnie, or anyone else affected,

Accepted virtualbox-ext-pack into artful-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-ext-pack/5.1.34-0ubuntu1.17.10.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-artful to verification-done-artful. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-artful. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Hello Lonnie, or anyone else affected,

Accepted virtualbox-ext-pack into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/virtualbox-ext-pack/5.1.34-0ubuntu1.16.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I've installed virtualbox (and virtualbox-qt) 5.1.34-dfsg-0ubuntu1.17.10.2 from artful-proposed. I can confirm that it fixes bug 1754991. I haven't done a thorough regression test, but everything else seems to work as expected.

Thanks for updating, LocutusOfBorg :)

This bug was fixed in the package kbuild - 1:0.1.9998svn2814+dfsg-2~ubuntu16.04.1

---------------
kbuild (1:0.1.9998svn2814+dfsg-2~ubuntu16.04.1) xenial; urgency=medium

  * SRU to xenial, to make virtualbox 5.1 build correctly
  * New upstream version 5.1.32-dfsg
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13

 -- Gianfranco Costamagna <email address hidden> Fri, 02 Feb 2018 14:51:36 +0100

The verification of the Stable Release Update for kbuild has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

This bug was fixed in the package virtualbox - 5.1.34-dfsg-0ubuntu1.17.10.2

---------------
virtualbox (5.1.34-dfsg-0ubuntu1.17.10.2) artful; urgency=medium

  * New upstream version 5.1.34-dfsg
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Apply 69989 to fix GL issue.
  * Lower compat level to 9

 -- Gianfranco Costamagna <email address hidden> Fri, 02 Feb 2018 13:27:46 +0100

This bug was fixed in the package virtualbox-ext-pack - 5.1.34-0ubuntu1.17.10.2

---------------
virtualbox-ext-pack (5.1.34-0ubuntu1.17.10.2) artful; urgency=medium

  * Really point to 5.1.34 source to download

virtualbox-ext-pack (5.1.34-0ubuntu1.17.10.1) artful; urgency=medium

  * New upstream release
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Lower compat level to 9
  * Update license key and text.

 -- Gianfranco Costamagna <email address hidden> Thu, 15 Mar 2018 12:26:08 +0100

This bug was fixed in the package virtualbox-guest-additions-iso - 5.1.34-0ubuntu1.17.10.1

---------------
virtualbox-guest-additions-iso (5.1.34-0ubuntu1.17.10.1) artful; urgency=medium

  * New upstream version 5.1.34
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Lower compat level to 9

 -- Gianfranco Costamagna <email address hidden> Fri, 02 Feb 2018 14:49:24 +0100

This bug was fixed in the package virtualbox - 5.1.34-dfsg-0ubuntu1.16.04.2

---------------
virtualbox (5.1.34-dfsg-0ubuntu1.16.04.2) xenial; urgency=medium

  * New upstream version 5.1.34-dfsg
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Apply 69989 to fix GL issue.
  * Lower compat level to 9

 -- Gianfranco Costamagna <email address hidden> Fri, 02 Feb 2018 13:27:46 +0100

This bug was fixed in the package virtualbox-ext-pack - 5.1.34-0ubuntu1.16.04.2

---------------
virtualbox-ext-pack (5.1.34-0ubuntu1.16.04.2) xenial; urgency=medium

  * Really point to 5.1.34 source to download

virtualbox-ext-pack (5.1.34-0ubuntu1.16.04.1) xenial; urgency=medium

  * New upstream release
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Lower compat level to 9
  * Update license key and text.

 -- Gianfranco Costamagna <email address hidden> Thu, 15 Mar 2018 12:26:08 +0100

This bug was fixed in the package virtualbox-guest-additions-iso - 5.1.34-0ubuntu1.16.04.2

---------------
virtualbox-guest-additions-iso (5.1.34-0ubuntu1.16.04.2) xenial; urgency=medium

  * New upstream version 5.1.34
    LP: #1746316 -> security patches for spectre and meltdown
    LP: #1736116 -> freeze with kernel >= 4.13
  * Lower compat level to 9

 -- Gianfranco Costamagna <email address hidden> Fri, 02 Feb 2018 14:49:24 +0100