Accepted xen 4.16.0+51-g0941d6cb-1 (source) into unstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 19 Feb 2022 20:29:32 +0100
Source: xen
Architecture: source
Version: 4.16.0+51-g0941d6cb-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Xen Team <pkg-xen-devel@lists.alioth.debian.org>
Changed-By: Hans van Kranenburg <hans@knorrie.org>
Closes: 976597 988901 992909 1002658
Changes:
xen (4.16.0+51-g0941d6cb-1) unstable; urgency=medium
.
* Update to new upstream version 4.16.0+51-g0941d6cb, which also contains
security fixes for the following issues:
- arm: guest_physmap_remove_page not removing the p2m mappings
XSA-393 CVE-2022-23033
- A PV guest could DoS Xen while unmapping a grant
XSA-394 CVE-2022-23034
- Insufficient cleanup of passed-through device IRQs
XSA-395 CVE-2022-23035
* Note that the following XSA are not listed, because...
- XSA-391 and XSA-392 have patches for the Linux kernel.
* Upload to unstable now, which obsoletes the Xen 4.14 FTBFS issue.
(Closes: #1002658)
.
xen (4.16.0-1~exp1) experimental; urgency=medium
.
Significant changes:
* Update to new upstream version 4.16.0. This also includes a security fix
for the following issue, which was not applicable to Xen 4.14 yet:
- certain VT-d IOMMUs may not work in shared page table mode
XSA-390 CVE-2021-28710
* No longer build any package for the i386 architecture. It was already not
possible to use x86_32 hardware because the i386 packages already
shipped a 64-bit hypervisor and PV shim. Running 32-bit utils with a
64-bit hypervisor requires using a compatibility layer that is fragile and
becomes harder to maintain and test upstream. This change ends the 'grace
period' in which users should have moved to using a fully 64-bit dom0.
- debian/{control,rules,salsa-ci.yml,xen-utils-V.install.vsn-in}: make the
necessary changes
- Remove the Recommends on libc6-xen, which already actually does not
exist any more. (Closes: #992909)
- Drop patch "tools/tests/x86_emulator: Pass -no-pie -fno-pic to gcc on
x86_32" because it is not relevant any more.
.
Changes related to upgrading to Xen 4.16:
* debian/control: adjust to 4.16 [Maximilian Engelhardt]
* Drop patches that have been applied upstream
* Refresh remaining patches if needed
* debian: follow upstream removal of '.sh' suffix in xl bash_completion file
[Maximilian Engelhardt]
* debian/control, debian/libxenstore*: ship a libxenstore4 package instead
of libxenstore3.0, since upstream bumped the soname
[Maximilian Engelhardt]
.
Packaging minor fixes and improvements [Maximilian Engelhardt]:
* debian/rules: set SOURCE_BASE_DIR to the top level build dir so that the
"Display Debian package version in hypervisor log" patch can use it.
* Add patch "xen/arch/x86: make objdump output user locale agnostic" to fix
reproducable builds. This patch will also be sent upstream.
* d/rules: remove reproducible=+fixfilepath from DEB_BUILD_MAINT_OPTIONS
* d/salsa-ci.yml: Explicitly set RELEASE variable to unstable
* d/salsa-ci.yml: disable cross building as it's currently not working
* debian: call update-grub when installing/removing xen-hypervisor-common
(Closes: #988901)
* debian: fix dependency generation for python after dh-python was fixed
first. (Closes: #976597)
* debian/rules: remove unused pybuild settings
.
Packaging minor fixes and improvements:
* Improve patches for building the PV shim separately. This enables to
drop the extra Revert of an upstream commit that was done in
4.14.0+80-gd101b417b7-1~exp1:
- Drop patch: Revert "pvshim: make PV shim build selectable from
configure"
- Update patch "[...] Respect caller's CONFIG_PV_SHIM" to follow moving
of a line to a different file
- Drop patch: "tools/firmware/Makefile: CONFIG_PV_SHIM: enable only on
x86_64" because that's now already the default upstream
* debian/control.md5sum: remove this obsolete file
* Merge patches "vif-common: disable handle_iptable" and
"t/h/L/vif-common.sh: fix handle_iptable return value" into a single
patch, since the latter was a fix for the first.
* debian/control: change the Uploaders email address for Ian Jackson,
since he does not work at Citrix any more now
Checksums-Sha1:
f2d0ec91131ecff7291ac88a64597f5e7abf6972 4117 xen_4.16.0+51-g0941d6cb-1.dsc
5938109ceb039a0aaf253cce72da9f8ea0745dfd 4542340 xen_4.16.0+51-g0941d6cb.orig.tar.xz
ba751d44993de4aa49f5a59f2553b8fb506df8ad 128356 xen_4.16.0+51-g0941d6cb-1.debian.tar.xz
Checksums-Sha256:
34778578fcbfcbae2c47a6caf6385355af9251ebe978d852f6d88cfd7af4ed7f 4117 xen_4.16.0+51-g0941d6cb-1.dsc
55bb3071592684dacecf7ab89574bc68afa50faeb14382179dfbe567a3831cbe 4542340 xen_4.16.0+51-g0941d6cb.orig.tar.xz
4515137736057c0522aa20ce0822bc36c678213e0d31cad8344dd7919afdf077 128356 xen_4.16.0+51-g0941d6cb-1.debian.tar.xz
Files:
6a9d0424f430e916af82ff14b1f2bbd7 4117 admin optional xen_4.16.0+51-g0941d6cb-1.dsc
c401b5c8834939e63c63c118e69a3885 4542340 admin optional xen_4.16.0+51-g0941d6cb.orig.tar.xz
249a0f42c03ad5aeefb39699166a10ac 128356 admin optional xen_4.16.0+51-g0941d6cb-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEESWyddwNaG9637koYssHfcmNhX2wFAmIRVBAACgkQssHfcmNh
X2xDfA/8Cld8sXQQfU4Dnv/10iOnsJ/gU0CZhQpD3+IIbqfaayul3ibiEm0hk+nX
dffepKSSEycme4tCCR1DPz7KVSc2LyrnHn2BJP5Fz2vVwiGbbAG9Q0VAXN64+8oN
tupORI4QWee4aC5wqien6hivWuhTNjHo2xQr14U4vMtAUNdNZxRIQ2z/B6tGwj94
m/0x5xPde1BdGeltnEzBENbZhBvJNMD1aRx787rZRXv4jKI2S25Mv5npO8JADPxf
nCGTljbZCcA8i6sk3C7oRB2ip4iVimYB0dR+0qqJi+9G+ZnfJbHYxISPvD5o4b4R
0LZQtp3XnfLjJMifW5eTJeMFR/hyogJZZa63ppgmFSDrprDSZhOvIkPVOF75HVUE
Dcb+kL31i7czJu5+DwXivckbWky2a3XzhhB+uNsRIqYNo36tT9jKJeN5pJPfBE7d
0UcnD7cWOyzZB/XExX0gaV7GGPY/B3uyTO9IN3YzjMRjGjuJZ+Vh4hClFBMxlz+m
06IsBahy0RQU9dPVpulf4HJrxlYYTSllrrO+1JCpyHUj4Z19DNE7bMg/0TPTFiW0
NA5TB4xwnxUrWaOr1YHaEcQIN2qZFJSG7ej8HrvMWfwkYCY4NROsIgpmT0rhGv8Z
/9zBPSby8GRxRu5K1VQc2KLeSwKT6qv/djP63Kq6qVwgTi6DvUg=
=ch60
-----END PGP SIGNATURE-----