epel

#287 Incompatible update proposal: botan2 in EPEL 8
Closed: Deferred by mrc0mmand. Opened by mrc0mmand.

Closed: Deferred
Reopen Issue

While patching a couple of recent CVEs in botan2 I came across a hurdle in EPEL 8 - the version there is too old (2.12.1 vs the latest 2.19.5), and the last (quite involved) CVE patch doesn't apply cleanly, since a lot of code has been moved around. I don't really feel confident to rewrite the patch (especially when it comes to security stuff).

Due to another incompatibility the latest botan2 version I can rebase to is 2.19.1 which is fine from the CVE point of view, as all patches there apply cleanly. This should also make backporting potential future patches slightly less annoying, as EPEL 8 is going to be with us for another ~5 years.

As for the incompatible part: the rebase to 2.19.1 bumps libbotan-2.so.12.12.1 to libbotan-2.so.19.19.1. Packages that'd need to be rebuild are as follows:

$ dnf repoquery --enablerepo "epel*" --whatrequires "libbotan-2.so*"
botan2-devel-0:2.12.1-4.el8.x86_64
corectrl-0:1.3.0-2.el8.x86_64
keepassxc-0:2.7.9-1.el8.x86_64
qca-qt5-botan-0:2.3.4-2.el8.x86_64

Thread on epel-devel: https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org/thread/GQ4QQKP2ZHW5VQTBAWNR5F3HYI3TQZIJ/

I'm +1 on this based on my research thus far.

Metadata Update from @salimma:
- Issue tagged with: meeting

A couple technical issues were raised during the EPSCO discussion (whom I do not represent), which also apply to Fedora's builds:
- python3-botan2 has no dependency on botan2. It uses ctypes to load the library, so there is no binding extension to automatically create the dependency on libbotan-2.so.*. Packaging guidelines require a hard dependency on the base packages (where such a dep makes sense, excluding -doc subpackages etc.), but here it is essential. https://src.fedoraproject.org/rpms/botan2/pull-request/5 fixes that, and if this is approved, should be fixed in epel (and probably stable fedora branches) as well.
- A question was raised as to why %python3_sitearch is used instead of %python3_sitelib. Given that the package as a whole is archful, I personally don't have a big problem with that, and it may be more trouble than its worth to "fix", if it's even really an issue in the first place.
Edited by yselkowitz

I filed a separate bug for the sitearch/sitelib problem. It's not a blocker for the EPEL 8 incompatible upgrade request, but worth considering fixing first and delivering in the same build to avoid having to ship another build later.

https://bugzilla.redhat.com/show_bug.cgi?id=2299798

This was approved at the meeting, so I'm taking the meeting tag off this.

As Carl said, you can go ahead with your current build if you want. Or you can wait and do an update before you do. That part is up to you.
Don't forget to send an announcement when it is ready to push out.

Metadata Update from @tdawson:
- Issue untagged with: meeting

Thanks for all the help! I merged all patches addressing the raised issues, backported them to EPEL 8, did a new botan2 build in a new side tag, and pinged all necessary parties again in [0].

[0] https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org/message/2HPAEA5R433CPTBHTWB7MU6Y4ZLRVOFA/

Hey again!

I'm trying to finally wrap this one and was wondering if there's any proven packager that could help me with that. I need help with rebuilding the dependencies (corectrl, keepassxc, and qca, see [0]), but so far I couldn't get ahold of anyone on both the epel-devel ML thread and the #epel matrix channel.

Thanks!

[0] https://lists.fedoraproject.org/archives/list/epel-devel@lists.fedoraproject.org/message/3ZJKCJYWMZYGWZPLOJ5OI3OIGRKVC5VQ/

Oh well, I didn't managed to get anyone to help me with the builds and then I got very sidetracked by other work. As I don't really have the time to pursue this change further (or maintain botan2 in general), I reverted the incompatible changes from the epel8 branch, so it should be back (more or less) where it was before.

Metadata Update from @mrc0mmand:
- Issue close_status updated to: Deferred
- Issue status updated to: Closed (was: Open)

This issue has been migrated to Fedora Forge:
https://forge.fedoraproject.org/epel/steering/issues/287

Please continue any further discussion there.
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.