liboqs - Debian Package Tracker

general

source: liboqs (main)
version: 0.8.0-1
maintainer: Andrius Merkys (DMD)
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

unstable: 0.8.0-1

versioned links

0.7.2-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.8.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

liboqs-dev
liboqs3

action needed

Multiarch hinter reports 1 issue(s) high

There are issues with the multiarch metadata for this package.

liboqs-dev conflicts on /usr/include/oqs/oqsconfig.h on mips64el <-> mipsel

Created: 2021-11-17 Last update: 2024-11-21 08:30

A new upstream version is available: 0.11.0 high

A new upstream version 0.11.0 is available, you should consider packaging it.

Created: 2023-10-02 Last update: 2024-11-21 07:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2024-31510: An issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /pqcrystals-dilithium-standard_ml-dsa-44-ipd_avx2/sign.c component.
CVE-2024-36405: liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A control-flow timing lean has been identified in the reference implementation of the Kyber key encapsulation mechanism when it is compiled with Clang 15-18 for `-Os`, `-O1`, and other compilation options. A proof-of-concept local attack on the reference implementation leaks the entire ML-KEM 512 secret key in ~10 minutes using end-to-end decapsulation timing measurements. The issue has been fixed in version 0.10.1. As a possible workaround, some compiler options may produce vectorized code that does not leak secret information, however relying on these compiler options as a workaround may not be reliable.

Created: 2024-05-27 Last update: 2024-08-15 08:30

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2023-06-21 Last update: 2024-11-21 08:05

1 bug tagged patch in the BTS normal

The BTS contains patches fixing 1 bug, consider including or untagging them.

Created: 2024-02-25 Last update: 2024-11-21 08:01

12 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit a021e3d53029b1deb05454e94a66115339185c92
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Apr 22 09:35:07 2024 +0300

    Collate more license statements.

commit 8f74ae5506d5922fcde948006cf8311894a756e3
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Apr 22 09:32:19 2024 +0300

    Identify licenses for src/kem/ml_kem/*.

commit 93477bb08839115743e0525d30100685eca5d635
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Apr 22 09:30:29 2024 +0300

    src/kem/classic_mceliece/* is public domain.

commit 7cec4fd612ccbc4a157fbc0b3f9b1301bfa03404
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Apr 22 09:28:38 2024 +0300

    Attempt to collate license statements in debian/copyright.src.

commit 309d2eff1813fce3891973f80c3f68c88ef5d7ef
Author: Andrius Merkys <merkys@debian.org>
Date:   Mon Apr 22 02:20:18 2024 -0400

    Add an attempt to collect licenses for src/ directory.

commit 4bed3b3be5d3bc2094f60501d5b17ad6b6f939fa
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:29:03 2024 -0400

    Start to rewrite debian/copyright from debian/copyright.hints.

commit ef61876b2c27a03384c986c017694f0fd53abda4
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:28:46 2024 -0400

    Update debian/copyright.hints.

commit 486b1e73861f8b3d056e47ea9cf74a3fb20cca82
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:28:24 2024 -0400

    Add one more new copyright entry.

commit be38942ffc5eb5ff98006164dfd2e8ae3c1f3a98
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:26:01 2024 -0400

    Adjust debian/copyright.

commit af0232f90c621433947614ed7c3bcd0d92d7dfbf
Merge: ed7c6c2 cebbf59
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:20:06 2024 -0400

    Update upstream source from tag 'upstream/0.10.0'
    
    Update to upstream version '0.10.0'
    with Debian dir 7489ec09ce565923e137e340f68bbe28b0c7080d

commit cebbf59840beba767623f093ee4f62f8f66cfb4d
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:19:49 2024 -0400

    New upstream version 0.10.0

commit ed7c6c2f6a2cdc8dd34e3045900ae6b74523f656
Author: Andrius Merkys <merkys@debian.org>
Date:   Fri Apr 19 01:17:22 2024 -0400

    Add debian/copyright.hints generated by licensecheck.

Created: 2024-04-22 Last update: 2024-11-18 02:05

RFH: The maintainer is looking for help with this package. normal

The current maintainer is looking for someone who can help with the maintenance of this package. If you are interested in this package, please consider helping out. One way you can help is offer to be a co-maintainer or triage bugs in the BTS. Please see bug number #1068294 for more information.

Created: 2024-04-03 Last update: 2024-04-03 09:04

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-03-10 Last update: 2024-03-10 11:33

debian/patches: 2 patches to forward upstream low

Among the 3 debian patches available in version 0.8.0-1 of the package, we noticed the following issues:

2 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-06-16 20:54

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.0 instead of 4.6.0).

Created: 2022-05-11 Last update: 2024-04-07 13:15

testing migrations

excuses:
- Migration status for liboqs (- to 0.8.0-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ Updating liboqs would introduce bugs in testing: #1000303, #1065802, #1073250
- ∙ ∙ Impossible Depends: liboqs -> libssl3/3.1.5-1/armel
- ∙ ∙ Impossible Depends: liboqs -> libssl3/3.1.5-1/armhf
- ∙ ∙ missing build on mips64el
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/libo/liboqs.html
- ∙ ∙ 524 days old (needed 5 days)
- Not considered

news

[rss feed]

[2023-06-16] Accepted liboqs 0.8.0-1 (source) into unstable (Andrius Merkys)
[2023-06-15] Accepted liboqs 0.8.0~rc1-1 (source amd64) into unstable (Debian FTP Masters) (signed by: Andrius Merkys)
[2022-09-04] Accepted liboqs 0.7.2-2 (source) into unstable (Andrius Merkys)
[2022-09-04] Accepted liboqs 0.7.2-1 (source) into unstable (Andrius Merkys)
[2022-08-11] Accepted liboqs 0.7.2~rc2-1 (source) into unstable (Andrius Merkys)
[2022-08-06] Accepted liboqs 0.7.2~rc1-1 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Andrius Merkys)
[2021-12-17] Accepted liboqs 0.7.1-1 (source) into unstable (Andrius Merkys)
[2021-12-10] Accepted liboqs 0.7.1~rc1-1 (source) into unstable (Andrius Merkys)
[2021-12-06] Accepted liboqs 0.7.0.39.g8e22871f-1 (source) into unstable (Andrius Merkys)
[2021-11-23] Accepted liboqs 0.7.0.32.g8df1a81d+dfsg-1 (source) into unstable (Andrius Merkys)
[2021-11-17] Accepted liboqs 0.7.0.27.gba5b61a7+dfsg-1 (source) into unstable (Andrius Merkys)
[2021-11-16] Accepted liboqs 0.7.0.15.g9be13d21+dfsg-1 (source amd64) into unstable, unstable (Debian FTP Masters) (signed by: Andrius Merkys)

bugs [bug history graph]

all: 6
RC: 3
I&N: 2
M&W: 1
F&P: 0
patch: 1

links

homepage
lintian
buildd: logs, checks, cross
popcon
browse source code
edit tags
other distros
security tracker
debian patches