[Deepin Integration]~[V23-Beta2] update glibc to 2.35-4 by UTsweetyfish@deepin-community/glibc by deepin-community-ci-bot[bot]

[deepin-bot[bot]]

Package information | 软件包信息

integrationinfo: 包名	版本
glibc	2.35-deepin3
glib2.0	2.74.6-2
meson	1.1.1-1
netcdf	1:4.9.2-1deepin
heimdal	7.8.git20221117.28daf24+dfsg-3
assimp	5.2.5~ds0-1
linux-atm	1:2.5.1-4
cups	2.4.2-5
fltk1.3	1.3.8-5deepin
trilinos	13.2.0-4
valgrind	1:3.19.0-1
nfs-utils	1:2.6.3-3
ismrmrd	1.8.0-2
libstrophe	0.12.3-1
loudmouth	1.5.4-1
dot2tex	2.11.3-3
ecbuild	3.8.0-1
dh-lua	29
openldap	2.5.13+dfsg-5
apache2	2.4.57-2
apr	1.7.2-3
apr-util	1.6.3-1
audit	1:3.0.9-1deepin1
ceph	14.2.21-1.1
courier-authlib	0.71.1-2
cups-filters	1.28.17-3deepin
curl	8.3.0-2
libtool	2.4.7-7deepin1
cyrus-sasl2	2.1.27.1-deepin
evolution-data-server	3.42.1-deepin
gconf	3.2.6-7
gnupg2	2.2.27-2
isc-dhcp	4.4.3.1-1+dde
kldap	21.08.1.1-deepin1
krb5	1.20.1-4
python-kdcproxy	1.0.0-1
pyrad	2.1-3
~libnfsidmap~	~0.25-6~
libreswan	4.7-1
php7.4	7.4.21-2+deb11u1
postgresql-15	15.3-1deepin1
postgresql-16	16.0-2
postgresql-common	255
spirv-llvm-translator-14	14.0.0-8deepin
spirv-headers	1.6.1+1.3.250.0-1
llvm-toolchain-15	1:15.0.7-10
python-ldap	3.2.0-4-deepin1
quota	4.06-1
samba	2:4.16.11+dfsg-1
seahorse	41.0-1
sendmail	8.17.1.9-1
strongswan	5.9.5-2
dee	1.2.7+17.10.20170616-7
ocaml	4.13.1-4
findlib	1.9.6-1
ocamlbuild	0.14.0-2
cppo	1.6.9-3
ocaml-csexp	1.5.2-4
ocaml-dune	3.9.1-1
ocaml-integers	0.7.0-3
lwt	5.6.1-4
ocaml-ctypes	0.17.1-2
ounit	2.2.7-1
ppxlib	0.30.0-2
react	1.2.1-1-deepin1
ocaml-result	1.5-deepin2
ocaml-mmap	1.2.0-3
ocplib-endian	1.2-3
ocaml-topkg	1.0.3-1
janest-ocaml-compiler-libs	0.12.4-4
ocaml-sexplib0	0.16.0-3
ppx-derivers	1.2.1-3
dh-ocaml	2.0
ocaml-bigarray-compat	1.1.0-3

Package repository address | 软件包仓库地址

deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-349/testing/ ./

Changelog | 更新信息

glibc (2.35-deepin3) unstable; urgency=medium

• Apply CVE-2023-4911 patch from tree.

glib2.0 (2.74.6-2) unstable; urgency=medium

• d/patches: Update to upstream 2.74.x branch commit 2.74.6-12-ga1e169129, omitting Windows-specific changes
  • Fix GDBus server interop with sd-bus clients (GNOME/glib#2916)
  • Fix use-after-free of a GDBusMethodInvocation in some threaded use patterns (GNOME/glib#2924)
  • Fix a test failure resulting in FTBFS in some container environments if gdb happens to be installed, but access to ptrace and /proc/PID/mem is disallowed (GNOME/glib#3307)

meson (1.1.1-1) experimental; urgency=medium

• New upstream release.

netcdf (1:4.9.2-1deepin) unstable; urgency=medium

• d/patches/fix-doxygen.patch: Fix doxygen error.

heimdal (7.8.git20221117.28daf24+dfsg-3) unstable; urgency=medium

• Fix random "Ticket expired" and "Clock skew too great" errors by setting kdc_offset correctly. Closes: #1039992.

assimp (5.2.5~ds0-1) unstable; urgency=medium

• New upstream version 5.2.5~ds0
  • Refresh patches
  • Drop patch applied upstream
  • Disable index_overflow.patch for now
• Explicitly enable building of assimp tools
• Modernize d/watch

linux-atm (1:2.5.1-4) unstable; urgency=medium

• QA upload.
• Fixup build failures with new kernel and glibc versions.
• Bump std-version to 4.4.0, no changes required

cups (2.4.2-5) unstable; urgency=medium

• CVE-2023-34241 (Closes: #1038885) use-after-free in cupsdAcceptClient()

fltk1.3 (1.3.8-5deepin) unstable; urgency=medium

• fix extract error.

trilinos (13.2.0-4) unstable; urgency=medium

• Team upload.

  [ Graham Inggs ]

• Drop globipack and optipack which have been empty for some time, thanks Lintian! (Closes: #1031964)

  [ Jochen Sprickerhof ]

• Drop unused cmake defines

valgrind (1:3.19.0-1) unstable; urgency=medium

• New upstream release (Closes: #1017791)
• Remove x32 from architectures list (Closes: #997015)
• Update lintian overrides
• Bump Standards-Version to 4.6.1 (no changes needed)

nfs-utils (1:2.6.3-3) unstable; urgency=medium

• nfs-idmapd.service: add network-online.target to Wants= and After= (Closes: #1035840)
• libnfsidmap: try to get the domain directly from hostname if the DNS lookup fails and always show the log message if the domain can't be determined

ismrmrd (1.8.0-2) unstable; urgency=medium

• Team upload.
• Source-only upload.

libstrophe (0.12.3-1) unstable; urgency=medium

• Team upload
• New upstream version

loudmouth (1.5.4-1) unstable; urgency=medium

• New upstream release
• debian/control: Bump debhelper compat to 13
• debian/copyright: Update copyright holders
• Remove obsolete patch for IPv6 support, applied upstream
• debian/patches/ and debian/rules: Build fixes
• Update symbols file with new API additions

dot2tex (2.11.3-3) unstable; urgency=medium

[ Debian Janitor ]

• Trim trailing whitespace.
• Bump debhelper from deprecated 9 to 12.
• Set upstream metadata fields: Bug-Database, Bug-Submit, Repository, Repository-Browse.

• Update standards version to 4.5.0, no changes needed.

  [ Ondřej Nový ]

• d/control: Update Vcs-* fields with new Debian Python Team Salsa layout.

  [ Sandro Tosi ]

• Use the new Debian Python Team contact name and address

ecbuild (3.8.0-1) unstable; urgency=medium

• New upstream release

dh-lua (29) unstable; urgency=medium

• Remove Enrico Tassi from the uploaders list (closes: #995544).
• Don't use deprecated which, use command -v instead in Makefile.single.
• Put versioned policy.txt to the doc directory.
• Add a patch by Helmut Grohne to stop using libtool-bin. (closes: #1024721).
• Switch build dependency to debhelper-compat.
• Bump Debhelper compatibility level to 13.
• Bump Standards-Version to 4.6.1.

openldap (2.5.13+dfsg-5) unstable; urgency=medium

• Fix sha2-contrib autopkgtest failure. Call slappasswd using its full path. (Closes: #1030814)
• Disable flaky test test069-delta-multiprovider-starttls.

apache2 (2.4.57-2) unstable; urgency=medium

• Revert debian/* changes (Bookworm freeze)

apr (1.7.2-3) unstable; urgency=medium

• Add more fixes for atomics from upstream, in particular for 32 bit archs with weak memory ordering.

apr-util (1.6.3-1) unstable; urgency=medium

[ Stefan Fritsch ]

• Incorporate NMUs. Closes: #1028435
• New upstream version:
  • CVE-2022-25147: Fix Integer Overflow or Wraparound vulnerability in apr_base64

• Bump libapr1-dev Build-Dep to 1.7.2-1

  [ Debian Janitor ]

• Use secure URI in Homepage field.
• Set debhelper-compat version in Build-Depends.
• Drop unnecessary dh arguments: --parallel
• Rely on pre-initialized dpkg-architecture variables.

• Remove constraints unnecessary since buster (oldstable):

  • libaprutil1: Drop conflict with removed package libapr1 (<< 1.4.8-2~) in Breaks.

  [ Jelmer Vernooij ]

• Set Repository and Repository-Browse fields in debian/upstream/metadata.
• Drop transition for old debug package migration.
• Update standards version to 4.6.1, no changes needed.

audit (1:3.0.9-1deepin1) unstable; urgency=medium

[ Gui-Yue ]

• Refresh deepin-sw64-porting-0001.patch.

ceph (14.2.21-1.1) unstable; urgency=medium

• Non-maintainer upload.
• Compile ppc.c on all powerpc machines. Fixes 32 bit powerpc build (Closes: #993642).

courier-authlib (0.71.1-2) unstable; urgency=medium

• Tighten permissions on /run/courier/authdaemon. Closes: #984810.
• Correct init script to be idempotent. Closes: #984818.
• Move binaries autpasswd, authtest, and authenumerate from courier-authlib to courier-authdaemon. They require the daemon to run and are useless without it.

cups-filters (1.28.17-3deepin) unstable; urgency=medium

• update debian/rules for deepin
• add default-testpage.pdf to debian/local

curl (8.3.0-2) unstable; urgency=medium

• d/rules: Add test 3102 to TESTS_FAILS_ON_IPV6_ONLY_MACHINES
• d/patches: Import two upstream patches to try to fix FTBFS on armel/armhf
  • test650_fix_an_end_tag_typo.patch
  • tests_increase_the_default_server_logs_lock_timeout.patch
• d/p/lib_use_wrapper_for_curl_mime_data_fseek_callback.patch: New patch to fix armel/armhf FTBFS

libtool (2.4.7-7deepin1) unstable; urgency=medium

• Refresh Add-sunway-support.patch.

cyrus-sasl2 (2.1.27.1-deepin) UNRELEASED; urgency=medium

• update

evolution-data-server (3.42.1-deepin) stable; urgency=medium

• ['Rebuild against by current gcc 11.2']

gconf (3.2.6-7) UNRELEASED; urgency=medium

• update

gnupg2 (2.2.27-2) unstable; urgency=medium

• Add a NEWS entry about the end of support for ~/.gnupg/options. Closes: #985158

isc-dhcp (4.4.3.1-1+dde) UNRELEASED; urgency=medium

• update

kldap (21.08.1.1-deepin1) unstable; urgency=medium

• Fix build with GCC 12

krb5 (1.20.1-4) unstable; urgency=low

[ Steve Langasek ]

• libkrb5support0: require strict binary dependency to deal with glibc 2.38, Closes: #1043184

  [Jelmer Vernooij]

• krb5-user: Use alternatives for kinit, klist, kswitch, ksu, kpasswd, kdestroy, kadmin and ktutil. This allows installation together with heimdal-clients. Closes: #213316, #751203

  [ Sam Hartman ]

• Enable build-time tests, Thanks Andreas Hasenack, Closes: #1017763
• Work around doxygen change that breaks doc build, Thanks Greg Hudson, Closes: #1051523

python-kdcproxy (1.0.0-1) unstable; urgency=medium

• New upstream release.
• control: Migrate to debhelper-compat.
• control: Bump policy to 4.5.1.

pyrad (2.1-3) unstable; urgency=low

[ Debian Janitor ]

• Bump debhelper from deprecated 9 to 12.

  [ Ondřej Nový ]

• d/control: Update Vcs-* fields with new Debian Python Team Salsa layout.

  [ Sandro Tosi ]

• Use the new Debian Python Team contact name and address

  [ Debian Janitor ]

• Bump debhelper from old 12 to 13.
• Set upstream metadata fields: Bug-Database, Bug-Submit, Name, Repository, Repository-Browse.

~libnfsidmap (0.25-6) unstable; urgency=medium~

~ QA upload.~ ~ Set Maintainer to Debian QA Group. (see #925022)~ ~* Build depend on automake instead of automake1.11. (Closes: #865185)~

~[ Andreas Hasenack ]~ ~* d/p/03-uid-map-krb5.patch: fix uid mapping when sec=krb5 is used~ ~(Closes: #581199, #924425)~

libreswan (4.7-1) UNRELEASED; urgency=medium

• update

php7.4 (7.4.21-2+deb11u1) UNRELEASED; urgency=medium

• update

postgresql-15 (15.3-1deepin1) unstable; urgency=medium

• Apply patches from postgresql-14

postgresql-16 (16.0-2) unstable; urgency=medium

• Use LLVM 15 for JIT support, 16 is not supported yet. (Closes: #1051881)

postgresql-common (255) unstable; urgency=medium

• PgCommon.pm: Set defined path in prepare_exec. Thanks Niko Tyni!
• debian/supported-versions: Add 16 as default version.

spirv-llvm-translator-14 (14.0.0-8deepin) unstable; urgency=medium

• Relax gcc dependency from 13 to 11.

spirv-headers (1.6.1+1.3.250.0-1) unstable; urgency=medium

• New upstream release.

llvm-toolchain-15 (1:15.0.7-10) unstable; urgency=medium

[ Gianfranco Costamagna ]

• Merge branch 14 containing wasm build fixes.

python-ldap (3.2.0-4-deepin1) unstable; urgency=medium

• Rebuild

quota (4.06-1) unstable; urgency=medium

• New upstream version 4.06
• Bumped Standards-Version, no changes needed.
• Fixed some lintian warnings.

samba (2:4.16.11+dfsg-1) unstable; urgency=medium

• new upstream stable/security release 4.16.11, including: o CVE-2022-2127: When winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in winbind and possibly crash it. https://www.samba.org/samba/security/CVE-2022-2127.html o CVE-2023-3347: SMB2 packet signing is not enforced if an admin configured "server signing = required" or for SMB2 connections to Domain Controllers where SMB2 packet signing is mandatory. https://www.samba.org/samba/security/CVE-2023-3347.html o CVE-2023-34966: An infinite loop bug in Samba's mdssvc RPC service for Spotlight can be triggered by an unauthenticated attacker by issuing a malformed RPC request. https://www.samba.org/samba/security/CVE-2023-34966.html o CVE-2023-34967: Missing type validation in Samba's mdssvc RPC service for Spotlight can be used by an unauthenticated attacker to trigger a process crash in a shared RPC mdssvc worker process. https://www.samba.org/samba/security/CVE-2023-34967.html o CVE-2023-34968: As part of the Spotlight protocol Samba discloses the server-side absolute path of shares and files and directories in search results. https://www.samba.org/samba/security/CVE-2023-34968.html o BUG 15418: Secure channel faulty since Windows 10/11 update 07/2023. https://bugzilla.samba.org/show_bug.cgi?id=15418 (this has been patched in the previous upload; Closes: #1041043)

seahorse (41.0-1) unstable; urgency=medium

• New upstream release
• debian/control.in: Bump minimum glib to 2.66
• debian/control.in: Build-Depend on gcr for build tests

sendmail (8.17.1.9-1) UNRELEASED; urgency=medium

• update

strongswan (5.9.5-2) unstable; urgency=medium

[ Deepin Packages Builder ]

• sync: sync obs workflows
• chore(CI): Update obs tag build workflow Thanks to deepin-ci-robot
• chore(CI): remove old obs workflow file Thanks to deepin-ci-robot
• chore(CI): Add OWNERS file for auto review or assign Thanks to deepin-ci-robot
• chore: new upstream version 5.9.5

dee (1.2.7+17.10.20170616-7) UNRELEASED; urgency=medium

• update

ocaml (4.13.1-4) unstable; urgency=medium

• Avoid build path ending up in binaries (Closes: #1030785)

findlib (1.9.6-1) unstable; urgency=medium

• New upstream release

ocamlbuild (0.14.0-2) unstable; urgency=medium

• Team upload
• Include ocamlvars.mk to avoid failure in dh_dwz
• Bump debhelper compat level to 13
• Bump Standards-Version to 4.5.0
• Add Rules-Requires-Root: no

cppo (1.6.9-3) unstable; urgency=medium

• Team upload
• Use ocaml_dune DH buildsystem
• Bump Standards-Version to 4.6.2

ocaml-csexp (1.5.2-4) unstable; urgency=medium

• Depend on ocaml instead of transitional ocaml-nox

ocaml-dune (3.9.1-1) unstable; urgency=medium

• New upstream release

ocaml-integers (0.7.0-3) unstable; urgency=medium

• Include ocamlvars.mk in debian/rules

lwt (5.6.1-4) unstable; urgency=medium

• Team upload.
• Bum dep on more recent dune.
• Bump standards-version to 4.6.2

ocaml-ctypes (0.17.1-2) unstable; urgency=medium

• Link libtest_functions.so with -lm (fixes FTBFS on some architectures)

ounit (2.2.7-1) unstable; urgency=medium

• Taking maintenance over (Closes: #934213).
• Fix d/watch.
• Bump standards-version to 4.6.2.
• New upstream release.
• Fix compilation with recent dune

ppxlib (0.30.0-2) unstable; urgency=medium

• Fix compilation with recent dune.

react (1.2.1-1-deepin1) unstable; urgency=medium

• Rebuild

ocaml-result (1.5-deepin2) unstable; urgency=medium

• Avoid downgrading.

ocaml-mmap (1.2.0-3) unstable; urgency=medium

• Include ocamlvars.mk in debian/rules

ocplib-endian (1.2-3) unstable; urgency=medium

• Depend on ocaml instead of transitional ocaml-nox

ocaml-topkg (1.0.3-1) unstable; urgency=medium

• New upstream release

janest-ocaml-compiler-libs (0.12.4-4) unstable; urgency=medium

• Depend on ocaml instead of transitional ocaml-nox

ocaml-sexplib0 (0.16.0-3) unstable; urgency=medium

[ Stéphane Glondu ]

• Use ocaml_dune DH buildsystem

  [ Debian Janitor ]

• Update watch file format version to 4.
• Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.

ppx-derivers (1.2.1-3) unstable; urgency=medium

• Team upload
• Include ocamlvars.mk in debian/rules

dh-ocaml (2.0) unstable; urgency=medium

• dh_ocaml:
  • Add explicit dependencies to versioned ocaml{,-base} if relevant
• ocaml_dune.pm:
  • Pass remaining arguments to "dune build"

ocaml-bigarray-compat (1.1.0-3) unstable; urgency=medium

• Use ocaml_dune DH buildsystem

Test suggestion | 测试建议

Influence | 影响范围

ADDITIONAL INFORMATION | 额外补充

[deepin-bot[bot]]

IntegrationProjector Bot Deepin Testing Integration Project Manager Info Link to https://github.com/deepin-community/Repository-Integration/pull/349

[babyfengfjx]

@kobe337 请开展集成验证，上文提到不添加内测源测试，这个点需要确认清楚，是什么原因不能添加内测源。

[UTsweetyfish]

@kobe337 请开展集成验证，上文提到不添加内测源测试，这个点需要确认清楚，是什么原因不能添加内测源。

历史遗留原因导致内测源的 libc6 版本号是不正确的，比本次集成高（内测源 2.35-deepin1 > 本次集成 2.35-4 > V23 Beta 2.35-1），使用内测源需要降级

[kobe337]

与研发同事沟通，版本号需要滚动，待修改版本号，再行验证，支持内测源直接更新

[kobe337]

与研发同事沟通，由于新的方案涉及的软件包依赖较多，需要解决后再行提测

[UTsweetyfish]

gloox 在 community 中，放弃集成 gloox

[UTsweetyfish]

python-iptables 在 community 中

[UTsweetyfish]

eckit 通过 OBS 集成 https://build.deepin.com/request/show/610

[UTsweetyfish]

dummy:

Details

``` Package: dummy-20230831 Version: 0 Architecture: all Depends: dh-lua (>= 27+nmu1~), libc-dev-bin (>= 2.31-8), nscd (>= 2.35), locales (>= 2.35), locales-all (>= 2.35), wcc (>= 0.0.2+dfsg-3), openssh-server (>= 1:8.1p1-5), busybox (>= 1.30.1-6), libgegl-0.4-0 (>= 0.4.18), aide (>= 0.17.3-4+b3), python3-iptables (>= 1.0.0-2), fakechroot (>= 2.19-3.5), chrony (>= 4.2-3~), valgrind (>= 1:3.19.0-1~), firefox (>= 91~), firefox-esr (>= 91~), libassimp-dev (>> 5.2.4~ds0-1), libeckit-dev (>> 1.20.0-1), libfltk1.3-dev (>> 1.3.8-4+b1), libismrmrd-dev (>> 1.8.0-2), libnetcdf-dev (>> 1:4.9.0-3), libtrilinos-amesos2-dev (>> 13.2.0-3), libtrilinos-amesos-dev (>> 13.2.0-3), libtrilinos-anasazi-dev (>> 13.2.0-3), libtrilinos-aztecoo-dev (>> 13.2.0-3), libtrilinos-belos-dev (>> 13.2.0-3), libtrilinos-epetra-dev (>> 13.2.0-3), libtrilinos-epetraext-dev (>> 13.2.0-3), libtrilinos-galeri-dev (>> 13.2.0-3), libtrilinos-ifpack2-dev (>> 13.2.0-3), libtrilinos-ifpack-dev (>> 13.2.0-3), libtrilinos-intrepid2-dev (>> 13.2.0-3), libtrilinos-intrepid-dev (>> 13.2.0-3), libtrilinos-isorropia-dev (>> 13.2.0-3), libtrilinos-kokkos-dev (>> 13.2.0-3), libtrilinos-kokkos-kernels-dev (>> 13.2.0-3), libtrilinos-komplex-dev (>> 13.2.0-3), libtrilinos-ml-dev (>> 13.2.0-3), libtrilinos-moertel-dev (>> 13.2.0-3), libtrilinos-muelu-dev (>> 13.2.0-3), libtrilinos-nox-dev (>> 13.2.0-3), libtrilinos-phalanx-dev (>> 13.2.0-3), libtrilinos-pike-dev (>> 13.2.0-3), libtrilinos-piro-dev (>> 13.2.0-3), libtrilinos-pliris-dev (>> 13.2.0-3), libtrilinos-rol-dev (>> 13.2.0-3), libtrilinos-rtop-dev (>> 13.2.0-3), libtrilinos-rythmos-dev (>> 13.2.0-3), libtrilinos-sacado-dev (>> 13.2.0-3), libtrilinos-shylu-dev (>> 13.2.0-3), libtrilinos-stokhos-dev (>> 13.2.0-3), libtrilinos-stratimikos-dev (>> 13.2.0-3), libtrilinos-teko-dev (>> 13.2.0-3), libtrilinos-teuchos-dev (>> 13.2.0-3), libtrilinos-thyra-dev (>> 13.2.0-3), libtrilinos-tpetra-dev (>> 13.2.0-3), libtrilinos-trilinoscouplings-dev (>> 13.2.0-3), libtrilinos-triutils-dev (>> 13.2.0-3), libtrilinos-xpetra-dev (>> 13.2.0-3), libtrilinos-zoltan2-dev (>> 13.2.0-3), libvtk7-dev (>> 7.1.1+dfsg2-10.2), libasyncns-dev (>> 0.8-6+b2), libatm1-dev (>> 1:2.5.1-4), libcups2-dev (>> 2.4.2-1), libghc-resolv-dev (>> 0.1.2.0-3), libghc-resolv-prof (>> 0.1.2.0-3), libglib2.0-dev (>> 2.72.3-1), libgloox-dev (>> 1.0.24-2+b1), libhesiod-dev (>> 3.2.1-3.1+b1), libldap-dev (>> 2.5.12+dfsg-2), libloudmouth1-dev (>> 1.5.4-1), libmongoc-dev (>> 1.22.1-1), libnfsidmap-dev (>> 1:2.6.1-2), libslurm-dev (>> 21.08.8.2-1), libstrophe-dev (>> 0.12.1-2), open-vm-tools-dev (>> 2:12.0.5-2), catch (>= 1.12.2-0.1), heimdal-multidev (>> 7.7.0+dfsg-4) ``` dummy-20230831 : 依赖: python3-iptables (>= 1.0.0-2) 但是它将不会被安装 依赖: chrony (>= 4.2-3~) 但是它将不会被安装 依赖: libvtk7-dev (> 7.1.1+dfsg2-10.2) 但是它将不会被安装 依赖: libgloox-dev (> 1.0.24-2+b1) 但是它将不会被安装 依赖: libldap-dev (> 2.5.12+dfsg-2) 依赖: libmongoc-dev (> 1.22.1-1) 但是它将不会被安装 依赖: libslurm-dev (> 21.08.8.2-1) 但是它将不会被安装

• [x] libldap-dev 2.4.17
• [ ] libvtk7-dev python3-nacl
• [ ] libmongoc-dev 1.19.2-deepin
• [ ] libslurm-dev 21.08.8.2-1
• [ ] python3-iptables/community
• [ ] chrony/community
• [ ] libgloox-dev/community

[Zeno-sole]

补充测试建议： 验证CVE-2023-4911 ，验证跨版本更新是否正常，验证升级后系统服务是否异常

[UTsweetyfish]

更新信息

• glibc 2.35-deepin2：修复 usrmerge
• glibc 2.35-deepin3：修复 CVE-2023-4911
• 更新 heimdal assimp atm fltk1.3 trilinos gloox ismrmrd libstrophe loudmouth ecbuild apr
• 更新 krb5 1.20.1
• 更新 valgrind 3.19.0
• 更新 nfs-utils 2.6.3
• 更新 cups 2.4.2
• 更新 dh-lua 29
• 更新 libtool
• 更新 curl 8.3.0
• 更新 openldap 至 2.5，可能导致部分软件包无法安装
• 添加 llvm-toolchain-15
• 更新 postgresql-16，移除 postgresql-14，并将 postgresql-16 设置为默认
• 修复部分 ocaml 工具链

可能影响

1. glibc 2.35-deepin2 可能导致部分软件包无法安装，已知列表见 5268#issuecomment-1706120282；
2. 更新 openldap 2.5 可能导致部分软件包无法安装，目前已尽可能保证 main 组件中的软件包使用，但是 main 中仍有软件包可能无法安装；community 中可能也有部分软件包无法安装；

   # main
   libreoffice

   # community
   cpu
   ldap2zone
   ldapvi
   libnet-ldapapi-perl
   mailutils
   sope
   squidguard

3. libppx-derivers-ocaml-dev 降级（1.2.1-deepin1 -> 1.2.1-3）
4. gnupg1 推荐 ldap-2.4，不依赖，影响范围不大

关联 topic

https://build.deepin.com/project/show/deepin:CI:topics:ocaml

[babyfengfjx]

@kobe337 请开展集成验证，主要沟通清楚核心影响点，开展针对性验证，并知会其他伙伴同步更新作为发散测试。

[UTsweetyfish]

CVE-2023-4911 相关链接 https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

[UTsweetyfish]

libnfsidmap2 已由 nfs-utils 提供， @Zeno-sole 请在集成时移除 libnfsidmap2(src:libnfsidmap)。见 https://tracker.debian.org/news/1311233/removed-025-6-from-unstable/

[kobe337]

关于CVE-2023-4911的漏洞修复，与研发同事沟通后，验证如下：

基于官方提供的数据，对代码进行了优化修复，一旦在缓冲区出现异常，做出相应处理。

此版本glibc 2.35属于漏洞范围，官方提示范围2.34 <= glibc <= 2.38，与研发同事沟通，此次为代码优化修复，后续将更新到最新版本。

[kobe337]

【环境】： 镜像：https://cdimage.uniontech.com/community/releases/23-Beta2/ 仓库：deb [trusted=yes] https://ci.deepin.com/repo/obs/deepin:/CI:/TestingIntegration:/test-integration-pr-349/testing/ ./ 内核：Linux deepin-PC 6.1.32-amd64-desktop-hwe #23.01.00.20 SMP PREEMPT_DYNAMIC Mon Sep 11 14:16:03 CST 2023 x86_64 GNU/Linux 【结论】： 测试通过，所有提测包均安装成功，暂无严重问题及影响 【补充】：与研发同事沟通，内测更新以后，由于openldap 2.4的包会被删除（测试环境存在），导致openldap 2.5的依赖会存在问题，计划下周将进行修复。具体影响如下图：

valgrind：是一款检测内存泄漏、内存违例和分析cache的开放源代码（GPL V2）仿真调试工具的集合 curl：是一个用来与服务器之间传输数据的命令行工具 clang: 是LLVM编译器工具集的一个用于编译C、C++、Objective-C的组件 PostgreSQL是一个功能强大的开源对象关系型数据库系统。