Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Michael Soegtrop]

Dear Cygwin Team,

my daily CI of Coq Platform indicates that this update:

libassuan0-2.5.5-1   -> libassuan0-2.5.6-1
libgpg-error0-1.47-1 -> libgpg-error0-1.37-1

breaks Opam, the OCaml package manager, via a failed call to curl as can 
be seen by executing these commands:

$ wget 
https://github.com/fdopen/opam-repository-mingw/releases/download/0.0.0.2/opam64.tar.xz 
-O "opam64.tar.xz"
$ tar -xf "opam64.tar.xz"
$ bash opam64/install.sh --prefix "/usr/$(uname 
-m)-w64-mingw32/sys-root/mingw"
$ opam init --bare --shell-setup --enable-shell-hook --enable-completion 
'default' 'https://opam.ocaml.org' --disable-sandboxing

Replacing the DLLs of libassuan0 and libgpg-error0 with the previous 
versions listed above (just replace the DLLs) fixes this.

I had a look at what happens with Procmon. In the end a call to cygwn 
curl (from a MinGW app) fails. In Procmon I can see that curl 
successfully downloads the file and crashes immediately after closing 
the output file. With the old versions of libassuan0 and libgpg-error0, 
curl succeeds. That this download as such is successful shows that this 
is not a temporary network hickup (I also tested it at least 10 times 
either way).

Usual usages of curl seem to work - I couldn't reduce the failure 
reproduction beyond the above 4 lines and couldn't figure out what is so 
special about the curl call of opam.

This is quite painful for me - I was in the middle of a release of Coq 
Platform (a widely used distribution of the Coq proof assistant), when 
my Windows CI (which does a cygwin based MinGW cross compilation of 
OCaml and Coq) failed. Especially painful is that there is no easy way 
to install older package versions from the command line.

I would appreciate a fast roll back. Otherwise I have to find a way to 
install the older versions without user interaction.

Btw.: I do a daily build test of Coq Platform with a fresh cygwin since 
about 6 years and this is only the fourth failure! I really appreciate 
the stability of cygwin - excellent work!

Best regards,

Michael

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Brian Inglis]

On 2023-12-19 06:26, Michael Soegtrop via Cygwin wrote:
> my daily CI of Coq Platform indicates that this update:
> libassuan0-2.5.5-1   -> libassuan0-2.5.6-1
> libgpg-error0-1.47-1 -> libgpg-error0-1.37-1

   libgpg-error0-1.37-1 -> libgpg-error0-1.47-1

> breaks Opam, the OCaml package manager, via a failed call to curl as can be seen 
> by executing these commands:
> $ wget 
> https://github.com/fdopen/opam-repository-mingw/releases/download/0.0.0.2/opam64.tar.xz -O "opam64.tar.xz"
> $ tar -xf "opam64.tar.xz"
> $ bash opam64/install.sh --prefix "/usr/$(uname -m)-w64-mingw32/sys-root/mingw"
> $ opam init --bare --shell-setup --enable-shell-hook --enable-completion 
> 'default' 'https://opam.ocaml.org' --disable-sandboxing
> Replacing the DLLs of libassuan0 and libgpg-error0 with the previous versions 
> listed above (just replace the DLLs) fixes this.
> I had a look at what happens with Procmon. In the end a call to cygwn curl (from 
> a MinGW app) fails. In Procmon I can see that curl successfully downloads the 
> file and crashes immediately after closing the output file. With the old 
> versions of libassuan0 and libgpg-error0, curl succeeds. That this download as 
> such is successful shows that this is not a temporary network hickup (I also 
> tested it at least 10 times either way).
> Usual usages of curl seem to work - I couldn't reduce the failure reproduction 
> beyond the above 4 lines and couldn't figure out what is so special about the 
> curl call of opam.
> This is quite painful for me - I was in the middle of a release of Coq Platform 
> (a widely used distribution of the Coq proof assistant), when my Windows CI 
> (which does a cygwin based MinGW cross compilation of OCaml and Coq) failed. 
> Especially painful is that there is no easy way to install older package 
> versions from the command line.
> 
> I would appreciate a fast roll back. Otherwise I have to find a way to install 
> the older versions without user interaction.

I don't build curl, gsasl, or libgcrypt with libassuan, which is used by gnupg2 
internally between components for IPC.

Deps are:

	opam -> curl -> libcurl4 -> libgsasl18 -> libgcrypt20 -> libgpg-error0

I have not yet upgraded libgpg-error and rebuilt libgcrypt, gsasl, or curl, do 
not use OCaML or Opam, or have them installed.

> Btw.: I do a daily build test of Coq Platform with a fresh cygwin since about 6 
> years and this is only the fourth failure! I really appreciate the stability of 
> cygwin - excellent work!

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[ASSI]

Michael Soegtrop via Cygwin writes:
[…]

Looks like this problem converges on the libgpg-error update, gpg2 also
segfaults with this library installed.


Regards,
Achim.
-- 
+<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+

DIY Stuff:
http://Synth.Stromeko.net/DIY.html

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Rainer Emrich]

Am 19.12.2023 um 17:13 schrieb ASSI via Cygwin:
> Michael Soegtrop via Cygwin writes:
> […]
> 
> Looks like this problem converges on the libgpg-error update, gpg2 also
> segfaults with this library installed.
Even python produces obscure crashes, throwing exceptions. Downgrading 
helps.

Rainer

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Michael Soegtrop]

Dear Cygwin Team & Users,

> Looks like this problem converges on the libgpg-error update, gpg2 also
> segfaults with this library installed.

I can confirm that just downgrading:

   libgpg-error0-1.47-1 -> libgpg-error0-1.37-1

and keeping the update of libassuan0:

   libassuan0-2.5.5-1   -> libassuan0-2.5.6-1

fixes the issue with curl and opam.

Since there seem to be various issues with this update of libgpg-error0, 
can we please have a roll-back?

Best regards,

Michael

RE: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[José Isaías Cabrera]

On Tuesday, December 19, 2023 12:16 PM, Michael Soegtrop expressed:
> 
> Since there seem to be various issues with this update of libgpg-error0, can we please have a roll-back?

Or, perhaps, fix the issue on the broken library.

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Marco Atzeri]

On 19/12/2023 19:05, José Isaías Cabrera via Cygwin wrote:
> 
> On Tuesday, December 19, 2023 12:16 PM, Michael Soegtrop expressed:
>>
>> Since there seem to be various issues with this update of libgpg-error0, can we please have a roll-back?
> 
> Or, perhaps, fix the issue on the broken library.
> 

I just rolled back the libgpg-error0 as fast term solution,
it will need some hours to propagate to the various mirrors

Fixing the broken library requires debugging and
understanding the issue, so it could take time that we can not afford.

Sorry for the inconvenience
MArco

Re: Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Michael Soegtrop]

Hi Marco,

> I just rolled back the libgpg-error0 as fast term solution,
> it will need some hours to propagate to the various mirrors

thank you for the quick action! I can confirm that our nightly Windows 
CI with latest cygwin runs through fine again.

> Sorry for the inconvenience

Nothing to say sorry for - cygwin is in my experience stability wise 
better than major Linux distros. Thank you for the good work!

Best regards,

Michael