Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Towards new release 0.20.0 #1782

Closed
frankmorgner opened this issue Sep 5, 2019 · 22 comments
Closed

Towards new release 0.20.0 #1782

frankmorgner opened this issue Sep 5, 2019 · 22 comments

Comments

@frankmorgner
Copy link
Member

frankmorgner commented Sep 5, 2019 •
edited
Loading

There are no critical issues left and the new functionality has been integrated. I think it's time to prepare and publish the next major release, @OpenSC/core, @OpenSC/maintainers.

This release renames the configuration option md_read_only to read_only. In openpgp-tool the options -L/ --key-length have been replaced with -t/--key-type. Please review your opensc.conf` and your shell scripts. Release candidate is available on Github.

The general functionality has been verified to some extent in the CI environment, where we're using simulations of PIV, OpenPGP, GIDS, IsoApplet, MyEID and CAC for testing. Refer to the wiki page on how to systematically test your card. OpenSC is now part of the OSS-Fuzz family, which has already led to the fix of some security issues (see below).

Here is the complete list of changes, that would also appear in the release notes and NEWS file (please let me know if I'm missing something):

General Improvements

PKCS#11

Minidriver

OpenSC tools

CAC1

New separate CAC1 driver using the old CAC specification (#1502).

CardOS

Coolkey

EstEID

  • adds support for a minimalistic, small and fast card profile based on IAS-ECC issued since December 2018 (EstEID 2018+ driver #1635)

GIDS

MICARDO

MyEID

Gemalto GemSafe

OpenPGP

Rutoken

SC-HSM

Starcos

TCOS

Infocamere, Postecert, Cnipa

ACS ACOS5
@Jakuje
Copy link
Member

Jakuje commented Sep 13, 2019

I re-read all the commits since the last release and I would suggest to mention also the following highlights that look like missed from the original list:

For MyEID, I would mention also a support for OsEID cards that was added to the driver (#1677).

For opensc-tool

For pkcs11-spy, parse the EC Derive parameters (#1677).

For pkcs11-tool:

Remove incomplete acos5 driver (#1622).

minidriver:

  • Add support for RSA-PSS (263b945)

coolkey: Improved card matching to avoid mismatches with similar muscle driver (#1500).

New separate CAC1 driver using the old CAC specification (#1502).

Additionally, I would like to ask for the status fo #1772, which adds support for IDPrime cards and in-card RSA-OAEP as an counterpart to RSA-PSS already in.

@plaes
Copy link
Contributor

plaes commented Sep 16, 2019 •
edited
Loading

EstEID section should mention something like this: "Added support for Estonian ID cards (supplied by IDEMIA) that have been issued since January 2019."

It's a big win, because we only had closed source blob that had some issues...

@frankmorgner
Copy link
Member Author

Thanks for the comments, @Jakuje @plaes !

I've edited and extended the NEWS as requested.

I'd like to avoid mentioning #1500 and #1762 because I think they are technical improvements, invisible to the user.

I'd like to postpone #1772 for the next release, because that are quite a lot of changes that did not yet get the attention they deserve.

@Jakuje
Copy link
Member

Jakuje commented Sep 16, 2019

Thank you for clarification.

@frankmorgner
Copy link
Member Author

You can find the updated release candidate here

@frankmorgner
Copy link
Member Author

Since macOS Catalina, TokenDs are disabled by default, that's why I had to update the installer to also distribute OpenSCToken... (installed by default on 10.15, available as alternative to OpenSC.tokend on 10.12-10.14, disabled on 10.11 and before). The installation of PKCS#11 module and tools are unaffected.

You can find the updated release candidate here.

@Jakuje
Copy link
Member

Jakuje commented Nov 20, 2019

Seems like the oss-fuzz got silent for now. I would be for drawing a line here, do a rc, ask for testing and do the release. Is there anything else that we should get in?

@frankmorgner
Copy link
Member Author

Updated CVEs and newly added fixes. Let's wait for the next report from OSS-Fuzz, which should finally allow a new release.

@Jakuje
Copy link
Member

Jakuje commented Dec 2, 2019

Thanks. I would probably like to see also #1877 (this was broken before, but current version can hang, which is not good. I would also like to see ack from the original reporter) and #1867 (this is broken since beginning, but it is frequently reported issue).

@metsma
Copy link
Contributor

metsma commented Dec 2, 2019

Can we get #1826 also in. It will improve parallel usage of cards

@frankmorgner
Copy link
Member Author

For #1877, I'm waiting for feedback from @the-kernel. If positive, the PR is good to be merged.

I didn't see how #1826 is a bugfix for an error with parallel use, so I originally planned to postpone it...

@metsma
Copy link
Contributor

metsma commented Dec 2, 2019

We discovered after testing, that things got better. I can change the label?

@the-kernel
Copy link

@metsma Sorry I have been away and haven't had a chance to test, I'll get right on it, and let you know shortly. Thanks!

@the-kernel
Copy link

@metsma The fix in #1877 appears to resolve all the issues I had, thanks!

@frankmorgner
Copy link
Member Author

I've merged the PRs as requested.

However, the coolkey issues in OSS-Fuzz keep popping up over and over again... Would it be OK to remove Coolkey from the default list of activate drivers to finally make a release, @Jakuje?

@Jakuje
Copy link
Member

Jakuje commented Dec 4, 2019

Even though they look like popping all over again, the latest one is a different issue than the previous ones (see the top commit in #1830). Some of the other issues look like running on some old revision. It looks like I am not getting email notification to all of the for some reason.

I would like to avoid dropping coolkey from default. Even though the customer base is not big, there were already several users reporting issues directly here so they are using it. So we can either wait few more days and address as much as possible (I believe the worst issues are already handled) or release it as it is now (and possibly count with some security/bugfix release in month or two).

Also in the previous comments I was asking about #1867 whether we can have it in release too as it is long-standing issue.

@dengert
Copy link
Member

dengert commented Dec 5, 2019

Can we #1881 into the 0.20.0 release? I can squash and clean up some debugging if needed

@frankmorgner
Copy link
Member Author

The situation around #1881 is not very clear, see the PR for comments

@frankmorgner
Copy link
Member Author

I've created a new release candidate...

@metsma
Copy link
Contributor

metsma commented Dec 11, 2019

RC4 tar.gz is missing test-pkcs11-tool-allowed-mechanisms.sh file

@Jakuje Jakuje mentioned this issue Dec 17, 2019
Merged
@Jakuje
Copy link
Member

Jakuje commented Dec 17, 2019

@metsma Thank you for reporting this. It should be fixed with #1889.

@dpward
Copy link
Contributor

dpward commented Dec 18, 2019 •
edited
Loading

I've created a new release candidate...

@frankmorgner Could I kindly ask that we improve the versioning here? This is making things unnecessarily difficult for downstream consumption.

The repository has recently been tagged with "0.20.0-rc1", "0.20.0-rc2", "OpenSC-0.20.0-rc3", and now "0.20.0-rc34". Could we please delete then re-create the latter two tags in the repository to follow the regular pattern? Distribution packaging scripts often depend on this.

It also appears that the filenames for the Windows installers have contained the wrong rc version for the last three builds.

Edit: It seems this was opened as #1886, but was closed without being fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@plaes @dpward @dengert @frankmorgner @Jakuje @metsma @the-kernel