Bug#1140227: marked as done (apt: HTTPS acquire fails under OpenSSL FIPS-only mode (missing ERR_clear_error before SSL_read/write))
"Debian Bug Tracking System" <[email protected]> Thu, 30 Jul 2026 21:13:04 +0000
| Newsgroups | gmane.linux.debian.apt.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format... ------------=_1785445984-59072-0 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Your message dated Thu, 30 Jul 2026 21:10:48 +0000 with message-id <[email protected]> and subject line Bug#1140227: fixed in apt 3.3.2 has caused the Debian Bug report #1140227, regarding apt: HTTPS acquire fails under OpenSSL FIPS-only mode (missing ER= R_clear_error before SSL_read/write) to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) --=20 1140227: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1140227 Debian Bug Tracking System Contact [email protected] with problems ------------=_1785445984-59072-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at submit) by bugs.debian.org; 17 Jun 2026 13:00:28 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-12.1 required=4.0 tests=BAYES_00, BODY_INCLUDES_PACKAGE,CT_IMAGE,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU, DKIM_VALID_EF,FOURLA,HAS_PACKAGE,HTML_FONT_LOW_CONTRAST,HTML_MESSAGE, MULTALT,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 145; hammy, 150; neutral, 287; spammy, 0. spammytokens: hammytokens:0.000-+--trixie, 0.000-+--bookworm, 0.000-+--size_t, 0.000-+--GnuTLS, 0.000-+--UD:cnf Return-path: <[email protected]> Received: from mail-vs1-xe64.google.com ([2607:f8b0:4864:20::e64]:45462) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_128_GCM:128) (Exim 4.96) (envelope-from <[email protected]>) id 1wZpsZ-000k8W-02 for [email protected]; Wed, 17 Jun 2026 13:00:28 +0000 Received: by mail-vs1-xe64.google.com with SMTP id ada2fe7eead31-6cfdce656bfso1918684137.3 for <[email protected]>; Wed, 17 Jun 2026 06:00:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=wellhive.com; s=google; t=1781701225; x=1782306025; darn=bugs.debian.org; h=to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=X4CoVmVw9nv+1O3rz/sTphD/Kv+ZZ8Nv3fosdYGLlwQ=; b=ciPPpb7CxT1zecvtV+K44AMpc+5Xv5zvowYRIzYZ0eYc4JltaV9dUL0E/Ll1MkMdwU m+BoQaoMTNUTMe38nttus8drXhtjiSMmk5l1HvNCah5Zh6rMpmFD4Uav7Ryq5j0aiJhi Uwrb8Tyd2ZlEAckBXhxrVaAi87G/p50qDHuoshyj4p40M6OBToYkQW9tSfgmuih/J19w EDTekviJNsYI6PxEgvf8mCjd3ExhUjOEkx70BZjzXzsmGK6+ZAJYr/yauWiuRmum4lhc n7v4DSfDgEoFaeUQl2Cjo/AoQTWTJd/2DETTU3OtEtS+ah2z+J79Icfry6D/zfJj2iT3 Sgjg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781701225; x=1782306025; h=to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=X4CoVmVw9nv+1O3rz/sTphD/Kv+ZZ8Nv3fosdYGLlwQ=; b=WedJ5nEIchD2dAsz/pIqyTBgnV5OaIN96oCs40z/53Qc4jQWXyteWSwmYY05sNiaue IVSx756sU7/glqvmy4voa6Jb0grvvMLXnUtfnSNnZljFNQ7EWtPewtoz8DYJ49Etqsyx L6be6d4U+p16udfq/SssJf4KXFlSPp+Hzqeuf8LLciMjMOSvpNRKKR0bG2HaMI+/v03a yvR8TN4xpzgQJgkECc7EQ+ZHGJV35Bv82uWRJmlG+myDZD3DrgdE/hakloqv2syxLVkC ASIrkJJTaa6M1ZfEdI/a3Qvn1a8jhHdIZwHqs/xFPHKPnVFj/zvoh83q3Nu1JrR0cAG1 1ACw== X-Gm-Message-State: AOJu0Yy0tsfpBg8aJhvSB0fKnloimJ9Uk7ABMgV3Xdix7WzCyFZX0xfJ YSWxFalCmbKQtwoRBkahXK+B64dgCvoJD7NIfll9EUbSf81a691qx/Ajanp9Nsx87vI92Ij82hC gYfGbWExQFJ25LjgP4Lk8X9JX35nEcg+FpJ7CQ7TpGGbM X-Gm-Gg: AfdE7cnP23USocNPto85mDXAe3CK1Bgh77U/datZxrJ4VOIKvqyQ858+A2uWQQvUI6f fdQ1WzNFk43nPWNbU7MVwKMTkGUqLxkYCRhSQg7PhWlg/GLyuZHNTw5XSgibYQxF/OuJ0xkUVn5 IEPGWGx2q+suENaWRIzDTEMkgH8lOZP97SMGuYj7Kt6rve5EXmsh/PajKvdH0y/5S6AKkzeNqxi P57Dbep/gbniD/e8r1vGA0UBrB3xmvVzjsrD//LbXBfWoGiNFLQAwPUMLTNLyqGejxEb7vsTsnT wFn8tMZqChYa8Cnmnsm+zC1rpx7zAddnj8cghslY6094LjiGouizLtKB9TvS34Xb3beea3p9CtF kL9S/jTcvvoGb0G5iI9zOJFAAfODL1qxjmKOoBi4rkErRjQ3dhMG33nw= X-Received: by 2002:a05:6102:2b81:b0:6d3:9409:d1b6 with SMTP id ada2fe7eead31-7245d52de20mr1998706137.6.1781701224644; Wed, 17 Jun 2026 06:00:24 -0700 (PDT) Received: from us1.smtp.exclaimer.net (us1.smtp.exclaimer.net. [191.237.4.149]) by smtp-relay.gmail.com with ESMTPS id ada2fe7eead31-72086c42d87sm774192137.13.2026.06.17.06.00.23 for <[email protected]> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Wed, 17 Jun 2026 06:00:24 -0700 (PDT) X-Relaying-Domain: wellhive.com Received: from mail-yw1-f197.google.com (209.85.128.197) by us1.smtp.exclaimer.net (191.237.4.149) with Exclaimer Signature Manager ESMTP Proxy us1.smtp.exclaimer.net (tlsversion=TLS12, tlscipher=TLS_DIFFIEHELLMAN_WITH_AES256_NONE); Wed, 17 Jun 2026 13:00:24 +0000 X-ExclaimerHostedSignatures-MessageProcessed: true X-ExclaimerProxyLatency: 11459475 X-ExclaimerImprintLatency: 6458630 X-ExclaimerImprintAction: 240bcf91998443629417437a71128d24 Received: by mail-yw1-f197.google.com with SMTP id 00721157ae682-7fd85d01ed0so24475127b3.1 for <[email protected]>; Wed, 17 Jun 2026 06:00:23 -0700 (PDT) X-Received: by 2002:a05:690c:e185:10b0:7ff:5a5:3eb6 with SMTP id 00721157ae682-7ff05a57e0amr10253557b3.18.1781701222477; Wed, 17 Jun 2026 06:00:22 -0700 (PDT) X-Received: by 2002:a05:690c:e185:10b0:7ff:5a5:3eb6 with SMTP id 00721157ae682-7ff05a57e0amr10252937b3.18.1781701221797; Wed, 17 Jun 2026 06:00:21 -0700 (PDT) MIME-Version: 1.0 From: Michael Hamill <[email protected]> Date: Wed, 17 Jun 2026 09:00:09 -0400 X-Gm-Features: AVVi8CcQyJbT9JFcIaCcmgMVQ_DgqIucAeyAUqXiocCYqrS2bBZFSubwqqfC670 Message-ID: <CAB_Va8MKm97t9P0VMfg1kbdxm-XpEhb=dHE3EPdnmhSs5hdb9Q@mail.gmail.com> Subject: apt: HTTPS acquire fails under OpenSSL FIPS-only mode (missing ERR_clear_error before SSL_read/write) To: [email protected] Content-Type: multipart/alternative; boundary="0000000000006be57e065472a4aa" Delivered-To: [email protected] --0000000000006be57e065472a4aa Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Package: apt Version: 3.0.3 Severity: important Dear Maintainer, With OpenSSL configured in FIPS-only mode (only the "base" and "fips" providers active; the "default" provider disabled), "apt-get update"/"install" against an HTTPS repository intermittently fails with: Err:N https://...repo... OpenSSL error: error:0308010C:digital envelope routines::unsupported Error reading from server - read (5: Input/output error) Root cause ---------- During the TLS handshake, libssl performs an implicit EVP_MD_fetch() for th= e legacy MD5 / MD5-SHA1 digests (used for pre-TLS-1.2 handshake signing and the TLS 1.0/1.1 PRF). Under a FIPS-only provider configuration those digests ar= e unavailable (they exist only in the default provider), so the fetch fails and leaves "error:0308010C ... unsupported" on the thread's OpenSSL error queue= . This is benign: the handshake completes fine. "openssl s_client" to the sam= e host under the identical FIPS config connects successfully with the very same failed MD5/MD5-SHA1 fetches (verifiable with an LD_PRELOAD trace of EVP_MD_fetch). The actual failure is that apt does not clear the OpenSSL error queue before its TLS I/O. In methods/connect.cc, TlsFd::Read() and TlsFd::Write() call SSL_read()/SSL_write() and then HandleError() -> SSL_get_error() WITHOUT a preceding ERR_clear_error(). When SSL_read() later returns <=3D 0 for a ben= ign reason, SSL_get_error() consults the non-empty error queue, returns SSL_ERROR_SSL, and apt reports the stale MD5 error as a fatal read failure (errno =3D EIO -> "Error reading from server"). This violates the documented precondition in SSL_get_error(3): "The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, [...] as the SSL_get_error() function uses the error queue [...]." PostgreSQL fixed the identical class of bug (stale FIPS-mode error-queue entry misreported later) by calling ERR_clear_error() "on the way in"; libpq already does this around its OpenSSL I/O. This did not occur before Debian 13 / apt 3.0: apt 2.6 (bookworm) used GnuTLS for its TLS transport, which does not touch OpenSSL's providers or error queue. Reproduction (Debian 13) ------------------------------ Minimal, self-contained Dockerfile. The build itself fails at the final RUN (installing Docker from an HTTPS repo) -- "docker build ." is the whole repro: FROM debian:13-slim SHELL ["/bin/bash", "-o", "pipefail", "-c"] # FIPS-only OpenSSL: install the FIPS provider, then activate base + fips and # disable the default provider. RUN apt-get update --yes \ && apt-get install --yes --no-install-recommends \ ca-certificates openssl openssl-provider-fips \ && MODULES_DIR=3D"$(openssl version -m | cut -d'"' -f2)" \ && openssl fipsinstall -out /etc/ssl/fipsmodule.cnf -module "${MODULES_DIR}/fips.so" RUN sed -i 's|^#\s*\.include\s\+fipsmodule.cnf|.include /etc/ssl/fipsmodule.cnf|' /etc/ssl/openssl.cnf \ && sed -i 's/^default\s*=3D\s*default_sect/# default =3D default_sect/= ' /etc/ssl/openssl.cnf \ && sed -i 's/^#\s*fips\s*=3D\s*fips_sect/fips =3D fips_sect\nbase =3D base_sect\n\n[base_sect]\nactivate =3D 1/' /etc/ssl/openssl.cnf # ("openssl list -providers" now shows only base + fips.) # Install Docker from its official HTTPS apt repo (any HTTPS repo triggers it; # this is just a convenient public one). This RUN fails: # OpenSSL error: error:0308010C ... Error reading from server # E: Package 'docker-ce' has no installation candidate RUN apt-get install --no-install-recommends -y ca-certificates curl gnupg \ && install -m 0755 -d /etc/apt/keyrings \ && curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg \ && echo "deb [signed-by=3D/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian trixie stable" \ > /etc/apt/sources.list.d/docker.list \ && apt-get update \ && apt-get install --no-install-recommends -y docker-ce docker-ce-cli containerd.io Build it: docker build . The build fails at the final RUN with the error:0308010C / "Error reading from server" message above. (The underlying trigger is a read returning <=3D 0 while the stale error is queued, so in principle a fluke pass is possible; in practice fetching the Docker repo over HTTPS this way fails on essentially every build, matching what we see in CI. If a build does pass, rebuild with --no-cache.) For contrast, the connection itself is fine and the failed MD5 fetch is benign -- both of these succeed under the identical FIPS config: # same handshake, succeeds, proving MD5 is not actually needed: openssl s_client -connect download.docker.com:443 -servername download.docker.com </dev/null # and apt works if the default provider is made available: OPENSSL_CONF=3D/dev/null apt-get update # (with the docker.list source above) System information ------------------ Debian release: 13 (trixie), amd64 Versions of relevant packages: apt 3.0.3 libssl3t64 3.5.6-1~deb13u2 (OpenSSL; apt's TLS backend in 3.0) openssl 3.5.6-1~deb13u2 libc6 2.41-12+deb13u3 Reproduced in a stock debian:13-slim container (see Dockerfile above). Suggested fix ------------- Clear the OpenSSL error queue immediately before each SSL_read()/SSL_write() in methods/connect.cc, mirroring libpq: ssize_t Read(void *buf, size_t count) override { assert(ssl); + ERR_clear_error(); return HandleError(SSL_read(ssl, buf, count)); } ssize_t Write(void *buf, size_t count) override { assert(ssl); + ERR_clear_error(); return HandleError(SSL_write(ssl, buf, count)); } This makes apt robust to any benign leftover OpenSSL error, not just the FIPS/MD5 case. Michael Hamill Senior Software Engineer II [email protected] www.wellhive.com WELLHIVE CONFIDENTIALITY NOTICE: The contents of this email message and any= attachments are intended solely for the addressee(s). Unless otherwise ind= icated, it contains information that is confidential, privileged and/or exe= mpt from disclosure under applicable law. If you are not the named addresse= e, you are not authorized to read, print, retain, copy or disseminate this = message or any part of it. If you have received this message in error, plea= se notify the sender immediately by e-mail and delete all copies of the mes= sage.=20 --0000000000006be57e065472a4aa Content-Type: multipart/related; boundary="=-GkqDXpLl9ezT2U8GiX+1xg==" --=-GkqDXpLl9ezT2U8GiX+1xg== Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head></head><body><div dir=3D"ltr">Package: apt<br>Version: 3.0.3<br= >Severity: important<br><br>Dear Maintainer,<br><br>With OpenSSL configured= in FIPS-only mode (only the "base" and "fips" provider= s<br>active; the "default" provider disabled), "apt-get upda= te"/"install" against an<br>HTTPS repository intermittently = fails with:<br><br>=C2=A0 Err:N https://...repo...<br>=C2=A0 =C2=A0 OpenSSL= error: error:0308010C:digital envelope routines::unsupported<br>=C2=A0 =C2= =A0 Error reading from server - read (5: Input/output error)<br><br>Root ca= use<br>----------<br>During the TLS handshake, libssl performs an implicit = EVP_MD_fetch() for the<br>legacy MD5 / MD5-SHA1 digests (used for pre-TLS-1= .2 handshake signing and the<br>TLS 1.0/1.1 PRF). Under a FIPS-only provide= r configuration those digests are<br>unavailable (they exist only in the de= fault provider), so the fetch fails and<br>leaves "error:0308010C ... = unsupported" on the thread's OpenSSL error queue.<br><br>This is b= enign: the handshake completes fine. "openssl s_client" to the sa= me<br>host under the identical FIPS config connects successfully with the v= ery same<br>failed MD5/MD5-SHA1 fetches (verifiable with an LD_PRELOAD trac= e of<br>EVP_MD_fetch).<br><br>The actual failure is that apt does not clear= the OpenSSL error queue before its<br>TLS I/O. In methods/connect.cc, TlsF= d::Read() and TlsFd::Write() call<br>SSL_read()/SSL_write() and then Handle= Error() -> SSL_get_error() WITHOUT a<br>preceding ERR_clear_error(). Whe= n SSL_read() later returns <=3D 0 for a benign<br>reason, SSL_get_error(= ) consults the non-empty error queue, returns<br>SSL_ERROR_SSL, and apt rep= orts the stale MD5 error as a fatal read failure<br>(errno =3D EIO -> &q= uot;Error reading from server").<br><br>This violates the documented p= recondition in SSL_get_error(3): "The current<br>thread's error qu= eue must be empty before the TLS/SSL I/O operation is<br>attempted, [...] a= s the SSL_get_error() function uses the error queue [...]."<br><br>Pos= tgreSQL fixed the identical class of bug (stale FIPS-mode error-queue entry= <br>misreported later) by calling ERR_clear_error() "on the way in&quo= t;; libpq already<br>does this around its OpenSSL I/O.<br><br>This did not = occur before Debian 13 / apt 3.0: apt 2.6 (bookworm) used GnuTLS<br>for its= TLS transport, which does not touch OpenSSL's providers or error queue= .<br><br>Reproduction (Debian 13)<br>------------------------------<br>Mini= mal, self-contained Dockerfile. The build itself fails at the final RUN<br>= (installing Docker from an HTTPS repo) -- "docker build ." is the= whole repro:<br><br>=C2=A0 =C2=A0 FROM debian:13-slim<br>=C2=A0 =C2=A0 SHE= LL ["/bin/bash", "-o", "pipefail", "-c&q= uot;]<br><br>=C2=A0 =C2=A0 # FIPS-only OpenSSL: install the FIPS provider, = then activate base + fips and<br>=C2=A0 =C2=A0 # disable the default provid= er.<br>=C2=A0 =C2=A0 RUN apt-get update --yes \<br>=C2=A0 =C2=A0 =C2=A0&= ;& apt-get install --yes --no-install-recommends \<br>=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 ca-certificates openssl openssl-provider-fips \<br= >=C2=A0 =C2=A0 =C2=A0&& MODULES_DIR=3D"$(openssl version -m | = cut -d'"' -f2)" \<br>=C2=A0 =C2=A0 =C2=A0&& opens= sl fipsinstall -out /etc/ssl/fipsmodule.cnf -module "${MODULES_DIR}/fi= ps.so"<br>=C2=A0 =C2=A0 RUN sed -i 's|^#\s*\.include\s\+fipsmodule= .cnf|.include /etc/ssl/fipsmodule.cnf|' /etc/ssl/openssl.cnf \<br>=C2=A0= =C2=A0 =C2=A0&& sed -i 's/^default\s*=3D\s*default_sect/# defa= ult =3D default_sect/' /etc/ssl/openssl.cnf \<br>=C2=A0 =C2=A0 =C2=A0&a= mp;& sed -i 's/^#\s*fips\s*=3D\s*fips_sect/fips =3D fips_sect\nbase= =3D base_sect\n\n[base_sect]\nactivate =3D 1/' /etc/ssl/openssl.cnf<br= >=C2=A0 =C2=A0 # ("openssl list -providers" now shows only base += fips.)<br><br>=C2=A0 =C2=A0 # Install Docker from its official HTTPS apt r= epo (any HTTPS repo triggers it;<br>=C2=A0 =C2=A0 # this is just a convenie= nt public one). This RUN fails:<br>=C2=A0 =C2=A0 # =C2=A0 OpenSSL error: er= ror:0308010C ... Error reading from server<br>=C2=A0 =C2=A0 # =C2=A0 E: Pac= kage 'docker-ce' has no installation candidate<br>=C2=A0 =C2=A0 RUN= apt-get install --no-install-recommends -y ca-certificates curl gnupg \<br= >=C2=A0 =C2=A0 =C2=A0&& install -m 0755 -d /etc/apt/keyrings \<br>=C2= =A0 =C2=A0 =C2=A0&& curl -fsSL <a href=3D"https://download.docker.c= om/linux/debian/gpg">https://download.docker.com/linux/debian/gpg</a> | gpg= --dearmor -o /etc/apt/keyrings/docker.gpg \<br>=C2=A0 =C2=A0 =C2=A0&&a= mp; echo "deb [signed-by=3D/etc/apt/keyrings/docker.gpg] <a href=3D"ht= tps://download.docker.com/linux/debian">https://download.docker.com/linux/d= ebian</a> trixie stable" \<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 > = /etc/apt/sources.list.d/docker.list \<br>=C2=A0 =C2=A0 =C2=A0&& apt= -get update \<br>=C2=A0 =C2=A0 =C2=A0&& apt-get install --no-instal= l-recommends -y docker-ce docker-ce-cli <a href=3D"http://containerd.io">co= ntainerd.io</a><br><br>Build it:<br><br>=C2=A0 =C2=A0 docker build .<br><br= >The build fails at the final RUN with the error:0308010C / "Error rea= ding from<br>server" message above. (The underlying trigger is a read = returning <=3D 0 while<br>the stale error is queued, so in principle a f= luke pass is possible; in practice<br>fetching the Docker repo over HTTPS t= his way fails on essentially every build,<br>matching what we see in CI. If= a build does pass, rebuild with --no-cache.)<br><br>For contrast, the conn= ection itself is fine and the failed MD5 fetch is benign --<br>both of thes= e succeed under the identical FIPS config:<br><br>=C2=A0 =C2=A0 # same hand= shake, succeeds, proving MD5 is not actually needed:<br>=C2=A0 =C2=A0 opens= sl s_client -connect <a href=3D"http://download.docker.com:443">download.do= cker.com:443</a> -servername <a href=3D"http://download.docker.com">downloa= d.docker.com</a> </dev/null<br>=C2=A0 =C2=A0 # and apt works if the defa= ult provider is made available:<br>=C2=A0 =C2=A0 OPENSSL_CONF=3D/dev/null a= pt-get update =C2=A0 =C2=A0 # (with the docker.list source above)<br><br>Sy= stem information<br>------------------<br>Debian release: 13 (trixie), amd6= 4<br><br>Versions of relevant packages:<br>=C2=A0 apt =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A03.0.3<br>=C2=A0 libssl3t64 =C2=A0 3.5.6-1~deb13u2 =C2=A0 (Open= SSL; apt's TLS backend in 3.0)<br>=C2=A0 openssl =C2=A0 =C2=A0 =C2=A03.= 5.6-1~deb13u2<br>=C2=A0 libc6 =C2=A0 =C2=A0 =C2=A0 =C2=A02.41-12+deb13u3<br= ><br>Reproduced in a stock debian:13-slim container (see Dockerfile above).= <br><br>Suggested fix<br>-------------<br>Clear the OpenSSL error queue imm= ediately before each SSL_read()/SSL_write() in<br>methods/connect.cc, mirro= ring libpq:<br><br>=C2=A0 =C2=A0 ssize_t Read(void *buf, size_t count) over= ride {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0assert(ssl);<br>=C2=A0 =C2=A0 + =C2=A0= ERR_clear_error();<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0return HandleError(SSL_rea= d(ssl, buf, count));<br>=C2=A0 =C2=A0 }<br>=C2=A0 =C2=A0 ssize_t Write(void= *buf, size_t count) override {<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0assert(ssl);<= br>=C2=A0 =C2=A0 + =C2=A0ERR_clear_error();<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0r= eturn HandleError(SSL_write(ssl, buf, count));<br>=C2=A0 =C2=A0 }<br><br>Th= is makes apt robust to any benign leftover OpenSSL error, not just the<br>F= IPS/MD5 case.<br><input name=3D"virtru-metadata" type=3D"hidden" value=3D"{= "email-policy":{"disableCopyPaste":false,"disableP= rint":false,"disableForwarding":false,"enableNoauth&quo= t;:false,"expires":false,"sms":false,"expirationNu= m":1,"expirationUnit":"days","expirationDate&= quot;:null,"isManaged":false},"attachments":{},"co= mpose-id":"1","compose-window":{"secure"= :false}}"></div> <div dir=3D"ltr" style=3D"mso-line-height-rule:exactly;-webkit-text-size-ad= just:100%;font-size:1px;direction:ltr;"><table dir=3D"ltr" cellpadding=3D"0= " cellspacing=3D"0" border=3D"0" style=3D"width:100%;direction:ltr;border-c= ollapse:collapse;font-size:1px;color:#000001;font-style:normal;font-weight:= 400;white-space:nowrap;"><tr style=3D"font-size:0;"><td align=3D"left" styl= e=3D"vertical-align:top;"><table cellpadding=3D"0" cellspacing=3D"0" border= =3D"0" style=3D"border-collapse:collapse;font-size:0;"><tr style=3D"font-si= ze:0;"><td align=3D"left" style=3D"padding:15px 0 20px;vertical-align:top;"= ><table cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"border-co= llapse:collapse;font-size:0;"><tr style=3D"font-size:0;"><td align=3D"cente= r" style=3D"padding:10px;vertical-align:top;"><table cellpadding=3D"0" cell= spacing=3D"0" border=3D"0" style=3D"border-collapse:collapse;font-size:0;li= ne-height:normal;"><tr style=3D"font-size:0;"><td align=3D"center" style=3D= "padding:10px 15px;vertical-align:top;"><img src=3D"cid:image985900.png@410= D6375.4A9EA34D" width=3D"60" height=3D"70" border=3D"0" alt=3D"" style=3D"w= idth:60px;min-width:60px;max-width:60px;height:70px;min-height:70px;max-hei= ght:70px;font-size:0;" /></td></tr></table></td><td align=3D"left" style=3D= "padding:10px 10px 10px 15px;border-top:none;border-right:none;border-botto= m:none;border-left:solid 1px #A1A1A1;vertical-align:top;"><table cellpaddin= g=3D"0" cellspacing=3D"0" border=3D"0" style=3D"border-collapse:collapse;fo= nt-size:0;"><tr style=3D"font-size:0;"><td align=3D"left" style=3D"vertical= -align:top;"><table cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D= "border-collapse:collapse;font-size:0;color:#3D3D3D;font-style:normal;font-= weight:700;white-space:nowrap;"><tr style=3D"font-size:15px;"><td align=3D"= left" style=3D"vertical-align:top;font-family:Arial;">Michael Hamill</= td></tr><tr style=3D"font-size:13.33px;font-style:italic;font-weight:400;">= <td align=3D"left" style=3D"vertical-align:top;font-family:Arial;">Senior&n= bsp;Software Engineer II</td></tr></table></td></tr><tr style=3D"= font-size:0;"><td align=3D"left" style=3D"vertical-align:top;"><table cellp= adding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"border-collapse:collap= se;font-size:0;"><tr style=3D"font-size:0;"><td align=3D"left" style=3D"pad= ding:10px 2px 2px 0;vertical-align:top;"><table cellpadding=3D"0" cellspaci= ng=3D"0" border=3D"0" style=3D"border-collapse:collapse;font-size:0;color:#= 3D3D3D;font-style:normal;font-weight:400;white-space:nowrap;"><tr style=3D"= font-size:13.33px;"><td align=3D"left" style=3D"vertical-align:top;font-siz= e:0;"><table cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"bord= er-collapse:collapse;font-size:0;line-height:normal;"><tr style=3D"font-siz= e:0;"><td align=3D"left" style=3D"padding:0 7px 0 0;vertical-align:top;"><i= mg src=3D"cid:[email protected]" width=3D"18" height=3D"18"= border=3D"0" alt=3D"" style=3D"width:18px;min-width:18px;max-width:18px;he= ight:18px;min-height:18px;max-height:18px;font-size:0;" /></td></tr></table= ></td><td align=3D"left" style=3D"vertical-align:top;font-family:Arial;">mi= [email protected]<br /></td></tr></table></td></tr></table></td></t= r><tr style=3D"font-size:0;"><td align=3D"left" style=3D"vertical-align:top= ;"><table cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"border-= collapse:collapse;font-size:0;"><tr style=3D"font-size:0;"><td align=3D"lef= t" style=3D"padding:2px 2px 2px 0;vertical-align:top;"><table cellpadding=3D= "0" cellspacing=3D"0" border=3D"0" style=3D"border-collapse:collapse;font-s= ize:0;color:#3D3D3D;font-style:normal;font-weight:400;white-space:nowrap;">= <tr style=3D"font-size:13.33px;"><td align=3D"left" style=3D"vertical-align= :top;font-size:0;"><table cellpadding=3D"0" cellspacing=3D"0" border=3D"0" = style=3D"border-collapse:collapse;font-size:0;line-height:normal;"><tr styl= e=3D"font-size:0;"><td align=3D"left" style=3D"padding:0 7px 0 0;vertical-a= lign:top;"><img src=3D"cid:[email protected]" width=3D"18" = height=3D"18" border=3D"0" alt=3D"" style=3D"width:18px;min-width:18px;max-= width:18px;height:18px;min-height:18px;max-height:18px;font-size:0;" /></td= ></tr></table></td><td align=3D"left" style=3D"vertical-align:top;font-fami= ly:Arial;">www.<a href=3D"https://www.wellhive.com/" target=3D"_blank" id=3D= "LPlnk689713" title=3D"WellHive" style=3D"text-decoration:none;color:#3D3D3= D;">wellhive.com</a></td></tr></table></td></tr></table></td></tr></table><= /td></tr></table></td></tr></table></td></tr><tr style=3D"font-size:14.67px= ;"><td align=3D"left" style=3D"vertical-align:top;font-family:Arial;"><br /= ></td></tr></table></div><div dir=3D"ltr" style=3D"mso-line-height-rule:exa= ctly;-webkit-text-size-adjust:100%;font-size:1px;direction:ltr;"><table dir= =3D"ltr" cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"width:10= 0%;direction:ltr;border-collapse:collapse;font-size:1px;"><tr style=3D"font= -size:1px;"><td align=3D"left" style=3D"vertical-align:top;font-size:0;"><t= able cellpadding=3D"0" cellspacing=3D"0" border=3D"0" style=3D"white-space:= normal;color:#000001;font-size:14.67px;font-family:Calibri,Arial,sans-serif= ;font-weight:400;font-style:normal;text-align:justify;width:100%;border-col= lapse:collapse;"><tr style=3D"font-size:13px;"><td style=3D"font-family:Cal= ibri;">WELLHIVE CONFIDENTIALITY NOTICE: The contents of this email message = and any attachments are intended solely for the addressee(s). Unless otherw= ise indicated, it contains information that is confidential, privileged and= /or exempt from disclosure under applicable law. If you are not the named a= ddressee, you are not authorized to read, print, retain, copy or disseminat= e this message or any part of it. If you have received this message in erro= r, please notify the sender immediately by e-mail and delete all copies of = the message. <br /></td></tr></table></td><td><span style=3D"font-fami= ly:remialcxesans;font-size:1px;color:#FFFFFF;line-height:1px;">​<span= style=3D"font-family:'template-DfPSVQa9Ee20eygYeG7fbQ';">​</= span><span style=3D"font-family:'zone-1';">​</span><span styl= e=3D"font-family:'zones-AQ';">​</span></span></td></tr></tabl= e></div></body></html>= --=-GkqDXpLl9ezT2U8GiX+1xg== Content-Type: image/png; name=image985900.png Content-Transfer-Encoding: base64 Content-Id: <[email protected]> Content-Description: image985900.png Content-Disposition: inline; filename=image985900.png; size=3645; creation-date="Wed, 17 Jun 2026 13:00:24 +0000"; modification-date="Wed, 17 Jun 2026 13:00:24 +0000" iVBORw0KGgoAAAANSUhEUgAAADwAAABGCAYAAACQRffVAAAACXBIWXMAAC4jAAAuIwF4pT92AAAG xmlUWHRYTUw6Y29tLmFkb2JlLnhtcAAAAAAAPD94cGFja2V0IGJlZ2luPSLvu78iIGlkPSJXNU0w TXBDZWhpSHpyZVN6TlRjemtjOWQiPz4gPHg6eG1wbWV0YSB4bWxuczp4PSJhZG9iZTpuczptZXRh LyIgeDp4bXB0az0iQWRvYmUgWE1QIENvcmUgNi4wLWMwMDIgNzkuMTY0MzUyLCAyMDIwLzAxLzMw LTE1OjUwOjM4ICAgICAgICAiPiA8cmRmOlJERiB4bWxuczpyZGY9Imh0dHA6Ly93d3cudzMub3Jn LzE5OTkvMDIvMjItcmRmLXN5bnRheC1ucyMiPiA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0i IiB4bWxuczp4bXA9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC8iIHhtbG5zOmRjPSJodHRw Oi8vcHVybC5vcmcvZGMvZWxlbWVudHMvMS4xLyIgeG1sbnM6cGhvdG9zaG9wPSJodHRwOi8vbnMu YWRvYmUuY29tL3Bob3Rvc2hvcC8xLjAvIiB4bWxuczp4bXBNTT0iaHR0cDovL25zLmFkb2JlLmNv bS94YXAvMS4wL21tLyIgeG1sbnM6c3RFdnQ9Imh0dHA6Ly9ucy5hZG9iZS5jb20veGFwLzEuMC9z VHlwZS9SZXNvdXJjZUV2ZW50IyIgeG1wOkNyZWF0b3JUb29sPSJBZG9iZSBQaG90b3Nob3AgMjEu MSAoTWFjaW50b3NoKSIgeG1wOkNyZWF0ZURhdGU9IjIwMTktMTEtMTRUMTI6NDc6MzYtMDU6MDAi IHhtcDpNb2RpZnlEYXRlPSIyMDIwLTA1LTIyVDE1OjI3OjQ1LTA0OjAwIiB4bXA6TWV0YWRhdGFE YXRlPSIyMDIwLTA1LTIyVDE1OjI3OjQ1LTA0OjAwIiBkYzpmb3JtYXQ9ImltYWdlL3BuZyIgcGhv dG9zaG9wOkNvbG9yTW9kZT0iMyIgcGhvdG9zaG9wOklDQ1Byb2ZpbGU9InNSR0IgSUVDNjE5NjYt Mi4xIiB4bXBNTTpJbnN0YW5jZUlEPSJ4bXAuaWlkOmRhNzI4OGMzLTA1YjItNGRmZS1iNjRmLWJm MTUyYTZlZmYxNSIgeG1wTU06RG9jdW1lbnRJRD0iYWRvYmU6ZG9jaWQ6cGhvdG9zaG9wOjQ1YzY0 ODEyLWY4YzMtM2Q0NC1hMjc2LTE0NTg0ZGYwMDEzYSIgeG1wTU06T3JpZ2luYWxEb2N1bWVudElE PSJ4bXAuZGlkOjc4NmEwYmU5LTBmZjQtNDVmZi05NGExLWExZTRjOTFmOWJhOSI+IDx4bXBNTTpI aXN0b3J5PiA8cmRmOlNlcT4gPHJkZjpsaSBzdEV2dDphY3Rpb249ImNyZWF0ZWQiIHN0RXZ0Omlu c3RhbmNlSUQ9InhtcC5paWQ6Nzg2YTBiZTktMGZmNC00NWZmLTk0YTEtYTFlNGM5MWY5YmE5IiBz dEV2dDp3aGVuPSIyMDE5LTExLTE0VDEyOjQ3OjM2LTA1OjAwIiBzdEV2dDpzb2Z0d2FyZUFnZW50 PSJBZG9iZSBQaG90b3Nob3AgMjEuMSAoTWFjaW50b3NoKSIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlv bj0ic2F2ZWQiIHN0RXZ0Omluc3RhbmNlSUQ9InhtcC5paWQ6M2EyZDMyZGItODFlNy00NThjLWI4 NjUtMzQ5YjljN2E0ZmFkIiBzdEV2dDp3aGVuPSIyMDIwLTA0LTEwVDE2OjU5OjI3LTA0OjAwIiBz dEV2dDpzb2Z0d2FyZUFnZW50PSJBZG9iZSBQaG90b3Nob3AgMjEuMSAoTWFjaW50b3NoKSIgc3RF dnQ6Y2hhbmdlZD0iLyIvPiA8cmRmOmxpIHN0RXZ0OmFjdGlvbj0ic2F2ZWQiIHN0RXZ0Omluc3Rh bmNlSUQ9InhtcC5paWQ6ZGE3Mjg4YzMtMDViMi00ZGZlLWI2NGYtYmYxNTJhNmVmZjE1IiBzdEV2 dDp3aGVuPSIyMDIwLTA1LTIyVDE1OjI3OjQ1LTA0OjAwIiBzdEV2dDpzb2Z0d2FyZUFnZW50PSJB ZG9iZSBQaG90b3Nob3AgMjEuMSAoTWFjaW50b3NoKSIgc3RFdnQ6Y2hhbmdlZD0iLyIvPiA8L3Jk ZjpTZXE+IDwveG1wTU06SGlzdG9yeT4gPC9yZGY6RGVzY3JpcHRpb24+IDwvcmRmOlJERj4gPC94 OnhtcG1ldGE+IDw/eHBhY2tldCBlbmQ9InIiPz4CR+oAAAAHHUlEQVR42u2bXWwU1xWAv3tn9t/r dey1MXHqYsA0YAmKjPmpEggO0JamShWaClpVJUkfUlX9eWkr9aVNH/rQn4eqrVpVitL0pSL0h0DV VolwCwgwTgzUgQIBN1672F6H1F7b613v7sztw8yaxWbttVkbW8yRVlrduffM/eace+65Z3aFUooH SSQPmDjADrAD7AA7wA6wA+wAL5joBfVqfmnmPrEMp5vLOdUUonwok6/XR4AfArvth90CfBe4dLfO gyGdrRdH2PHmLQjqIGaYQ8v3FtDCCkwhMEXeWX0SuAo8AwSBAPBp4B1g311VCoEpFqtLK0UwboAA MfU8UgL8bprRvwXCuQ1CgSGxdBpqZusuOLBXsqI7QSBukHZNmd2zk4Hu8kAO5DZkNIE/abKiOwFu uQgt7NMou5lkdVeCwZCONO+4Wl+AhjUTkzJhsEynLpIg3J0Ev3bfgBuBvwJRoM920+WWDwK65LFz QwQSJmM+mevafQXo7s26csIr8aQVj7XFrBnenmUl8DJwExgA3gC2zhfwAeBtO/hUAdXAF4EeYCMK CGqEbo6z89Qgg2U6hiay0EcL0H9EKDAlfPCQi+2nBwl3jUGpDpaOtUAEeB542IbfDZwFXig28Erg N3muacA5YD0KKNPZ8FaMx9tiRMMuDAlCEQG+PY3+7wvFFVNCNOxm24Vhms4OQciVuyTaAF+e8b8G GooJ/KwdWPKJC7gINKIL8Ema/3aLx9uHeb/CnYX+MbAf6M8Zdws4KOAlU8BAhZutHSN8/NgAeCS4 BSjWAv+a4f56vq1tbomHZeGZRACtKBrxyQ4UNP9lACXg9MZSlt1KIU0OKcFhO0BJ4BrWpkO00s3m d0bY87oN65dgsgZ4axrL5sojxQQu1BN04DwmW/DLdoAnbejW9UGqPkgDmHYCMrHfRsNuNl0e5RNZ 2IAEk7V2zPAXeG9RTJDZlDY14Dgm1fgleDV2HR3go1fjRMPuO5ISqRTRSjcNnWPs/XMUXAICGpiU 2Wmnfxb3VcWO0rOREPAyJpZruiVPHRtgdU+CaNiFNEGaimiFm9q+cT7zehQ0ASU6mAo7QFYvtdPS XmAfJlbib8D+1/pZ3ZOkv8pFf6WH2v4Unz/Uhxg3re3Hgv2UHSSX5PHwa4AFEtIRKZP9r/VTH0lS 15vkC4f60McMKHNlYQG+Msd7iWIGrbnKDjvC/8eCdsFohmeOREGATJmTYZcBe5Z6AaBp4pupIKDh MsFlACVaLmw2dXXd/wLA7KL0ZFk1RVP2NKVm6LtELRyaRd/SxQJ8L8dvMU99H/giXlEzrfgSAE4W E7hzCQD3FBO4fQkAXygm8Fng/CKGvQ6cKHbQemURA78KjBcb+BfAu4sQthf46XxtS88tQuAXCo3Q cwE+A3xuHic/2xT2y8Df5zvxOAw8OYunOh+ZlgKexqpRL0im1QJUMP37otwz8VcL6HeQ6Uu5Wfkj UE5hte6ippZjwJeAFaBOICS43CDEZM/02AGv24bKPUwEsUq3N+xdIDjF4LobpARUG9br1s8CQ/cn l1YKpIwQCD2B17crnYxHlS8AHp917U75kA31PnAFuGx///3UI6QCtwcCQdLJeExp+tP4g1uQ2rv3 dlKda8XDAgWvH9IpeiLXuNB19XhkpO+XGx9+9AcfW9uILKuA0WHIpG2rT4gLeDSvXl2HQAgVH6b1 0gmu9Ha9UldZc7S+upaaimqExw/pcTCMyXrnEVjTQCne67nB5Z7rdMV6MTCRCI72/oNL/TfYXb+F VavWWdaOx0DM4EymCYFSkILI9Q7evHaOy0Yn61yr1ODwCKdiF6gOhamrqqE2vBypadaYhbEwmKaB 3+Nl8+r17PJvw6O7SBsGFzuvcvxmK7+6dpim99axp3Fn7KHyKi/xmCcvtDIhUJoeGf7f2BvtJ0Ln Eh0EKWFf9R6a6hvw6G5SRprEeIK0kcE0TaTUFtKlDaSQLCuvvu1WSuH2uti8aTvraldy8t9v0xJr o6u192ff3HbwR57S4M8ZT+yy13Ku9OH2thAf+/qrbX947kaq5yfNJZvZ0bCJUHUtpMYhncKt67g9 9hsXIwPmQrp0drvMpO5szoxDMk5J+TL2bn+KDZE1HOs46T/TeT6+c+MTzyMEKPUI1utOAfQhRDdS oz1yEV/a6/tGwwHq6hqsy8OD1rq+G5gQC2jhmR5EfBikRk3tGl5c/mESI0OYidGsG/7X/kx4hkqO 0VCzksb6DQqvH8ZGbgclUdyqz/zUpYWw1mU8BtKFz18KRjpv5iiEwOsrsaw5GrsnC94f4FyLm5nC Zm5kFqSw5/z00AF2gOcauufcd1Gv4UyBbfkkfY/jFxz4bIFtsxl/ZjED/xPrhXYKMIBvAUdmMf4k 8KI93gS+A/ypqOvL+SueA+wAO8AOsAPsADvADrADXBz5P+ZKSFiF0+9XAAAAAElFTkSuQmCC --=-GkqDXpLl9ezT2U8GiX+1xg== Content-Type: image/png; name=image218692.png Content-Transfer-Encoding: base64 Content-Id: <[email protected]> Content-Description: image218692.png Content-Disposition: inline; filename=image218692.png; size=448; creation-date="Wed, 17 Jun 2026 13:00:24 +0000"; modification-date="Wed, 17 Jun 2026 13:00:24 +0000" iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAAAAXNSR0IArs4c6QAAAARnQU1BAACx jwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFVSURBVDhP3ZM9S8NQFIbzTQYHh45dBMe6tdA1 WzIILo6Ojo4dnPwJzlLB/gDBRSKZ0s1RQcFF0EFw6dDBId/xfW9vo4GIySY+cDjn3Jz73nM/ovxf VOkFvu/3VVU1ZPornue9yvBLKAiCW4iMZdqWR9M0R47jRBqzMAw34IaMOzKI47jPQAhB8QNuxrgj c9d1nxlUHVmWdVyW5TnzllxjW/uY22MihKIo6qVpyjM6K4piF4ILjjeBb+z+MM/zoyRJbrIsG3Bc CEm2UUSxIUR3kF+uhmvMsRC/KZqmPbBWjILvQgqvHnaClq+w4gTCB7Alu4DAhFvRdf0UpVPU8YIq akJrUDTGinfwNs5ui4Z4ga084fPeqqpOoxDBxE24KSa/w16QX8DEwTbxo9AadgWrbaMJIWTb9htc 9dzbwrMzDOOecfWL8C3hKju9borgMS9l+qdQlE8AznuZYagu9gAAAABJRU5ErkJggg== --=-GkqDXpLl9ezT2U8GiX+1xg== Content-Type: image/png; name=image653561.png Content-Transfer-Encoding: base64 Content-Id: <[email protected]> Content-Description: image653561.png Content-Disposition: inline; filename=image653561.png; size=626; creation-date="Wed, 17 Jun 2026 13:00:24 +0000"; modification-date="Wed, 17 Jun 2026 13:00:24 +0000" iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAAAAXNSR0IArs4c6QAAAARnQU1BAACx jwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAIHSURBVDhPtZSvT1tRFMf7Ky0CgUBUkGwCMZL9 AzgaaHkkNc1CMkFD5pZsJAgIEkEIAsGfAAlmAkGyJ15VJ0qCqNjUJourQEwgXtrXls/39t7y3p4d 3+S8c+/58b3nnnvazP9C1uoUgiB4h/Ly+fwb7Uej0UMul+vUarWu9v8iReT7frlYLF6z3NB+Mpn8 zWazC1oL7LtI0/O8P9ZkkCCyJG2tCT5FhVTRR39gvy+7RX88HlfiZDMiR6IKhsNho16vi0BXPIDs nOUt8oTfo8JF1gmynD6CvU4BXXUkAok3JOyR3KM/TfaryD2uMgd8n0bZitRYjL8JiJAGp/jGG0O7 3Z5DFaIoOoN4x/WN9RbxgavI0wdnAVFCCpVKJRwMBvskfnYkAq+6Lm2I3BMLBO1yesFuZ2i1Wh/x negwazLgBm+lnTHurFP+OWSH2lDFDsHzEHwx3jRMrqlIwybtoPLVizAMlyC4RC4gW7LuBPD1pA0R jf4h7YBzDrKv2NfQejEfmbfuBPDfSRsijT0nJkZfZIiqOcP3C5NOvkLiE91nXDRfL3NEcBM1mx8H VYIcs/zGgZ+QFdYB8U/Yt3nNyMTp42DnST+R8tTyAq7QKJVKHXp3pB4St1WtVjvWnf7RWjJN7PLU MsNPqnhPFY+qJE4ipIgcINRfyCbJZk5I7qmx6om7zisgk3kGL/L1gF4YudEAAAAASUVORK5CYII= --=-GkqDXpLl9ezT2U8GiX+1xg==-- --0000000000006be57e065472a4aa-- ------------=_1785445984-59072-0 Content-Type: message/rfc822 Content-Disposition: inline Content-Transfer-Encoding: 7bit Received: (at 1140227-close) by bugs.debian.org; 30 Jul 2026 21:10:50 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-114.1 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA, FVGT_m_MULTI_ODD,HAS_BUG_NUMBER,MD5_SHA1_SUM,PGPSIGNATURE, SPF_HELO_PASS,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 13; hammy, 150; neutral, 408; spammy, 0. spammytokens: hammytokens:0.000-+--HX-Debian:DAK, 0.000-+--H*rp:D*ftp-master.debian.org, 0.000-+--HX-DAK:process-upload, 0.000-+--H*r:sk:fasolo., 0.000-+--H*MI:fasolo Return-path: <[email protected]> Received: from mailly.debian.org ([2001:41b8:202:deb:6564:a62:52c3:4b72]:51878) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <[email protected]>) id 1wpY1i-000FCe-0v for [email protected]; Thu, 30 Jul 2026 21:10:50 +0000 Received: via submission from C=NA,ST=NA,L=Ankh Morpork,O=Debian SMTP,OU=Debian SMTP CA,CN=fasolo.debian.org,[email protected] (verified) by mailly.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <[email protected]>) id 1wpY1h-00DDZd-03 for [email protected]; Thu, 30 Jul 2026 21:10:49 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=ftp-master.debian.org; s=smtpauto.fasolo; h=Date:Message-Id:Content-Type: Subject:MIME-Version:To:Reply-To:From:Cc:Content-Transfer-Encoding:Content-ID :Content-Description:In-Reply-To:References; bh=b0RhWsWEFF4cLadvDvhK94j4N/SmUM+A7Bcq1F2cueE=; b=d2Doi4aGP+gDN7wdoNg0ErRgOh WntEZZBYOmz+7XUHwYODrUWjzrB3GZXLXDCsH9B/6kww6uzTRy0r1/uOet+RXQ2L9iE0hlEvFW/S4 SpQOHjTTGfD3b/+bBnVUtSAwtXHnns0xwQ9x776Xiy6uVaDwU+yz5eBd3y/uX+nqZXkunAnVVIpbL wStpZtumimQsS3HGPp6EKQVq5p88vGEDj1B1VHpAy5MgP1W4i1Grp6zB3e3OTsEtveERN5WetcOJ2 yTqEGa5ykVT9t12FqRoEmHeWrGLeaNELPqrrnI+DM1OZ6pmUsOLKk+x2lDd9OJM9W+0ngLpFP1FHJ YGEppVRg==; Received: from dak by fasolo.debian.org with local (Exim 4.98.2) (envelope-from <[email protected]>) id 1wpY1g-00000007s7b-0Qke; Thu, 30 Jul 2026 21:10:48 +0000 From: Debian FTP Masters <[email protected]> Reply-To: Julian Andres Klode <[email protected]> To: [email protected] X-DAK: dak process-upload X-Debian: DAK X-Debian-Package: apt Debian: DAK Debian-Changes: apt_3.3.2_source.changes Debian-Source: apt Debian-Version: 3.3.2 Debian-Architecture: source Debian-Suite: unstable Debian-Archive-Action: accept MIME-Version: 1.0 Subject: Bug#1140227: fixed in apt 3.3.2 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="===============0661509796880750261==" Message-Id: <[email protected]> Date: Thu, 30 Jul 2026 21:10:48 +0000 X-CrossAssassin-Score: 3 --===============0661509796880750261== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Source: apt Source-Version: 3.3.2 Done: Julian Andres Klode <[email protected]> We believe that the bug you reported is fixed in the latest version of apt, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Julian Andres Klode <[email protected]> (supplier of updated apt package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 30 Jul 2026 22:43:05 +0200 Source: apt Architecture: source Version: 3.3.2 Distribution: unstable Urgency: medium Maintainer: APT Development Team <[email protected]> Changed-By: Julian Andres Klode <[email protected]> Closes: 1133965 1135221 1135222 1139336 1140227 Changes: apt (3.3.2) unstable; urgency=3Dmedium . [ Julian Andres Klode ] * Document and test combined `build-dep --arch-only --indep-only` * ftparchive: fix heap overflow in ContentsExtract::DoItem * deb: guard against unsigned underflow when trimming control newlines * gpgv: don't advance past the null terminator in PushEntryWithKeyID * ftparchive: replace ContentsExtract's manual buffer with std::vector<cha= r> * test: Limit valgrind to 1024 open files * hashes: Fix lingering OpenSSL error (Closes: #1140227) * test: use `gnurm` where available * Convert command-line option-parsing to declarative format * Fix crash when an aux file request is redirected * Reply to aux requests with the original URI if redirected * debian/apt-daily.service: Add timeouts. 30 mins for apt-daily.service, 12 hours for apt-daily-upgrade.service should be sufficient. (LP: #2158000) . [ =D0=BD=D0=B0=D0=B1 ] * apt-transport-https(1): document host-specific SSLCert, SSLKey, Verify-H= ost with host:: instead of ::host . [ David Kalnischkies ] * aptwebserver: Refuse client immediately on TLS handshake . [ Am=C3=A9rico Monteiro ] * Portuguese manpages translation update (Closes: #1133965) . [ Frans Spiesschaert ] * Dutch program translation update (Closes: #1135221) * Dutch manpages translation update (Closes: #1135222) . [ Remus-Gabriel Chelu ] * Romanian program translation update (Closes: #1139336) . [ Mark Atwood ] * hashes: include <span> for std::span * hashes: don't crash on an unavailable digest * test: exercise hashes with a disabled digest . [ dongshengyuan ] * Fix installing a deb with colon in path . [ Simon Johnsson ] * apt-pkg: rename "OpenPGP signature verification failed" to "Signature ve= rification failed" . [ Andreas Noteng ] * Norwegian Bokm=C3=A5l (nb) translation update . [ Temuri Doghonadze ] * po: Add Georgian translation . [ Andriy Pysyk ] * Update Ukrainian translation for 3.3.1 . [ Mikhail Khachayants ] * srvrec: reject res_query answers bigger than our buffer . [ Ramesh Adhikari ] * tagfile: fix unbounded backward scan in Fill()'s trailing-newline check Checksums-Sha1: cc908164eab430cd2d913e727761f13773088bba 3132 apt_3.3.2.dsc b11dc55fc4238aee345832f9673d1330d5c807e0 2500604 apt_3.3.2.tar.xz 394d4b63680d9c7eceec7825ff150829e6666ff3 7455 apt_3.3.2_source.buildinfo Checksums-Sha256: 62b65b8ff473c9f6e99ab88f4bee84befef42075198201c67ff872c07da65dd6 3132 apt_3.= 3.2.dsc 97d2cb48a3a91994662ab879a39ae803dc7a08d6d93070262c9e3bdfa22ae928 2500604 apt= _3.3.2.tar.xz 6d82d582e73e496a3512ad59ef540464968e96280fe5c0a9b608c19d5d9831d6 7455 apt_3.= 3.2_source.buildinfo Files: 9f7aa40cc51aefe7ab6f23cc6a14a20b 3132 admin required apt_3.3.2.dsc 00f9e6c225e98a3e55c942d2a9667766 2500604 admin required apt_3.3.2.tar.xz 319742d81622e269c134d570168fab3e 7455 admin required apt_3.3.2_source.buildi= nfo -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEET7WIqEwt3nmnTHeHb6RY3R2wP3EFAmpruFEPHGpha0BkZWJp YW4ub3JnAAoJEG+kWN0dsD9xAGAP/jLMbjZm4GVyE6E0ba/psQQa5OyTjicYh7Lb gQzJ8Nsucy10KohqgTI/GBGo/XzmC6o+LJb61kKOKJCb358tIwsJ7JqCgpKRZaaG 1m3UyVTWH0TC830VcOO19G3P9x234tosS8fRM+nbHqVrJHsncN2ncdT1kUEikhnL tx76FSEjJ20aFfeWfLqNhWKg3Z396D/yhoZDWlQFOq/VOdT/0GAjh+1Kw8javOfr XAfwJoD314MoOwDzDGzdsE3cO8eUvSIOPON5en5Jduwx4MPNvsA0jCcQnk6+b/bu lJUxxMTVeimM+hRNzY+QDy9ClKLW7f+X5mZzw4JGRsnVtBCpIG09yg4eOw6jdZeL x8UC//t+yTHO08IO+yjFQDwhl8IwPzKA2wLIAWUGkrv5lP/XT0oKRdyIUhCmBQJH WZdv4hnpp795scdB1YnbW/N5gz5KqFA3V1IVE4/D/8FhhJywo001hbPzk7MEBv2V XvZM3RxAVexSf0HoJ3rOF/SZPWcW/tFcUVkDME17PxgZpDvLf0upB30srNPOjLVJ vJmXtLvYFM6UD3RfW8ER+vqewQ17PFPB3PVxUx9MdL0rtYMApmJPjzaoAT72andV OV9XWtBWdQAtaT4SsCeS0SuyQwB7xzVV2D+j4jjlc85z9P6SxQtEjjozstzi5zsI Ea0XJlM2 =3DGEAC -----END PGP SIGNATURE----- --===============0661509796880750261== Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- iHUEABYIAB0WIQTziqJOuF8J+ZI8pJSb9qggYcy5IQUCamu92AAKCRCb9qggYcy5 IQIcAQDULWTbWk2C2AJ0u8Nc7baRmWu5GEXhtLML/Jw5LLiL7QEA0d1FAVmGfost FNOh0rEKpFMjf2L/dDLm0PHR8hiTbQc= =eHx8 -----END PGP SIGNATURE----- --===============0661509796880750261==-- ------------=_1785445984-59072-0--