Recent update of libgpg-error0 and libassuan0 break curl and Opam (OCaml package manager)

[Brian Inglis]

On 2023-12-19 06:26, Michael Soegtrop via Cygwin wrote:
> my daily CI of Coq Platform indicates that this update:
> libassuan0-2.5.5-1   -> libassuan0-2.5.6-1
> libgpg-error0-1.47-1 -> libgpg-error0-1.37-1

   libgpg-error0-1.37-1 -> libgpg-error0-1.47-1

> breaks Opam, the OCaml package manager, via a failed call to curl as can be seen 
> by executing these commands:
> $ wget 
> https://github.com/fdopen/opam-repository-mingw/releases/download/0.0.0.2/opam64.tar.xz -O "opam64.tar.xz"
> $ tar -xf "opam64.tar.xz"
> $ bash opam64/install.sh --prefix "/usr/$(uname -m)-w64-mingw32/sys-root/mingw"
> $ opam init --bare --shell-setup --enable-shell-hook --enable-completion 
> 'default' 'https://opam.ocaml.org' --disable-sandboxing
> Replacing the DLLs of libassuan0 and libgpg-error0 with the previous versions 
> listed above (just replace the DLLs) fixes this.
> I had a look at what happens with Procmon. In the end a call to cygwn curl (from 
> a MinGW app) fails. In Procmon I can see that curl successfully downloads the 
> file and crashes immediately after closing the output file. With the old 
> versions of libassuan0 and libgpg-error0, curl succeeds. That this download as 
> such is successful shows that this is not a temporary network hickup (I also 
> tested it at least 10 times either way).
> Usual usages of curl seem to work - I couldn't reduce the failure reproduction 
> beyond the above 4 lines and couldn't figure out what is so special about the 
> curl call of opam.
> This is quite painful for me - I was in the middle of a release of Coq Platform 
> (a widely used distribution of the Coq proof assistant), when my Windows CI 
> (which does a cygwin based MinGW cross compilation of OCaml and Coq) failed. 
> Especially painful is that there is no easy way to install older package 
> versions from the command line.
> 
> I would appreciate a fast roll back. Otherwise I have to find a way to install 
> the older versions without user interaction.

I don't build curl, gsasl, or libgcrypt with libassuan, which is used by gnupg2 
internally between components for IPC.

Deps are:

	opam -> curl -> libcurl4 -> libgsasl18 -> libgcrypt20 -> libgpg-error0

I have not yet upgraded libgpg-error and rebuilt libgcrypt, gsasl, or curl, do 
not use OCaML or Opam, or have them installed.

> Btw.: I do a daily build test of Coq Platform with a fresh cygwin since about 6 
> years and this is only the fourth failure! I really appreciate the stability of 
> cygwin - excellent work!

-- 
Take care. Thanks, Brian Inglis              Calgary, Alberta, Canada

La perfection est atteinte                   Perfection is achieved
non pas lorsqu'il n'y a plus rien à ajouter  not when there is no more to add
mais lorsqu'il n'y a plus rien à retirer     but when there is no more to cut
                                 -- Antoine de Saint-Exupéry