mbedtls 4.1.1-1
Package Information
| Description | lightweight crypto and SSL/TLS library - development files mbed TLS (formerly known as PolarSSL) is a lean open source crypto library for providing SSL and TLS support in your programs. It offers an intuitive API and documented header files, so you can actually understand what the code does. It features: - Symmetric algorithms, like AES, Triple-DES, Camellia - Hash algorithms, like SHA-1, SHA-2, RIPEMD-160 and MD5 - Entropy pool and random generators, like CTR-DRBG and HMAC-DRBG - Public key algorithms, like RSA, Elliptic Curves, Diffie-Hellman, ECDSA and ECDH - TLS 1.2 and 1.3 - Abstraction layers for ciphers, hashes, public key operations, platform abstraction and threading This package contains the header files and static libraries for mbed TLS. |
|---|---|
| Maintainer | Debian IoT Maintainers <debian-iot-maintainers@alioth-lists.debian.net> |
| Changed By | Bastian Germann <bage@debian.org> |
| Sponsor | bage@debian.org |
| Distribution | experimental |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/debian-iot-team/mbedtls.git (browse) |
| Closes | #1126421, #1150693 |
| Popcon Installs | 107844 |
| Binary NEW | Yes (new binary packages of a source already in sid) |
| Tracker | https://tracker.debian.org/pkg/mbedtls |
| Uploaded | 3 hours ago |
New Package Report
.changes
| Architecture | source amd64 all |
|---|---|
| Distribution | experimental |
| Date | Tue, 10 Nov 2026 22:21:03 +0100 |
| Source | mbedtls |
| Version | 4.1.1-1 |
| Changed-By | Bastian Germann <bage@debian.org> |
Changelog
mbedtls (4.1.1-1) experimental; urgency=medium . * Team upload * Adjust long description for current features (Closes: #1126421) * New upstream version 4.1.1 (Closes: #1150693)
.dsc
| Section | libs |
|---|---|
| Priority | optional |
| Component | main |
| Package-List | libmbedcrypto18 deb libs optional arch=any libmbedtls-dev deb libdevel optional arch=any libmbedtls-doc deb doc optional arch=all libmbedtls23 deb libs optional arch=any libmbedx509-9 deb libs optional arch=any libtfpsacrypto2 deb libs optional arch=any |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: Mbed TLS
Source: https://github.com/Mbed-TLS/mbedtls/releases/
Upstream-Contact: mbed-tls <mbed-tls@lists.trustedfirmware.org>
Files: *
Copyright: The Mbed TLS Contributors
License: Apache-2.0 or GPL-2+
Comment: Not available under GPL-2+ between the 2.26 and 2.28.5 releases
Files: tf-psa-crypto/drivers/everest/include/*
tf-psa-crypto/drivers/everest/library/*
Copyright: 2016-2018 INRIA and Microsoft Corporation
License: Apache-2.0
Files: tf-psa-crypto/drivers/pqcp/mldsa-native/*
Copyright:
Copyright (c) The mlkem-native project authors
Copyright (c) The mldsa-native project authors
License: Apache-2.0 or ISC or Expat
Files: tf-psa-crypto/configs/ext/crypto_config_profile_medium.h
Copyright: The Mbed TLS Contributors
(c) 2018-2023, Arm Limited. All rights reserved.
Comment:
The file header says BSD-3-Clause but the README has:
In Mbed TLS, with permission from the TF-M project,
crypto_config_profile_medium.h is distributed under a dual Apache-2.0
OR GPL-2.0-or-later license, with copyright assigned to The Mbed TLS Contributors.
License: Apache-2.0 or GPL-2+
Files: debian/*
Copyright: 2015-2021 James Cowgill <jcowgill@debian.org>
2022-2025 Andrea Pappacoda <tachi@debian.org>
2023 Philippe Coval <rzr@users.sf.net>
License: Apache-2.0 or GPL-2+
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
.
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
License: Expat
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
License: ISC
Permission to use, copy, modify, and/or distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright notice
and this permission notice appear in all copies.
.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
THIS SOFTWARE.
License: GPL-2+
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
On Debian systems, the complete text of the GNU General Public License
version 2 can be found in "/usr/share/common-licenses/GPL-2".
DFSG Assistant LLM REVIEW 1 blocker, 1 important, 5 minor
This is an LLM based review using a Debian Inference based workflow. It was not written by a member of the DFSG team and has not been checked by one. It is not a decision on the package: it may be wrong, and it may have missed things.
Reviewed 1 hour ago.
Proposes a replacement debian/watch:
debian/watch in version 5 format
Report
DFSG NEW review for mbedtls version 4.1.1-1
Summary
- Licensing is DFSG-compliant and
debian/copyrightis accurate: No - Packaging is of good quality: Yes
- Issues: 1 blocker, 1 important, 5 minor
- debian/watch: old format (version 4)
- debian/copyright: machine-readable
- Scan before the review: 496 found (456 not listed by the scan, so not checked)
Licensing
Every licence in the tree is DFSG-free (Apache-2.0, GPL-2+, ISC, Expat/MIT, MIT-0, CC0-1.0, 0BSD, CC-BY-4.0, public-domain code), so nothing here is non-free. debian/copyright is, however, inaccurate and incomplete for the vendored mldsa-native driver: its Files: stanza names neither the seven holders whose notices are in that subtree nor the licences its own subdirectories carry (MIT-0, PD-hp/CC0-1.0/0BSD, CC-BY-4.0), and no text is given for those licences. Two further files (the dco.txt copies, configs/ext/tfm_mbedcrypto_config_profile_medium.h) are misdescribed.
Packaging
The packaging is careful: debhelper compat 14 with dpkg-build-api 1, full hardening, a correct library split with symbols files, DEP-5 copyright, gbp configuration, and three autopkgtests. Two things a sponsor would raise: debian/tests/control lists the tests comma-separated, so autopkgtest cannot find any of them, and the crypto library is shipped in two packages (libtfpsacrypto2 and libmbedcrypto18, the latter holding a copy) while its symbols file sits in the package that does not provide the SONAME file.
Issues
blocker licensing 1. debian/copyright names none of the seven holders found in tf-psa-crypto/drivers/pqcp/mldsa-native/ (Arm Limited, Dougall Johnson, Markku-Juhani O. Saarinen, Hanno Becker, Amin Abdulrahman, Matthias Kannwischer, Amazon.com, Inc.) ◂
- Files:
debian/copyright:17-22,tf-psa-crypto/drivers/pqcp/mldsa-native/LICENSE:19-22,tf-psa-crypto/drivers/pqcp/mldsa-native/mldsa/src/native/aarch64/src/intt.S:1-6,tf-psa-crypto/drivers/pqcp/mldsa-native/dev/aarch64_clean/src/ntt.S:2-3,tf-psa-crypto/drivers/pqcp/mldsa-native/test/hal/hal.c:1-5,tf-psa-crypto/drivers/pqcp/mldsa-native/proofs/cbmc/Makefile.common:4-6,tf-psa-crypto/drivers/pqcp/mldsa-native/examples/custom_backend/mldsa_native/src/fips202/native/custom/src/sha3.c:1-3 - Basis: checked, in the package or with a reference tool
- Evidence: The stanza has only
Copyright: Copyright (c) The mlkem-native project authors/Copyright (c) The mldsa-native project authors, but the files say e.g.Copyright (c) 2022 Arm Limited,Copyright (c) 2022 Hanno Becker,Copyright (c) 2023 Amin Abdulrahman, Matthias Kannwischer(intt.S:1-4),Copyright (c) 2020 Dougall Johnson(hal.c:4, also LICENSE:20),Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.(Makefile.common:5),19-Nov-11 Markku-Juhani O. Saarinen(sha3.c:4). - Problem: copyright-format 6.8 requires each Files stanza to record the copyright holders of the files it covers, and these Apache-2.0/ISC/MIT notices must be retained when the code is redistributed. The omission covers code that is compiled into libtfpsacrypto (the aarch64 assembly, the builtin/native backends) as well as proofs and test code that Debian distributes in the source package, so debian/copyright does not describe the copyright of the tree.
- Fix: Add these holders to the Copyright field of the
Files: tf-psa-crypto/drivers/pqcp/mldsa-native/*stanza, with the per-file notices they apply to (or split the stanza if the sets differ).
important
licensing
2. mldsa-native stanza says Apache-2.0 or ISC or Expat, but proofs/cbmc is MIT-0, test/notrandombytes and the valgrind patch are PD-hp/CC0-1.0/0BSD/MIT-0, and 27 files are CC-BY-4.0; none of their texts is in debian/copyright
◂
- Files:
debian/copyright:17-22,tf-psa-crypto/drivers/pqcp/mldsa-native/proofs/cbmc/Makefile.common:6,tf-psa-crypto/drivers/pqcp/mldsa-native/proofs/cbmc/ct_memcmp/ct_memcmp_harness.c:3,tf-psa-crypto/drivers/pqcp/mldsa-native/test/notrandombytes/notrandombytes.c:3,tf-psa-crypto/drivers/pqcp/mldsa-native/nix/valgrind/valgrind-varlat-patch-20240808.txt:1,tf-psa-crypto/drivers/pqcp/mldsa-native/README.md:1,tf-psa-crypto/drivers/pqcp/mldsa-native/examples/custom_backend/mldsa_native/src/fips202/native/custom/src/LICENSE:1 - Basis: checked, in the package or with a reference tool
- Evidence:
// SPDX-License-Identifier: MIT-0andMIT-0 AND Apache-2.0in proofs/cbmc;SPDX-License-Identifier: LicenseRef-PD-hp OR CC0-1.0 OR 0BSD OR MIT-0 OR MITin test/notrandombytes/notrandombytes.c, the valgrind patch and per mldsa-native/LICENSE:11-13;[//]: # (SPDX-License-Identifier: CC-BY-4.0)in 27 .md files (README.md, BIBLIOGRAPHY.md, BUILDING.md, examples/*/README.md, ...); the custom backend's LICENSE claimsCC-BY-4.0in its first line above MIT text. - Problem: copyright-format 6.7 requires the License field to state the licence actually granted; here it offers Apache-2.0/ISC/Expat for files that are granted under MIT-0 or the PD-hp/CC0-1.0/0BSD set only, or under CC-BY-4.0, so a consumer relying on the file could use terms the authors never granted. All of these licences are free, so this is not a DFSG violation, but the statement is wrong and the required texts (none of MIT-0, 0BSD and the PD-hp reference is in /usr/share/common-licenses) are absent.
- Fix: Split the stub-subtree into stanzas that give the real licences and holders, and add stand-alone License paragraphs (or pointers to /usr/share/common-licenses/CC0-1.0 and /CC-BY-4.0, which this system has) for CC-BY-4.0, MIT-0, 0BSD and the public-domain alternative.
minor
licensing
3. debian/copyright does not name The Linux Foundation for the five dco.txt copies, and calls them Apache-2.0 or GPL-2+ although their own text allows verbatim copying only
◂
- Files:
dco.txt:4,framework/dco.txt:4,tf-psa-crypto/dco.txt:4,tf-psa-crypto/framework/dco.txt:4,tf-psa-crypto/drivers/pqcp/mldsa-native/dco.txt:4,debian/copyright:7-9 - Basis: checked, in the package or with a reference tool
- Evidence:
Copyright (C) 2004, 2006 The Linux Foundation and its contributors.andEveryone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed.The files are matched only byFiles: *(Copyright: The Mbed TLS Contributors,License: Apache-2.0 or GPL-2+). - Problem: The holder is not recorded and the licence is misstated: the DCO text grants no Apache-2.0 or GPL-2+ rights. Debian ships such licence texts unchanged, which is why this is minor rather than a DFSG problem, but the copyright file should describe them as they are.
- Fix: Add a stanza for the dco.txt files with
Copyright: 2004, 2006 The Linux Foundation and its contributorsand a License short name whose paragraph quotes the verbatim-copy permission.
minor
licensing
4. configs/ext/tfm_mbedcrypto_config_profile_medium.h is Apache-2.0 only, held by ARM Limited, but Files: * claims Apache-2.0 or GPL-2+ and names only The Mbed TLS Contributors
◂
- Files:
configs/ext/tfm_mbedcrypto_config_profile_medium.h:10-12,debian/copyright:7-9,debian/copyright:23-33 - Basis: checked, in the package or with a reference tool
- Evidence:
Copyright (C) 2006-2023, ARM Limited, All Rights Reserved/SPDX-License-Identifier: Apache-2.0(no GPL option). The only ARM/TF-M stanza coverstf-psa-crypto/configs/ext/crypto_config_profile_medium.h, a different file. - Problem: The file falls through to
Files: *, so debian/copyright offers a GPL-2+ option that is not granted and omits the ARM Limited holder. - Fix: Extend the existing
configs/extstanza (or add one) to cover this file withCopyright: 2006-2023, Arm LimitedandLicense: Apache-2.0.
minor
packaging
5. debian/tests/control lists the tests as build, cmake, selftest, with commas, so autopkgtest finds no test executable
◂
- Files:
debian/tests/control:1-2 - Basis: checked, in the package or with a reference tool
- Evidence:
Tests:/build,/cmake,/selftest,— the autopkgtest specification says "Test names are separated by whitespace and should contain only characters which are legal in package names", so the names arebuild,,cmake,andselftest,. - Problem: autopkgtest executes debian/tests/ for each name in the field; with the commas the three scripts debian/tests/build, cmake and selftest are never run and every test job for the package errors out, so the package has no effective autopkgtest coverage.
- Fix: Drop the commas:
Tests: build cmake selftest.
minor packaging 6. The crypto library is in two packages while its symbols file is in the one that does not ship the SONAME file: libmbedcrypto18.symbols declares libtfpsacrypto.so.2, and libtfpsacrypto2 has no symbols file ◂
- Files:
debian/libmbedcrypto18.symbols:1,debian/libmbedcrypto18.install:1-2,debian/libtfpsacrypto2.install:1-2,library/CMakeLists.txt:337-346 - Basis: checked, in the package or with a reference tool
- Evidence:
libtfpsacrypto.so.2 libmbedcrypto18 #MINVER#as the first line of libmbedcrypto18.symbols; upstream installslibmbedcrypto.so.4.1.1as a copy oflibtfpsacrypto.so.1.1.x(install(FILES $<TARGET_FILE:${target}> ... RENAME "libmbedcrypto.so.${MBEDTLS_VERSION}")), so that copy keeps SONAME libtfpsacrypto.so.2 while only libtfpsacrypto2 ships a file of that name. - Problem: dpkg-shlibdeps attributes a needed SONAME to the package owning the file it resolves (here libtfpsacrypto2 via /usr/lib/*/libtfpsacrypto.so.2), and only that package's symbols file would be consulted, so the symbols data in libmbedcrypto18 is inert and libtfpsacrypto2 is tracked by shlibs alone; deb-symbols(5) expects a symbols file to be shipped with the package whose libraries it describes. No consumer's NEEDED entry can refer to libmbedcrypto18, and both packages ship the same ~1 MB ELF file.
- Fix: Ship the crypto library in one package, or move the symbols data to debian/libtfpsacrypto2.symbols (
libtfpsacrypto.so.2 libtfpsacrypto2 #MINVER#) and decide explicitly whether the historical libmbedcrypto.so.* copies belong in libmbedcrypto18 at all.
minor packaging 7. debian/watch is in the old version 4 format ◂
- Files:
debian/watch - Basis: found by the review tooling's own checks
- Evidence:
version=4 - Problem: Version 5 is the current format of
debian/watch. - Fix: Convert it to version 5; a mechanical conversion is under Proposed changes.
Verified ◂
- Read all of debian/ (control, rules, changelog head, copyright, clean, all .install/.docs/.links/.doc-base, tests/*, gbp.conf, source/format, upstream/metadata) and listed the upstream tree directory by directory; read all six LICENSE files.
- The 496 files the scan lists as unrecognised binary data are DER-encoded X.509 certificates, CSRs, RSA/EC keys, PKCS#7 blobs and one libFuzzer regression input used by the test suite, under framework/data_files/ and its duplicate tf-psa-crypto/framework/data_files/ (e.g. framework/data_files/server5.crt.der, framework/data_files/cli-rsa-sha256.key.der, framework/data_files/clusterfuzz-testcase-minimized-fuzz_x509crt-6666050834661376.crt.der). They are test data, not built artefacts, and framework/data_files/Makefile with the openssl configs beside it plus framework/scripts/generate_test_keys.py, generate_test_cert_macros.py and generate_ssl_debug_helpers.py generate them.
- All seven holders the prescan reports are accounted for: the six missing from the mldsa-native stanza are reported above (Arm Limited also appears in test/hal/hal.c and the aarch64 assembly as well as in LICENSE); The Linux Foundation appears only in the five dco.txt copies, reported separately.
- The two text files over 4 MiB are tf-psa-crypto/tests/suites/test_suite_pk.pk_can_do_psa.data (5.1 MB) and tf-psa-crypto/tests/suites/test_suite_psa_crypto_op_fail.generated.data (4.7 MB); both are generated test data and their generators (framework/scripts/generate_psa_tests.py, test_generate_test_code.py) ship in the tree, so only the first 4 MiB of each was scanned and there is nothing else to read there.
- Outside tf-psa-crypto/drivers/pqcp/ and tf-psa-crypto/drivers/everest/, the only copyright notices in 3374 files are The Mbed TLS Contributors, ARM Limited in configs/ext/tfm_mbedcrypto_config_profile_medium.h and the Linux Foundation in dco.txt; no other holder, and no licence wording beyond the Apache-2.0/GPL-2+ pair in the four LICENSE files.
- Every mldsa-native file is free: Apache-2.0, ISC and Expat for the bulk (mldsa-native/LICENSE), MIT-0 for proofs/cbmc, MIT for test/hal/hal.c and the Markku-Juhani tiny_sha3 files, PD-hp/CC0-1.0/0BSD/MIT-0/MIT for test/notrandombytes and one nix patch, CC-BY-4.0 for 27 .md files. None is non-commercial, no-modification or field-of-use.
- tf-psa-crypto/drivers/everest/ is INRIA/Microsoft under Apache-2.0 as its headers say, and the existing stanza covers include/* and library/; its C is KreMLin-generated (the headers record the generator invocation) with the F sources outside the tarball, as in earlier mbedtls releases.
- debian/libmbedcrypto18.symbols, libmbedtls23.symbols and libmbedx509-9.symbols match the SOVERSIONs of CMakeLists.txt (18, 23, 9); the libmbedcrypto check is the one described in the last issue.
- The autopkgtest scripts build files that are present (programs/test/selftest.c, programs/ssl/mini_client.c, and <mbedtls/md.h> installed by libmbedtls-dev) and the @ / pkgconf dependencies match what they call.
- Debhelper's doc-main-package auto-detection (Dh_Lib.pm compute_doc_main_package: libmbedtls-doc -> libmbedtls-dev) puts apidoc in /usr/share/doc/libmbedtls-dev/apidoc inside libmbedtls-doc, which is exactly what libmbedtls-doc.doc-base and libmbedtls-doc.links reference; apidoc is built into the source root (doxygen/mbedtls.doxyfile: OUTPUT_DIRECTORY = ../apidoc/) and removed by debian/clean.
- At compat 14 dh_gencontrol adds the relationship substvars itself, so the missing Depends/${misc:Depends} lines in the library and -dev packages are not a fault; Standards-Version 4.7.2 is current enough against Policy 4.7.4.1.
- The build flags in debian/rules are live: MBEDTLS_ALIGNMENT_DISABLE_EFFICENT_UNALIGNED_ACCESS is used in tf-psa-crypto/core/alignment.h, and MBEDTLS_DEPRECATED_WARNING, MBEDTLS_THREADING_C, MBEDTLS_THREADING_PTHREAD and MBEDTLS_SSL_DTLS_SRTP all exist in 4.1.1's configuration.
- There are no patches: debian/patches/ is absent and .pc/applied-patches is empty, so the tree is pristine 4.1.1.
- uscan found the packaged version as the newest upstream release (upstream
4.1.1, packaged4.1.1). - Every pointer of
debian/copyrightto /usr/share/common-licenses names a file that is there (Apache-2.0,GPL-2).
Not confirmed ◂
- debian/rules runs dh_doxygen, which is neither installed on the reviewing system nor provided by any binary package in the package lists or NEW; I could not read what it does. A build with the default (docs enabled) would show whether that command exists in the archive.
- Whether some framework/data_files certificates were imported from other projects: the names and the shipped Makefile point to locally generated test material, but I read only a sample of the certificate files by name.
Proposed: debian/watch in version 5 format ◂
debian/watch is in an old format. This is the conversion made by uscan --update-watchfile, which has not been run against the upstream site: some defaults differ in version 5, so test it with uscan --report before use.
Version: 5
#just show LTS updates
Source: https://api.github.com/repos/Mbed-TLS/mbedtls/releases
Matching-Pattern: https://github.com/Mbed-TLS/mbedtls/releases/download/[^/]+/mbedtls-(4.1.\d+).tar.bz2
Pgpmode: none
Searchmode: plain
Uploader's response to the LLM review
Waiting for the uploader's response until , because the review found serious issues.