Bug#1111893: "GnuTLS version mismatch” after upgrade until reboot

[Andreas Metzler]

Control: reassign -1 courier-imap 5.0.13+1.0.16-3
Control: found -1 5.2.11+1.4.1-6

On 2025-08-24 Soren Stoutner <soren at debian.org> wrote:
> Control: reassign -1 gnutls28
> Control: retitle -1 "GnuTLS version mismatch” after upgrade until reboot

> I am going to reassign this bug to gnutls28.  There might be a way they can 
> prevent this problem without requiring a reboot.

Hello Soeren,

thanks for maintaining courier.

This is an issue on the courier side. Looking at the source code we
find (in both oldstable and current version):
libs/tcpd/libcouriergnutls.c
if (gnutls_check_version(LIBGNUTLS_VERSION) == NULL)
	{
		fprintf(stderr, "GnuTLS version mismatch\n");

And LIBGNUTLS_VERSION is defined in /usr/include/gnutls/compat.h
#define LIBGNUTLS_VERSION GNUTLS_VERSION
and /usr/include/gnutls/gnutls.h
#define GNUTLS_VERSION "3.8.10"

So when you compile courier against e.g. 3.8.10 and run it against
gnutls 3.8.9 it will run
gnutls_check_version(3.8.10)
and fail, although 3.8.9 and 3.8.10 are ABI compliant.

(And at the time the bug submitter restarted courier by rebootting gnutls
had been upgrade and the error went away.)

You should not run gnutls_check_version against the gnutls version
installed at compile time but against the gnutls version you actually
need.

cu Andreas
-- 
`What a good friend you are to him, Dr. Maturin. His other friends are
so grateful to you.'
`I sew his ears on from time to time, sure'