Your message dated Sun, 11 Oct 2026 19:04:54 +0000
with message-id <[email protected]>
and subject line Bug#1148069: fixed in dh-nss 1.8
has caused the Debian Bug report #1148069,
regarding dh-nss: fix adding non-default nsswitch config fields on package
upgrades
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148069: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148069
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: dh-nss
Severity: important
Version: 1.7.1
Tags: patch
UserTag: debian-edu
User: [email protected]
Dear Gioele,
I am currently on a mission to get sssd back into Debian testing,
currently blocked by:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522
The proposed fix for the above issue involves sudo becoming the
"owner" of the sudoers: entry in nsswitch.conf:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147179
The proposed fix in above bug report (adding debian/sudo.nss with
below content) does fail when upgrading sudo from a version of the
sudo package that did not have debian/sudo.nss, yet:
```
sudoers database-add
sudoers first files
```
When installing sudo a-fresh, with above sudo.nss file, "sudoers:
files" appears at the end of nsswitch.conf (GOOD). However, when
upgrading from an earlier version of the sudo package, we get
"sudoers:" in nsswitch.conf (BOOM). So, we end up in a broken state.
The fix for this needs to be applied to dh-nss, I guess:
```
diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss
dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000
+0200
+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16
16:05:08.000000000 +0200
@@ -1,4 +1,4 @@
-if [ "$1" = install ]; then
+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E
#SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then
# Signal to postinst that the NSS services should be installed,
even if the package has been removed but not purged.
touch
"${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+ upgrade, too. (Closes: -1).
+ - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+ from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+ been applied, yet.
+ - Assure SERVICE_PATTERN macro gets populated properly during preinst
+ autoscript generation.
+
+ -- Mike Gabriel <[email protected]> Wed, 16 Sep 2026 16:05:25 +0200
+
dh-nss (1.7.1) unstable; urgency=medium
* t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
my $service_patterns_expr = service_patterns_expr(\%db_services);
# Add a snippet in preinst to detect installation of non-purged
packages.
- autoscript($package, "preinst", "preinst-nss");
+ autoscript($package, "preinst", "preinst-nss", {
+ "SERVICE_PATTERNS" => $service_patterns_expr,
+ });
# Generate one snippet for each extra NSS databases to be added.
foreach my $db_extra (@dbs_extra_add) {
```
Same .debdiff is attached. Please let us know if you see this as a
possible fix and if you can provide this change anytime soon.
Thanks,
Mike (and Marc, maintainer of sudo)
--
mike gabriel aka sunweaver (Debian Developer)
mobile: +49 (1520) 1976 148
landline: +49 (4351) 486 14 27
GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net
diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss
dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000
+0200
+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16 16:05:08.000000000
+0200
@@ -1,4 +1,4 @@
-if [ "$1" = install ]; then
+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E
#SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then
# Signal to postinst that the NSS services should be installed, even if
the package has been removed but not purged.
touch
"${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+ upgrade, too. (Closes: -1).
+ - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+ from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+ been applied, yet.
+ - Assure SERVICE_PATTERN macro gets populated properly during preinst
+ autoscript generation.
+
+ -- Mike Gabriel <[email protected]> Wed, 16 Sep 2026 16:05:25 +0200
+
dh-nss (1.7.1) unstable; urgency=medium
* t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
my $service_patterns_expr = service_patterns_expr(\%db_services);
# Add a snippet in preinst to detect installation of non-purged
packages.
- autoscript($package, "preinst", "preinst-nss");
+ autoscript($package, "preinst", "preinst-nss", {
+ "SERVICE_PATTERNS" => $service_patterns_expr,
+ });
# Generate one snippet for each extra NSS databases to be added.
foreach my $db_extra (@dbs_extra_add) {
pgpbDzhDhNt0C.pgp
Description: Digitale PGP-Signatur
--- End Message ---
--- Begin Message ---
Source: dh-nss
Source-Version: 1.8
Done: Gioele Barabucci <[email protected]>
We believe that the bug you reported is fixed in the latest version of
dh-nss, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Gioele Barabucci <[email protected]> (supplier of updated dh-nss package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 11 Oct 2026 20:48:01 +0200
Source: dh-nss
Architecture: source
Version: 1.8
Distribution: unstable
Urgency: medium
Maintainer: Gioele Barabucci <[email protected]>
Changed-By: Gioele Barabucci <[email protected]>
Closes: 1148069
Changes:
dh-nss (1.8) unstable; urgency=medium
.
* autoscripts: Add basic support for installing NSS services during package
upgrades
(Closes: #1148069)
* Makefile: Add `test` target
* t/dh_installnss:
- Test multiple installation scenarios for each subtest
- Add test infrastructure for package upgrades
- Add first tests for upgrades
- Add tests for moving databases across packages
* d/t/doc-example: Fix test by properly modifying nsswitch.conf
* d/gbp.conf: Use default `debian-tag`
Checksums-Sha1:
1c15988b4de59bdc3c23ce0aa8754f91f8cbb1f9 1898 dh-nss_1.8.dsc
51020273fa5b4cf3c93b9181a45820b809d8b949 16524 dh-nss_1.8.tar.xz
80fce7c5b59e0527e03434a7062a4599d0a42ea4 32304 dh-nss_1.8.git.tar.xz
98f7783f84120cedf9c472cf014d65773ce430da 17704 dh-nss_1.8_source.buildinfo
Checksums-Sha256:
a10b2141ce8b2060cd194b9eb10f4087c9cdadf20f25e9d67f4953ffb1cb601e 1898
dh-nss_1.8.dsc
5eb08ba6b7d27b4d7f87be34097cb4c5c2be752ed9cce93c0b651570b816f341 16524
dh-nss_1.8.tar.xz
3b3454d91a2c5623b711ef4dd9abdcff8066c05f86fb26fcc0d7343d32d17132 32304
dh-nss_1.8.git.tar.xz
f3dee94cd0278bd1fbbeaa17ffbeec00c8cd06893909e63efd9cf818adc44eb7 17704
dh-nss_1.8_source.buildinfo
Files:
5fecd60ce2cb2a4ad1c0ffa15387057e 1898 devel optional dh-nss_1.8.dsc
7e07172c103b3180c460422b0c1b10d9 16524 devel optional dh-nss_1.8.tar.xz
617b1d20a9b20915ac7e4e81b9202c93 32304 devel None dh-nss_1.8.git.tar.xz
fc6096017b753cb3f64fafc1efa8ec1f 17704 devel optional
dh-nss_1.8_source.buildinfo
Git-Tag-Info: tag=c735d2aa5ab0488884e481a935bf4fc2b82c3aa1
fp=02988a8f528fa493e1b98e388f89871cdb75972e
Git-Tag-Tagger: Gioele Barabucci <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrL2xQACgkQYG0ITkaD
wHlVcw/+O+Ab4XCiJjzOyzYAOOlotXbsK3EqRbU2w6hZUdBgdhdFWNJJ9WPvANsV
ZUgBPF5dCubuzeA8vqNwUywATyRplUC8pdg+gNB1yIWDM6nFSYDirKtEV+WqFcpy
GgjUQApMLm2ZWmvICqyb/o9QCC/dxv79bH3XTU8EY52D+Xkrx+7MJsK16PtumSVk
U4jx5PoCUkhNIALG5XDBCoRm1lolwB83lZwQV6oS15IJqhUxu8Pv5Uq6z++1vrM7
GSJ0KGmayDSF+/nuW8ftMw+smByWOAtPPdI3f74JvtvpJsWcQvPrK+iu1ZLQaEku
BL/ZrZc5n32CfYuzsA4slEdiwgaiUHD/XhkBspDO8yX4NCzCw/8n+kk9LprurA1K
BbEnTHZXP/5esNcDQKPuU/5MiPsjr6YnhqTUs/DJjqsH0665Uwzy1sYHCvIXAmQm
H3ydJII3fh5zk66vPwoDj2t1JFmMApmnDqJoC0SF+RsvNA0qTFL0D9Mt5pT8bb5u
YOcULw1xhIbRpPbmogvY/cg+tQuVJMh6m9hsghP/NnYtbrfN8nfeAoPuMcDcFIrK
+2xAYY8/ehgJy4vLVh1B6w1haFaYGnknPJ5pI+KMNSWMH23PEPmGeavZRhtPbra7
caz638DTzB8EUJdd/OrmPgzhykN5hmdQVNxV9C3SF5LnPDvEZLQ=
=m+2R
-----END PGP SIGNATURE-----
pgp5qoQHz62vh.pgp
Description: PGP signature
--- End Message ---
