Sam Hartman <[email protected]> wrote: > Sam Hartman <[email protected]> wrote: > > > > Thanks, I can confirm something went wrong with 1.7.0-7. (The > > patch got lost. I don't entirely understand how/why and am just > > now looking into it. Your report was what made the problem > > obvious. > > Hmm, actually I don't believe the behavior of @include changed between > 1.7.0-6 and 1.7.0-7. > I do believe a couple of other patches got misplaced, but I cannot > reproduce this bug against 1.7.0-7.
Oh, that sounds like a mystery. When we got 1.7.0-7 instead of 1.7.0-6, our tests started failing like they did when trying to use `pam_start_confdir()` with a user defined confdir in 1.7.0-5. I then recreated the test setup I posted in my original report and it reproduced the issue exactly in the same way. I think I've found a way to pin our devcontainer to 1.7.0-6 in case it helps anyone else. In our Dockerfile, I still install whatever pam version we get from the "testing" repo (just to not mess with any dependencies there may be). I however end the whole docker container build with: ############################################################################# # Pin libpam to 1.7.0-6 (1.7.0-7 regresses pam_start_confdir + include) ARG PAM_SNAPSHOT=https://snapshot.debian.org/archive/debian/20260616T204322Z/pool/main/p/pam RUN curl -fLO ${PAM_SNAPSHOT}/libpam0g_1.7.0-6_amd64.deb \ && curl -fLO ${PAM_SNAPSHOT}/libpam-modules_1.7.0-6_amd64.deb \ && curl -fLO ${PAM_SNAPSHOT}/libpam-modules-bin_1.7.0-6_amd64.deb \ && curl -fLO ${PAM_SNAPSHOT}/libpam-runtime_1.7.0-6_all.deb \ && curl -fLO ${PAM_SNAPSHOT}/libpam0g-dev_1.7.0-6_amd64.deb \ && curl -fLO ${PAM_SNAPSHOT}/libpam-doc_1.7.0-6_all.deb \ && dpkg -i libpam0g_1.7.0-6_amd64.deb libpam-modules-bin_1.7.0-6_amd64.deb \ && dpkg -i libpam-modules_1.7.0-6_amd64.deb \ libpam-runtime_1.7.0-6_all.deb \ libpam0g-dev_1.7.0-6_amd64.deb \ libpam-doc_1.7.0-6_all.deb \ && rm -f *.deb \ && apt-mark hold libpam0g libpam-modules libpam-modules-bin libpam-runtime libpam0g-dev libpam-doc ############################################################################# So now we should stay pinned at 1.7.0-6 until we can manually verify that any new version that comes still work. Br, Ted
