Package: dh-nss Severity: important Version: 1.7.1 Tags: patch UserTag: debian-edu User: [email protected]
Dear Gioele,I am currently on a mission to get sssd back into Debian testing, currently blocked by:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129522The proposed fix for the above issue involves sudo becoming the "owner" of the sudoers: entry in nsswitch.conf:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147179The proposed fix in above bug report (adding debian/sudo.nss with below content) does fail when upgrading sudo from a version of the sudo package that did not have debian/sudo.nss, yet:
``` sudoers database-add sudoers first files ```When installing sudo a-fresh, with above sudo.nss file, "sudoers: files" appears at the end of nsswitch.conf (GOOD). However, when upgrading from an earlier version of the sudo package, we get "sudoers:" in nsswitch.conf (BOOM). So, we end up in a broken state.
The fix for this needs to be applied to dh-nss, I guess: ```diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000 +0200+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16 16:05:08.000000000 +0200
@@ -1,4 +1,4 @@ -if [ "$1" = install ]; then+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E #SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then # Signal to postinst that the NSS services should be installed, even if the package has been removed but not purged. touch "${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+ upgrade, too. (Closes: -1).
+ - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+ from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+ been applied, yet.
+ - Assure SERVICE_PATTERN macro gets populated properly during preinst
+ autoscript generation.
+
+ -- Mike Gabriel <[email protected]> Wed, 16 Sep 2026 16:05:25 +0200
+
dh-nss (1.7.1) unstable; urgency=medium
* t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
my $service_patterns_expr = service_patterns_expr(\%db_services);
# Add a snippet in preinst to detect installation of non-purged
packages.
- autoscript($package, "preinst", "preinst-nss");
+ autoscript($package, "preinst", "preinst-nss", {
+ "SERVICE_PATTERNS" => $service_patterns_expr,
+ });
# Generate one snippet for each extra NSS databases to be added.
foreach my $db_extra (@dbs_extra_add) {
```
Same .debdiff is attached. Please let us know if you see this as a
possible fix and if you can provide this change anytime soon.
Thanks, Mike (and Marc, maintainer of sudo) -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4351) 486 14 27 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: [email protected], http://sunweavers.net
diff -Nru dh-nss-1.7.1/autoscripts/preinst-nss
dh-nss-1.7.1+nmu1/autoscripts/preinst-nss
--- dh-nss-1.7.1/autoscripts/preinst-nss 2026-08-20 01:17:24.000000000
+0200
+++ dh-nss-1.7.1+nmu1/autoscripts/preinst-nss 2026-09-16 16:05:08.000000000
+0200
@@ -1,4 +1,4 @@
-if [ "$1" = install ]; then
+if [ "$1" = install ] || ( [ "$1" = upgrade ] && ! grep -q -E
#SERVICE_PATTERNS# "${DPKG_ROOT}/etc/nsswitch.conf" ); then
# Signal to postinst that the NSS services should be installed, even if
the package has been removed but not purged.
touch
"${DPKG_ROOT}/etc/nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install"
fi
diff -Nru dh-nss-1.7.1/debian/changelog dh-nss-1.7.1+nmu1/debian/changelog
--- dh-nss-1.7.1/debian/changelog 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/debian/changelog 2026-09-16 16:05:25.000000000 +0200
@@ -1,3 +1,16 @@
+dh-nss (1.7.1+nmu1) UNRELEASED; urgency=medium
+
+ * Non-maintainer upload.
+ * {autoscripts/preinst-nss,dh_installnss}: Apply .nss configs on package
+ upgrade, too. (Closes: -1).
+ - Also signal nsswitch.conf.nss.${DPKG_MAINTSCRIPT_PACKAGE}-will-install
+ from preinst to postinst on package upgrades if SERVICE_PATTERN has not
+ been applied, yet.
+ - Assure SERVICE_PATTERN macro gets populated properly during preinst
+ autoscript generation.
+
+ -- Mike Gabriel <[email protected]> Wed, 16 Sep 2026 16:05:25 +0200
+
dh-nss (1.7.1) unstable; urgency=medium
* t/dh_installnss: Fix typo
diff -Nru dh-nss-1.7.1/dh_installnss dh-nss-1.7.1+nmu1/dh_installnss
--- dh-nss-1.7.1/dh_installnss 2026-08-20 01:17:24.000000000 +0200
+++ dh-nss-1.7.1+nmu1/dh_installnss 2026-09-16 16:05:25.000000000 +0200
@@ -405,7 +405,9 @@
my $service_patterns_expr = service_patterns_expr(\%db_services);
# Add a snippet in preinst to detect installation of non-purged
packages.
- autoscript($package, "preinst", "preinst-nss");
+ autoscript($package, "preinst", "preinst-nss", {
+ "SERVICE_PATTERNS" => $service_patterns_expr,
+ });
# Generate one snippet for each extra NSS databases to be added.
foreach my $db_extra (@dbs_extra_add) {
pgp7mNVKA182e.pgp
Description: Digitale PGP-Signatur
