On Sat, Sep 11, 2021 at 2:26 PM Marc Haber wrote: > What would debian-mentors' recommendation be? Your hints will be > appreciated.
To prevent installation of an static aide with a incompatible nss libraries, you could get glibc to add Provides: libc-nss-abi (= N) or Provides: libc-nss-abi-N and a mechanism to get the current ABI number at build time then have aide depend on that. Then when glibc transitions happen, aide could get binNMUed automatically. I wondering which nss calls aide is doing and if they can be eliminated entirely. I think I would lean towards the dynamic solution; I assume that if someone can modify the nss libraries then they can also modify the static aide binaries. It might be worth discussing the issue with aide upstream, they probably have guidance about this by now. PS: I wonder if you are tracking when static aide requires a binNMU after security updates to libraries it uses? -- bye, pabs https://wiki.debian.org/PaulWise
