Merge nginx from Debian unstable for noble

Bug #2040404 reported by Bryce Harrington
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
nginx (Ubuntu)
Fix Released
Undecided
Bryce Harrington

Bug Description

Scheduled-For: Backlog
Upstream: tbd
Debian: 1.24.0-2
Ubuntu: 1.24.0-1ubuntu1

If it turns out this needs a sync rather than a merge, please change the tag 'needs-merge' to 'needs-sync', and (optionally) update the title as desired.

### New Debian Changes ###

nginx (1.24.0-2) unstable; urgency=medium

  * d/control added dependency nginx-common to nginx (Closes: 1039905)
    After nginx installation, the nginx-common package is installed
    automatically due to its dependencies. The nginx-common package includes
    the systemd unit, which becomes enabled and activated upon installation.
    When the nginx is removed, nginx-common package and the systemd unit will
    remain in the system. Adding a dependency nginx-common to nginx solves
    this problem.
  * d/control fixed binNMU safe dependency declaration nginx to nginx-common,
    nginx is 'any', nginx-common is 'all' -> dependency '= ${source:Version}'
  * d/rules removed override_dh_strip, migration to automatic debug symbols is
    already done, fixes debug-symbol-migration-possibly-complete lint. warning
  * d/po/ro.po added Romanian debconf translation. (Closes: 1033084),
    Thanks to Remus-Gabriel Chelu
  * d/po/sv.po added Swedish debconf translation. (Closes: 1050443),
    Thanks to Peter Kvillegård
  * d/conf/mime.types added video/ogg, video/x-matroska (Closes: 1028144)
  * d/p/CVE-2023-44487.patch adds additional mitigations for CVE-2023-44487
    that according to NGINX developers on nginx-devel are already suitably
    mitigated with the default config options for keepalive. (Closes: 1053770)
  * d/control added nginx-dev dependency on ${nginx:abi}
  * d/debhelper/nginx_mod.pm automatic libnginx-mod-stream dependencies

 -- Jan Mojžíš <email address hidden> Wed, 11 Oct 2023 01:17:51 +0200

nginx (1.24.0-1) unstable; urgency=medium

  * New upstream version 1.24.0
  * nginx ABI release: nginx-abi-1.24.0-1
  * d/libnginx-mod.abisubstvars update version constraints of the 3rd party
    modules
  * d/p/bug-{1024605,973861}.patch removed, fixed in upstream
  * d/copyright: updated copyright for files src/event/ngx_event_udp.h,
    src/os/win32/ngx_dlopen

 -- Jan Mojžíš <email address hidden> Tue, 27 Jun 2023 23:19:31 +0200

nginx (1.22.1-9) unstable; urgency=medium

  * d/control: nginx-common Breaks+Replaces: nginx (<< 1.22.1-8)
    (Closes: 1032929)

 -- Jan Mojžíš <email address hidden> Tue, 14 Mar 2023 16:19:32 +0100

nginx (1.22.1-8) unstable; urgency=medium

  * Main change:
    Configuration files returned to nginx-common package. This fixes
    the serious problem of losing configuration files during upgrade.
    This is a rollback of a change made in 1.22.1-6 (Closes: 1032517)
  * d/control: fix nginx-full dependencies
  * d/libnginx-mod.abisubstvars: update libnginx-mod-http-lua version

 -- Jan Mojžíš <email address hidden> Tue, 14 Mar 2023 06:53:32 +0100

nginx (1.22.1-7) unstable; urgency=medium

  * nginx ABI release: nginx-abi-1.22.1-7
  * nginx ABI: Nginx now provides nginx-abi-<VERSION> to better manage
    dependencies between nginx and 3rd party modules. Credit to Jérémy Lal.
  * switched to libpcre2 (Closes: 1000013)
  * d/p/bug-973861: added, lingering close for connections with pipelined
    requests. The patch is backported from the upstream. (Closes: 973861)
  * d/gbb.conf: switched to debian branch main (debian-branch = main)
  * d/copyright: updated to be compatible with 'cme update dpkg-copyright'

 -- Jan Mojžíš <email address hidden> Mon, 13 Feb 2023 13:04:16 +0100

nginx (1.22.1-6) unstable; urgency=medium

  * Main change:
    Nginx binary moved to package nginx, also moved basic
    configuration files from nginx-common to package nginx.
    The packages nginx-{light,core,extras,common} are replaced
    by a metapackage. (Closes: 1025763)
    Users should simply install 'nginx' and 'libnginx-mod-...'
    instead of these packages.
  * Additional changes:
    * d/nginx-{light,core,extras,full,common}.NEWS: added warning that
      nginx-{light,core,extras,full,common} are deprecated
    * d/control: fixed dependencies for safe binNMU
    * d/copyright: updated debian/* copyright
    * d/copyright: added missing copyright for d/apport/*
    * d/copyright: added missing GPL-2+ copyright for d/debhelper/dh_nginx
    * d/copyright: added missing copyright for d/help/examples/nginx_modsite
    * d/po/it.po: added Italian debconf translation. (Closes: 1019160)
    * d/control: removed dependency on obsolete package lsb-base
    * d/control: bump Standards-Version: 4.6.2, no changes

 -- Jan Mojžíš <email address hidden> Wed, 08 Feb 2023 17:20:27 +0100

nginx (1.22.1-5) unstable; urgency=medium

  [ Jan Mojžíš ]
  * Since version 1.22.1-5 all third party modules are removed from Debian NGINX
    package and all these modules are maintained in separate external packages.
    Removed namely these remaining modules:
      - libnginx-mod-http-geoip2
      - libnginx-mod-stream-geoip2

### Old Ubuntu Delta ###

nginx (1.24.0-1ubuntu1) mantic; urgency=low

  * Merge with Debian unstable. Remaining changes:
    - Branding for Ubuntu
      + d/p/ubuntu-branding.patch: add Ubuntu branding
      + d/t/branding: Add autopkgtest to validate branding presence
    - d/control: Drop the Lua module (libnginx-mod-http-lua) as a
      dependency for NGINX (Server Team Decision) - future support
      for Lua module now requires resty-core from OpenResty, meaning that if
      we want to continue to support the Lua module, we have to start becoming
      OpenResty - users should just use OpenResty at this point for Lua.
    - d/control: let nginx-core depend on geoip2 instead of geoip.
    - d/t/control: Drop autopkgtest dependencies on libnginx-mod-http-lua too

 -- Gianfranco Costamagna <email address hidden> Wed, 28 Jun 2023 08:48:23 +0200

Bryce Harrington (bryce)
Changed in nginx (Ubuntu):
assignee: nobody → Bryce Harrington (bryce)
milestone: none → ubuntu-24.01
Revision history for this message
Bryce Harrington (bryce) wrote :

Looks like Gianfranco has already uploaded the merge to -proposed

nginx (1.24.0-2ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Branding for Ubuntu
      + d/p/ubuntu-branding.patch: add Ubuntu branding
      + d/t/branding: Add autopkgtest to validate branding presence
    - d/control: Drop the Lua module (libnginx-mod-http-lua) as a
      dependency for NGINX (Server Team Decision) - future support
      for Lua module now requires resty-core from OpenResty, meaning that if
      we want to continue to support the Lua module, we have to start becoming
      OpenResty - users should just use OpenResty at this point for Lua.
    - d/control: let nginx-core depend on geoip2 instead of geoip.
    - d/t/control: Drop autopkgtest dependencies on libnginx-mod-http-lua too

Changed in nginx (Ubuntu):
milestone: ubuntu-24.01 → ubuntu-23.11
status: New → Fix Committed
Revision history for this message
Thomas Ward (teward) wrote :

Don't forget that despite the merge, we'll have a ton of NGINX modules we need to import too to make it work. Most of the modules that aren't core are separated into their own libnginx packages now...

Bryce Harrington (bryce)
description: updated
Revision history for this message
Bryce Harrington (bryce) wrote :

teward, speaking of which, there is indeed a migration issue for nginx against one of these split out modules, libnginx-mod-http-geoip2. The issue appears to be not that the module isn't imported, but rather that nginx appears to expect its version to be equivalent to its own, but it isn't:

Package: nginx-core
Architecture: all
Depends: libnginx-mod-http-geoip2 (>= ${libnginx-mod-geoip2:Version}),
         libnginx-mod-http-geoip2 (<< ${libnginx-mod-geoip2:Version}.1~),

So nginx's autopkgtest fails:

# https://autopkgtest.ubuntu.com/results/autopkgtest-noble/noble/amd64/n/nginx/20231122_220741_d4ae7@/log.gz
2440s The following packages have unmet dependencies:
2440s nginx-core : Depends: libnginx-mod-http-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
2440s Depends: libnginx-mod-stream-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
2440s E: Unable to correct problems, you have held broken packages.
2440s ssi-module-test FAIL badpkg

And the module also fails:

# https://autopkgtest.ubuntu.com/results/autopkgtest-noble/noble/amd64/libn/libnginx-mod-http-geoip2/20231122_213148_b4894@/log.gz
:
131s
131s The following packages have unmet dependencies:
131s nginx-core : Depends: libnginx-mod-http-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
131s Depends: libnginx-mod-stream-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
131s E: Unable to correct problems, you have held broken packages.
131s generic FAIL badpkg

I wonder if the better approach may be to drop the versioned dependencies from nginx-core for modules that now live in their own source packages. What do you think?

Revision history for this message
Thomas Ward (teward) wrote :

@bharrington

Refer to my IRC poke.

Proper way to handle this would be to depend as nginx-full in Debian does - https://salsa.debian.org/nginx-team/nginx/-/blob/main/debian/control#L129 - and replace the existing dependency lines with this:

libnginx-mod-http-geoip2 (>= ${libnginx-mod-geoip2:Version}~),

... which would match how we restructured in Debian for these external dependencies.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package nginx - 1.24.0-2ubuntu3

---------------
nginx (1.24.0-2ubuntu3) noble; urgency=medium

  * d/control: Fix versioned dependency for libnginx-mod-*-geoip2, as
    these are now distinct source packages with their own version numbers,
    not linked to the nginx source package itself.
    (LP: #2040404)

 -- Bryce Harrington <email address hidden> Tue, 05 Dec 2023 00:54:00 -0800

Changed in nginx (Ubuntu):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.