Merge ~ahasenack/ubuntu/+source/sssd:cosmic-sssd-merge-1.16.2-1 into ubuntu/+source/sssd:debian/sid

[Andreas Hasenack]

Merge from debian's 1.16.2. Notable changes:
- libcmocka-dev new build dependency. This is used for testing only, so it doesn't matter that it's in universe
- building with cmocka triggered many more tests, and one in particular fails in Ubuntu because of our usage of the -Bsymbolic-functions linker flag. This prevents a mocked function from being called and the real one is called instead. See https://bit.ly/2OTDtDM for a thread in the upstream mailing list. I did an experimental build without -Bsymbolic-functions and the test passed. I'm not prepared to remove this flag from the whole build, however, and the alternatives seem cumbersome at this time, so I rather just disable this known test failure. Unfortunately this is a new delta, but an easy one to maintain.
- another new delta is to fix a build problem that does not happen with all linux distributions. So far just gentoo, opensuse and us. Removing -Bsymbolic-flags doesn't affect the outcome, so it's something else. This was discussed upstream at https://bit.ly/2MrqgAw and the patch that we are carrying is committed upstream, so the next version will have this bit of delta dropped.
- finally, I dropped Doko's fix for a python3 module build error that happened once when he did a no-change rebuild upload (see build failures at https://launchpad.net/ubuntu/+source/sssd/1.16.1-1ubuntu2). Those don't happen again in a PPA (https://launchpad.net/~ahasenack/+archive/ubuntu/sssd-merge-1.16.2-1/+packages), and I hope they won't happen when uploading to the archive. There is some magic going on with dh-install and/or dh-python, look at https://pastebin.ubuntu.com/p/CBvNgDmp9d/: the paths in *.install don't agree with what ends up in the deb package.
- the debian d/rules change to use samba idmap version 6 is fine, since that was the default before when this option didn't exist

PPA with test packages: https://launchpad.net/~ahasenack/+archive/ubuntu/sssd-merge-1.16.2-1/+packages

I tested locally the following scenarios:
- pure ldap authentication with ssl, and ldap user enumeration/information
- ldap with ssl for user information, kerberos for user authentication
- kerberos for authentication, /etc/passwd (files) for user enumeration/information

These tests are a bit complex to describe in a step by step basis. I still want to add them as DEP8 tests in an upcoming upload.

To confirm that the new build-depends didn't introduce anything unexpected, I installed all generated debs in a container with no universe component enabled, and it worked fine.

[Andreas Hasenack (ahasenack)]

If happy with the MP, please push the upload tag and set the MP to approved. I can dput the package and follow migration.

[Andreas Hasenack (ahasenack)]

Upstream opened a PR for this issue: https://github.com/SSSD/sssd/pull/632

I confirmed that the patch makes the test pass in Ubuntu. We can either wait for it to be merged, and then apply it in this branch, or do that in a second step as to not block this upload.

[Christian Ehrhardt  (paelzer)]

Since you surgically only disable the one test and a solution is incoming (which implies we can drop next time) we should be fine to upload this as-is.
If we wait for the next merge or do a minor upload with the fix mostly depends on how much pain/effort it is - if migration turns out to be rather painful we might not do a follow on soon.
If it is trivial, then why not.
And if you know from the past that sssd migrates painfully, we might give upstream until mid next week to commit, so that we would only have one upload.

On the MP itself:
Ack to Changelog (not complaining abotu different wording style preferences)
Ack to Dropped changes
Ack to new changes
Upgrade works fine on a test
General Testing (I'm not good at sssd thou) also works (tested 1.16.2-1ubuntu1~ppa8)

FYI - Rbasak once told me that the Forwarded in Dep3 is only defined as yes/no
Since then I only do yes/no but add own flags called Forwarded-info: or so.
Really not important enough to stop you, but I wanted to let you know.

I'd leave the tag&push to your confirm that you want to keep the header as-is (and if you want to wait for upstream committing the fix).

review: Approve

[Andreas Hasenack (ahasenack)]

I updated the dep3 header and pushed --force. New hash to tag with upload is 83d52c481399b10d78b6553b6376bd28fd0b59b8 please.

[Christian Ehrhardt  (paelzer)]

Tag pushed and sponsored

diff --git a/debian/changelog b/debian/changelog
index 06a1412..df16eea 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,19 @@
+sssd (1.16.2-1ubuntu1) cosmic; urgency=medium
+
+  * Merge with Debian unstable.
+  * Dropped:
+    - Fix installation of the python3 modules.
+      [No longer needed, it builds fine now.]
+    - d/sssd-common.maintscript: rm_conffile for upstart drop
+      [Can be dropped in a merge post 18.04]
+  * Added:
+    - d/p/libsss-dependency.diff: fix build issue dependency between
+      libsss_cert and libsss_child.
+    - d/p/disable-sss_nss_idmap-tests.diff: disable the sss_nss_idmap tests
+      which fail in Ubuntu because of the -Bsymbolic-functions linker flag.
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 08 Aug 2018 10:49:35 -0300
+
 sssd (1.16.2-1) unstable; urgency=medium
 
   * New upstream release. (LP: #1778554)
@@ -13,6 +29,35 @@ sssd (1.16.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 27 Jun 2018 14:07:55 +0300
 
+sssd (1.16.1-1ubuntu4) cosmic; urgency=medium
+
+  * d/p/python3-libipa-hbac.install, d/p/python3-libsss-nss-idmap.install,
+    d/p/python3-sss.install: modules go in /usr/lib/python3*, not
+    /usr/local/lib/python3* (LP: #1780783)
+  * d/sssd-common.sssd.init: drop initscript that was accidentally added
+    in 1.16.1-1ubuntu3.
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 10 Jul 2018 17:21:22 -0300
+
+sssd (1.16.1-1ubuntu3) cosmic; urgency=medium
+
+  * Fix installation of the python3 modules.
+
+ -- Matthias Klose <[e-mail]>  Tue, 15 May 2018 12:08:22 -0400
+
+sssd (1.16.1-1ubuntu2) cosmic; urgency=medium
+
+  * No-change rebuild for http-parser soname change.
+
+ -- Matthias Klose <[e-mail]>  Mon, 14 May 2018 17:33:20 +0000
+
+sssd (1.16.1-1ubuntu1) bionic; urgency=medium
+
+  * Merge from Debian. (LP: #1754746)
+  * d/p/restart_providers_on_timeshift.patch: Dropped, upstream.
+
+ -- Timo Aaltonen <[e-mail]>  Mon, 09 Apr 2018 13:45:29 +0300
+
 sssd (1.16.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -27,6 +72,29 @@ sssd (1.16.1-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Tue, 13 Mar 2018 11:25:00 +0200
 
+sssd (1.16.0-5ubuntu2) bionic; urgency=medium
+
+  * Enable the secrets service and build against http-parser (LP: #1754365).
+    This drops the following Debian delta:
+    - Build without the secrets service as libhttp-parser2.1 is in universe
+  * d/{sssd-common.postinst,sssd-common.dirs}: create the secrets directory
+    used by sssd-secrets and set its permissions in postinst.
+    (Closes: #892315)
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 06 Mar 2018 16:23:11 +0100
+
+sssd (1.16.0-5ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1735493). Remaining changes:
+    - Build without the secrets service as libhttp-parser2.1 is in universe
+    - d/p/restart_providers_on_timeshift.patch: Use SIGUSR2 after watchdog
+      detects time shift to execute pending scheduled tasks that could
+      be stuck (LP 1641875)
+      [refreshed with what was committed upstream in the end]
+    - d/sssd-common.maintscript: rm_conffile for upstart drop
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 26 Jan 2018 17:46:39 -0200
+
 sssd (1.16.0-5) unstable; urgency=medium
 
   * rules: Disable files domain, it's not useful in Debian. (Closes:
@@ -63,12 +131,35 @@ sssd (1.16.0-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 20 Dec 2017 11:58:50 +0200
 
+sssd (1.15.3-3ubuntu1) bionic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1732242). Remaining changes:
+    - Build without the secrets service as libhttp-parser2.1 is in universe
+    - d/p/restart_providers_on_timeshift.patch: Use SIGUSR2 after watchdog
+    detects time shift to execute pending scheduled tasks that could
+    be stuck (LP 1641875)
+  * Drop unused upstart file debian/sssd-common.sssd.upstart.in
+    - remove debian/sssd-common.sssd.upstart.in
+    - debian/sssd-common.maintscript remove stale conffile
+
+ -- Andreas Hasenack <[e-mail]>  Tue, 14 Nov 2017 16:13:02 -0200
+
 sssd (1.15.3-3) unstable; urgency=medium
 
   * Rebuild against new libldb. (Closes: #880013)
 
  -- Timo Aaltonen <[e-mail]>  Sun, 29 Oct 2017 09:13:42 +0200
 
+sssd (1.15.3-2ubuntu1) artful; urgency=medium
+
+  * Merge from Debian, remaining changes:
+    - Build without the secrets service as libhttp-parser2.1 is in universe
+    - d/p/restart_providers_on_timeshift.patch: Use SIGUSR2 after watchdog
+    detects time shift to execute pending scheduled tasks that could
+    be stuck (LP: 1641875)
+
+ -- Timo Aaltonen <[e-mail]>  Thu, 12 Oct 2017 10:02:08 +0300
+
 sssd (1.15.3-2) unstable; urgency=medium
 
   * control: Fix libipa-hbac-dev short description.
@@ -92,6 +183,27 @@ sssd (1.15.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Sat, 29 Jul 2017 11:50:41 +0300
 
+sssd (1.15.2-1ubuntu3) artful; urgency=medium
+
+  * No-change rebuild to build with python3.6.
+
+ -- Matthias Klose <[e-mail]>  Mon, 24 Jul 2017 18:24:23 +0000
+
+sssd (1.15.2-1ubuntu2) artful; urgency=medium
+
+  * d/apparmor-profile:
+    - allow the chown capability (LP: #1699576)
+    - allow sssd to notify systemd during startup (LP: #1689387)
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 21 Jun 2017 15:50:35 -0300
+
+sssd (1.15.2-1ubuntu1) zesty; urgency=medium
+
+  * Merge from Debian.
+    - new bugfix release
+
+ -- Timo Aaltonen <[e-mail]>  Thu, 06 Apr 2017 12:45:49 +0300
+
 sssd (1.15.2-1) unstable; urgency=medium
 
   * New upstream release.
@@ -103,6 +215,41 @@ sssd (1.15.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Mon, 20 Mar 2017 15:17:19 +0200
 
+sssd (1.15.0-3ubuntu4) zesty; urgency=medium
+
+  * Rebuild against new samba/libldb. (LP: #1664785)
+
+ -- Timo Aaltonen <[e-mail]>  Sun, 05 Mar 2017 13:30:40 +0200
+
+sssd (1.15.0-3ubuntu3) zesty; urgency=medium
+
+  * d/p/restart_providers_on_timeshift.patch: Use SIGUSR2 after watchdog
+    detects time shift to execute pending scheduled tasks that could
+    be stuck (LP: #1641875)
+
+ -- Victor Tapia <[e-mail]>  Wed, 15 Feb 2017 17:05:05 +0100
+
+sssd (1.15.0-3ubuntu2) zesty; urgency=medium
+
+  * Demote sssd-ad Recommends to Suggests. This fixes a component mismatch in
+    Ubuntu, but also we believe in LP 1590471 that it shouldn't be required for
+    full functionality of sssd-ad anyway. This has also been done in Debian VCS
+    in commit d26fd6b.
+
+ -- Robie Basak <[e-mail]>  Thu, 09 Feb 2017 13:34:01 +0000
+
+sssd (1.15.0-3ubuntu1) zesty; urgency=medium
+
+  * Build without the secrets service as libhttp-parser2.1 is in universe. An
+    MIR is pending in LP 1638957; when this is complete, we can revert this.
+    - Configure with --without-secrets.
+    - Drop build depends on libhttp-parser-dev and libjansson-dev. These are
+      only needed for the "secrets service".
+    - Remove secrets service -related files from d/sssd-common.install and in
+      d/rules.
+
+ -- Robie Basak <[e-mail]>  Tue, 07 Feb 2017 19:37:45 +0000
+
 sssd (1.15.0-3) unstable; urgency=medium
 
   * rules, install: Remove responder service and socket files for now, the
diff --git a/debian/control b/debian/control
index ba9aede..28853e2 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>
 Build-Depends:
  autopoint,
diff --git a/debian/patches/disable-sss_nss_idmap-tests.diff b/debian/patches/disable-sss_nss_idmap-tests.diff
 new file mode 100644
index 0000000..f9145a1
--- /dev/null
+++ b/debian/patches/disable-sss_nss_idmap-tests.diff
@@ -0,0 +1,23 @@
+Description: Disable sss_nss_idmap-tests
+ The test_getsidbyname and test_getorigbyname tests rely on mocking out
+ a call to sss_nss_make_request_timeout(), using libcmocka. In Ubuntu that
+ mocking doesn't work because of the -Bsymbolic-functions linker flag that
+ is used by default. It's less intrusive to just disable this test than to
+ remove the linker flag from the whole build.
+ Mailing list thread: https://bit.ly/2OTDtDM
+Author: Andreas Hasenack <[e-mail]>
+Bug: https://github.com/SSSD/sssd/pull/632
+Forwarded: no
+Last-Update: 2018-08-07
+---
+This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -239,7 +239,6 @@
+         test-io \
+         test-negcache \
+         test-authtok \
+-        sss_nss_idmap-tests \
+         dyndns-tests \
+         fqnames-tests \
+         nestedgroups-tests \
diff --git a/debian/patches/libsss-dependency.diff b/debian/patches/libsss-dependency.diff
 new file mode 100644
index 0000000..e1b7d16
--- /dev/null
+++ b/debian/patches/libsss-dependency.diff
@@ -0,0 +1,30 @@
+Description: utils: add libsss_child dependency to libsss_cert
+ Since the refactoring of the ssh responder to call p11_child to
+ validate certificates there is a dependency between libss_cert and
+ libsss_child. In some environments, e.g. gentoo or the OpenSUSE build
+ service, this dependency must be declared explicitly even if it is
+ resolved otherwise while linking the binaries.
+ Reviewed-by: Fabiano Fidêncio <[e-mail]>
+Author: Sumit Bose <[e-mail]>
+Origin: upstream, https://pagure.io/SSSD/sssd/c/a2cc554f438c220b3cc73eb93879dd87795a86cd
+Last-Update: 2018-08-07
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -967,11 +967,17 @@
+     $(AM_CFLAGS) \
+     $(SSS_CERT_CFLAGS) \
+     $(NULL)
++# NOTE:
++# There is a dependency between libsss_cert and libsss_child which should
++# always be declared explicitly and if missing might cause issue in some
++# environments (e.g. Gentoo or OpenSUSE build service), even if it is
++# resolved otherwise while linking the binaries.
+ libsss_cert_la_LIBADD = \
+     $(SSS_CERT_LIBS) \
+     $(TALLOC_LIBS) \
+     $(TEVENT_LIBS) \
+     libsss_crypt.la \
++    libsss_child.la \
+     libsss_debug.la \
+     libsss_certmap.la \
+     $(NULL)
diff --git a/debian/patches/series b/debian/patches/series
index 512387a..99828b4 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,2 +1,4 @@
 #placeholder
 disable-tests.diff
+libsss-dependency.diff
+disable-sss_nss_idmap-tests.diff