Merge ~ahasenack/ubuntu/+source/sssd:eoan-sssd-2.2.0-4-merge into ubuntu/+source/sssd:debian/sid

[Andreas Hasenack]

Merge from debian, new major version. I'm glad we have the dep8 tests we do, and they passed:

https://bileto.ubuntu.com/#/ticket/3772

Our delta is minimal, a lot was dropped. It's just a python -> python3 switch, and I'm not sure what debian's stance on that is yet.

I asked Timo about this merge, and he said the debian package has stabilized now in this new 2.x series and we could get it. There were no blockers or big issues.

[Andreas Hasenack (ahasenack)]

sssd master has pcre2 support (https://github.com/SSSD/sssd/pull/677#issuecomment-508238642), but not this 2.2.0 release. Anyway, that means soon the sssd task in https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1792544 can be closed

2be6d8b... by Andreas Hasenack on 2019-07-31

  * Added:
    - d/p/restart-on-failure.patch: add Restart=on-failure to sssd.service
      (LP: #1821927)

b512a3b... by Andreas Hasenack on 2019-07-31

changelog

[Andreas Hasenack (ahasenack)]

I added a fix for #1821927 and uploaded a new package to the bileto ppa, it's running as I write this.

[Bryce Harrington (bryce)]

It installed into an lxd container just fine, although I noticed some warnings during the install. Noticed the adduser one we ran into with kafka. :-) Not sure about the relevance of the other warnings.

# sudo add-apt-repository -y ppa:ci-train-ppa-service/3772
(...)
# apt-get install sssd
(...)
Creating SSSD system user & group...
adduser: Warning: The home directory `/var/lib/sss' does not belong to the user you are currently creating.
Warning: found usr.sbin.sssd in /etc/apparmor.d/force-complain, forcing complain mode
Warning from /etc/apparmor.d/usr.sbin.sssd (/etc/apparmor.d/usr.sbin.sssd line 54): Warning failed to create cache: usr.sbin.sssd
(...)
Created symlink /etc/systemd/system/multi-user.target.wants/sssd.service → /lib/systemd/system/sssd.service.
sssd-autofs.service is a disabled or a static unit, not starting it.
sssd-nss.service is a disabled or a static unit, not starting it.
sssd-pam.service is a disabled or a static unit, not starting it.
sssd-ssh.service is a disabled or a static unit, not starting it.
sssd-sudo.service is a disabled or a static unit, not starting it.
Job for sssd-pam-priv.socket failed.
See "systemctl status sssd-pam-priv.socket" and "journalctl -xe" for details.
A dependency job for sssd-pam.socket failed. See 'journalctl -xe' for details.
Job for sssd-nss.socket failed.
See "systemctl status sssd-nss.socket" and "journalctl -xe" for details.
Job for sssd-autofs.socket failed.
See "systemctl status sssd-autofs.socket" and "journalctl -xe" for details.
Job for sssd-sudo.socket failed.
See "systemctl status sssd-sudo.socket" and "journalctl -xe" for details.
Job for sssd-ssh.socket failed.
See "systemctl status sssd-ssh.socket" and "journalctl -xe" for details.
Setting up sssd-proxy (2.2.0-4ubuntu1~ppa2) ...
Setting up cracklib-runtime (2.9.6-2) ...
Setting up libpwquality1:amd64 (1.4.0-3) ...
Setting up sssd-ad-common (2.2.0-4ubuntu1~ppa2) ...
Created symlink /etc/systemd/system/sssd.service.wants/sssd-pac.socket → /lib/systemd/system/sssd-pac.socket.
sssd-pac.service is a disabled or a static unit, not starting it.
Job for sssd-pac.socket failed.
See "systemctl status sssd-pac.socket" and "journalctl -xe" for details.
Setting up sssd-krb5-common (2.2.0-4ubuntu1~ppa2) ...
(...)
# apt-cache policy sssd | grep Installed:
  Installed: 2.2.0-4ubuntu1~ppa2

[Bryce Harrington (bryce)]

 √ Verified LP numbers and descriptions

Note that Robie expressed a doubt on LP #1821927 regarding Restart=on-failure and wanting to see more discussion. I also notice the upstream bug report got closed as fixed (with same change as here), but doesn't appear to have been any discussion about pros and cons. Maybe it's good? maybe it needs more discussion? Maybe it's Maybelline.

(My personal opinion is if upstream has taken the change, and it isn't something that'll cause annoyances for users, no reason we can't carry it too. But I could see value in adopting a standard across all services, to achieve better distro consistency, so will defer to those with stronger opinions than me.)

 √ Verified version number
 √ Verified update-maintainer
 √ Verified debdiff targets correct release codename
 √ Verified bileto build completed w/ autopkgtests without errors
 √ Verified installation / de-installation / purge / upgrade from the PPA into lxc

I notice bileto ran and passed the autopkgtests, however when I first ran them in an lxd container the ldap test errors out:

    https://paste.ubuntu.com/p/KxH9yh6ybK/

The journal -xe output:

    https://paste.ubuntu.com/p/kbJWKvRhkd/

The above output suggested doing this:

    # systemctl disable sssd-pam.socket

After that, I reran the test and this time everything passed

    https://paste.ubuntu.com/p/8FtWmxy2th/

No idea if this indicates something that needs adjusted in packaging, or is just an installation configuration detail.

+1 approve from me, just make sure to touch base with Robie before finalizing stuff.

review: Approve

[Christian Ehrhardt  (paelzer)]

Thanks for adding https://pagure.io/SSSD/sssd/c/b1ea33eca64a0429513fcfe2ba7402ff56889b46

[Christian Ehrhardt  (paelzer)]

review: Approve

[Andreas Hasenack (ahasenack)]

Thanks for the review guys!

Bryce, in your ldap run I think this noise from run-parts broke the expect tool:

ldap.example.com login: testuser1
Password:
run-parts: /etc/update-motd.d/98-fsck-at-reboot exited with return code 2

The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the

I also don't like the messages about socket services failing to start, I'll take a look at that and how it was supposed to be handled.

[Andreas Hasenack (ahasenack)]

I clarified with Timo, and he with upstream, that these socket activated services won't start if there is no config file. It's noisy, but harmless for the time being. Timo might patch it in a new debian upload.

I'll upload b512a3b4910648902d13ea2dfc8f2cf013516d6f now.

$ git push pkg upload/2.2.0-4ubuntu1
Enumerating objects: 39, done.
Counting objects: 100% (39/39), done.
Delta compression using up to 2 threads
Compressing objects: 100% (33/33), done.
Writing objects: 100% (33/33), 4.96 KiB | 508.00 KiB/s, done.
Total 33 (delta 19), reused 0 (delta 0)
To ssh://git.launchpad.net/~usd-import-team/ubuntu/+source/sssd
 * [new tag] upload/2.2.0-4ubuntu1 -> upload/2.2.0-4ubuntu1

$ dput ubuntu ../sssd_2.2.0-4ubuntu1_source.changes
Checking signature on .changes
gpg: ../sssd_2.2.0-4ubuntu1_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../sssd_2.2.0-4ubuntu1.dsc: Valid signature from AC983EB5BF6BCBA9
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.2.0-4ubuntu1.dsc: done.
  Uploading sssd_2.2.0.orig.tar.gz: done.
  Uploading sssd_2.2.0-4ubuntu1.diff.gz: done.
  Uploading sssd_2.2.0-4ubuntu1_source.buildinfo: done.
  Uploading sssd_2.2.0-4ubuntu1_source.changes: done.
Successfully uploaded packages.

[Andreas Hasenack (ahasenack)]

This migrated in eoan.

diff --git a/debian/changelog b/debian/changelog
index 7a97edd..6e636f7 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,23 @@
+sssd (2.2.0-4ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Switch sss_obfuscate shebang to python3.
+  * Dropped:
+    - Fix build with newer samba (4.10+):
+      + d/p/build-newer-samba.patch: replace ARRAY_SIZE with N_ELEMENTS, since
+        the former is no longer available.
+        [Fixed upstream]
+      + d/p/make-n_elements-public.patch: make N_ELEMENTS public
+        [Fixed upstream]
+    - d/p/GPO_CROND-customization.patch: Set GPO_CROND to cron instead of
+      crond for Debian and Ubuntu (LP #1572908)
+      [Fixed upstream]
+  * Added:
+    - d/p/restart-on-failure.patch: add Restart=on-failure to sssd.service
+      (LP: #1821927)
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 29 Jul 2019 18:09:16 -0300
+
 sssd (2.2.0-4) unstable; urgency=medium
 
   [ Sam Morris ]
@@ -57,6 +77,25 @@ sssd (1.16.4-1~exp1) experimental; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 03 Apr 2019 09:56:33 +0300
 
+sssd (1.16.3-3.1ubuntu1) eoan; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - Fix build with newer samba (4.10+):
+      + d/p/build-newer-samba.patch: replace ARRAY_SIZE with N_ELEMENTS, since
+        the former is no longer available.
+      + d/p/make-n_elements-public.patch: make N_ELEMENTS public
+    - d/p/GPO_CROND-customization.patch: Set GPO_CROND to cron instead of
+      crond for Debian and Ubuntu (LP #1572908)
+    - Switch sss_obfuscate shebang to python3.
+  * Dropped:
+    - d/p/mit-krb-1.17-build-fix.patch: accept krb5 1.17 for building the PAC
+      plugin
+      [In 1.16.3-3.1]
+    - d/p/fix-test-copy-ccache.patch: fix mocking krb5_creds in test_copy_ccache
+      [In 1.16.3-3.1]
+
+ -- Andreas Hasenack <[e-mail]>  Wed, 22 May 2019 18:28:06 -0300
+
 sssd (1.16.3-3.1) unstable; urgency=high
 
   * Non-maintainer upload.
@@ -65,6 +104,31 @@ sssd (1.16.3-3.1) unstable; urgency=high
 
  -- Dominik George <[e-mail]>  Sun, 24 Feb 2019 11:05:55 +0100
 
+sssd (1.16.3-3ubuntu3) eoan; urgency=medium
+
+  * Switch sss_obfuscate shebang to python3.
+
+ -- Dimitri John Ledkov <[e-mail]>  Mon, 29 Apr 2019 11:17:49 +0100
+
+sssd (1.16.3-3ubuntu2) eoan; urgency=medium
+  
+  * d/p/GPO_CROND-customization.patch: Set GPO_CROND to cron instead of
+    crond for Debian and Ubuntu (LP: #1572908)
+
+ -- Victor Tapia <[e-mail]>  Mon, 23 Apr 2019 13:48:26 +0100
+
+sssd (1.16.3-3ubuntu1) disco; urgency=medium
+
+  * Fix build with newer samba (4.10+):
+    - d/p/build-newer-samba.patch: replace ARRAY_SIZE with N_ELEMENTS, since
+      the former is no longer available.
+    - d/p/make-n_elements-public.patch: make N_ELEMENTS public
+  * d/p/fix-test-copy-ccache.patch: fix mocking krb5_creds in test_copy_ccache
+  * d/p/mit-krb-1.17-build-fix.patch: accept krb5 1.17 for building the PAC
+    plugin
+
+ -- Andreas Hasenack <[e-mail]>  Mon, 04 Mar 2019 20:21:27 -0300
+
 sssd (1.16.3-3) unstable; urgency=medium
 
   * fix-curl-ftbfs.diff: Fix build with current curl. (Closes: #913403)
diff --git a/debian/control b/debian/control
index baa5115..8fc2aba 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -232,8 +233,8 @@ Description: System Security Services Daemon -- proxy back end
 Package: sssd-tools
 Architecture: any
 Depends:
- python,
- python-sss,
+ python3,
+ python3-sss,
  sssd-common (= ${binary:Version}),
  ${misc:Depends},
  ${shlibs:Depends}
diff --git a/debian/patches/python3-shebang.patch b/debian/patches/python3-shebang.patch
new file mode 100644
index 0000000..a74fd04
--- /dev/null
+++ b/debian/patches/python3-shebang.patch
@@ -0,0 +1,13 @@
+Description: Switch sss_obfuscate shebang to python3.
+Author: Dimitri John Ledkov <[e-mail]>
+
+Index: sssd-1.16.3/src/tools/sss_obfuscate
+===================================================================
+--- sssd-1.16.3.orig/src/tools/sss_obfuscate
++++ sssd-1.16.3/src/tools/sss_obfuscate
+@@ -1,4 +1,4 @@
+-#!/usr/bin/python
++#!/usr/bin/python3
+ 
+ from __future__ import print_function
+ 
diff --git a/debian/patches/restart-on-failure.patch b/debian/patches/restart-on-failure.patch
new file mode 100644
index 0000000..03677ba
--- /dev/null
+++ b/debian/patches/restart-on-failure.patch
@@ -0,0 +1,29 @@
+From b1ea33eca64a0429513fcfe2ba7402ff56889b46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Pavel=20B=C5=99ezina?= <[e-mail]>
+Date: Mon, 8 Jul 2019 11:37:19 +0200
+Subject: [PATCH] systemd: add Restart=on-failure to sssd.service
+
+Resolves:
+https://pagure.io/SSSD/sssd/issue/4040
+
+Reviewed-by: Jakub Hrozek <[e-mail]>
+---
+ src/sysv/systemd/sssd.service.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+Origin: upstream, https://github.com/SSSD/sssd/commit/b1ea33eca64a0429513fcfe2ba7402ff56889b46
+Bug: https://pagure.io/SSSD/sssd/issue/4040
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1821927
+Last-Update: 2019-07-31
+diff --git a/src/sysv/systemd/sssd.service.in b/src/sysv/systemd/sssd.service.in
+index 2cb7cadf7d..7a4b7c74c8 100644
+--- a/src/sysv/systemd/sssd.service.in
++++ b/src/sysv/systemd/sssd.service.in
+@@ -11,6 +11,7 @@ ExecStart=@sbindir@/sssd -i ${DEBUG_LOGGER}
+ Type=notify
+ NotifyAccess=main
+ PIDFile=@pidpath@/sssd.pid
++Restart=on-failure
+ 
+ [Install]
+ WantedBy=multi-user.target
diff --git a/debian/patches/series b/debian/patches/series
index 8488b90..8bfa56a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,3 +1,5 @@
 fix-have-systemd.diff
 fix-whitespace-test.diff
 default-to-socket-activated-services.diff
+python3-shebang.patch
+restart-on-failure.patch