Merge ~ahasenack/ubuntu/+source/strongswan:bionic-strongswan-charon-apparmor-1932197 into ubuntu/+source/strongswan:ubuntu/bionic-devel

[Andreas Hasenack]

Bileto ticket (still ongoing): https://bileto.ubuntu.com/#/ticket/4589

Associated PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4589

Change the dependencies between strongswan-starter and strongswan-charon to what we have in focal and later (cherry-picked patch) so that the charon daemon will run confined with its apparmor profile on first install, and not just after a restart.

The linked bug has the SRU template filled in and a more detailed explanation, as well as a simple test case.

[Lucas Kanashiro (lucaskanashiro)]

I am grabbing this for review.

[Lucas Kanashiro (lucaskanashiro)]

The packaging changes look good, I reproduced the bug and confirmed that the version in the PPA fixes the issue.

I was not able to check the test runs triggered by bileto, did I miss something there? FWIW I did run autopkgtest locally and it passed:

autopkgtest [12:01:20]: @@@@@@@@@@@@@@@@@@@@ summary
daemon PASS
admin-strongswan-charon PASS
admin-strongswan-starter PASS
plugins PASS

review: Approve

[Andreas Hasenack (ahasenack)]

I just checked bileto, and there are no test results listed, so that means they are all green.
Bileto itself is saying "failed" but that's because it's an SRU and bileto doesn't know how to interpret that the package is blocked from automated migration (because the SRU team has to do the upload):

"Not touching package due to block request by freeze (please contact ubuntu-release if update is needed) "

[Andreas Hasenack (ahasenack)]

Pushing upload tag:

$ git push pkg upload/5.6.2-1ubuntu2.6
Enumerating objects: 13, done.
Counting objects: 100% (13/13), done.
Delta compression using up to 4 threads
Compressing objects: 100% (9/9), done.
Writing objects: 100% (9/9), 1.33 KiB | 65.00 KiB/s, done.
Total 9 (delta 6), reused 0 (delta 0), pack-reused 0
To ssh://git.launchpad.net/ubuntu/+source/strongswan
 * [new tag] upload/5.6.2-1ubuntu2.6 -> upload/5.6.2-1ubuntu2.6

Uploading package:
$ dput ubuntu ../strongswan_5.6.2-1ubuntu2.6_source.changes
Checking signature on .changes
gpg: ../strongswan_5.6.2-1ubuntu2.6_source.changes: Valid signature from AC983EB5BF6BCBA9
Checking signature on .dsc
gpg: ../strongswan_5.6.2-1ubuntu2.6.dsc: Valid signature from AC983EB5BF6BCBA9
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading strongswan_5.6.2-1ubuntu2.6.dsc: done.
  Uploading strongswan_5.6.2-1ubuntu2.6.debian.tar.xz: done.
  Uploading strongswan_5.6.2-1ubuntu2.6_source.buildinfo: done.
  Uploading strongswan_5.6.2-1ubuntu2.6_source.changes: done.
Successfully uploaded packages.

diff --git a/debian/changelog b/debian/changelog
index d1780cc..b92dee3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+strongswan (5.6.2-1ubuntu2.6) bionic; urgency=medium
+
+  * d/control: change dependency relationship between strongswan-charon and
+    strongswan-starter so that the charon service is started with the apparmor
+    profile applied (LP: #1932197)
+
+ -- Andreas Hasenack <[e-mail]>  Fri, 18 Jun 2021 19:58:12 +0000
+
 strongswan (5.6.2-1ubuntu2.5) bionic; urgency=medium
 
   * d/p/lp-1772705-charon-nm-Fix-building-list-of-DNS-MDNS-servers-with.patch:
diff --git a/debian/control b/debian/control
index 2f24752..1f54245 100644
--- a/debian/control
+++ b/debian/control
@@ -248,9 +248,9 @@ Architecture: any
 Depends: adduser,
          libstrongswan (= ${binary:Version}),
          lsb-base (>= 3.0-6),
+         strongswan-charon,
          ${misc:Depends},
          ${shlibs:Depends}
-Recommends: strongswan-charon
 Conflicts: openswan
 Description: strongSwan daemon starter and configuration file parser
  The strongSwan VPN suite uses the native IPsec stack in the standard
@@ -285,9 +285,9 @@ Architecture: any
 Pre-Depends: debconf | debconf-2.0
 Depends: iproute2 [linux-any] | iproute [linux-any],
          libstrongswan (= ${binary:Version}),
-         strongswan-starter,
          ${misc:Depends},
          ${shlibs:Depends}
+Recommends: strongswan-starter,
 Provides: ike-server
 Description: strongSwan Internet Key Exchange daemon
  The strongSwan VPN suite uses the native IPsec stack in the standard