Merge ~jj/ubuntu/+source/python-ldap:lp2130351-autopkgtest-apparmor into ubuntu/+source/python-ldap:ubuntu/devel

[Jonas Jelten]

fix for bug #2130351
ppa: https://launchpad.net/~jj/+archive/ubuntu/lp2119884-openldap-fix-apparmor/

  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [amd64]
    + ✅ python-ldap on resolute for amd64 @ 17.11.25 11:53:01 Log️ 🗒️
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [arm64]
    + ✅ python-ldap on resolute for arm64 @ 17.11.25 11:53:53 Log️ 🗒️
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [armhf]
    + ❌ python-ldap on resolute for armhf @ 17.11.25 11:55:05 Log️ 🗒️
      • upstream FAIL 🟥
      • startserver FAIL 🟥
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [i386]
    + ❌ python-ldap on resolute for i386 @ 17.11.25 11:52:53 Log️ 🗒️
      • 76s FAIL 🟥
      • 76s FAIL 🟥
      • 76s FAIL 🟥
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [ppc64el]
    + ✅ python-ldap on resolute for ppc64el @ 17.11.25 11:53:17 Log️ 🗒️
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [riscv64]
    + ⛔ python-ldap on resolute for riscv64 @ 17.11.25 12:01:24 Log️ 🗒️
      • testbed BAD ⛔
  - python-ldap: resolute/python-ldap/3.4.4-2ubuntu1~ppa4 [s390x]
    + ✅ python-ldap on resolute for s390x @ 17.11.25 11:53:21 Log️ 🗒️

armhf fails because apparmor can't be accessed, i386 has failed in previous releases.

[Andreas Hasenack (ahasenack)]

What happens if you just ignore the apparmor_parser exit status, like we do already in other cases, like d/t/slapd[1] from src:openldap? Does the test pass?

Incidentally, we should probably standardize on this, as other tests even in openldap use different code to skip apparmor failures on armhf (like d/t/smbk5pwd). But that's for another time.

1. https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/tests/slapd#n23

review: Needs Information

[Jonas Jelten (jj)]

I've uploaded ubuntu2~ppa1 with isolation-machine restriction, let's see how this goes (likely the test is just skipped).

I agree we should standartize to this - the bug to resolve this in properly is #2008393 I'd say.

[Andreas Hasenack (ahasenack)]

There is no support for isolation-machine on armhf, the test will just be skipped then.

[Andreas Hasenack (ahasenack)]

As discussed in standup, the suggestion is to take the same approach as the openldap package[1] and just ignore the apparmor error (with a warning) if running on ubuntu-armhf. Then please remove the isolation-machine test restriction.

1. https://git.launchpad.net/ubuntu/+source/openldap/tree/debian/tests/slapd#n23

[Jonas Jelten (jj)]

added a function for allowing apparmor commands to fail if on Ubuntu+armhf

[Andreas Hasenack (ahasenack)]

Comments inline.

[Jonas Jelten (jj)]

simplified the function to not use a temp dir.

[Andreas Hasenack (ahasenack)]

needs-sudo restriction

[Andreas Hasenack (ahasenack)]

Looks good, +1 after adding the restriction.

[Jonas Jelten (jj)]

added the needs-sudo-restriction, thx.

[Andreas Hasenack (ahasenack)]

The ppa9 upload of python-ldap has a couple of build failures without logs, typical of an infrastructure problem. I can't retry them, because I don't own the ppa. I triggered a new dep8 run, but I don't think it will find the ppa9 package published because of the FTBFS.

Since this is a devel upload, I'll go ahead and sponsor. If the real migration hits problems, we'll just fix them.

+1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: ahasenack, jj
Uploaders: ahasenack
MP auto-approved

review: Approve

[Andreas Hasenack (ahasenack)]

Sponsored:
Uploading python-ldap_3.4.4-2ubuntu1.dsc
Uploading python-ldap_3.4.4-2ubuntu1.debian.tar.xz
Uploading python-ldap_3.4.4-2ubuntu1_source.buildinfo
Uploading python-ldap_3.4.4-2ubuntu1_source.changes

[Andreas Hasenack (ahasenack)]

 84s allowing /tmp/autopkgtest.1r6Pve/autopkgtest_tmp in apparmor...
 84s reverting apparmor adjustments...
 84s /tmp/autopkgtest.1r6Pve/build.KCc/src/debian/tests/upstream: 54: cannot create /etc/apparmor.d/local/usr.sbin.slapd: Permission denied
 84s rm: cannot remove '/etc/apparmor.d/local/usr.sbin.slapd': No such file or directory
 84s autopkgtest [18:16:34]: test upstream: -----------------------]

This needs root/sudo:

        # this directory is like /etc/slapd
        echo "allowing $_apparmor_allowdir in apparmor..."
        echo "$_apparmor_allowdir/** kwr," >> /etc/apparmor.d/local/usr.sbin.slapd

Well, too late now, it's uploaded. New PR and new bug is needed.

[Jonas Jelten (jj)]

new MR with fix at: https://code.launchpad.net/~jj/ubuntu/+source/python-ldap/+git/python-ldap/+merge/497057

diff --git a/debian/changelog b/debian/changelog
index ed43841..b543b15 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+python-ldap (3.4.4-2ubuntu1) resolute; urgency=medium
+
+  * d/t/{startserver,upstream}: fix slapd apparmor access to test directory
+    (LP: #2130351)
+    - d/t/apparmor.sh: ignore apparmor control failures on Ubuntu+armhf
+      (LP: #2008393)
+
+ -- Jonas Jelten <[e-mail]>  Tue, 11 Nov 2025 17:53:15 +0100
+
 python-ldap (3.4.4-2) unstable; urgency=medium
 
   * Team Upload
diff --git a/debian/control b/debian/control
index 0f8c0af..3b9c487 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: python-ldap
 Section: python
 Priority: optional
-Maintainer: Debian Python Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Python Team <[e-mail]>
 Uploaders:
  Willem van den Akker <[e-mail]>,
  Michael Fladischer <[e-mail]>,
diff --git a/debian/tests/apparmor.sh b/debian/tests/apparmor.sh
new file mode 100644
index 0000000..7308195
--- /dev/null
+++ b/debian/tests/apparmor.sh
@@ -0,0 +1,58 @@
+# apparmor profile adjustments during testing
+
+if command -v aa-enabled > /dev/null; then
+	apparmor_enabled=$(test "$(aa-enabled)" = "Yes" && echo true || echo false)
+else
+	apparmor_enabled=false
+fi
+
+_apparmor_check() {
+	# allow command to fail if running on Ubuntu-armhf (due to LP: #2008393)
+	"$@" && return 0
+	_ret=$?
+
+	if [ "$(dpkg-vendor --query Vendor)-$(dpkg --print-architecture)" = "Ubuntu-armhf" ]; then
+		echo "WARNING: failed to perform apparmor command: $*" >&2
+		echo "On armhf and Ubuntu DEP8 infrastructure, this is not a fatal error." >&2
+		echo "See LP: #2008393 for details." >&2
+		return 0
+	fi
+
+	echo "apparmor command failed: $*" >&2
+	exit $_ret
+}
+
+_apparmor_cleanup() {
+	if [ "$apparmor_enabled" = true ]; then
+		echo "reverting apparmor adjustments..."
+		sudo rm /etc/apparmor.d/local/usr.sbin.slapd
+
+		if [ -f /etc/apparmor.d/local/usr.sbin.slapd.bak ]; then
+			sudo mv /etc/apparmor.d/local/usr.sbin.slapd.bak /etc/apparmor.d/local/usr.sbin.slapd
+		fi
+
+		_apparmor_check sudo apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd
+	fi
+}
+
+apparmor_setup() {
+	# if apparmor is used, allow access to test directory
+	if [ "$apparmor_enabled" = true ]; then
+		_apparmor_allowdir=$1
+		if [ -z "$_apparmor_allowdir" ]; then
+			echo "no directory to allow given to apparmor_setup"
+			exit 1
+		fi
+		trap "_apparmor_cleanup" EXIT
+
+		if [ -f /etc/apparmor.d/local/usr.sbin.slapd ]; then
+			sudo mv /etc/apparmor.d/local/usr.sbin.slapd /etc/apparmor.d/local/usr.sbin.slapd.bak
+		fi
+
+		# this directory is like /etc/slapd
+		echo "allowing $_apparmor_allowdir in apparmor..."
+		echo "$_apparmor_allowdir/** kwr," >> /etc/apparmor.d/local/usr.sbin.slapd
+
+		_apparmor_check sudo apparmor_parser -W -T -r /etc/apparmor.d/usr.sbin.slapd
+	fi
+}
diff --git a/debian/tests/control b/debian/tests/control
index adad8c0..dd2e537 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -5,4 +5,4 @@ Depends:
  slapd,
  @,
  @builddeps@,
-Restrictions: allow-stderr
+Restrictions: allow-stderr, needs-sudo
diff --git a/debian/tests/startserver b/debian/tests/startserver
index 17f0ed3..3259dec 100644
--- a/debian/tests/startserver
+++ b/debian/tests/startserver
@@ -2,6 +2,10 @@
 
 set -e
 
+. debian/tests/apparmor.sh
+
+apparmor_setup ${AUTOPKGTEST_TMP}
+
 cd ${AUTOPKGTEST_TMP}
 for p in $(py3versions -s); do
     $p -c "import slapdtest; server = slapdtest.SlapdObject(); server.start(); assert server.port > 0 and server.port < 65536; server.stop()"
diff --git a/debian/tests/upstream b/debian/tests/upstream
index ec5712b..c8e1513 100644
--- a/debian/tests/upstream
+++ b/debian/tests/upstream
@@ -2,6 +2,10 @@
 
 set -e
 
+. debian/tests/apparmor.sh
+
+apparmor_setup ${AUTOPKGTEST_TMP}
+
 cp -r Tests ${AUTOPKGTEST_TMP}
 cd ${AUTOPKGTEST_TMP}
 for p in $(py3versions -s); do