Merge ~sergiodj/ubuntu/+source/sssd:merge-2.5.2-4-jammy into ubuntu/+source/sssd:debian/sid

[Sergio Durigan Junior]

This is the merge of sssd 2.5.2-4 from Debian.

This is a relatively straightforward merge. Fortunately we will be able to drop a bunch of delta we've been carrying, because Debian incorporated most of it.

There's one patch that we're still going to have to carry for a bit more which is the d/p/fix-python-tests.patch. This one hasn't been adopted by Debian because it's not a problem there yet, and eventually we will be able to drop it because it's been accepted by upstream and is part of the 2.6.0 release. I'm expecting that Debian will update sssd to this release before the end of jammy's cycle.

Aside from that, there's not much else to say. The package is getting into a better shape with each release, which is good.

There's a PPA with the proposed package here:

https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-merge/+packages

autopkgtest is still happy:

autopkgtest [20:30:44]: @@@@@@@@@@@@@@@@@@@@ summary
ldap-user-group-ldap-auth PASS
ldap-user-group-krb5-auth PASS

[Sergio Durigan Junior (sergiodj)]

Ping :-).

[Christian Ehrhardt  (paelzer)]

Putting that on my TODO-List for today ...

[Christian Ehrhardt  (paelzer)]

"The package is getting into a better shape with each release, which is good."
=> That is the right spirit :-)

* Changelog:
  - [+] old content and logical tag match as expected
  - [+] changelog entry correct version and targeted codename
  - [+] changelog entries correct
  - [x] bug references correct
        Keeping the reference to "(LP: #1910611) fully intact will ping the bug on every merge.
        please change that to e.g. LP: 1910611 to leave the bug alone.
  - [+] update-maintainer has been run

* Merge - Indirect Changes:
  - [+] no upstream changes to consider
        At https://github.com/SSSD/sssd/releases there are some removals with 2.5.0 which
        made me think, but the biggest one is the samba change which would not work with
        our recent samba anyway.
  - [+] no further upstream version to consider
        (we know 2.6 will be another step, it is good to go them one by one)
  - [+] debian changes look safe
        I wondered but 994479 didn't skip all testing, so ok

* Merge - Old Delta:
  - [+] dropped changes are ok to be dropped
  - [+] nothing else to drop (yet)
  - [+] changes forwarded upstream/debian

* New Delta:
  - [+] no new patches added

* Git/Maintenance
  - [+] commits are properly split (more important on -dev than on SRUs)

* Build/Test:
  - [+] build is ok
  - [+] verified PPA package installs/uninstalls
  - [+] autopkgtest against the PPA package passes
  - [+] sanity checks test fine

I have only had a trivial sssd install (2.5.2-4ubuntu1~ppa2) that worked fine, I assume you have tested this for real and ran the autopkgtest?

Only found the minimal nitpick in the changelog, up to you to adapt before an upload.

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Tuesday, November 02 2021, Christian Ehrhardt  wrote:

> Review: Approve

Thanks for the review, Christian.

> * Changelog:
> - [+] old content and logical tag match as expected
> - [+] changelog entry correct version and targeted codename
> - [+] changelog entries correct
> - [x] bug references correct
> Keeping the reference to "(LP: #1910611) fully intact will ping the bug on every merge.
> please change that to e.g. LP: 1910611 to leave the bug alone.

Huh, that's funny. git-ubuntu should take care of automatically
removing the colon from these bug references, but for some reason it
didn't this time. But yeah, I will remove it by hand, thanks.

> - [+] update-maintainer has been run
>
> * Merge - Indirect Changes:
> - [+] no upstream changes to consider
> At https://github.com/SSSD/sssd/releases there are some removals with 2.5.0 which
> made me think, but the biggest one is the samba change which would not work with
> our recent samba anyway.

+1

> - [+] no further upstream version to consider
> (we know 2.6 will be another step, it is good to go them one by one)

Yeah. I think Debian will merge it before the end of our cycle.

> - [+] debian changes look safe
> I wondered but 994479 didn't skip all testing, so ok
>
> * Merge - Old Delta:
> - [+] dropped changes are ok to be dropped
> - [+] nothing else to drop (yet)
> - [+] changes forwarded upstream/debian
>
> * New Delta:
> - [+] no new patches added
>
> * Git/Maintenance
> - [+] commits are properly split (more important on -dev than on SRUs)
>
> * Build/Test:
> - [+] build is ok
> - [+] verified PPA package installs/uninstalls
> - [+] autopkgtest against the PPA package passes
> - [+] sanity checks test fine
>
> I have only had a trivial sssd install (2.5.2-4ubuntu1~ppa2) that worked fine, I assume you have tested this for real and ran the autopkgtest?

Yeah, I did test it locally and ran autopkgtest as well.

> Only found the minimal nitpick in the changelog, up to you to adapt before an upload.

Thanks, I've adjusted d/changelog to remove the colon and uploaded it:

$ dput sssd_2.5.2-4ubuntu1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/sssd/sssd_2.5.2-4ubuntu1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/sssd/sssd_2.5.2-4ubuntu1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.5.2-4ubuntu1.dsc: done.
  Uploading sssd_2.5.2.orig.tar.gz: done.
  Uploading sssd_2.5.2.orig.tar.gz.asc: done.
  Uploading sssd_2.5.2-4ubuntu1.debian.tar.xz: done.
  Uploading sssd_2.5.2-4ubuntu1_source.buildinfo: done.
  Uploading sssd_2.5.2-4ubuntu1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[Christian Ehrhardt  (paelzer)]

 sssd | 2.5.2-4ubuntu1 | jammy | source, amd64, arm64, armhf, i386, ppc64el, riscv64, s390x

This is done

diff --git a/debian/changelog b/debian/changelog
index 5d77edb..8b4a535 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,32 @@
+sssd (2.5.2-4ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+      [ Incorporated by Debian.  ]
+    - Fix FTBFS with newer autoconf
+      + debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+        and PYTHON_EXEC_PREFIX in src/external/python.m4.
+      [ Incorporated by Debian. ]
+    - SECURITY UPDATE: shell command injection in sssctl comment
+      + debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+        avoid execution of user supplied command in
+        src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+        src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+      + CVE-2021-3621
+      [ Incorporated by Debian. ]
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+      [ Not needed anymore; issue does not reproduce on Jammy. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 27 Oct 2021 20:16:31 -0400
+
 sssd (2.5.2-4) unstable; urgency=medium
 
   * control: Promote libnss-sss and libpam-sss to sssd-common Depends.
@@ -40,6 +69,63 @@ sssd (2.5.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Thu, 16 Sep 2021 14:51:42 +0300
 
+sssd (2.4.1-2ubuntu4) impish; urgency=medium
+
+  * Fix FTBFS with newer autoconf
+    - debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+      and PYTHON_EXEC_PREFIX in src/external/python.m4.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 08 Sep 2021 11:39:53 -0400
+
+sssd (2.4.1-2ubuntu3) impish; urgency=medium
+
+  * SECURITY UPDATE: shell command injection in sssctl comment
+    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+      avoid execution of user supplied command in
+      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+    - CVE-2021-3621
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 18 Aug 2021 08:13:38 -0400
+
+sssd (2.4.1-2ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:09:16 -0400
+
+sssd (2.4.1-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+  * Dropped changes:
+    - d/p/condition-path-exists-sssd-conf.patch: Only start
+      sssd.service if there is a configuration file present.
+      (LP: #1900642)
+      [ Included in 2.4.1-2 ]
+    - d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+      Upstream patch to make sssd.service only able to start when there
+      is a configuration file present.  (LP #1900642)
+    - d/p/condition-path-exists-sssd-conf.patch: Remove.
+      [ Included in 2.4.1-2 ]
+    - Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP #1908065):
+      + d/p/lp-1908065-01-syslog_identifier-format.patch:
+        Upstream patch to include "sssd[]" identifier in program names.
+      + d/p/lp-1908065-02-remove-syslog_identifier.patch:
+        Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+      [ Included in 2.4.1-2 ]
+  * Added changes:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 18 May 2021 17:29:58 -0400
+
 sssd (2.4.1-2) unstable; urgency=medium
 
   [ Marco Trevisan (Treviño) ]
@@ -65,6 +151,59 @@ sssd (2.4.1-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 10 Feb 2021 11:32:35 +0200
 
+sssd (2.4.0-1ubuntu7) impish; urgency=medium
+
+  * d/control: Drop libgdm-dev Build-Depend on i386.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 May 2021 16:22:31 -0400
+
+sssd (2.4.0-1ubuntu6) hirsute; urgency=medium
+
+  * Disable lto, not ready upstream.
+
+ -- Matthias Klose <[e-mail]>  Tue, 23 Mar 2021 13:18:53 +0100
+
+sssd (2.4.0-1ubuntu5) hirsute; urgency=medium
+
+  * No change rebuild with fixed ownership.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 16 Feb 2021 15:22:14 +0000
+
+sssd (2.4.0-1ubuntu4) hirsute; urgency=medium
+
+  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
+    - d/p/lp-1908065-01-syslog_identifier-format.patch:
+      Upstream patch to include "sssd[]" identifier in program names.
+    - d/p/lp-1908065-02-remove-syslog_identifier.patch:
+      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+
+ -- Valters Jansons <[e-mail]>  Fri, 05 Feb 2021 20:51:32 +0000
+
+sssd (2.4.0-1ubuntu3) hirsute; urgency=medium
+
+  * d/apparmor-profile: Update profile. (LP: #1910611)
+    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
+    - Add read/execute permission to /usr/libexec/sssd/*.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 18 Jan 2021 16:57:21 -0500
+
+sssd (2.4.0-1ubuntu2) hirsute; urgency=medium
+
+  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+    Upstream patch to make sssd.service only able to start when there
+    is a configuration file present.  (LP: #1900642)
+  * d/p/condition-path-exists-sssd-conf.patch: Remove.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 12 Jan 2021 16:17:38 -0500
+
+sssd (2.4.0-1ubuntu1) hirsute; urgency=medium
+
+  * d/p/condition-path-exists-sssd-conf.patch: Only start
+    sssd.service if there is a configuration file present.
+    (LP: #1900642)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 10 Dec 2020 14:20:24 -0500
+
 sssd (2.4.0-1) unstable; urgency=medium
 
   * New upstream release.
diff --git a/debian/control b/debian/control
index e02837d..3fad894 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -25,7 +26,7 @@ Build-Depends:
  libcollection-dev,
  libdbus-1-dev,
  libdhash-dev,
- libgdm-dev [!s390x !kfreebsd-any !hurd-any],
+ libgdm-dev [!s390x !kfreebsd-any !hurd-any !i386],
  libglib2.0-dev,
  libini-config-dev,
  libjansson-dev,
diff --git a/debian/patches/fix-python-tests.patch b/debian/patches/fix-python-tests.patch
 new file mode 100644
index 0000000..5053f8e
--- /dev/null
+++ b/debian/patches/fix-python-tests.patch
@@ -0,0 +1,83 @@
+From: Sergio Durigan Junior <[e-mail]>
+Date: Mon, 17 May 2021 19:09:14 -0400
+Subject: Improve assertion when verifying paths for Python modules
+
+In Ubuntu we're facing a problem where the 3 Python tests under
+src/tests/*-test.py are failing due to cosmetical differences between
+what the '.__file__' method returns and what 'MODPATH' ends up being.
+
+I have not been able to pinpoint exactly what is causing this issue;
+it only happens when SSSD is built inside a chroot environment (with
+sbuild, for example).  The logs look like this:
+
+F
+======================================================================
+FAIL: testImport (__main__.PyHbacImport)
+Import the module and assert it comes from tree
+----------------------------------------------------------------------
+Traceback (most recent call last):
+  File "/<<PKGBUILDDIR>>/src/tests/pyhbac-test.py", line 91, in testImport
+    self.assertEqual(pyhbac.__file__, MODPATH + "/pyhbac.so")
+AssertionError: '/<<PKGBUILDDIR>>/build/./tp_pyhbac_xw2omut2/pyhbac.so' != './tp_pyhbac_xw2omut2/pyhbac.so'
+- /<<PKGBUILDDIR>>/build/./tp_pyhbac_xw2omut2/pyhbac.so
++ ./tp_pyhbac_xw2omut2/pyhbac.so
+
+Given that the intention of the test is to verify that the two paths
+are equal, I suggest that we do this slight improvement and call
+'os.path.realpath' before comparing both paths.  This way we guarantee
+that they're both properly canonicalized.
+
+I have verified that the tests still pass with this change.
+
+Signed-off-by: Sergio Durigan Junior <[e-mail]>
+
+Forwarded: yes, https://github.com/SSSD/sssd/pull/5636
+Last-Updated: 2021-05-18
+---
+ src/tests/pyhbac-test.py       | 3 ++-
+ src/tests/pysss-test.py        | 3 ++-
+ src/tests/pysss_murmur-test.py | 3 ++-
+ 3 files changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/src/tests/pyhbac-test.py b/src/tests/pyhbac-test.py
+index 06163af..c8ce47f 100755
+--- a/src/tests/pyhbac-test.py
++++ b/src/tests/pyhbac-test.py
+@@ -88,7 +88,8 @@ class PyHbacImport(unittest.TestCase):
+             print("Could not load the pyhbac module. Please check if it is "
+                   "compiled", file=sys.stderr)
+             raise e
+-        self.assertEqual(pyhbac.__file__, MODPATH + "/pyhbac.so")
++        self.assertEqual(os.path.realpath(pyhbac.__file__),
++                         os.path.realpath(MODPATH + "/pyhbac.so"))
+ 
+ 
+ class PyHbacRuleElementTest(unittest.TestCase):
+diff --git a/src/tests/pysss-test.py b/src/tests/pysss-test.py
+index 30bc074..20ef0ab 100755
+--- a/src/tests/pysss-test.py
++++ b/src/tests/pysss-test.py
+@@ -58,7 +58,8 @@ class PysssImport(unittest.TestCase):
+             print("Could not load the pysss module. Please check if it is "
+                   "compiled", file=sys.stderr)
+             raise ex
+-        self.assertEqual(pysss.__file__, MODPATH + "/pysss.so")
++        self.assertEqual(os.path.realpath(pysss.__file__),
++                         os.path.realpath(MODPATH + "/pysss.so"))
+ 
+ 
+ class PysssEncryptTest(unittest.TestCase):
+diff --git a/src/tests/pysss_murmur-test.py b/src/tests/pysss_murmur-test.py
+index 531f8b5..75b4651 100755
+--- a/src/tests/pysss_murmur-test.py
++++ b/src/tests/pysss_murmur-test.py
+@@ -59,7 +59,8 @@ class PySssMurmurImport(unittest.TestCase):
+             print("Could not load the pysss_murmur module. "
+                   "Please check if it is compiled", file=sys.stderr)
+             raise e
+-        self.assertEqual(pysss_murmur.__file__, MODPATH + "/pysss_murmur.so")
++        self.assertEqual(os.path.realpath(pysss_murmur.__file__),
++                         os.path.realpath(MODPATH + "/pysss_murmur.so"))
+ 
+ 
+ class PySssMurmurTestNeg(unittest.TestCase):
diff --git a/debian/patches/series b/debian/patches/series
index 66b6f6e..21183b7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -3,3 +3,4 @@ default-to-socket-activated-services.diff
 fix_newer_autoconf.patch
 0001-TOOLS-replace-system-with-execvp-to-avoid-execution-.patch
 0001-ad-fallback-to-ldap-if-cldap-is-not-available-in-lib.patch
+fix-python-tests.patch
diff --git a/debian/rules b/debian/rules
index 2adb804..c2251b3 100755
--- a/debian/rules
+++ b/debian/rules
@@ -3,6 +3,8 @@
 	dh $@ --with python3 \
 		--builddirectory=build
 
+export DEB_BUILD_MAINT_OPTIONS = optimize=-lto
+
 DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk