Merge ~sergiodj/ubuntu/+source/sssd:merge-2.7.1-2-kinetic into ubuntu/+source/sssd:debian/sid

[Sergio Durigan Junior]

This is the merge of sssd 2.7.1-2 from Debian unstable.

The merge itself was simple, and we're actually able to even drop one of our deltas (the LTO one). The rest of our delta is very Ubuntu-specific and I don't see us getting rid of it anytime soon, but it's also very easy to maintain.

This new upstream release fixes a bunch of bugs, including one that I reported to upstream a while ago and is causing authentication failures (see bug #1934997). I looked at the current list of bugs for the package and couldn't find anything else that may be fixed by this new release.

There was a problem with version 2.7.1-1 (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012502) but that's been fixed by 2.7.1-2 which backports an upstream patch (https://github.com/SSSD/sssd/pull/6204). This should be part of the next minor release.

There's a PPA with the proposed changes here:

https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-merge/+packages

The builds are still running. Once they finish, I'll trigger autopkgtests and post the results here.

[Sergio Durigan Junior (sergiodj)]

Hm, the i386 build has failed due to missing dependencies. sssd unfortunately has this problem... I will check with the AA and see if it's possible to include those deps on i386.

[Sergio Durigan Junior (sergiodj)]

Status update: the new sssd introduces a new binary package called sssd-idp, which provides Kerberos plugins that are required to enable authentication against external identity providers. It also provides a helper program to handle the OAuth 2.0 Device Authorization Grant is provided.

This new binary package requires a few more Build-Dependends to be built:

- libcurl4-openssl-dev
- libjose-dev
- libkrad-dev

Of those, only libjose-dev isn't available on i386, and that's what's causing the FTBFS right now. I pinged vorlon on IRC and asked him if it's possible to add the jose package to i386, given that jose's build dependencies are all available on i386, and the fact that this is not the first time this i386 conundrun has happened.

I'm waiting on his reply to proceed with this MP.

I also think it's important to mention that this new binary package, once accepted, will land in universe. I talked to Andreas in private and we think that it should be fine to keep sssd-idp in universe for this cycle while we gather more information about its role in the bigger sssd picture. We can certainly revisit this next cycle and consider doing an MRI for it.

[Sergio Durigan Junior (sergiodj)]

<vorlon> | sergiodj: I would prefer you do the upload first so we can see via update_excuses what needs to be done and follow through

Therefore, I'm marking this MP as Needs Review again. Bear in mind that the build is currently failing on i386.

[Andreas Hasenack (ahasenack)]

I'll grab this

[Andreas Hasenack (ahasenack)]

> I talked to Andreas in private and we think that it should be fine to keep sssd-idp in universe
> for this cycle

Just reiterating this. Check out these upstream release notes about sssd-idp[1]:
"""
Added a new krb5 plugin idp and a new binary oidc_child which performs OAuth2 authentication against FreeIPA. This, however, can not be tested yet because this feature is still under development on the FreeIPA server side. Nevertheless, we have decided to include this in the release in order to enable the functionality on the clients immediately when the FreeIPA project delivers this feature without the need to update the clients.
"""

1. https://sssd.io/release-notes/sssd-2.7.0.html

[Andreas Hasenack (ahasenack)]

I think you can merge these two commits. Usually in logical, but if you want to do it now on top of debian/sid that's also fine:

commit d36036c652ab62d942eb2a8f8fa800fea6a78e3e
Author: Sergio Durigan Junior <email address hidden>
Date: Mon Feb 14 16:16:18 2022 -0500

        - Remember how architecture lists in debian/control work.

commit 0d33597c0bec4a96959d9a770b7d2681707ab8e9
Author: Sergio Durigan Junior <email address hidden>
Date: Mon Feb 14 16:15:29 2022 -0500

        - d/control: Don't build sssd-tools on i386, now uninstallable due
          to added python3-{click,systemd} dependencies.

DEP8 tests look good as well. I'm unsure what vorlon expects to see after the upload, since i386 won't build, and thus won't migrate.

+1

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Monday, June 20 2022, Andreas Hasenack wrote:

> Review: Approve

Thanks for the review, Andreas.

> I think you can merge these two commits. Usually in logical, but if you want to do it now on top of debian/sid that's also fine:
>
> commit d36036c652ab62d942eb2a8f8fa800fea6a78e3e
> Author: Sergio Durigan Junior <email address hidden>
> Date: Mon Feb 14 16:16:18 2022 -0500
>
> - Remember how architecture lists in debian/control work.
>
> commit 0d33597c0bec4a96959d9a770b7d2681707ab8e9
> Author: Sergio Durigan Junior <email address hidden>
> Date: Mon Feb 14 16:15:29 2022 -0500
>
> - d/control: Don't build sssd-tools on i386, now uninstallable due
> to added python3-{click,systemd} dependencies.
>

Done, thanks.

> DEP8 tests look good as well. I'm unsure what vorlon expects to see after the upload, since i386 won't build, and thus won't migrate.

Uploaded:

$ dput sssd_2.7.1-2ubuntu1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/sssd/sssd_2.7.1-2ubuntu1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/sssd/sssd_2.7.1-2ubuntu1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.7.1-2ubuntu1.dsc: done.
  Uploading sssd_2.7.1.orig.tar.gz: done.
  Uploading sssd_2.7.1.orig.tar.gz.asc: done.
  Uploading sssd_2.7.1-2ubuntu1.debian.tar.xz: done.
  Uploading sssd_2.7.1-2ubuntu1_source.buildinfo: done.
  Uploading sssd_2.7.1-2ubuntu1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, ahasenack
Uploaders: sergiodj, ahasenack
MP auto-approved

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 0aeea88..ea630cd 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,15 @@
+sssd (2.7.1-2ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971327, #1934997). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes:
+    - d/rules: Disable lto, not ready upstream.
+    [ Incorporated by Debian ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 14 Jun 2022 16:59:20 -0400
+
 sssd (2.7.1-2) unstable; urgency=medium
 
   * pac-relax-default-for-pac_check-option.diff: Drop pac_present from
@@ -40,6 +52,31 @@ sssd (2.6.3-2) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Tue, 29 Mar 2022 10:04:50 +0300
 
+sssd (2.6.3-1ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild with new samba 4.15.5
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 24 Feb 2022 08:55:08 -0300
+
+sssd (2.6.3-1ubuntu2) jammy; urgency=medium
+
+  * No-change rebuild with new libnfsidmap from src:nfs-utils
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 Feb 2022 10:57:41 -0300
+
+sssd (2.6.3-1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - d/rules: Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes, picked by Debian:
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 14 Feb 2022 16:21:21 -0500
+
 sssd (2.6.3-1) unstable; urgency=medium
 
   * New upstream release.
@@ -51,6 +88,40 @@ sssd (2.6.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Fri, 11 Feb 2022 09:35:43 +0200
 
+sssd (2.6.1-1ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild with Python 3.10 as default version
+
+ -- Graham Inggs <[e-mail]>  Sun, 16 Jan 2022 15:13:06 +0000
+
+sssd (2.6.1-1ubuntu3) jammy; urgency=medium
+
+  * Remember how architecture lists in debian/control work.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 23:12:51 +0000
+
+sssd (2.6.1-1ubuntu2) jammy; urgency=medium
+
+  * Don't build sssd-tools on i386, now uninstallable due to added
+    python3-{click,systemd} dependencies.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 21:50:00 +0000
+
+sssd (2.6.1-1ubuntu1) jammy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+  * Dropped changes, included upstream:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes, included in Debian:
+    - debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Steve Langasek <[e-mail]>  Fri, 10 Dec 2021 10:29:16 -0800
+
 sssd (2.6.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -67,6 +138,54 @@ sssd (2.5.2-5) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Mon, 08 Nov 2021 21:17:29 +0200
 
+sssd (2.5.2-4ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild against libssl3
+
+ -- Steve Langasek <[e-mail]>  Thu, 09 Dec 2021 00:19:23 +0000
+
+sssd (2.5.2-4ubuntu3) jammy; urgency=medium
+
+  * Remove RANDFILE from the config template. It's no longer necessary and
+    breaks with openssl 3.0.
+
+ -- Rico Tzschichholz <[e-mail]>  Tue, 23 Nov 2021 20:19:07 +0100
+
+sssd (2.5.2-4ubuntu2) jammy; urgency=medium
+
+  * debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Rico Tzschichholz <[e-mail]>  Mon, 22 Nov 2021 20:51:36 +0100
+
+sssd (2.5.2-4ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+      [ Incorporated by Debian.  ]
+    - Fix FTBFS with newer autoconf
+      + debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+        and PYTHON_EXEC_PREFIX in src/external/python.m4.
+      [ Incorporated by Debian. ]
+    - SECURITY UPDATE: shell command injection in sssctl comment
+      + debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+        avoid execution of user supplied command in
+        src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+        src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+      + CVE-2021-3621
+      [ Incorporated by Debian. ]
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+      [ Not needed anymore; issue does not reproduce on Jammy. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 27 Oct 2021 20:16:31 -0400
+
 sssd (2.5.2-4) unstable; urgency=medium
 
   * control: Promote libnss-sss and libpam-sss to sssd-common Depends.
@@ -109,6 +228,63 @@ sssd (2.5.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Thu, 16 Sep 2021 14:51:42 +0300
 
+sssd (2.4.1-2ubuntu4) impish; urgency=medium
+
+  * Fix FTBFS with newer autoconf
+    - debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+      and PYTHON_EXEC_PREFIX in src/external/python.m4.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 08 Sep 2021 11:39:53 -0400
+
+sssd (2.4.1-2ubuntu3) impish; urgency=medium
+
+  * SECURITY UPDATE: shell command injection in sssctl comment
+    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+      avoid execution of user supplied command in
+      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+    - CVE-2021-3621
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 18 Aug 2021 08:13:38 -0400
+
+sssd (2.4.1-2ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:09:16 -0400
+
+sssd (2.4.1-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+  * Dropped changes:
+    - d/p/condition-path-exists-sssd-conf.patch: Only start
+      sssd.service if there is a configuration file present.
+      (LP: #1900642)
+      [ Included in 2.4.1-2 ]
+    - d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+      Upstream patch to make sssd.service only able to start when there
+      is a configuration file present.  (LP #1900642)
+    - d/p/condition-path-exists-sssd-conf.patch: Remove.
+      [ Included in 2.4.1-2 ]
+    - Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP #1908065):
+      + d/p/lp-1908065-01-syslog_identifier-format.patch:
+        Upstream patch to include "sssd[]" identifier in program names.
+      + d/p/lp-1908065-02-remove-syslog_identifier.patch:
+        Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+      [ Included in 2.4.1-2 ]
+  * Added changes:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 18 May 2021 17:29:58 -0400
+
 sssd (2.4.1-2) unstable; urgency=medium
 
   [ Marco Trevisan (Treviño) ]
@@ -134,6 +310,59 @@ sssd (2.4.1-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 10 Feb 2021 11:32:35 +0200
 
+sssd (2.4.0-1ubuntu7) impish; urgency=medium
+
+  * d/control: Drop libgdm-dev Build-Depend on i386.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 May 2021 16:22:31 -0400
+
+sssd (2.4.0-1ubuntu6) hirsute; urgency=medium
+
+  * Disable lto, not ready upstream.
+
+ -- Matthias Klose <[e-mail]>  Tue, 23 Mar 2021 13:18:53 +0100
+
+sssd (2.4.0-1ubuntu5) hirsute; urgency=medium
+
+  * No change rebuild with fixed ownership.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 16 Feb 2021 15:22:14 +0000
+
+sssd (2.4.0-1ubuntu4) hirsute; urgency=medium
+
+  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
+    - d/p/lp-1908065-01-syslog_identifier-format.patch:
+      Upstream patch to include "sssd[]" identifier in program names.
+    - d/p/lp-1908065-02-remove-syslog_identifier.patch:
+      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+
+ -- Valters Jansons <[e-mail]>  Fri, 05 Feb 2021 20:51:32 +0000
+
+sssd (2.4.0-1ubuntu3) hirsute; urgency=medium
+
+  * d/apparmor-profile: Update profile. (LP: #1910611)
+    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
+    - Add read/execute permission to /usr/libexec/sssd/*.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 18 Jan 2021 16:57:21 -0500
+
+sssd (2.4.0-1ubuntu2) hirsute; urgency=medium
+
+  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+    Upstream patch to make sssd.service only able to start when there
+    is a configuration file present.  (LP: #1900642)
+  * d/p/condition-path-exists-sssd-conf.patch: Remove.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 12 Jan 2021 16:17:38 -0500
+
+sssd (2.4.0-1ubuntu1) hirsute; urgency=medium
+
+  * d/p/condition-path-exists-sssd-conf.patch: Only start
+    sssd.service if there is a configuration file present.
+    (LP: #1900642)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 10 Dec 2020 14:20:24 -0500
+
 sssd (2.4.0-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1203,3 +1432,4 @@ sssd (0.5.0-0ubuntu1) karmic; urgency=low
   * Initial release.
 
  -- Mathias Gug <[e-mail]>  Mon, 24 Aug 2009 16:35:11 -0400
+
diff --git a/debian/control b/debian/control
index 7fdf6ff..4a8fc74 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -26,7 +27,7 @@ Build-Depends:
  libcurl4-openssl-dev,
  libdbus-1-dev,
  libdhash-dev,
- libgdm-dev [!s390x !kfreebsd-any !hurd-any],
+ libgdm-dev [!s390x !kfreebsd-any !hurd-any !i386],
  libglib2.0-dev,
  libini-config-dev,
  libjansson-dev,
@@ -228,7 +229,7 @@ Description: System Security Services Daemon -- proxy back end
  PAM modules to leverage SSSD caching.
 
 Package: sssd-tools
-Architecture: any
+Architecture: amd64 arm64 armhf ppc64el riscv64 s390x
 Depends:
  python3,
  python3-sss,