Merge ~sergiodj/ubuntu/+source/sssd:merge-2.9.2-1-noble into ubuntu/+source/sssd:debian/sid

[Sergio Durigan Junior]

This is the merge of sssd 2.9.2-1 from Debian unstable.

Another trivial merge. The only manual thing I did was to edit one commit message to make it easier to run "git ubuntu merge finish".

PPA: https://launchpad.net/~sergiodj/+archive/ubuntu/sssd-merge

dep8 results pending.

[Sergio Durigan Junior (sergiodj)]

This is now ready to be reviewed.

[Andreas Hasenack (ahasenack)]

I'll take it

[Andreas Hasenack (ahasenack)]

- delta ok
- tags ok
- debian changes ok (smart card updates, including dep8 tests, and build-time tests re-enabled)
- new upstream changes ok

The new DEP8 tests are using a restriction unknown to the ubuntu test runners, though:

597s sssd-softhism2-certificates-tests SKIP unknown restriction needs-sudo
597s sssd-smart-card-pam-auth-configs SKIP unknown restriction needs-sudo

We might want to add a delta for that. Let them run as root, and see where in the code they should run as non-root and make changes if necessary. Given that sssd is subject to some complex SRUs sometimes, I think we should get these tests running in Ubuntu.

review: Needs Fixing

[Sergio Durigan Junior (sergiodj)]

That's a good catch, thanks. I will work on the delta.

d1fd884... by Sergio Durigan Junior on 2024-01-17

  * Add changes:
    - d/t/control: Remove "needs-sudo" restriction from smartcard tests,
      replace with "needs-root". This is needed because Ubuntu's
      autopkgtest infrastructure doesn't support "needs-sudo".
    - d/t/sssd-smart-card-pam-auth-configs-tester.sh,
      d/t/sssd-softhism2-certificates-tests.sh: Add code to handle
      ${AUTOPKGTEST_NORMAL_USER}.

[Sergio Durigan Junior (sergiodj)]

I've analysed the script and noticed that they don't actually invoke sudo; instead, it seems to me that they're using "needs-sudo" because it's easier than using "needs-root" and having to handle AUTOPKGTEST_NORMAL_USER. So I've adjusted them to use needs-root instead, and they're passing.

I'm going to submit this change to Debian, and I'm also building a new version of the package so that I can run the dep8 tests again. Meanwhile, feel free to review what I did.

Thanks.

[Andreas Hasenack (ahasenack)]

Thanks, looks good. I would just add something to the commit (and/or changelog) saying why we are switching to needs-root (because ubuntu's dep8 infra does not support needs-sudo yet).

If the tests pass, +1

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: sergiodj, ahasenack
Uploaders: sergiodj, ahasenack
MP auto-approved

review: Approve

[Sergio Durigan Junior (sergiodj)]

On Wednesday, January 17 2024, Andreas Hasenack wrote:

> Review: Approve
>
> Thanks, looks good. I would just add something to the commit (and/or changelog) saying why we are switching to needs-root (because ubuntu's dep8 infra does not support needs-sudo yet).
>
> If the tests pass, +1

Thanks, Andreas.

Commit message adjusted. dep8 tests passed:

Results: (from http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/?format=plain)
  sssd @ amd64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/noble/amd64/s/sssd/20240118_013412_75d9a@/log.gz
    18.01.24 01:34:12 ✅ Triggers: sssd/2.9.2-1ubuntu1~ppa2
  sssd @ arm64:
    http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/noble/arm64/s/sssd/20240118_013352_b1e90@/log.gz
    18.01.24 01:33:52 ✅ Triggers: sssd/2.9.2-1ubuntu1~ppa2
  sssd @ armhf:
    http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/noble/armhf/s/sssd/20240118_012420_26483@/log.gz
    18.01.24 01:24:20 ✅ Triggers: sssd/2.9.2-1ubuntu1~ppa2
  sssd @ ppc64el:
    http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/noble/ppc64el/s/sssd/20240118_013335_b1e90@/log.gz
    18.01.24 01:33:35 ✅ Triggers: sssd/2.9.2-1ubuntu1~ppa2
  sssd @ s390x:
    http://autopkgtest.ubuntu.com/results/autopkgtest-noble-sergiodj-sssd-merge/noble/s390x/s/sssd/20240118_014023_75d9a@/log.gz
    18.01.24 01:40:23 ✅ Triggers: sssd/2.9.2-1ubuntu1~ppa2

Therefore, uploaded:

$ dput sssd_2.9.2-1ubuntu1_source.changes
Trying to upload package to ubuntu
Checking signature on .changes
gpg: /home/sergio/work/sssd/sssd_2.9.2-1ubuntu1_source.changes: Valid signature from 106DA1C8C3CBBF14
Checking signature on .dsc
gpg: /home/sergio/work/sssd/sssd_2.9.2-1ubuntu1.dsc: Valid signature from 106DA1C8C3CBBF14
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading sssd_2.9.2-1ubuntu1.dsc: done.
  Uploading sssd_2.9.2.orig.tar.gz: done.
  Uploading sssd_2.9.2.orig.tar.gz.asc: done.
  Uploading sssd_2.9.2-1ubuntu1.debian.tar.xz: done.
  Uploading sssd_2.9.2-1ubuntu1_source.buildinfo: done.
  Uploading sssd_2.9.2-1ubuntu1_source.changes: done.
Successfully uploaded packages.

--
Sergio
GPG key ID: E92F D0B3 6B14 F1F4 D8E0 EB2F 106D A1C8 C3CB BF14

diff --git a/debian/apparmor-profile b/debian/apparmor-profile
index fadfa6c..7491662 100644
--- a/debian/apparmor-profile
+++ b/debian/apparmor-profile
@@ -4,6 +4,7 @@
   #include <abstractions/base>
   #include <abstractions/kerberosclient>
   #include <abstractions/nameservice>
+  #include <abstractions/openssl>
   #include <abstractions/user-tmp>
 
   capability chown,
@@ -16,6 +17,7 @@
   capability sys_resource,
 
   @{PROC} r,
+  @{PROC}/[0-9]*/cmdline r,
   @{PROC}/[0-9]*/net/psched r,
   @{PROC}/[0-9]*/status r,
 
@@ -42,7 +44,7 @@
   /var/lib/sss/* rw,
   /var/lib/sss/db/* rwk,
   /var/lib/sss/gpo_cache/* rw,
-  /var/lib/sss/mc/* rw,
+  /var/lib/sss/mc/* rwk,
   /var/lib/sss/pipes/* rw,
   /var/lib/sss/pipes/private/* rw,
   /var/lib/sss/pubconf/* rw,
@@ -53,6 +55,7 @@
 
   /{,var/}run/sssd.pid rw,
   /{,var/}run/systemd/notify w,
+  /{,var/}run/systemd/users/* r,
 
   # Site-specific additions and overrides. See local/README for details.
   #include <local/usr.sbin.sssd>
diff --git a/debian/changelog b/debian/changelog
index 52a5d97..ab3ba9b 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,22 @@
+sssd (2.9.2-1ubuntu1) noble; urgency=medium
+
+  * Merge with Debian unstable (LP: #2040429). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+    - d/apparmor-profile: Add some entries to apparmor-profile file
+      to get rid of the extraneous ALLOWED messages visible in the
+      /var/log/syslog. (LP #1999190)
+  * Add changes:
+    - d/t/control: Remove "needs-sudo" restriction from smartcard tests,
+      replace with "needs-root".  This is needed because Ubuntu's
+      autopkgtest infrastructure doesn't support "needs-sudo".
+    - d/t/sssd-smart-card-pam-auth-configs-tester.sh,
+      d/t/sssd-softhism2-certificates-tests.sh: Add code to handle
+      ${AUTOPKGTEST_NORMAL_USER}.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 03 Jan 2024 11:20:10 -0500
+
 sssd (2.9.2-1) unstable; urgency=medium
 
   [ Timo Aaltonen ]
@@ -10,6 +29,29 @@ sssd (2.9.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Fri, 15 Sep 2023 11:18:38 +0300
 
+sssd (2.9.1-2ubuntu3) noble; urgency=medium
+
+  * Rebuild against latest libunistring
+
+ -- Jeremy Bícha <[e-mail]>  Fri, 27 Oct 2023 11:05:49 -0400
+
+sssd (2.9.1-2ubuntu2) mantic; urgency=medium
+
+  * d/apparmor-profile: Add some entries to apparmor-profile file
+    to get rid of the extraneous ALLOWED messages visible in the
+    /var/log/syslog. (LP: #1999190)
+
+ -- Michal Maloszewski <[e-mail]>  Wed, 04 Oct 2023 16:58:26 +0200
+
+sssd (2.9.1-2ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2028722). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 26 Jul 2023 16:04:29 -0400
+
 sssd (2.9.1-2) unstable; urgency=medium
 
   [ Sergio Durigan Junior ]
@@ -23,6 +65,19 @@ sssd (2.9.1-2) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Tue, 25 Jul 2023 15:01:14 +0300
 
+sssd (2.9.1-1ubuntu1) mantic; urgency=medium
+
+  * Merge with Debian unstable (LP: #2018112). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Drop change:
+    - d/rules: Fix 'find' syntax to remove '*.egg-info'
+      files/directories.
+      [ Incorporated by Debian. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 Jul 2023 14:48:14 -0400
+
 sssd (2.9.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -76,6 +131,30 @@ sssd (2.8.1-2) unstable; urgency=medium
 
  -- Sergio Durigan Junior <[e-mail]>  Tue, 03 Jan 2023 16:36:00 -0500
 
+sssd (2.8.1-1ubuntu1) lunar; urgency=medium
+
+  * Merge with Debian unstable (LP: #1993448). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Drop changes:
+    - Revert dh_nss usage; the feature is still being polished.
+      + d/control: Don't Build-Depend on dh-sequence-installnss.
+      + d/libnss-sss.nss: Remove file.
+      + d/libnss-sss.postinst: Revert changes to use dh-nss.
+      + d/libnss-sss.postrm: Likewise.
+      [ Fixed in Debian. ]
+    - d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
+      variables in "main" functions, preventing inadvertent changes in
+      p11_child.log file permissions. (LP #1989356)
+      [ Incorporated by upstream. ]
+  * Add changes:
+    - d/rules: Fix 'find' syntax to remove '*.egg-info'
+      files/directories.
+      [ Submitted to Debian. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 03 Jan 2023 16:42:10 -0500
+
 sssd (2.8.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -99,6 +178,41 @@ sssd (2.7.4-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Thu, 22 Sep 2022 15:34:06 +0300
 
+sssd (2.7.3-2ubuntu4) lunar; urgency=medium
+
+  * No-change rebuild with Python 3.11 as default
+
+ -- Graham Inggs <[e-mail]>  Tue, 27 Dec 2022 03:42:49 +0000
+
+sssd (2.7.3-2ubuntu3) lunar; urgency=medium
+
+  * No-change rebuild against libldap-2
+
+ -- Steve Langasek <[e-mail]>  Thu, 15 Dec 2022 19:56:34 +0000
+
+sssd (2.7.3-2ubuntu2) kinetic; urgency=medium
+
+  * d/p/initialize-uid-gid-main-functions.patch: Initialize UID/GID
+    variables in "main" functions, preventing inadvertent changes in
+    p11_child.log file permissions. (LP: #1989356)
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 04 Oct 2022 19:00:49 -0400
+
+sssd (2.7.3-2ubuntu1) kinetic; urgency=medium
+    
+  * Merge with Debian unstable (LP: #1987348, #1988615). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Add changes:
+    - Revert dh_nss usage; the feature is still being polished.
+      + d/control: Don't Build-Depend on dh-sequence-installnss.
+      + d/libnss-sss.nss: Remove file.
+      + d/libnss-sss.postinst: Revert changes to use dh-nss.
+      + d/libnss-sss.postrm: Likewise.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 06 Sep 2022 13:56:06 -0400
+
 sssd (2.7.3-2) unstable; urgency=medium
 
   [ Timo Aaltonen ]
@@ -118,6 +232,15 @@ sssd (2.7.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 06 Jul 2022 08:52:58 +0300
 
+sssd (2.7.2-3ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 23 Jun 2022 14:03:54 -0400
+
 sssd (2.7.2-3) unstable; urgency=medium
 
   * d/p/fix-shebang-on-sss_analyze.patch: Fix shebang on sss_analyze.
@@ -137,6 +260,18 @@ sssd (2.7.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 22 Jun 2022 13:19:27 +0300
 
+sssd (2.7.1-2ubuntu1) kinetic; urgency=medium
+
+  * Merge with Debian unstable (LP: #1971327, #1934997). Remaining changes:
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes:
+    - d/rules: Disable lto, not ready upstream.
+    [ Incorporated by Debian ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 14 Jun 2022 16:59:20 -0400
+
 sssd (2.7.1-2) unstable; urgency=medium
 
   * pac-relax-default-for-pac_check-option.diff: Drop pac_present from
@@ -179,6 +314,31 @@ sssd (2.6.3-2) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Tue, 29 Mar 2022 10:04:50 +0300
 
+sssd (2.6.3-1ubuntu3) jammy; urgency=medium
+
+  * No-change rebuild with new samba 4.15.5
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 24 Feb 2022 08:55:08 -0300
+
+sssd (2.6.3-1ubuntu2) jammy; urgency=medium
+
+  * No-change rebuild with new libnfsidmap from src:nfs-utils
+
+ -- Andreas Hasenack <[e-mail]>  Thu, 17 Feb 2022 10:57:41 -0300
+
+sssd (2.6.3-1ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - d/rules: Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/control: Don't build sssd-tools on i386, now uninstallable due
+      to added python3-{click,systemd} dependencies.
+  * Dropped changes, picked by Debian:
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 14 Feb 2022 16:21:21 -0500
+
 sssd (2.6.3-1) unstable; urgency=medium
 
   * New upstream release.
@@ -190,6 +350,40 @@ sssd (2.6.3-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Fri, 11 Feb 2022 09:35:43 +0200
 
+sssd (2.6.1-1ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild with Python 3.10 as default version
+
+ -- Graham Inggs <[e-mail]>  Sun, 16 Jan 2022 15:13:06 +0000
+
+sssd (2.6.1-1ubuntu3) jammy; urgency=medium
+
+  * Remember how architecture lists in debian/control work.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 23:12:51 +0000
+
+sssd (2.6.1-1ubuntu2) jammy; urgency=medium
+
+  * Don't build sssd-tools on i386, now uninstallable due to added
+    python3-{click,systemd} dependencies.
+
+ -- Steve Langasek <[e-mail]>  Fri, 17 Dec 2021 21:50:00 +0000
+
+sssd (2.6.1-1ubuntu1) jammy; urgency=low
+
+  * Merge from Debian unstable. Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - Remove RANDFILE from the config template. It's no longer necessary and
+      breaks with openssl 3.0.
+  * Dropped changes, included upstream:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes, included in Debian:
+    - debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Steve Langasek <[e-mail]>  Fri, 10 Dec 2021 10:29:16 -0800
+
 sssd (2.6.1-1) unstable; urgency=medium
 
   * New upstream release.
@@ -206,6 +400,54 @@ sssd (2.5.2-5) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Mon, 08 Nov 2021 21:17:29 +0200
 
+sssd (2.5.2-4ubuntu4) jammy; urgency=medium
+
+  * No-change rebuild against libssl3
+
+ -- Steve Langasek <[e-mail]>  Thu, 09 Dec 2021 00:19:23 +0000
+
+sssd (2.5.2-4ubuntu3) jammy; urgency=medium
+
+  * Remove RANDFILE from the config template. It's no longer necessary and
+    breaks with openssl 3.0.
+
+ -- Rico Tzschichholz <[e-mail]>  Tue, 23 Nov 2021 20:19:07 +0100
+
+sssd (2.5.2-4ubuntu2) jammy; urgency=medium
+
+  * debian/control: Switch to libsemanage-dev from libsemanage1-dev
+
+ -- Rico Tzschichholz <[e-mail]>  Mon, 22 Nov 2021 20:51:36 +0100
+
+sssd (2.5.2-4ubuntu1) jammy; urgency=medium
+
+  * Merge with Debian unstable (LP: #1946904). Remaining changes:
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+  * Dropped changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+      [ Incorporated by Debian.  ]
+    - Fix FTBFS with newer autoconf
+      + debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+        and PYTHON_EXEC_PREFIX in src/external/python.m4.
+      [ Incorporated by Debian. ]
+    - SECURITY UPDATE: shell command injection in sssctl comment
+      + debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+        avoid execution of user supplied command in
+        src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+        src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+      + CVE-2021-3621
+      [ Incorporated by Debian. ]
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+      [ Not needed anymore; issue does not reproduce on Jammy. ]
+
+ -- Sergio Durigan Junior <[e-mail]>  Wed, 27 Oct 2021 20:16:31 -0400
+
 sssd (2.5.2-4) unstable; urgency=medium
 
   * control: Promote libnss-sss and libpam-sss to sssd-common Depends.
@@ -248,6 +490,63 @@ sssd (2.5.2-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Thu, 16 Sep 2021 14:51:42 +0300
 
+sssd (2.4.1-2ubuntu4) impish; urgency=medium
+
+  * Fix FTBFS with newer autoconf
+    - debian/patches/fix_newer_autoconf.patch: do not unset PYTHON_PREFIX
+      and PYTHON_EXEC_PREFIX in src/external/python.m4.
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 08 Sep 2021 11:39:53 -0400
+
+sssd (2.4.1-2ubuntu3) impish; urgency=medium
+
+  * SECURITY UPDATE: shell command injection in sssctl comment
+    - debian/patches/CVE-2021-3621.patch: replace system() with execvp() to
+      avoid execution of user supplied command in
+      src/tools/sssctl/sssctl.c, src/tools/sssctl/sssctl.h,
+      src/tools/sssctl/sssctl_data.c, src/tools/sssctl/sssctl_logs.c.
+    - CVE-2021-3621
+
+ -- Marc Deslauriers <[e-mail]>  Wed, 18 Aug 2021 08:13:38 -0400
+
+sssd (2.4.1-2ubuntu2) impish; urgency=medium
+
+  * No-change rebuild due to OpenLDAP soname bump.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 21 Jun 2021 18:09:16 -0400
+
+sssd (2.4.1-2ubuntu1) impish; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - d/apparmor-profile: Update profile. (LP #1910611)
+      + Extend read permissions to /etc/sssd/** and /etc/gss/**.
+      + Add read/execute permission to /usr/libexec/sssd/*.
+    - Disable lto, not ready upstream.
+    - d/control: Drop libgdm-dev Build-Depend on i386.
+  * Dropped changes:
+    - d/p/condition-path-exists-sssd-conf.patch: Only start
+      sssd.service if there is a configuration file present.
+      (LP: #1900642)
+      [ Included in 2.4.1-2 ]
+    - d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+      Upstream patch to make sssd.service only able to start when there
+      is a configuration file present.  (LP #1900642)
+    - d/p/condition-path-exists-sssd-conf.patch: Remove.
+      [ Included in 2.4.1-2 ]
+    - Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP #1908065):
+      + d/p/lp-1908065-01-syslog_identifier-format.patch:
+        Upstream patch to include "sssd[]" identifier in program names.
+      + d/p/lp-1908065-02-remove-syslog_identifier.patch:
+        Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+      [ Included in 2.4.1-2 ]
+  * Added changes:
+    - d/p/fix-python-tests.patch: Fix Python tests by making them
+      assert Python module paths by using full pathnames.
+    - d/p/disable-fail_over-tests.patch: Disable fail_over-tests,
+      which is failing when running inside sbuild.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 18 May 2021 17:29:58 -0400
+
 sssd (2.4.1-2) unstable; urgency=medium
 
   [ Marco Trevisan (Treviño) ]
@@ -273,6 +572,59 @@ sssd (2.4.1-1) unstable; urgency=medium
 
  -- Timo Aaltonen <[e-mail]>  Wed, 10 Feb 2021 11:32:35 +0200
 
+sssd (2.4.0-1ubuntu7) impish; urgency=medium
+
+  * d/control: Drop libgdm-dev Build-Depend on i386.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 11 May 2021 16:22:31 -0400
+
+sssd (2.4.0-1ubuntu6) hirsute; urgency=medium
+
+  * Disable lto, not ready upstream.
+
+ -- Matthias Klose <[e-mail]>  Tue, 23 Mar 2021 13:18:53 +0100
+
+sssd (2.4.0-1ubuntu5) hirsute; urgency=medium
+
+  * No change rebuild with fixed ownership.
+
+ -- Dimitri John Ledkov <[e-mail]>  Tue, 16 Feb 2021 15:22:14 +0000
+
+sssd (2.4.0-1ubuntu4) hirsute; urgency=medium
+
+  * Avoid sending malformed SYSLOG_IDENTIFIER to journald (LP: #1908065):
+    - d/p/lp-1908065-01-syslog_identifier-format.patch:
+      Upstream patch to include "sssd[]" identifier in program names.
+    - d/p/lp-1908065-02-remove-syslog_identifier.patch:
+      Upstream patch to remove custom SYSLOG_IDENTIFIER from Journald.
+
+ -- Valters Jansons <[e-mail]>  Fri, 05 Feb 2021 20:51:32 +0000
+
+sssd (2.4.0-1ubuntu3) hirsute; urgency=medium
+
+  * d/apparmor-profile: Update profile. (LP: #1910611)
+    - Extend read permissions to /etc/sssd/conf.d/* and /etc/gss/mech.d/*.
+    - Add read/execute permission to /usr/libexec/sssd/*.
+
+ -- Sergio Durigan Junior <[e-mail]>  Mon, 18 Jan 2021 16:57:21 -0500
+
+sssd (2.4.0-1ubuntu2) hirsute; urgency=medium
+
+  * d/p/0003-Only-start-sssd.service-if-there-s-a-configuration-f.patch:
+    Upstream patch to make sssd.service only able to start when there
+    is a configuration file present.  (LP: #1900642)
+  * d/p/condition-path-exists-sssd-conf.patch: Remove.
+
+ -- Sergio Durigan Junior <[e-mail]>  Tue, 12 Jan 2021 16:17:38 -0500
+
+sssd (2.4.0-1ubuntu1) hirsute; urgency=medium
+
+  * d/p/condition-path-exists-sssd-conf.patch: Only start
+    sssd.service if there is a configuration file present.
+    (LP: #1900642)
+
+ -- Sergio Durigan Junior <[e-mail]>  Thu, 10 Dec 2020 14:20:24 -0500
+
 sssd (2.4.0-1) unstable; urgency=medium
 
   * New upstream release.
@@ -1342,3 +1694,4 @@ sssd (0.5.0-0ubuntu1) karmic; urgency=low
   * Initial release.
 
  -- Mathias Gug <[e-mail]>  Mon, 24 Aug 2009 16:35:11 -0400
+
diff --git a/debian/control b/debian/control
index 3b3a54c..3fa7133 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: sssd
 Section: utils
 Priority: optional
-Maintainer: Debian SSSD Team <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian SSSD Team <[e-mail]>
 Uploaders: Timo Aaltonen <[e-mail]>,
  Dominik George <[e-mail]>
 Build-Depends:
@@ -29,7 +30,7 @@ Build-Depends:
  libdbus-1-dev,
  libdhash-dev,
  libfido2-dev,
- libgdm-dev [!s390x !kfreebsd-any !hurd-any],
+ libgdm-dev [!s390x !kfreebsd-any !hurd-any !i386],
  libglib2.0-dev,
  libini-config-dev,
  libjansson-dev,
@@ -240,7 +241,7 @@ Description: System Security Services Daemon -- proxy back end
  PAM modules to leverage SSSD caching.
 
 Package: sssd-tools
-Architecture: any
+Architecture: amd64 arm64 armhf ppc64el riscv64 s390x
 Depends:
  python3,
  python3-sss,
diff --git a/debian/tests/control b/debian/tests/control
index 601165e..0d94a73 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -6,9 +6,7 @@ Tests: ldap-user-group-krb5-auth
 Depends: @, slapd, ldap-utils, openssl, expect, lsb-release, krb5-user, krb5-admin-server, krb5-kdc
 Restrictions: isolation-container, needs-root, allow-stderr
 
-Test-Command: sudo
-  bash debian/tests/sssd-softhism2-certificates-tests.sh
-Features: test-name=sssd-softhism2-certificates-tests
+Tests: sssd-softhism2-certificates-tests.sh
 Depends: bash,
          gnutls-bin,
          openssl,
@@ -16,10 +14,10 @@ Depends: bash,
          softhsm2,
          sssd,
          util-linux
-Restrictions: needs-sudo,
+Restrictions: needs-root,
               allow-stderr
 
-Test-Command: sudo env
+Test-Command: env
   OFFLINE_MODE=1
   bash debian/tests/sssd-smart-card-pam-auth-configs-tester.sh
 Features: test-name=sssd-smart-card-pam-auth-configs
@@ -34,6 +32,6 @@ Depends: bash,
          util-linux
 Restrictions: breaks-testbed,
               isolation-container,
-              needs-sudo,
+              needs-root,
               allow-stderr
 
diff --git a/debian/tests/sssd-smart-card-pam-auth-configs-tester.sh b/debian/tests/sssd-smart-card-pam-auth-configs-tester.sh
index fde2e2b..12351cf 100644
--- a/debian/tests/sssd-smart-card-pam-auth-configs-tester.sh
+++ b/debian/tests/sssd-smart-card-pam-auth-configs-tester.sh
@@ -13,6 +13,12 @@ set -xe
 
 export DEBIAN_FRONTEND=noninteractive
 
+if [ -z "${AUTOPKGTEST_NORMAL_USER}" ]; then
+    adduser --quiet --disable-password _sssduser
+    AUTOPKGTEST_NORMAL_USER="_sssduser"
+fi
+SUDO_USER="${AUTOPKGTEST_NORMAL_USER}"
+
 required_tools=(
     pamtester      # debian package: pamtester
     softhsm2-util  # debian package: softhsm2
diff --git a/debian/tests/sssd-softhism2-certificates-tests.sh b/debian/tests/sssd-softhism2-certificates-tests.sh
index 2f37167..df61c44 100644
--- a/debian/tests/sssd-softhism2-certificates-tests.sh
+++ b/debian/tests/sssd-softhism2-certificates-tests.sh
@@ -7,6 +7,12 @@
 # Used to verify p11_child usage in SSSD.
 set -xe
 
+if [ -z "${AUTOPKGTEST_NORMAL_USER}" ]; then
+    adduser --quiet --disable-password _sssduser
+    AUTOPKGTEST_NORMAL_USER="_sssduser"
+fi
+SUDO_USER="${AUTOPKGTEST_NORMAL_USER}"
+
 required_tools=(
     p11tool        # debian package: gnutls-bin
     openssl        # debian package: openssl