Your message dated Mon, 21 Sep 2026 18:05:12 +0000
with message-id <[email protected]>
and subject line Bug#1147527: fixed in nginx 1.26.3-3+deb13u9
has caused the Debian Bug report #1147527,
regarding nginx-dev: Missing header file in nginx-dev after backport
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147527: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147527
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: nginx-dev
Version: 1.26.3-3+deb13u8
Severity: important
X-Debbugs-Cc: [email protected], [email protected]
Dear Maintainer,
* What led up to the situation?
Debian backported a fix for CVE-2026-42533 and released 1.26.3-3+deb13u8.
* What exactly did you do (or not do) that was effective (or ineffective)?
I tried to build my nginx-dynamic-module package against the new nginx-dev
package version.
* What was the outcome of this action?
Make throws the error: make[2]: *** No rule to make target
'src/http/ngx_http_script.hh', needed by
'objs/addon/nginx_module/ngx_http_passenger_module.o'. Stop.
* What outcome did you expect instead?
Make succeeds.
* Investigation
# on debian 13:
apt update && apt install -y nginx-dev
# snipped output from apt
dpkg -L nginx-dev | grep -F 'ngx_http_script.hh'
find /usr/share/nginx/src -name 'ngx_http_script.hh' -o -name
'ngx_stream_script.hh'
ls -l /usr/share/nginx/src/src/http/ngx_http_script.hh
ls: cannot access '/usr/share/nginx/src/src/http/ngx_http_script.hh': No such
file or directory
auto/modules was patched to include src/http/ngx_http_script.hh and that file
is added to the source tree:
https://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2120411.html?utm_source=chatgpt.com
but that file isn't present in the nginx-dev package.
-- System Information:
Debian Release: 13.6
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: arm64 (aarch64)
Kernel: Linux 6.8.0-117-generic (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect
Versions of packages nginx-dev depends on:
ii debhelper [debhelper-compat] 13.24.2
ii libexpat1-dev [libexpat-dev] 2.8.3-1~deb13u1
ii libgd-dev 2.3.3-14~deb13u1
ii libgeoip-dev 1.6.12-11.2~deb13u1
ii libpcre2-dev 10.46-1~deb13u2
ii libperl-dev 5.40.1-6+deb13u1
ii libssl-dev 3.5.7-1~deb13u2
ii libxslt1-dev 1.1.35-1.2+deb13u3
ii nginx [nginx-abi-1.26.3-1] 1.26.3-3+deb13u8
ii po-debconf 1.0.21+nmu1
ii zlib1g-dev 1:1.3.dfsg+really1.3.1-1+b1
nginx-dev recommends no packages.
nginx-dev suggests no packages.
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: nginx
Source-Version: 1.26.3-3+deb13u9
Done: Jan Mojžíš <[email protected]>
We believe that the bug you reported is fixed in the latest version of
nginx, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Jan Mojžíš <[email protected]> (supplier of updated nginx package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 15 Sep 2026 09:28:28 +0000
Source: nginx
Architecture: source
Version: 1.26.3-3+deb13u9
Distribution: trixie-security
Urgency: medium
Maintainer: Debian Nginx Maintainers
<[email protected]>
Changed-By: Jan Mojžíš <[email protected]>
Closes: 1147527
Changes:
nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium
.
* d/p/CVE-2026-42533.patch update: keep private script headers out of
auto/modules' ngx_module_deps so third-party modules can be built
against nginx-dev. (Closes: #1147527)
* d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load
a minimal third-party dynamic HTTP module.
Checksums-Sha1:
c5290c39a068ff2a152ae0617092f78a39b45e63 3473 nginx_1.26.3-3+deb13u9.dsc
fef7d98e84ad3be1af8d19c6aaacb253179d8cd2 103108
nginx_1.26.3-3+deb13u9.debian.tar.xz
1ae77149b3fc8563047837c877cf32e2c4500be2 6199
nginx_1.26.3-3+deb13u9_source.buildinfo
Checksums-Sha256:
ede21ae86c60e8be4112f871d319724d19c0f1b3b1840aa9abbcce4c1a7244b9 3473
nginx_1.26.3-3+deb13u9.dsc
860b84ea2e0b394ef2124ce118f9479eea7e63d9a6c6991e5b965e7c21a4a407 103108
nginx_1.26.3-3+deb13u9.debian.tar.xz
98cb587828fdcd4dbba10ba347cc3ab436bd87c8570d182ab2e0e2d6f8f82aed 6199
nginx_1.26.3-3+deb13u9_source.buildinfo
Files:
61dc89f8a3446939846a840cf78386d1 3473 httpd optional nginx_1.26.3-3+deb13u9.dsc
828776bdba680e0fcd08290361c38896 103108 httpd optional
nginx_1.26.3-3+deb13u9.debian.tar.xz
fec4963628021b59f0570fe7071df2bc 6199 httpd optional
nginx_1.26.3-3+deb13u9_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqph20ACgkQ+GQ1dHE8
m64+CAf+O36elG7eFqKNIbIvTAw+aknNRf3ZLO0nIIyILgw8lmqr2kYU3kIG9fIH
oXnR8V8pi6DWwITtApxLxjT0vWqnRc/ovmh+ehdgaZa/9UvGcwhY7qrL94LBopJL
axR3ryYlpK6IJaKqS8DRDnIE+dBFmvQkUf2eb1DVeKCbvvu53/bLV7+WysBijDkA
/nGJFUEyCVk3N5Z7/n4jnctuU76txIb0iGmCkwmWm/O6fJrGhbfJSs/2P+iwUgZ1
euyAPqg2YYs/lKtnAhaZaf9r1Ag0jzGDwHukjFfyIz22S5Eme88gWpK1VdQMvoyF
iLeXV932h+y3vRZTdxgngFVYg4+RRQ==
=M2ns
-----END PGP SIGNATURE-----
pgpTneA1soEqT.pgp
Description: PGP signature
--- End Message ---
