Hi Gioele,
On Sa 03 Okt 2026 23:47:42 UTC, Gioele Barabucci wrote:
Hi Mike,
On Fri, 02 Oct 2026 15:58:00 +0000 Mike Gabriel <[email protected]> wrote:
On Fr 02 Okt 2026 13:06:44 UTC, Gioele Barabucci wrote:
On Sat, 26 Sep 2026 13:02:27 +0000 Mike Gabriel
<[email protected]> wrote:
* to get sssd fixed (#1129522) it needs sudo bug #1147179 getting fixed
* to get the approach suggested in #1147179 fully functional
dh-nss needs
love (#1148069)
Hi, long story short: I improved the testsuite with quite a few >
tests focused on upgrades and it turns out, as it always the case,
> that a simple fix like the one proposed here does not properly
cover > all the possible upgrade paths (for arbitrary changes to
.nss > files). Upgrades are hard.
I'll try now a different strategy: making the maintscript snippets
> go back to a clean state before each upgrade. On paper it
works, but > I'm afraid it may cause intermittent issues because
there will be a > window of time in which the service will not be
enabled in > /etc/nsswitch.conf. In case of a failed upgrade that
window may be > arbitrarily long and if that service is something
needed to log in, > the admin may end up locked out of their
accounts.
Another option, more in line with what sssd and autofs need at the
> moment, would be to state something along the lines of ".nss
files > can only be added to or removed from a package; changing
the content > of .nss files between package versions is not
allowed without > additional ad-hoc code in maintscripts".
Both options are unsatisfactory. Option 2 is perhaps the best to
> unblock the current sssd situation.
I'll do some other testing and play with these two options during
> the weekend, then release a version that will at least unblock
sssd.
It looks like I'll go with option 2. To make sure that the tested
code matches the reality, can you please confirm my reading of the
solution you agreed upon in the other bugs?
From <https://bugs.debian.org/1147179#30>:
## sudo
sudoers database-add
sudoers first files
## libsss-sudo
Pre-Depends: sudo (>= $some-version)
sudoers database-require
sudoers after=files sss
Confirming! That's the proposed solution, indeed.
Mike
--
mike gabriel aka sunweaver (Debian Developer)
mobile: +49 (1520) 1976 148
landline: +49 (4351) 486 14 27
GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net
