postinst should validate config before restarting bind

Thanks James.

I think I favour b) since a) would only be noticed by someone watching console output. Though having said that, the situation wouldn't be any worse than before the postinst was run.

This needs to be forwarded to Debian.

@Athos - this still is assigned to you, did you have a chance to look at it, was it aborted for some reason, ... ?

I did submit a patch (attached) upstream at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995310

The proposal is available in a PPA at

https://launchpad.net/~athos-ribeiro/+archive/ubuntu/bind9-validate-config/+packages

The idea is to run a simple configuration validation before the systemd debhelper hooks run in the postinst script. In case the validation fails, the service will not be restarted and the upgrade will stay in a config failed state. Thoughts?

Note that I did not craete an MP for the git Ubuntu repository yet, since this patch is a draft to start a discussion around the issue. Moreover, it would be nice to hear the thoughts of the Debian maintainer before we proceed with this one.

A simple test can be performed with the following steps:

On a jammy machine

- Install bind9
- Upgrade to the proposed version
- Verify the upgrade succeeds and the service is running

On a jammy machine

- Install bind9
- add "foo bar" to the last line of /etc/bind/named.conf
- Upgrade to the proposed version
- Verify the upgrade exits with an error status, such as

/etc/bind/named.conf:13: unknown option 'foo'
/etc/bind/named.conf:14: unexpected token near end of file
dpkg: error processing package bind9 (--configure):
 installed bind9 package post-installation script subprocess returned error exit status 1

- Verify that the service is still running (no disruption).

The attachment "validate-config.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

Hi Athos, hope you're still working on this one? :D

I unassigned it for now and set the priority to low. A patch has been forwarded to Debian and it would be nice to have their input on this one before creating a delta changing how the service behaves just to (possibly) revert/change it again later.

Per previous comment the patch does not appear ready for inclusion yet, so I am unsubscribing ubuntu-sponsors.