FFe: disable NIS basic auth helper, doesn't build with glibc 2.32
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Release Notes for Ubuntu |
Fix Released
|
Undecided
|
Unassigned | ||
Squid |
Unknown
|
Unknown
|
|||
squid (Ubuntu) |
Fix Released
|
Undecided
|
Unassigned |
Bug Description
Disable the NIS basic authentication helper.
TL;DR I think it's less risky to disable NIS than to try to port this basic auth helper to use tirpc. Both approaches will require an FFe.
A diff can be seen in the linked MP.
Please let me know if you prefer the tirpc approach, it would take longer though.
Longer explanation follows
The NIS basic auth helper needs rpc.h which is no longer provided by glibc 2.32[1]. An alternative is to use libtirpc, and I tried that in another branch[2], but here are the reasons for not doing that:
- the patch is a bit more complicated
- I don't really fancy testing NIS
- who still uses NIS?
- I have no idea if tirpc is a drop-in replacement like that (goes back to testing this, listed above)
Fedora dropped this helper in 2018[3] exactly because of the rpc deprecation in glibc:
* Wed Jan 17 2018 Luboš Uhliarik <email address hidden> - 7:4.0.22-1
- new version 4.0.22
- Removed NIS helper (#1531540)
I tried to use libtirpc in [2], and it builds and the executable runs, but the remarks I made above about NIS remains. Plus, there are some unknowns in this attempt of mine:
- dpkg-shlibdeps didn't flag libtirpc as a needed dependency
- ldd shows libtirpc, but objdump -x ... | grep NEEDED doesn't. Looks like dpkg-shlibdeps only goes over the NEEDED deps shown by objdump -x
- I think ldd, being recursive, found libtirpc via libnsl, which is one of the NEEDED deps in objdump
- adding -ltirpc to the linking phase of that helper means changing an autoconf file, and calling autoreconf. That introduced (or revealed?) a bug where mime.conf was no longer instaled in /usr/share/squid, but in /etc/squid. So I had to fix that too
- the helper builds even without -ltirpc in the linking phase, which would simplify the branch a bit as I wouldn't have to regenerate the Makefile, but I wonder why it builds...
If I can be sure not having to use -ltirpc is correct, and not that it worked by just pure chance, then maybe the libtirpc approach has some merit, but it would still need testing, and find out why the new dependency wasn't added automatically by shlibs. Adding it manually to depends is icky.
Anyway, that is the story :)
PPA with NIS disabled: https:/
PPA with NIS using libtirpc, with the above caveats not addressed: https:/
1. https:/
2. https:/
3. https:/
[Original Description]
...
checking for sys/types.h... yes
checking for rpc/rpc.h... no
checking for rpcsvc/ypclnt.h... yes
checking for rpcsvc/yp_prot.h... no
checking for crypt.h... (cached) yes
autopkgtest [17:59:58]: test upstream-
upstream-test-suite FAIL non-zero exit status 2
Glibc 2.32 stopped shipping rpc/rpc.h and other RPC development files. Software projects are recommended to switch to TI-RPC.
https:/
Related branches
- Bryce Harrington (community): Approve
- Canonical Server Reporter: Pending requested
-
Diff: 1212 lines (+1039/-2)9 files modifieddebian/NEWS (+7/-0)
debian/changelog (+794/-0)
debian/control (+3/-2)
debian/patches/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch (+65/-0)
debian/patches/90-cf.data.ubuntu.patch (+22/-0)
debian/patches/99-ubuntu-ssl-cert-snakeoil.patch (+28/-0)
debian/patches/fix-max-pkt-sz-for-icmpEchoData-padding.patch (+89/-0)
debian/patches/series (+4/-0)
debian/usr.sbin.squid (+27/-0)
- Christian Ehrhardt (community): Needs Fixing
- Canonical Server Reporter: Pending requested
-
Diff: 1142 lines (+976/-2)9 files modifieddebian/NEWS (+7/-0)
debian/changelog (+735/-0)
debian/control (+3/-2)
debian/patches/0009-Fix-Werror-alloc-size-larger-than-on-GCC-12.patch (+65/-0)
debian/patches/90-cf.data.ubuntu.patch (+22/-0)
debian/patches/99-ubuntu-ssl-cert-snakeoil.patch (+24/-0)
debian/patches/fix-max-pkt-sz-for-icmpEchoData-padding.patch (+89/-0)
debian/patches/series (+4/-0)
debian/usr.sbin.squid (+27/-0)
- Robie Basak: Needs Fixing
- Canonical Server: Pending requested
-
Diff: 1015 lines (+856/-2)9 files modifieddebian/NEWS (+7/-0)
debian/changelog (+647/-0)
debian/control (+3/-2)
debian/patches/90-cf.data.ubuntu.patch (+22/-0)
debian/patches/99-ubuntu-ssl-cert-snakeoil.patch (+22/-0)
debian/patches/fix-max-pkt-sz-for-icmpEchoData-padding.patch (+89/-0)
debian/patches/series (+4/-0)
debian/patches/workaround-gcc11-wstringop-overread-bug.patch (+35/-0)
debian/usr.sbin.squid (+27/-0)
- Lucas Kanashiro (community): Approve
- Canonical Server: Pending requested
-
Diff: 42 lines (+14/-1)3 files modifieddebian/NEWS (+7/-0)
debian/changelog (+6/-0)
debian/rules (+1/-1)
summary: |
- autopkgtest fails in groovy with glibc 2.32, also FTBFS + FFe: disable NIS basic auth helper, doesn't build with glibc 2.32 |
description: | updated |
description: | updated |
This is actually an FTBFS, as the dep8 test is rebuilding squid. The missing line from the above output is complaining about the NIS auth helper:
(...) cdbs/1/ class/autotools .mk:46: debian/ stamp-autotools ] Error 1
checking for rpcsvc/ypclnt.h... yes
checking for rpcsvc/yp_prot.h... no
checking for crypt.h... (cached) yes
configure: error: Basic auth helper NIS ... found but cannot be built
make: *** [/usr/share/
dpkg-buildpackage: error: debian/rules build subprocess returned exit status 2