-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 13 Jul 2025 20:08:32 +0100
Source: gdm3
Architecture: source
Version: 48.0-2
Distribution: unstable
Urgency: medium
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Closes: 1051785 1096689 1105057
Changes:
gdm3 (48.0-2) unstable; urgency=medium
.
* Team upload
* d/greeter.dconf-defaults: Remove non-functional theming options.
The visual design of the greeter (login prompt) is no longer intended
to be configurable, and in particular the background is no longer
configurable, so none of the background-related settings have any
effect. The greeter also does not use GTK, so changing the GTK
theme has no effect on it.
Remove these options from the default configuration file so that
they will not mislead sysadmins. (Closes: #1105057)
* d/greeter.dconf-defaults: Add some useful example options.
Disabling fingerprint authentication is one of the examples given
in the GNOME System Administration Guide. The steps from that guide
won't actually work as-is on Debian (because we use a different
username for the greeter, #1107944) but we can make it as easy as
possible to do the equivalent.
Meanwhile, disabling smartcard authentication is a way to avoid the
presence of a smartcard having the side-effect of disabling the user
list, and in some configurations also the ability to log in with a
password (#1051785).
* d/gdm3.alternatives: When smart card authentication is re-enabled,
make gdm-smartcard-sssd-or-password the default.
With the previous default, gdm-smartcard-sssd-exclusive, if a smart
card was plugged in and libpam-sss was installed, we would reject
attempts to log in with a password. This is the most-hardened choice
if smart cards are being used for authentication, but prevents login
if the smart card has not been enrolled for authentication and is
actually being used for some other purpose such as OpenPGP or X509.
(Closes: #1051785)
* d/greeter.dconf-defaults: Disable smartcard authentication by default.
Enabling smartcard authentication has side-effects on other aspects of
greeter behaviour if a compatible smartcard happens to be connected:
in particular, it disables the user list, resulting in users being
required to type their username to log in.
Enrolling smartcards to be used for authentication requires sysadmin
action, so it seems reasonable to require the sysadmin to take action
to enable it after they have done the necessary enrolment step.
(Closes: #1051785)
* d/p/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch:
Add patch from upstream 49.alpha.0 to fix FTBFS in C23 mode.
This won't become relevant until gcc 15 becomes the default during
the forky cycle, but is a harmless change while we're uploading anyway.
(Closes: #1096689)
Checksums-Sha1:
dfba5596e42c01ed7df3dbecb752d19cebcd1c86 3208 gdm3_48.0-2.dsc
b9e359e03e6c5273964e159948562315de5071b8 86860 gdm3_48.0-2.debian.tar.xz
a9269b9fa53256868cab293e376974e9ca840170 16401 gdm3_48.0-2_source.buildinfo
Checksums-Sha256:
8eadada57b7f29f20cedfabc95434bf64c8342ac9a33d6d526cac103b51a3ecf 3208 gdm3_48.0-2.dsc
3bacef59fee6fe06ccb15c81e8313fa3a68228f6289b889b518c43cfc5a21242 86860 gdm3_48.0-2.debian.tar.xz
df4bea5c47acc826e0dc12e7bb66ccc80bff15c15d98300b0501a69f5bd01efc 16401 gdm3_48.0-2_source.buildinfo
Files:
24af7805ab175fd3431c620cac0d5e0b 3208 gnome optional gdm3_48.0-2.dsc
3cf84c15def8c2cb1e0c1668eea0b361 86860 gnome optional gdm3_48.0-2.debian.tar.xz
fa6a4aa5f485e9a782cb1574551ce42a 16401 gnome optional gdm3_48.0-2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmh0MwcACgkQI1wJnT6z
MHZxeBAAweUXi1a/Zy74r8M7tBD6bwuT4y4x9Mhjmn4G+XGbsryvs2qmloCVpkpk
jwHwi18gPb+WaxaNb+bQM1DiSt2io2NncJt3Gkw0UdPq+tfYpzBaLJiJBhl9sgJE
vtnSr/a1iu0SYvUGXXPp3fwQJ3g3jDHtNDlhw/JsTJVKF+g3wdweWXUsKhCOJSzX
PCKXa5FoyiFTxDhiKyRuW0JB4LZU9LyFtc/r+DIEQz0x5MgQ5oxOVIpr/c/P40zZ
2TNUSegDbMI1S/hXk586xuCvDuzDNR0rM5E+ELJRAjiWHPqNMB0r7wVd+d1RPJ70
FU9/Kr0ye/Glh654LvVcGsYNB0BA4u8iBLRFjUawIiZmujk6Q1+rufdmjEQrtGjW
Ep0HaKkaRNkT9+/ovgV7B81OXmZO9lJHfb27x3zES7sLApfNDRwgWEMFXOCUkyXP
OnuERhRMpVP+wLOes/cjaHiKuKGqPgJiJnkptmR9gb9HQgGUB0d6Yw3WMdeHtAbt
tIzzkBAEZo2a7OdGCwPYook9u15Q2PzsXNOmTNsPAoM0c9+dKTFgpAh1rKJp2DdH
iRBiAEywU54VtdmO1Jkzituy5W5A8lfaZKZMy/L8Ps5WRAiHTmVT25KM9Z37aF55
HJPeZRhGMwlIwLTPWAS8jgXy0c6nGi/8R0Ia4BvJv0kHlFK3bTI=
=NwAa
-----END PGP SIGNATURE-----
Attachment:
pgphU9DUznMle.pgp
Description: PGP signature