Bug#779641: debian-edu-config: postinst fails to remove a diversion

[Petter Reinholdtsen <pere@hungry.com>]

[Wolfgang Schweer]
> While testing to upgrade a combined server (profiles: Main-Server, 
> Workstation, Thin-Client-Server) from wheezy to jessie I noticed that 
> upgrading failed (when pam-auth-update was run) cause the postinst did 
> not remove a diversion.

I ran into this too when I upgraded an old Wheezy machine just now.
Thank you very much for the bug report.  It was very useful!

> Removing the diversion manually before upgrading like this solved the
> problem:
>
> dpkg-divert --remove /usr/share/pam-configs/krb5
> rm /usr/share/pam-configs/edu-krb5
>
> No idea why this happens, the code contained in postinst seems to be
> ok.

I believe it happen because the file
/usr/share/debian-edu-config/pam-config-krb5 no longer included in the
deb is removed when the new version is unpacked, while the postinst
might run a long time after it is removed.  I suspect code need to be in
a preinst script instead, to avoid the problem.

I suspect what went wrong was this:

 (1) The divert /usr/share/pam-configs/edu-krb5 is operatinonal and
     pointing to an existing file
     /usr/share/debian-edu-config/pam-config-krb5.

 (2) debian-edu-config is unpacked, the divert is still in place, but
     the file /usr/share/debian-edu-config/pam-config-krb5 is removed by
     dpkg.

 (3) Some other package try to run pam-auth-update, which fail because
     /usr/share/pam-configs/ contain a bogus file (the dangling symlink)

 (4) Perhaps the new debian-edu-config postinst script is executed,
     perhaps not.  It depend on the set of packages being upgraded.

 (5) apt give up and report upgrade failure.

If we make sure the divert is removed before the package is unpacked,
there will be no dangling symlink and pam-auth-update will work the
whole time.

-- 
Happy hacking
Petter Reinholdtsen