Bug#924401: base-files fails postinst when base-passwd is unpacked

[Santiago Vila <sanvila@unex.es>]

On Thu, Mar 14, 2019 at 07:50:27AM +0100, Johannes Schauer wrote:

> I agree that we should not expect maintainers to write numeric user and group
> ids into their maintainer scripts. This is not only hard to write but also hard
> to read and maintain. In my opinion, using numeric ids should only be a
> temporary measure until we have a declarative method or other helper that does
> the correct translation instead. But since no such helper exists right now,
> numeric ids are probably the best way to fix this bug for buster.
> 
> I was now als able to trigger this bug in mmdebstrap. Here is how to populate a
> chroot directory with a set of packages that is less than the Essential:yes set
> and based on busybox:
> 
> sudo mmdebstrap --mode=root --variant=custom \
>     --include=dpkg,busybox,libc-bin,base-files,base-passwd,debianutils \
>     --setup-hook='mkdir -p "$1/bin"' \
>     --setup-hook='for p in awk cat chmod chown cp diff echo env grep less ln mkdir mount rm rmdir sed sh sleep sort touch uname; do ln -s busybox "$1/bin/$p"; done' \
>     --setup-hook='echo root:x:0:0:root:/root:/bin/sh > "$1/etc/passwd"' \
>     --setup-hook='printf "root:x:0:\nmail:x:8:\nutmp:x:43:\n" > "$1/etc/group"' \
>     unstable ./debian-unstable-busybox
> 
> As one can see, I had to create a minimal /etc/passwd and /etc/group inside the
> chroot filled with entries for root, mail and utmp for the base-files postinst
> to work. Using mmdebstrap like that is indeed quite a hack right now, so I'm
> not claiming that mmdebstrap should be the reason for base-files to change.

I think from all the above that it should be not only mmdebstrap but
maybe also every other bootstrapping tool the one to create a minimal
/etc/passwd to bootstrap base-passwd.

The reason I'm often asked to add hacks to base-files.postinst is only
that base-files is usually configured in the second place, but the same
thing base-files does could be done by any other essential package.

The way I see it, if base-files fails during bootstrapping it's not
because it does not "help" the bootstrapping tool, but because the
bootstrapping tool didn't bootstrap base-passwd in the first place.

> But maybe this is a useful way for you of how to see this problem
> happening for yourself.

If those setup hooks are the workaround for the problem, I see the
problem in this case, and in my opinion creating a minimal /etc/passwd
and configuring base-passwd before base-files would be the optimal way
to fix this particular problem (i.e. moving two of the setup hooks
into mmdebstrap itself).

Now the question would be if we really need to add a paragraph to
Debian Policy, "Recommendations/guidelines for bootstrapping tools",
clearly stating that bootstrapping tools should bootstrap base-passwd
before trying to configure base-files. I think that would be quite
clear by now, but I could be wrong.

Thanks.