Bug#924401: #924401 base-files fails postinst when base-passwd is unpacked

[Tim Woodall <debianbugs@woodall.me.uk>]

On Mon, 22 Feb 2021, Helmut Grohne wrote:

> On Mon, Feb 22, 2021 at 07:33:10AM +0000, Tim Woodall wrote:
> > A. /etc/passwd is part of base-passwd's interface and base-files is
> >    right in relying on it working at all times. Then base-passwd is rc
> >    buggy for violating a policy must. Fixing this violation is
> >    technically impossible.
> >
> >
> > I seem to have hit this same issue independently.
> >
> > Could you explain why "Fixing this violation is technically impossible"
>
> The requirement here is that base-passwd needs to work when unpacked.
> The only way to make that work is making /etc/passwd a conffile. That
> would technically be possible, but it would be very annoying, because
> this file is different on virtually any Debian installation. So we
> cannot make it a conffile in practice. The next bet would be ensuring
> that base-passwd.postinst is run before other packages' postint somehow.
> Such an ordering mechanism does not exist at present and it would be
> prone to dependency loops.
>
> > As far as I can see, making base-passwd not essential, only required,
> > and then making passwd and base-files pre-depend on base-passwd the
> > system seems to bootstrap /etc/passed and /etc/group OK.
>
> What you write is almost certainly self-contradictory. base-files is
> essential. Anything it depends on (including base-passwd in your
> scenario) is pseudo-essential and thus inherits all the same
> requirements except for actually being essential. You gained nothing.
> And you didn't explain how you'd make base-passwd non-essential.
>
> > That also seems to conform to the debian policy. The oddity is that
> > base-files and passwd only actually need to depend on base-passwd, not
> > pre-depend on it as they only use /etc/passwd and /etc/group in the
> > postinst scripts but the debian policy doesn't seem to consider this
> > case.
>
> They don't have to depend on base-passwd at all, because dependencies on
> essential packages should be omitted.

If base-passwd wasn't essential then passwd and base-files should depend
on it.

If passwd and base-files (pre)depend on base-passwd then base-passwd
will be configured before passwd or base-files postinst is run.

> I suggest that you detail on the practical issue you have been hitting.
> Doing so allows evaluating prospective solutions against all relevant
> use cases.

What I am doing - which seems similar to what others are doing with
other tools, is to:

1. unpack apt, dpkg and debian-archive-keyring data.tar.xz into tmpdir/
(This provides a set of config that apt needs to run)

2. create a sources.list in tmpdir and touch image/var/lib/dpkg/status
(dpkg needs this file to exist)

3. apt-get install -o RootDir=tmpdir -d $ESSENTIAL
(This resolves all of the dependencies and downloads every package that
needs to be installed. I cannot see a way to get apt to do this without
jumping through the hoops of step 1 and 2 as --reinstall doesn't
re-download dependencies)

4. unpack the data.tar.xz from every deb downloaded in 3 into image/

5.  repeat step 2 but in image/

6. chroot image/
apt-get update
apt-get install $ESSENTIAL

And expect that to create a fully configured system.

For buster at least, the _only_ sticking point is apt not configuring
base-passwd early enough so one or the other of base-files and passwd
postinst fails. I've created local copies of those two that have
an explicit dependency on base-passwd and the problem is solved.

I haven't tried with unstable or bullseye yet but I don't immediately
see any other issues.

Tim.