Bug#1109435: unblock: gdm3/48.0-2
Package: release.debian.org
Severity: normal
X-Debbugs-Cc: gdm3@packages.debian.org, marco@ubuntu.com
Control: affects -1 + src:gdm3
User: release.debian.org@packages.debian.org
Usertags: unblock
(Explicitly cc'ing Marco since he's the author of most of our
integration glue for gdm smart card auth, to give him one last
opportunity to propose a better solution.)
[ Reason ]
RC bug #1051785
[ Impact ]
If not accepted, booting a GNOME system with a smartcard inserted in a
reader, or with a smartcard-based authentication token like a Yubikey,
makes it more difficult or sometimes impossible to log in with a
username and password (depending whether libpam-sss is installed).
The proposed version also removes some misleading commented-out example
configuration, which would have no effect if uncommented (#1105057);
adds commented-out example configuration for disabling fingerprint
authentication; and fixes a future FTBFS with gcc-15 (#1096689) while I
was preparing an upload anyway.
[ Tests ]
Manually tested, login works normally. Plugging in a Nitrokey Pro to an
otherwise unconfigured test system does not affect the login flow any
more.
[ Risks ]
Key package, central to our default desktop environment.
I'm not a primary maintainer of this package, I'm only stepping in to
fix the RC bug since other GNOME team members don't seem to have had
enough time available.
Sysadmins who want to allow smart card authentication might not realize
that, in addition to enrolling smart cards and setting up the smartcard
to uid mapping, they will need to edit /etc/gdm3/greeter.dconf-defaults
to re-enable it.
Sysadmins who want to *only* allow smart card authentication (with
password auth forbidden) might not realize that they need to
`update-alternatives --config gdm-smartcard`, as well as installing
libpam-sss.
(I think those are not a big concern in practice, because sysadmins who
want to set this up will already need to do quite lot of other setup,
and can be expected to know what they're doing.)
The changes for #1105057 are low-risk, they only add/remove comments and
remove the headings of some empty .ini-style groups.
The changes for #1096689 are low-risk, they only rename a local variable.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
unblock gdm3/48.0-2
diffstat for gdm3-48.0 gdm3-48.0
common/gdm-settings-utils.c | 8 -
common/gdm-settings-utils.h | 2
debian/changelog | 47 +++++++++
debian/gdm3.alternatives | 4
debian/greeter.dconf-defaults | 18 ---
debian/patches/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch | 51 ++++++++++
debian/patches/series | 1
7 files changed, 110 insertions(+), 21 deletions(-)
diff -Nru gdm3-48.0/common/gdm-settings-utils.c gdm3-48.0/common/gdm-settings-utils.c
--- gdm3-48.0/common/gdm-settings-utils.c 2025-03-17 16:07:15.000000000 +0000
+++ gdm3-48.0/common/gdm-settings-utils.c 2025-07-13 23:03:11.000000000 +0100
@@ -287,16 +287,16 @@
/* adapted from GKeyFile */
gboolean
gdm_settings_parse_value_as_boolean (const char *value,
- gboolean *bool)
+ gboolean *boolval)
{
g_return_val_if_fail (value != NULL, FALSE);
- g_return_val_if_fail (bool != NULL, FALSE);
+ g_return_val_if_fail (boolval != NULL, FALSE);
if (g_ascii_strcasecmp (value, "true") == 0 || strcmp (value, "1") == 0) {
- *bool = TRUE;
+ *boolval = TRUE;
return TRUE;
} else if (g_ascii_strcasecmp (value, "false") == 0 || strcmp (value, "0") == 0) {
- *bool = FALSE;
+ *boolval = FALSE;
return TRUE;
} else {
return FALSE;
diff -Nru gdm3-48.0/common/gdm-settings-utils.h gdm3-48.0/common/gdm-settings-utils.h
--- gdm3-48.0/common/gdm-settings-utils.h 2025-03-17 16:07:15.000000000 +0000
+++ gdm3-48.0/common/gdm-settings-utils.h 2025-07-13 23:03:11.000000000 +0100
@@ -44,7 +44,7 @@
GSList **list);
gboolean gdm_settings_parse_value_as_boolean (const char *value,
- gboolean *bool);
+ gboolean *boolval);
gboolean gdm_settings_parse_value_as_integer (const char *value,
int *intval);
gboolean gdm_settings_parse_value_as_double (const char *value,
diff -Nru gdm3-48.0/debian/changelog gdm3-48.0/debian/changelog
--- gdm3-48.0/debian/changelog 2025-03-17 16:33:51.000000000 +0000
+++ gdm3-48.0/debian/changelog 2025-07-13 20:08:32.000000000 +0100
@@ -1,3 +1,50 @@
+gdm3 (48.0-2) unstable; urgency=medium
+
+ * Team upload
+ * d/greeter.dconf-defaults: Remove non-functional theming options.
+ The visual design of the greeter (login prompt) is no longer intended
+ to be configurable, and in particular the background is no longer
+ configurable, so none of the background-related settings have any
+ effect. The greeter also does not use GTK, so changing the GTK
+ theme has no effect on it.
+ Remove these options from the default configuration file so that
+ they will not mislead sysadmins. (Closes: #1105057)
+ * d/greeter.dconf-defaults: Add some useful example options.
+ Disabling fingerprint authentication is one of the examples given
+ in the GNOME System Administration Guide. The steps from that guide
+ won't actually work as-is on Debian (because we use a different
+ username for the greeter, #1107944) but we can make it as easy as
+ possible to do the equivalent.
+ Meanwhile, disabling smartcard authentication is a way to avoid the
+ presence of a smartcard having the side-effect of disabling the user
+ list, and in some configurations also the ability to log in with a
+ password (#1051785).
+ * d/gdm3.alternatives: When smart card authentication is re-enabled,
+ make gdm-smartcard-sssd-or-password the default.
+ With the previous default, gdm-smartcard-sssd-exclusive, if a smart
+ card was plugged in and libpam-sss was installed, we would reject
+ attempts to log in with a password. This is the most-hardened choice
+ if smart cards are being used for authentication, but prevents login
+ if the smart card has not been enrolled for authentication and is
+ actually being used for some other purpose such as OpenPGP or X509.
+ (Closes: #1051785)
+ * d/greeter.dconf-defaults: Disable smartcard authentication by default.
+ Enabling smartcard authentication has side-effects on other aspects of
+ greeter behaviour if a compatible smartcard happens to be connected:
+ in particular, it disables the user list, resulting in users being
+ required to type their username to log in.
+ Enrolling smartcards to be used for authentication requires sysadmin
+ action, so it seems reasonable to require the sysadmin to take action
+ to enable it after they have done the necessary enrolment step.
+ (Closes: #1051785)
+ * d/p/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch:
+ Add patch from upstream 49.alpha.0 to fix FTBFS in C23 mode.
+ This won't become relevant until gcc 15 becomes the default during
+ the forky cycle, but is a harmless change while we're uploading anyway.
+ (Closes: #1096689)
+
+ -- Simon McVittie <smcv@debian.org> Sun, 13 Jul 2025 20:08:32 +0100
+
gdm3 (48.0-1) unstable; urgency=medium
* New upstream release
diff -Nru gdm3-48.0/debian/gdm3.alternatives gdm3-48.0/debian/gdm3.alternatives
--- gdm3-48.0/debian/gdm3.alternatives 2025-03-17 16:33:51.000000000 +0000
+++ gdm3-48.0/debian/gdm3.alternatives 2025-07-13 20:08:32.000000000 +0100
@@ -1,12 +1,12 @@
Name: gdm-smartcard
Link: /etc/pam.d/gdm-smartcard
Alternative: /etc/pam.d/gdm-smartcard-sssd-exclusive
-Priority: 50
+Priority: 40
Name: gdm-smartcard
Link: /etc/pam.d/gdm-smartcard
Alternative: /etc/pam.d/gdm-smartcard-sssd-or-password
-Priority: 40
+Priority: 50
Name: gdm-smartcard
Link: /etc/pam.d/gdm-smartcard
diff -Nru gdm3-48.0/debian/greeter.dconf-defaults gdm3-48.0/debian/greeter.dconf-defaults
--- gdm3-48.0/debian/greeter.dconf-defaults 2025-03-17 16:33:51.000000000 +0000
+++ gdm3-48.0/debian/greeter.dconf-defaults 2025-07-13 20:08:32.000000000 +0100
@@ -6,20 +6,6 @@
# configuration, not the GSettings path.
-# Theming options
-# ===============
-# - Change the GTK+ theme
-[org/gnome/desktop/interface]
-# gtk-theme='Adwaita'
-# - Use another background
-[org/gnome/desktop/background]
-# picture-uri='file:///usr/share/themes/Adwaita/backgrounds/stripes.jpg'
-# picture-options='zoom'
-# - Or no background at all
-[org/gnome/desktop/background]
-# picture-options='none'
-# primary-color='#000000'
-
# Login manager options
# =====================
[org/gnome/login-screen]
@@ -32,6 +18,10 @@
# - Show a login welcome message
# banner-message-enable=true
# banner-message-text='Welcome'
+# - Don't use a fingerprint reader for authentication
+# enable-fingerprint-authentication=false
+# - Don't use a smartcard reader for authentication
+enable-smartcard-authentication=false
# Automatic suspend
# =================
diff -Nru gdm3-48.0/debian/patches/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch gdm3-48.0/debian/patches/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch
--- gdm3-48.0/debian/patches/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch 1970-01-01 01:00:00.000000000 +0100
+++ gdm3-48.0/debian/patches/gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch 2025-07-13 20:08:32.000000000 +0100
@@ -0,0 +1,51 @@
+From: =?utf-8?q?Zbigniew_J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
+Date: Mon, 27 Jan 2025 14:01:23 +0100
+Subject: gdm-settings-utils: rename variable to fix build with gcc 15
+
+In GNU23 C, bool is a keyword. Rename the variable to avoid syntax error.
+
+Origin: upstream, 49.alpha.0, commit:2fbc2ac50b9f143eb594e5f77a8051222ffbd2c9
+Bug-Debian: https://bugs.debian.org/1096689
+---
+ common/gdm-settings-utils.c | 8 ++++----
+ common/gdm-settings-utils.h | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/common/gdm-settings-utils.c b/common/gdm-settings-utils.c
+index 636be3a..da4c7ae 100644
+--- a/common/gdm-settings-utils.c
++++ b/common/gdm-settings-utils.c
+@@ -287,16 +287,16 @@ gdm_settings_parse_boolean_as_value (gboolean boolval)
+ /* adapted from GKeyFile */
+ gboolean
+ gdm_settings_parse_value_as_boolean (const char *value,
+- gboolean *bool)
++ gboolean *boolval)
+ {
+ g_return_val_if_fail (value != NULL, FALSE);
+- g_return_val_if_fail (bool != NULL, FALSE);
++ g_return_val_if_fail (boolval != NULL, FALSE);
+
+ if (g_ascii_strcasecmp (value, "true") == 0 || strcmp (value, "1") == 0) {
+- *bool = TRUE;
++ *boolval = TRUE;
+ return TRUE;
+ } else if (g_ascii_strcasecmp (value, "false") == 0 || strcmp (value, "0") == 0) {
+- *bool = FALSE;
++ *boolval = FALSE;
+ return TRUE;
+ } else {
+ return FALSE;
+diff --git a/common/gdm-settings-utils.h b/common/gdm-settings-utils.h
+index 4f2362c..734d625 100644
+--- a/common/gdm-settings-utils.h
++++ b/common/gdm-settings-utils.h
+@@ -44,7 +44,7 @@ gboolean gdm_settings_parse_schemas (const char *fil
+ GSList **list);
+
+ gboolean gdm_settings_parse_value_as_boolean (const char *value,
+- gboolean *bool);
++ gboolean *boolval);
+ gboolean gdm_settings_parse_value_as_integer (const char *value,
+ int *intval);
+ gboolean gdm_settings_parse_value_as_double (const char *value,
diff -Nru gdm3-48.0/debian/patches/series gdm3-48.0/debian/patches/series
--- gdm3-48.0/debian/patches/series 2025-03-17 16:33:51.000000000 +0000
+++ gdm3-48.0/debian/patches/series 2025-07-13 20:08:32.000000000 +0100
@@ -1,3 +1,4 @@
+gdm-settings-utils-rename-variable-to-fix-build-with-gcc-.patch
16_xserver_path.patch
90_config_comments.patch
91_dconf_database_path.patch
Reply to: