Hi,

this is one of the uploads where we benefit from having gone via
experimental.

/usr/lib/x86_64-linux-gnu/libaudit.so.1 and
/usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0 have been moved from
libaudit1 to libaudit1t64 in this upload and these files have formerly
been installed below /lib in bookworm. Hence, we are creating exactly
the problem that the file move moratorium was meant to prevent.

/usr/lib/x86_64-linux-gnu/libauparse.so.0 and
/usr/lib/x86_64-linux-gnu/libauparse.so.0.0.0 likewise move from
libauparse0 to libauparse0t64 and create the same problem.

DEP17 classifies this a P1 and proposed mitigations M7 and M8. In this
case, I recommend not exercising Conflicts (M7), because they are known
to be unreliable and libaudit1 is part of the the essential set (login
depends on it). Instead, their respective preinst script should create
protective diversions

    dpkg-divert --package libaudit1t64 --no-rename --divert /lib/x86_64-linux-gnu/libaudit.so.1.usr-is-merged /lib/x86_64-linux-gnu/libaudit.so.1

for each of the affected files with their aliased location. In this case
- since we cannot use Conflicts - we cannot get rid of these diversions
in postinst. We already have Breaks: libaudit1 (<< ...), but that allows
concurrent unpack and hence still allows for the file loss scenario. The
diversions should be cleaned up in forky's postinst.

I appreciate another upload of audit to experimental to verify the
mitigation.

Helmut

http://subdivi.de/~helmut/dep17.html

We believe that the bug you reported is fixed in the latest version of
audit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1061966@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steve Langasek <vorlon@debian.org> (supplier of updated audit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 31 Jan 2024 08:49:07 +0000
Source: audit
Architecture: source
Version: 1:3.1.2-2.1~exp2
Distribution: experimental
Urgency: medium
Maintainer: Laurent Bigonville <bigon@debian.org>
Changed-By: Steve Langasek <vorlon@debian.org>
Closes: 1061966
Changes:
 audit (1:3.1.2-2.1~exp2) experimental; urgency=medium
 .
   * Non-maintainer upload.
   * Rename libraries for 64-bit time_t transition.
   * Fix uninstallable packages from the previous upload.
   * Add usrmerge diversions in preinst to protect against file deletion
     due to libraries moving between packages.  Closes: #1061966.
Checksums-Sha1:
 b98a840f1878a53cd079edb4c7da94a2400a232e 2789 audit_3.1.2-2.1~exp2.dsc
 1916e10dae8598c9df3336bda90e31b0488053d5 18720 audit_3.1.2-2.1~exp2.debian.tar.xz
 7c91b7a49d0b9eac7fa6c1c639f1ff75cf72bca0 8034 audit_3.1.2-2.1~exp2_source.buildinfo
Checksums-Sha256:
 21e7802432c233ac1d0c73425c58b2a97ee000a6a78bef14a35d4681ed8c80b0 2789 audit_3.1.2-2.1~exp2.dsc
 2e2d4113c07410a7604d03efe946a65756ac5d7648474e0fc928da1a44f02326 18720 audit_3.1.2-2.1~exp2.debian.tar.xz
 2d3d270b38ff38d57eeed6a9153999d5b027445955a97c1828d3cf295973884f 8034 audit_3.1.2-2.1~exp2_source.buildinfo
Files:
 433cbdb827638c9b1436271f9fd1f010 2789 libs optional audit_3.1.2-2.1~exp2.dsc
 adb582c8f91c36e4941683df794640c1 18720 libs optional audit_3.1.2-2.1~exp2.debian.tar.xz
 23da16fb3fc076fee2f31c7023bd024d 8034 libs optional audit_3.1.2-2.1~exp2_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEErEg/aN5yj0PyIC/KVo0w8yGyEz0FAmW6CrwSHHZvcmxvbkBk
ZWJpYW4ub3JnAAoJEFaNMPMhshM9YugP/0QxJ3llRm7eoqPyhMUEIP2co29E37CM
flF/LbOnhJo6mOxANFTSTHd1SlCNctY+g3kirri0XDpkS/I2m6feJ5cNQMMCl08P
yKDBjleuJqdn9GQSPBXXFetD+usLUeB6vgNkz091/ytQRHVc48KBhqOd+22i1B3G
ulLvJJllzT1FH6/10GUEQBU3SkROklQcl+e5kub8F/c8RBTvC6WsPAYDuIcMTuq9
3Ic7nPYvse1JKQ3uTtNTTcHrw/VcbG7IknKCRDwBq1jTMYv6QYjiUuw5YzjvSSnx
Vf8lXLC8Fs0C+rFimWQzaJJjvypb7U9jdYTpwk3rxtX79nHut9oU3xKf6Xw4V0NB
IsC2DjRgaFvODQJQ5gXy4b4DFzNm6kfyNHU6yJFxisYQmcrCgc72BjJ8oySLukPR
2rU5bO7MhiDWTaPXDF34BuRFDBIVzZj76GEL+u9uvqx24D5ftAqzJgrUuvB0qL0J
RX3OfvWwaQzrIxfzaxCE14W3sSM6p5xozSaAVjjsdpgtXLxR28pdDIhsgSSIX4Mp
TUOTihuGJHqsfzVdpFDCOD7EaHK91YqewjoiqMFBCsMtTvMNLBOtiiVcZdYBhqOJ
kjDA3mTLDageq9gR3Moj8IVxRYX6ItCl9ck8g7bl3Ss8t1vSrsPsucVf2Fn7iQSj
gcuZDSzi70MX
=jyNd
-----END PGP SIGNATURE-----

Control: reopen -1

I fear this is not fixed.

This is fixed.

This not.

This is fixed.

This not.

Helmut

Sorry, and thanks for bearing with me.  Uploaded to experimental again;
updated full NMU debdiff attached.

We believe that the bug you reported is fixed in the latest version of
audit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1061966@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Steve Langasek <vorlon@debian.org> (supplier of updated audit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 31 Jan 2024 20:39:17 +0000
Source: audit
Architecture: source
Version: 1:3.1.2-2.1~exp3
Distribution: experimental
Urgency: medium
Maintainer: Laurent Bigonville <bigon@debian.org>
Changed-By: Steve Langasek <vorlon@debian.org>
Closes: 1061966
Changes:
 audit (1:3.1.2-2.1~exp3) experimental; urgency=medium
 .
   * Proper complete fix for usrmerge.  Closes: #1061966.
Checksums-Sha1:
 d22ad59425b652e9c62c8135d6bc50a9cc81ac12 2789 audit_3.1.2-2.1~exp3.dsc
 e8d006d0137809daf7d961ca4faa1e4a0cb9b265 18784 audit_3.1.2-2.1~exp3.debian.tar.xz
 f04ff6950f123cb9ac3e016e2d670562633ba0b9 6718 audit_3.1.2-2.1~exp3_source.buildinfo
Checksums-Sha256:
 307f649daaab906f78d4d7ae44bf9c55c3bbd4da5e1665661d2ee203deb6f14b 2789 audit_3.1.2-2.1~exp3.dsc
 505b679102050d63fb3bcba8360caef8006efa6c872c9c62fd004ac1ec2a7ee7 18784 audit_3.1.2-2.1~exp3.debian.tar.xz
 06f45feecd338e44d507399e5599bbf5d7cda7eefd95a1c226a34c85db91baa7 6718 audit_3.1.2-2.1~exp3_source.buildinfo
Files:
 dc3dbd2845f75c4f067998635c40bdde 2789 libs optional audit_3.1.2-2.1~exp3.dsc
 01145058c99857f5c0ebf06213cb3a57 18784 libs optional audit_3.1.2-2.1~exp3.debian.tar.xz
 e3e44e2def24a43ffff6523a42bf4589 6718 libs optional audit_3.1.2-2.1~exp3_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEErEg/aN5yj0PyIC/KVo0w8yGyEz0FAmW6sAcSHHZvcmxvbkBk
ZWJpYW4ub3JnAAoJEFaNMPMhshM9EFEP/Rn91raGajan3meWPO7h/1aXrjeywhfV
ixTcpgWuuKOQgVkUU7Ac3Ea8wZk9uxlilWMme1QuPIrQmNhpd4JDI5709JRzeuSp
EAALsynRK3W7Qrl87L1RtICMBQmpoZxhZ1zAh4/8Ezx1vMAebxeOcPHjYje1ueaq
to7IEQ9HOjae5uX5RwE0T9n8iUjyXsbPCo6owZyrGCDHrOiY4moEA/I3ecfoK8UF
u73w6/KBYTeQHBf7uf3MOdgm70zh5AqvWsUglbVp2x9QfYwxlFcZvGRKF5kV/Ty+
+GRUaXrXYOOsEGrRnaZvvOKuWP4MjTd/puwUSSNsA2FDSEU81DKx5crplb5pY6Lf
nXSiWYTqX8FTh839iUzP/73OoPB0AAScDqCCzacscGXm6e2UvL+b/HUOGwUleU3X
lSLgq3Z7YrEJNgIFP3jh7DwJJuI8MsB3ebYddSp0IurSNIlHL29UfUKY9cQlvdmV
QjK0rHGNkrSsVQwBmF3v7Vu76ZdIyk7QRB2gu1EKK7CUezQRd0Lo8/AC/7sphz64
Ur0FzQZonq36B5oOV5/YohAbHy4FgKwOGhm00kqc7f5nnfvIljXkNG+OeUup1scY
XQ84waI093IodvouGw+R0SB4ZMn1W8mJPizAdEOmsRoRa8Hkins88+vsRo8Ygc4B
sc+ZIZtKx20f
=VfpL
-----END PGP SIGNATURE-----

By happenstance I noticed that I had mindlessly hard-coded the
amd64-specific multiarch path into the preinsts.

Please find a really-fixed-this-time NMU patch for experimental.

Helmut pointed out the preinst.in files didn't actually include the token to
be substituted, but instead still had the hard-coded architecture path :/

Attached is the really-really-fixed-this-time NMU patch.

Really-really-really....