Dear Maintainer,

Trying to set up cfengine as a policy host in bookworm.

Minimal procedure would be:
1. install cfengine3 on host; enable services in /etc/default/cfengine3
2. make changes in /var/lib/cfengine3/masterfiles (which was populated
from /usr/share/cfengine3/masterfiles during install)
3. bootstrap the host to itself with "cf-agent -B <host's own IP address>"
4. this should result in /var/lib/cfengine3/masterfiles being (verified
and) copied over to /var/lib/cfengine3/inputs and used by the cfengine3
service
5. host is then available as policy host to other devices

Instead, after step 4 the contents of /usr/share/cfengine3/masterfiles
are always copied back to /var/lib/cfengine3/inputs; and it is not
usable as a policy host.

Capturing -v output of the bootstrap run seems to show that
/var/lib/cfengine3/masterfiles/ are copied over correctly first; but are then
replaced by /usr/share/cfengine3/inputs

In comparison, the cfengine-community package v3.21.4 available direct
from the cfengine3 project pages works as expected when following steps
1..5 above (but uses /var/cfengine/ instead of /var/lib/cfengine3).

I encountered this today while trying out CFEngine for the first time,
and was very confused why my changes in /var/lib/cfengine/masterfiles
were being ignored and not copied into /var/lib/cfengine/input as they
should.  As noted in the original report, cf-agent is using
/usr/share/cfengine/masterfiles as the policy source, instead of
/var/lib/cfengine/masterfiles.

The reason why it's looking in the wrong place is that the
controls/update_def.cf policy file sets the
mpf_update_policy_master_location variable to
/usr/share/cfengine3/masterfiles (when running on the policy hub).  The
upstream copy of that file uses /var/cfengine/masterfiles, so Debian is
patching the file to use a different path, but mistakenly patching it
to say /usr/share instead of /var/lib.

The package's /usr/share/cfengine3/masterfiles/controls/update_def.cf
file ought to say /var/lib/cfengine3/masterfiles as the value of
mpf_update_policy_master_location, so that when the directory is copied
to /var/lib/cfengine/masterfiles by the package's postinst, the file
there will correctly point to its own location.

In the meantime, the workaround is to manually edit
/var/lib/cfengine3/masterfiles/controls/update_def.cf and change it to
the correct path.  If the bootstrap has already been done, the copy in
/var/lib/cfengine3/inputs must be manually edited too.