On my up to date testing system:

# apt-get source samhain

(As root)
# apt install libgmp3-dev libext2fs-dev libauparse-dev

cd samhain-4.1.4/

debuild

dpkg-buildpackage -us -uc -ui
dpkg-buildpackage: Information: Quellpaket samhain
dpkg-buildpackage: Information: Quellversion 4.1.4-5
dpkg-buildpackage: Information: Quelldistribution unstable
dpkg-buildpackage: Information: Quelle geändert durch Sven Geuer <sge@debian.org>
 dpkg-source --before-build .
dpkg-buildpackage: Information: Host-Architektur amd64
dpkg-source: Information: Optionen aus samhain-4.1.4/debian/source/options werden verwendet: --extend-diff-ignore=(^|/)(config\.sub|config\.guess|configure|Makefile)$
 debian/rules clean
dh clean
   debian/rules override_dh_clean
make[1]: Verzeichnis „/tmp/ddcheck/samhain-4.1.4“ wird betreten
[ ! -f Makefile ] || /usr/bin/make distclean
rm -f samhainrc.install
rm -f build-stamp build-server-stamp build-client-stamp
dh_clean
make[1]: Verzeichnis „/tmp/ddcheck/samhain-4.1.4“ wird verlassen
 dpkg-source -b .
dpkg-source: Information: Optionen aus samhain-4.1.4/debian/source/options werden verwendet: --extend-diff-ignore=(^|/)(config\.sub|config\.guess|configure|Makefile)$
dpkg-source: Information: Quellformat »3.0 (quilt)« wird verwendet
dpkg-source: Information: samhain wird unter Benutzung des existierenden ./samhain_4.1.4.orig.tar.gz gebaut
dpkg-source: Information: Patchliste aus debian/patches/series wird verwendet
dpkg-source: Warnung: Löschen der Datei docs/#Changelog# wird ignoriert, verwenden Sie --include-removal zum außer Kraft setzen
dpkg-source: Warnung: Löschen der Datei src/#sh_unix.c# wird ignoriert, verwenden Sie --include-removal zum außer Kraft setzen
dpkg-source: Warnung: neu angelegte leere Datei »typescript« wird im Diff nicht dargestellt werden
dpkg-source: Information: samhain wird in samhain_4.1.4-5.debian.tar.xz gebaut
dpkg-source: Information: samhain wird in samhain_4.1.4-5.dsc gebaut
 debian/rules binary
dh binary
   dh_update_autotools_config
   dh_autoreconf
configure.ac:236: warning: The macro 'AC_HEADER_TIME' is obsolete.
configure.ac:236: You should run autoupdate.
./lib/autoconf/headers.m4:702: AC_HEADER_TIME is expanded from...
configure.ac:236: the top level
configure.ac:1077: warning: The macro 'ACX_PTHREAD' is obsolete.
configure.ac:1077: You should run autoupdate.
aclocal.m4:248: ACX_PTHREAD is expanded from...
configure.ac:1077: the top level
configure.ac:1083: warning: The macro 'CHECK_ZLIB' is obsolete.
configure.ac:1083: You should run autoupdate.
aclocal.m4:81: CHECK_ZLIB is expanded from...
configure.ac:1083: the top level
configure.ac:1119: warning: The macro 'CHECK_ZLIB' is obsolete.
configure.ac:1119: You should run autoupdate.
aclocal.m4:81: CHECK_ZLIB is expanded from...
lib/m4sugar/m4sh.m4:697: AS_IF is expanded from...
./lib/autoconf/general.m4:1553: AC_ARG_WITH is expanded from...
configure.ac:1119: the top level
autoheader: warning: WARNING: Using auxiliary files such as 'acconfig.h', 'config.h.bot'
autoheader: WARNING: and 'config.h.top', to define templates for 'config.h.in'
autoheader: WARNING: is deprecated and discouraged.
autoheader:
autoheader: WARNING: Using the third argument of 'AC_DEFINE_UNQUOTED' and
autoheader: WARNING: 'AC_DEFINE' allows one to define a template without
autoheader: WARNING: 'acconfig.h':
autoheader:
autoheader: WARNING:   AC_DEFINE([NEED_FUNC_MAIN], 1,
autoheader: 		[Define if a function 'main' is needed.])
autoheader:
autoheader: WARNING: More sophisticated templates can also be produced, see the
autoheader: WARNING: documentation.
   debian/rules override_dh_auto_configure
make[1]: Verzeichnis „/tmp/ddcheck/samhain-4.1.4“ wird betreten
./configure --prefix=/usr --mandir=\${prefix}/share/man \
	--with-config-file=/etc/samhain/samhainrc \
	--with-state-dir=/var/lib/samhain  \
	--enable-dnmalloc \
	--disable-asm \
	--enable-network=no  \
	--enable-login-watch \
	--enable-mounts-check \
	--enable-process-check \
	--enable-port-check \
	--enable-suidcheck \
	--with-pid-file=/run/samhain/samhain.pid \
	--with-log-file=/var/log/samhain/samhain.log \
	--build=x86_64-linux-gnu \
	--host=x86_64-linux-gnu \

checking build system type... x86_64-pc-linux-gnu
checking host system type... x86_64-pc-linux-gnu
checking for x86_64-linux-gnu-gcc... x86_64-linux-gnu-gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether the compiler supports GNU C... yes
checking whether x86_64-linux-gnu-gcc accepts -g... yes
checking for x86_64-linux-gnu-gcc option to enable C11 features... none needed
checking how to run the C preprocessor... x86_64-linux-gnu-gcc -E
checking for a BSD-compatible install... /usr/bin/install -c
checking whether ln -s works... yes
checking for gawk... gawk
./configure: line 4515: SH_PROG_LD: command not found
checking for hostname... /usr/bin/hostname
./configure: line 4566: SH_GCC_VERSION: command not found
checking for stdio.h... yes
checking for stdlib.h... yes
checking for string.h... yes
checking for inttypes.h... yes
checking for stdint.h... yes
checking for strings.h... yes
checking for sys/stat.h... yes
checking for sys/types.h... yes
checking for unistd.h... yes
checking for sys/time.h... yes
checking for sys/ipc.h... yes
checking for sys/sem.h... yes
checking for sys/msg.h... yes
checking for sys/uio.h... yes
checking for fcntl.h... yes
checking for OS specific issues... use ioctl to get e2fs flags
checking for dirent.h that defines DIR... yes
checking for library containing opendir... none required
checking for sys/mkdev.h... no
checking for sys/sysmacros.h... yes
checking for sys/time.h... (cached) yes
checking whether stat file-mode macros are broken... no
checking for x86_64-linux-gnu-gcc options needed to detect all undeclared functions... none needed
checking whether sys_siglist is declared... no
checking for stddef.h... yes
checking for libgen.h... yes
checking for sched.h... yes
checking for malloc.h... yes
checking for sys/uio.h... (cached) yes
checking for sys/mman.h... yes
checking for sys/param.h... yes
checking for sys/inotify.h... yes
checking for sys/vfs.h... yes
checking for mntent.h... yes
checking for sys/select.h... yes
checking for sys/socket.h... yes
checking for netinet/in.h... yes
checking for regex.h... yes
checking for glob.h... yes
checking for fnmatch.h... yes
checking for linux/ext2_fs.h... no
checking for linux/fs.h... yes
checking for ext2fs/ext2_fs.h... yes
checking for asm/segment.h... no
checking for elf.h... yes
checking for linux/elf.h... yes
checking for auparse.h... yes
checking for paths.h... yes
checking for arpa/nameser.h... yes
checking for arpa/nameser_compat.h... yes
checking for rpc/rpcent.h... no
checking for rpc/rpc.h... no
checking for sys/statvfs.h... yes
checking for utmpx.h... yes
checking for egrep -e... /usr/bin/grep -E
checking for sys/acct.h... yes
checking for struct statfs.f_flags... yes
checking for x86_64-linux-gnu-gcc option to enable large file support... none needed
./configure: line 6178: SAMHAIN_POSIX: command not found
checking for strftime... yes
checking for memcmp... yes
checking for memcpy... yes
checking for memmove... yes
checking for memset... yes
checking for getpwent... yes
checking for endpwent... yes
checking for fpurge... no
checking for gettimeofday... yes
checking for strlcat... yes
checking for strlcpy... yes
checking for strstr... yes
checking for strchr... yes
checking for strerror... yes
checking for strsignal... yes
checking for seteuid... yes
checking for setreuid... yes
checking for setresuid... yes
checking for lstat... yes
checking for getwd... yes
checking for getcwd... yes
checking for ptrace... yes
checking for usleep... yes
checking for setpriority... yes
checking for getpeereid... no
checking for nanosleep... yes
checking for strptime... yes
checking for basename... yes
checking for sched_yield... yes
checking for hasmntopt... yes
checking for inet_aton... yes
checking for gethostbyname... yes
checking for setutent... yes
checking for setrlimit... yes
checking for gethostname... yes
checking for uname... yes
checking for initgroups... yes
checking for getpagesize... yes
checking for ttyname... yes
checking for fchmod... yes
checking for writev... yes
checking for mmap... yes
checking for tzset... yes
checking for getsid... yes
checking for getpriority... yes
checking for getpgid... yes
checking for statvfs... yes
checking for strerror_r... yes
checking for getgrgid_r... yes
checking for getpwnam_r... yes
checking for getpwuid_r... yes
checking for gmtime_r... yes
checking for localtime_r... yes
checking for rand_r... yes
checking for readdir_r... yes
checking for strtok_r... yes
checking for mincore... yes
checking for posix_fadvise... yes
checking for inotify_init1... yes
checking for statfs... yes
./configure: line 6604: SL_CHECK_VA_COPY: command not found
checking for vsnprintf... yes
./configure: line 6612: SL_CHECK_VSNPRINTF: command not found
./configure: line 6616: SH_STRFTIME_Z: command not found
checking how to get filesystem type... 4.3BSD
checking for gethostbyname in -lnsl... yes
checking for socket in -lsocket... no
checking for gethostbyname in -lnsl... (cached) yes
checking for res_search in -lsocket... no
checking for res_search in -lresolv... yes
checking for getnameinfo... yes
checking for getaddrinfo... yes
checking for auparse_find_field in -lauparse... yes
checking for socklen_t... yes
./configure: line 7337: sh_CHECK_XATTR: command not found
./configure: line 7350: sh_CHECK_POSIX_ACL: command not found
checking for long double... yes
./configure: line 7400: syntax error near unexpected token `long'
./configure: line 7400: `SH_CHECK_TYPEDEF(long long, HAVE_LONG_LONG)'
make[1]: *** [debian/rules:44: override_dh_auto_configure] Fehler 2
make[1]: Verzeichnis „/tmp/ddcheck/samhain-4.1.4“ wird verlassen
make: *** [debian/rules:41: binary] Fehler 2
dpkg-buildpackage: Fehler: Unterprozess debian/rules binary lieferte Exitstatus 2
debuild: fatal error at line 1184:
dpkg-buildpackage -us -uc -ui failed

Hello.

I tried building samhain on testing and it worked for me.

Can you try building it with sbuild on a chroot using only build-essential packages?

I would really worry if it also fails to build that way. For now it
seems there is something wrong in your system, or maybe you have
discovered an undeclared build-conflict, or your testing system
contains packages not in testing.

Thanks.

severity 1099415 important
thanks

Hello Santiago,
Am Mon, Mar 03, 2025 at 12:51:17PM +0100 schrieb Santiago Vila:

Ok, I was really suprised myself and tried it twice in my main system.

In a sid chroot samhain builds for me.

I pasted the build log on my system, if that gives you a hint?

I installed upstream Mediathekview but otherwise all packages on this
system come from Debian, however I did not check if some packages were
removed from Testing.

I'm happy to help investigating this, if you tell me what I should
look for.

Greetings

            Helge

El 3/3/25 a las 13:20, Helge Kreutzmann escribió:

I see very funny differences:

(in what follows, "before" is mine and "after" is yours)

Hello Santiago,
Am Mon, Mar 03, 2025 at 01:53:25PM +0100 schrieb Santiago Vila:

Ok. So far, this has not been visible.

$ gcc --version
gcc (Debian 14.2.0-16) 14.2.0
Copyright (C) 2024 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

It does work. A few hours ago I just complied a small programme, and
once in while I compile Debian packages (mainly to see if I can do an
L10n NMU).

Please find the diff attached. One == good-tree and two = bad-tree

Also attached. It' pretty difficult to read, but e.g.
-gcc version 14.2.0 (Debian 14.2.0-17)
+gcc version 14.2.0 (Debian 14.2.0-16)
installed, in the chroot only mawk.

But this does not change the "good" build (succeeds with both). So
this is a false hint.

Next, on the good (chroot) only:
configure:4515: checking for ld used by x86_64-linux-gnu-gcc
configure:4581: result: /usr/bin/X11/ld
configure:4588: checking if the linker (/usr/bin/X11/ld) is GNU ld
configure:4605: result: yes

Howver, ld is installed in both environments, and /usr/bin/X11/ld is
present the same way in both.

On the good build (only) I have:
configure:4663: checking for gcc version
configure:4679: result: 14

(and in subsequent lines these appear only on the good chroot).

Later on, only on the good system:
configure:6302: checking whether _POSIX_SOURCE is necessary
…

And then later on it diverges more.

I guess my complier / building knowledge is more than exceeded here,
so sorry, that I cannot be of any help further (but of course, I can
run further commands if necessary).

Greetings

          Helge

      Dr. Helge Kreutzmann                     debian@helgefjell.de
           Dipl.-Phys.                   http://www.helgefjell.de/debian.php
        64bit GNU powered                     gpg signed mail preferred
           Help keep free software "libre": http://www.ffii.de/

-gcc version 14.2.0 (Debian 14.2.0-17)
+gcc version 14.2.0 (Debian 14.2.0-16)

Note: gcc-14 in trixie is still at version 14.2.0-16, so you
are still comparing the good build you made in unstable
with the build made natively on your trixie system.

As a result, the diff has a lot of unwanted noise.

Either upgrade your system to unstable and compare
good and bad builds both made in unstable, or build it in a
trixie chroot to compare good and bad builds both made in trixie.

Also, use deborphan from bookworm to remove any package which
you don't really need, including binutils-gold (I don't think
it's related but who knows).

If it still fails, you could start adding packages to your chroot which
you know they are also installed in your native system until
the build also fails in the chroot. If there is an undeclared
build-conflict, that would be the way to tell.

If everything else fails, consider reinstalling your testing system
from scratch. At some point, doing that will be less time-consuming
than debugging the problem. Your system seems to be messed up.

Thanks.

Hello Santiago,
thanks for your review.

Am Mon, Mar 03, 2025 at 03:44:13PM +0100 schrieb Santiago Vila:

Yes, currently I only have an Unstable and Stable chroot, not Trixie,
but of course I can install it.

Yes, that's true. For my "analysis" I looked at the vimdiff, where I
had hoped to see the cause.

Well, the first is not an option (I run in Testing on purpose). If I
find time I can maybe try the latter.

No, unfortunately removing this and binutils-gold-x86-64-linux-gnu did
not change anything.

And I checked deborphan - it's removed from Debian for serious reasons
by it's maintainer, so I would not want to install an old version on
the system.

Well, if I had an idea *which* package could cause this potential
hidden build-conflict I could try this, but for randomly adding
packages I'm afraid I'm lacking the time.

Well, for debugging a potential problem in samhain (a programm I've
never used) this is a bit big "workload". And I'm really not conviced
that my system "is messed up". All other workloads, including
occassionally building programms, work fine (except the bugs
you can find under my name in the BTS, of course).

So if I find time today, I'll check the Trixie chroot output, but
otherwise I guess there's no further debugging possibly right now.

Greetings

          Helge

Well, I still use deborphan to remove cruft from my chroots
(the ones I use for archive rebuilds), and I can tell you
that it's still useful, at least for me. The reason it was
removed from trixie is that in trixie it may have false positives,
but the tool by itself does nothing when invoked from the command
line, it just tell what would be a candidate to be removed.
(i.e. it's not "dangerous").

You can also try debfoster to remove cruft, which still exists
in trixie.

And finally, you can try this script I use from time to time,
called "installed-packages-which-do-not-exist-in-trixie" which
has a self-explanatory name (needs wget to work).

Thanks.

Hello Santiago,
thanks for your e-mails, I saw your most recent e-mail.

I installed a trixie chroot now, but there is nothing new in diffs.

I now compared configure in both my main system (not working,-) and the
Trixie chroot (working,+):
--- ../tbuild/samhain-4.1.4/configure   2025-03-03 17:06:35.389011407 +0100
+++ samhain-4.1.4/configure     2025-03-03 16:03:50.371638797 +0100
@@ -677,18 +677,18 @@
 myport
 mydebugdef
 HAVE_MYSQL_CONFIG
-PTHREAD_LDFLAGS
 PTHREAD_CFLAGS
 PTHREAD_LIBS
+PTHREAD_CXX
 PTHREAD_CC
-acx_pthread_config
+ax_pthread_config
+SED
 clmytclient
 mytclient
 sh_main_prg
 samhainadmin_prg
 yulectl_prg
 setpwd_prg
-tiger_src
 sh_libsocket
 selectconfig
 cmd_hostname
@@ -772,6 +772,7 @@
 with_libwrap
 enable_network
 enable_static
+with_zlib
 with_database
 with_console
 with_altconsole
@@ -1492,6 +1493,9 @@
   --with-cflags                        additional flags to pass to compiler
   --with-libs                          additional libraries to link with
   --with-libwrap=PATH          Compile in libwrap (TCP Wrappers) support
+  --with-zlib=DIR         root directory path of zlib installation [defaults to
+                          /usr/local or /usr if not found in /usr/local]
+  --without-zlib          to disable zlib usage completely
   --with-database=[mysql|postgresql|oracle|odbc]       database support [no]
   --with-console=PATH           set path to console device [/dev/console]
   --with-altconsole=PATH        set path to second console device [none]

And the config.log still shows the same diff, still noisy because of the
changing line numbers, but in the first part the build from the chroot
shows the following addtional:
-configure:4515: checking for ld used by x86_64-linux-gnu-gcc
-configure:4581: result: /bin/ld
-configure:4588: checking if the linker (/bin/ld) is GNU ld
-configure:4605: result: yes
-configure:4663: checking for gcc version
-configure:4679: result: 14

I already tried installing some PTHREAD packages[1] in the chroot (which
I have on my main system), but the build in the chroot continues to
succeed with them).

I'm quite a bit beyond my knowledge now, and I have no idea why
PTHREAD_LDFLAGS is not, but PTHREAD_CXX is used on my main system and
the acx_pthread_config → ax_pthread_config seems also to indicate some
package changing things.

(And now idea what "tiger_src" is).

Zlib is identically inside and outside the chroot.

That's it for now.

Greetings

         Helge

[1] libpthread-stubs0-dev libpthreadpool0 libopenblas0-pthread

retitle 1099415 samhain is missing build conflict on autoconf-archive
# Severity is fine
thanks

After more diagnosis (thanks Santiago) it turned out thet install
autoconf-archive make samhain FTBFS.

Please install the appropriate build conflicts.

Greetings

           Helge

tags 1099415 pending
thanks

This bug has been fixed in the GIT repo:
https://salsa.debian.org/pkg-security-team/samhain/-/commit/3ed6d1b687ed700e12b4e0dd369cc55101859626


It should be closed in the next package uploaded.

Best regards

Javier

We believe that the bug you reported is fixed in the latest version of
samhain, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1099415@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Sven Geuer <sge@debian.org> (supplier of updated samhain package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 06 Sep 2025 21:05:45 +0200
Source: samhain
Architecture: source
Version: 4.1.4-7
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Sven Geuer <sge@debian.org>
Closes: 868158 1097839 1099415 1107458 1111631
Changes:
 samhain (4.1.4-7) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Javier Fernández-Sanguino Peña ]
   * Add build conflict on autoconf-archive to prevent FTBFS (Closes: #1099415)
   * debian/samhain.init: Instead of using hard-coded path of
     /var/lib/samhain/samhain_file for the location of the database, check the
     configuration file. This prevents samhain from failing in case the
     administrator has changed its location (Closes: #868158)
 .
   [ Sven Geuer ]
   * d/rules:
     - Quick fix to make samhain 4.1.4 buildable using GCC-15 (Closes: #1097839)
     - Quick fix preventing potential segfaults (Closes: #1111631)
       Thanks to Aurelien Jarno <aurel32@debian.org> for debugging and
       providing a patch.
   * Update Portuguese debconf template translations (Closes: #1107458)
     Thanks to Américo Monteiro <a_monteiro@gmx.com> for providing it.
Checksums-Sha1:
 5085daa599fd8eab9fff795188a709ea82edf05f 2087 samhain_4.1.4-7.dsc
 09b9348e6d240d41e63db49d798391a6e5936a11 105212 samhain_4.1.4-7.debian.tar.xz
 5c52eb06cc34ff3be574919f82ebca71634563c5 6354 samhain_4.1.4-7_amd64.buildinfo
Checksums-Sha256:
 305cc20ee8c19c500178c7e0ef0e4c92d964fc4f8d662e507ae031146dd42c15 2087 samhain_4.1.4-7.dsc
 c59a9082cd25453c22f0fa169657f81bfc89262f014c10a07d1a732c9bfb26b7 105212 samhain_4.1.4-7.debian.tar.xz
 4214f86d15dc0e96d09cbb5c7512fab056da0f16ec2b3cee06223c85dcb5a491 6354 samhain_4.1.4-7_amd64.buildinfo
Files:
 4d14822501be1ee4532d4fd14cb703ad 2087 admin optional samhain_4.1.4-7.dsc
 6efbd8ff4223382640428864d6710736 105212 admin optional samhain_4.1.4-7.debian.tar.xz
 5685418dd5881da8f875b36101fe4dd4 6354 admin optional samhain_4.1.4-7_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmi8h3QPHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFyUQQAKvCsC+O+U6l+m5MKsRRxukFlO6nh/h2zbna
X6L3m88qhCUOM/tfT7XRh95vU3YDTdvWCIOBoqzdHXoNaGY19lUE1ujMppsHuz+O
q+Tuo3ssvOhCL4CLWe/MRhdQVG5PXTElOvQmBwIWMemtqav7Bldr3DjADDkQekpi
tyVTPwuGccqBeG+W0wJmP5k+ogBD6mLQukGMrkTkLVzCYk0vNx0P2t6hv70xnSJE
zjGzqnpn9+9C1/zhkjDeiYcOPG39ugh9pWU3VAfgP4hvY9UoJVWEdbezKmth52wO
WA8NhkzLMImnJEvWi489KPuKZvpUZRHzT4jkDbjhcsauyWgGsZPkrMIALJ+LyYEp
ECiSwA/yypTo93p/19Y5WoaFUaKLUpmqn6Oz5oECyuxlTKezNuuYnm9m4FL0h4Sh
AouXirYnZNauWaBx3OzC8RuJREQadUlIkAW3vcMxmU8Xh7P05D7jwTA9a3H4B1yn
yE7Vqw4mNoLGNrwPpNeOiiaiCOrVktRxlwSwdQ1QkqXkNZFeMDP3WlFb23oviGmi
rUI3vR7Tki0sRLcArdfsSHiGLt4ELNaOH+/Ekm1ohxREjMfTpY8nVJxJPhP+Jslj
aCBrFyFi16M6oHiVfI/DzGAaXDkmPoOpwUl6H0PyQo83jZ7/u5i9V1JMVWmzP6wP
bm8m06jZ
=EbdG
-----END PGP SIGNATURE-----