Hi Josch,

During use of Debusine, I was faced with a very strange piuparts error.
The relevant workrequest sadly is private, but the gist is that debsums
was complaining about a checksum error for start-stop-daemon. After a
while, I investigated the base image passed to piuparts and ran dpkg
--verify there. It was also unhappy about start-stop-daemon. This image 
was created using mmdebstrap and this is where we get into the problem I
am trying to report.

The distribution at hand was Ubuntu xenial. It is a bit special in that
it presently has a dpkg security update. What happened here is roughly
this:
 * All essential packages are extracted (without the security update).
 * mmdebstrap replaces start-stop-daemon.
 * Remaining packages are installed and this includes the dpkg security
   update.
 * mmdebstrap moves back the replaced start-stop-daemon.

A relatively simple way to reproduce this is simulating a dist-upgrade.

mmdebstrap --variant=apt bookworm /tmp/upgraded.tar --chrooted-customize-hook='sed -i -e s/bookworm/trixie/ /etc/apt/sources.list && apt-get update && apt-get dist-upgrade'

The problem happens after the customization stage, so we actually need
to emit some image and run dpkg --verify inside to see the problem.

Beyond this, I don't think the replacement of start-stop-daemon ever
worked as intended, because start-stop-daemon is being replaced before
the essential packages unpacked, so dpkg overwrites it.

| mmdebstrap --variant=essential sid /dev/null --chrooted-customize-hook='ls -la /sbin/start-stop-daemon*'
...
| I: running --chrooted-customize-hook in shell: sh -c 'ls -la /sbin/start-stop-daemon*'
| -rwxr-xr-x 1 root root 44464 Jun 30 23:32 /sbin/start-stop-daemon
| -rwxr-xr-x 1 root root 44464 Jun 30 23:32 /sbin/start-stop-daemon.REAL

As far as I can see, the proper solution here is using dpkg-divert and
creating local diversions, no?

Of course this code is cargo culted from debootstrap and likely exists
to maximize compatibility with it. deboostrap cannot easily use
diversions, so there is that.

Replacing start-stop-daemon is also something we haven't needed in a
long time. Since moving to systemd, we aren't using start-stop-daemon
much at all and even before, sysvinit was already using invoke-rc.d and
policy-rc.d for a long time. Is this code actually needed still?

My impression is that you would like to retain compatibility with very
old releases where this is still needed and diversions should work
there.

We've discussed this on IRC now and you've already applied the attached
patch to your develop upstream branch despite it failing the salsa-ci
pipeline for bsdutils having become non-essential. Thank you. I'm
attaching a copy for reference.

Helmut