Hi,

Debian CI is switching away from lxc containers in favor of incus Containers.
This is motivated by security concerns from us; incus is based on lxc, but
orchestrates containers substantially different: containers are not privileged
(so root in the container is not uid 0 outside of it, and incus imposes a
stricter isolation from the host system.

dh-nss passes its tests under lxc, but fails under incus.
The relevant part of the failure is (hopefully):
The full autokpgtest logs are available at:
https://ci.debian.net/experiments/8/regressions/
(please beware of pagination)

Common types of failure and suggested fixes are being documented at:
https://wiki.debian.org/ContinuousIntegration/LxcToIncus

Note that for the time being, dh-nss is still being tested under lxc to
avoid disturbing its testing migration test results.

If you decide to add the `isolation-machine` restriction to get this package
tested under qemu, please mention that explicitly when closing this bug (it's
fine to do that only in the package changelog entry that closes the bug) so
that we can configure your package for qemu on ci.debian.net.

We believe that the bug you reported is fixed in the latest version of
dh-nss, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144779@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Gioele Barabucci <gioele@debian.org> (supplier of updated dh-nss package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 20 Aug 2026 01:17:24 +0200
Source: dh-nss
Architecture: source
Version: 1.7.1
Distribution: unstable
Urgency: medium
Maintainer: Gioele Barabucci <gioele@debian.org>
Changed-By: Gioele Barabucci <gioele@debian.org>
Closes: 1144779
Changes:
 dh-nss (1.7.1) unstable; urgency=medium
 .
   * t/dh_installnss: Fix typo
   * t/Test/DH.pm: Sync with debhelper/13.20
   * t/dh_installnss: Run tests with DH_VERBOSE=1
   * d/control: Drop `Priority: optional`, default as of dpkg-dev 1.22.13
   * d/control: Drop `Rules-Requires-Root: no`, default as of dpkg-dev 1.22.13
   * d/control: Update standards version to 4.7.4
   * d/control: Update email address
   * d/t/control: Depend on locales for locale-gen (Closes: #1144779)
   * d/t/shared-functions: Refresh control file of fake packages
Checksums-Sha1:
 06d65d12db96c66e2d315628cdc9a48ad711f522 1908 dh-nss_1.7.1.dsc
 7adfbac749e0c055f57103b99f075849b30c8fc6 15080 dh-nss_1.7.1.tar.xz
 f2f60b965f501d024451f5b6423e4fc15d48be40 29880 dh-nss_1.7.1.git.tar.xz
 5f2433cc0d83885b30e6fcdde1d02b88ab72e96a 17648 dh-nss_1.7.1_source.buildinfo
Checksums-Sha256:
 c044c18649fbf531d88b28065886361b03d3b70043ed662476fe95e0ca075701 1908 dh-nss_1.7.1.dsc
 8334e9a2d4efe633aafb0255aef94c695498dabac8a6707aaf80d2fbc03c43a5 15080 dh-nss_1.7.1.tar.xz
 d78b067ca521183b18ec76815dc4f58fbc16736af9cfbf43b6f81f19c6b9b52e 29880 dh-nss_1.7.1.git.tar.xz
 50990bcbeb541da73920b7b84ddc2ae1d049a8193eedd1a57ed0269b89e43385 17648 dh-nss_1.7.1_source.buildinfo
Files:
 f44287bb667840b97ecd5c624d4b72c2 1908 devel optional dh-nss_1.7.1.dsc
 7ee1d216644a8998bb3d537745a690ae 15080 devel optional dh-nss_1.7.1.tar.xz
 4cd382adb486c20286994d11af8dbdcd 29880 devel None dh-nss_1.7.1.git.tar.xz
 cebab78b8dc0f7ff86948fb12538009e 17648 devel optional dh-nss_1.7.1_source.buildinfo
Git-Tag-Info: tag=2e474cbbbe5dde8bdff62de9fbfb7b51abe9420a fp=02988a8f528fa493e1b98e388f89871cdb75972e
Git-Tag-Tagger: Gioele Barabucci <gioele@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqOIX0ACgkQYG0ITkaD
wHl5Mw//f8XBi6bQd6ZIdbTXkLck/A1Bs8t1S6W3c04jLL1/cOegLFddDhDP0xlt
BmxamCw8BDVyVTgKpxoE2PJkWbcpcOKfuh0UCMM4DADScLOW/SIhCZQC1TAxnHSw
o6kiv/7pLq17NtI/4EjGc9iT/K4xl0L2JGkUsG3NdDkeMJ0OP7nMgGjJtpkadcyQ
VOcr9nayF7oRL9UhFfsqb/MWLrub3yc/b0IktuVmeNT6uo7d0YA7ga0ETNN/8exG
4eEGHiMkZKt1DiIJ1ttopH54wQzzIYO2wQQPdXFY+NS8cl9zYMl4mp0/YmZjQLWL
7OSiXbKCzEIjpoVSX/6Lok9yfvSbOoAPZ0gBt70z9GqAAu8CqtLKy82TQGMtz2BA
80/5lH0X1j70KHvpEhPbDL891a9TyBsg66jmUn8Rb8weLpD89vNexSiQmWItZzMl
8Tna0YQGHookRifdsV04gHJW1QAINIv4Bo5rDPEa9r56ZtkLhS0pqOIlMoTORdpX
0q/tWIxVEmTRZxDxVX5DPPgVAXidTwQceTVSNyKX3O9N8vCM05Npag14ewwwim6C
wJWwK2Knj+RESbArM7vihMk3yiK5nhg1YzD/xlNDCJy9qYrVZDPG/dTbvYfehXzh
i888UlbmVLYt6W0KQhqsU5JVHACUcj1atGmtP7mPdr+Hsl5fyNE=
=Urox
-----END PGP SIGNATURE-----