Dear maintainer(s),

I looked at the results of the autopkgtest of your package. I noticed
that it regularly fails, at least on s390x. I triggered 5 runs and 2
failed. I hope I copy/pasted the relevant part below.

Because the unstable-to-testing migration software now blocks on
regressions in testing, flaky tests, i.e. tests that flip between
passing and failing without changes to the list of installed packages,
are causing people unrelated to your package to spend time on these
tests.

Don't hesitate to reach out if you need help and some more information
from our infrastructure.

Paul

https://ci.debian.net/packages/c/chkrootkit/testing/s390x/74480411/

532s ** FAIL: Testing: all-tests-can-find-something-01 (chkrootkit -p
/tmp/clean) done: FAIL
532s *** FAIL was with config set to:
532s RUN_DAILY=true
532s RUN_DAILY_OPTS='-q'
532s DIFF_MODE=true
532s MAILTO=root
532s
532s *** Reason(s) for failure follows
532s Result: FAIL
532s
532s Missing: ^Checking `sshd'\.\.\.
      INFECTED but disabled$
532s *** Unexpected (unmatched) lines follow (for info):
532s Checking `sshd'...                                          INFECTED
532s erspan0: not promisc and no packet sniffer sockets
532s gre0: not promisc and no packet sniffer sockets
532s gretap0: not promisc and no packet sniffer sockets
532s ip6_vti0: not promisc and no packet sniffer sockets
532s ip6gre0: not promisc and no packet sniffer sockets
532s ip6tnl0: not promisc and no packet sniffer sockets
532s ip_vti0: not promisc and no packet sniffer sockets
532s sit0: not promisc and no packet sniffer sockets
532s tunl0: not promisc and no packet sniffer sockets

I think what is happening is that a running (and unrelated) sshd is
sometimes visible from the testbed and sometimes not (which influences
the output). The autopkgtest wrongly assumed it would be consistent .
i assume different test runners have different settings and that's why
it looks flaky

But i think there's some other issue that needs a bit more
investigating by me (i will loook in the next 2 weeks):
- how can sshd ever be visible from the testbed?
- why doesnt the following test with -q fail in the same way.
- (is the upstream code for seeing if sshd is running correct? )

(nb - add a "ps ax" to the info section at the start of the test to
have more info about the testbed!)

Hi Richard,

Looking at https://ci.debian.net/packages/c/chkrootkit/testing/s390x/
it seems the issue is related to the incus-lxc backend, introduced
after 2026-07-30 22:13:25 UTC. Earlier tests, run on lxc, passed.

Sven

thanks -- looking at
https://wiki.debian.org/ContinuousIntegration/LxcToIncus the lxc backend
incldues sshd (!) it's correctly missing from incus.

except isnt this one
https://ci.debian.net/data/autopkgtest/testing/s390x/c/chkrootkit/74450913/log.gz
is incus and passing. And there's not anything obviously arch-specific
about this -- we should be seeing all the other arch's being equally flaky,
and they dont seem to be.

(if anyone can  reproduce the failure, i would be curious to see what

bash -xv chkrootkit sshd

ps ax | grep sshd

return on a s390 system where it fails)


(But looking further: I dont actually see how the message seen on s390
could ever be produced in a functioning system --- it would need "ps ax
sshd | grep -E sshd" to _fail_, which is never going to happen: the grep
will match its own process in the output of ps  (which is a bug in
chkrootkit - but this is offset by a second bug as the test is backwards...
luckily this only affects systems with a rootkit in sshd..... and there's a
3rd issue in that 'chkrootkit -q sshd' never reports anything ). so
something else is perhaps broken/flaky in s390, but i suspect fixing the
issues in chkrootkit and its tests will probably resolve the failure)

On Sun, 23 Aug 2026 at 23:56, Richard Lewis <richard.lewis.debian@googlemail.com> wrote:

in the meantime, i pushed some commits that should fix this - i havnt
tested in incus but it should work

Hi Richard,

I'll be looking into it.

Sven

We believe that the bug you reported is fixed in the latest version of
chkrootkit, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144950@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Richard Lewis <richard.lewis.debian@googlemail.com> (supplier of updated chkrootkit package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 24 Aug 2026 21:29:47 +0100
Source: chkrootkit
Architecture: source
Version: 0.59-2
Distribution: unstable
Urgency: medium
Maintainer: Debian Security Tools <team+pkg-security@tracker.debian.org>
Changed-By: Richard Lewis <richard.lewis.debian@googlemail.com>
Closes: 1144950
Changes:
 chkrootkit (0.59-2) unstable; urgency=medium
 .
   [ Alexandre Detiste ]
   * rename files under debian/ for upcoming debhelper 14/15 compatibility
 .
   [ Richard Lewis ]
   * Fix chk_sshd to more correctly report its results (Closes: 1144950)
   * Fix non-reporting of "INFECTED but disabled" messages with -q
   * Add openssh-{client,server}-gssapi and account-utils-passwd to Enhances
   * Update autopkgtests and debian/test/find-debs-that-are-enhanced
   * Switch to debhelper v14
 .
   [ Sven Geuer ]
   * d/control: Drop all ${*:Depends} substvar mentionings. They became
     obsolete with debhelper v14.
Checksums-Sha1:
 34beded13bf72c5082ddeac059e2b24b1d6b3a4c 2099 chkrootkit_0.59-2.dsc
 0135478ea4e799d527cc54fa53fdd55a7b8ca756 90212 chkrootkit_0.59-2.debian.tar.xz
 2d6a6279622e5293b3b73a3ff7c1e233eaee0a97 5507 chkrootkit_0.59-2_amd64.buildinfo
Checksums-Sha256:
 bb8f93927889e3f0c75f516ad79ea371e1206bae63fd0ebfcec4d4eec1e2012c 2099 chkrootkit_0.59-2.dsc
 7ed35f53d16d96d478fed2981c8830fd9c20d793b22c7a2963e39e9a73d24d2f 90212 chkrootkit_0.59-2.debian.tar.xz
 50f9e955999f331f5495e572be42d786887af79e4bfa292cb9b9c7d86099d05b 5507 chkrootkit_0.59-2_amd64.buildinfo
Files:
 3100713f7659181c37087717726cc357 2099 misc optional chkrootkit_0.59-2.dsc
 c98248cd0c7e4217e3b3aa979444cb8a 90212 misc optional chkrootkit_0.59-2.debian.tar.xz
 0d05b594133f76d3334c16e80ee2d9e8 5507 misc optional chkrootkit_0.59-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJDBAEBCgAtFiEEPfXoqkP8n9/QhvGVrfUO2vit1YUFAmqfH2IPHHNnZUBkZWJp
YW4ub3JnAAoJEK31Dtr4rdWFJJ8P+QH1Mz5neu2vxd1FiDgO0XQnFOnbd9DlQxCb
Zu9rqaKt2Nvj88sMtkzk1SrWR0iwi7uHB1wtEp1OP1I4Zuu8kEPjpFoRPaoRZnnP
Od7w3g45WYeK0lzBYj6SMwx6VbOI3jUuESi+Y/c0TsyxadgJngUdJICCmkcr0L0i
gQkaEgH7rILvipaj0+T7N6Z7b57W51zABRQgThQiPApDyqUMJVJBLDcLa3RGXLOc
/fhUEFnuRClIZnfWU2QqqPZka2eBOqaVzZV3HToQc3gsXynnVAEsGkN9R6w6bZBd
SgAfOjJIHj/qlR9zaV9bfIiGqU3ofTHJq/b68gHir/LlpfVMoX1WIt6kZoLIW18w
OCR5I1D5+gOQQycM7AuPBV50fOvEkVhwaZyMrB6PG4jD30a99LoUw/YFUAuSW9rI
Fr2f+u0OvRf9Aa+efkgTlR3qCuWxuN6CircEmq/Qmj+89ndRVUYZv2DPLYKmABic
RVI/+Ua5MKXBjcNzO/KF2PwKqZStCXTyiaITDC1vpL0K8vJaEOLmLehlGuIHyfjL
ZaxaLHZJv+YpK1ld1CJXyZ1mztaVUvvOt32+N85lw5Apvmg3cHYKqK6eHexMUZMd
ULJpHOOf7Wzu3/FbdORnXIhlVwcBXD1p+0wDHEOqJ+Yl1cnGq0HGROW7CuLCMSBW
zVmYXtx9
=mLBv
-----END PGP SIGNATURE-----