Package: release.debian.org
Severity: normal
Tags: bullseye
User: release.debian....@packages.debian.org
Usertags: pu
X-Debbugs-Cc: debian-gl...@lists.debian.org
[ Reason ]
During the upgrade from Buster to Bullseye, the SSH server is not
restarted following the libc6 upgrade, causing new SSH connections to
get rejected until the SSH server is restarted later in the upgrade.
It could be considered as a regression as it didn't happen during the
upgrade from Stretch to Buster.
[ Impact ]
Upgrade might fail or get stuck for remote upgrade using SSH if for some
reason the SSH connection breaks. Using screen or tmux doesn't help here
as it is not possible to connect again using SSH.
[ Tests ]
This is not covered by any automated test. This has been tested using a
VM with a fresh Buster installation. This code is in unstable for a few
days, and no issue has been reported so far.
[ Risks ]
The risk can probably be considered low. If openssh-server fails to
start due to a removed config option, the installation will continue
anyway, after displaying a debconf message that the service has failed
to restart. This will just leave the SSH service disabled, until it get
restarted later in the upgrade.
The alternative is to read the release notes and upgrade openssh-server
before upgrading the full system.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in stable
[x] the issue is verified as fixed in unstable
[ Changes ]
The change consist in updating the regex getting the list of services in
the "installed" state, to also consider openssh-server in 'unpacked'
state.
diff --git a/debian/changelog b/debian/changelog
index 138f350a..a8586063 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+glibc (2.31-13+deb11u1) unstable; urgency=medium
+
+ [ Aurelien Jarno ]
+ * debian/script.in/nsscheck.sh: restart openssh-server even if it has been
+ deconfigured during the upgrade. Closes: #990069.
+
+ -- Aurelien Jarno <aure...@debian.org> Sun, 22 Aug 2021 14:41:36 +0200
+
glibc (2.31-13) unstable; urgency=medium
[ Colin Watson ]
diff --git a/debian/script.in/nsscheck.sh b/debian/script.in/nsscheck.sh
index 8406a543..7e21b8e4 100644
--- a/debian/script.in/nsscheck.sh
+++ b/debian/script.in/nsscheck.sh
@@ -1,8 +1,10 @@
echo -n "Checking for services that may need to be restarted..."
# Only get the ones that are installed, of the same architecture
- # as libc (or arch all) and configured
+ # as libc (or arch all) and configured. Restart openssh-server even
+ # if only half-configured to continue accepting new connections
+ # during the upgrade.
check=$(dpkg-query -W -f='${binary:Package} ${Status}
${Architecture}\n' $check 2> /dev/null | \
- grep -E "installed (all|${DPKG_MAINTSCRIPT_ARCH})$" |
sed 's/[: ].*//')
+ grep -E "(^openssh-server .* unpacked|installed)
(all|${DPKG_MAINTSCRIPT_ARCH})$" | sed 's/[: ].*//')
# some init scripts don't match the package names
check=$(echo $check | \
sed -e's/\bapache2.2-common\b/apache2/g' \
