Bug#1059746: ucf: Symlinks followed before looking up dpkg-divert

[Alexis Murzeau]

Hi,

On Fri, 10 Jan 2025 16:45:05 +0000 Mark Hindley <m...@hindley.org.uk> wrote:

Hristo,

Thanks for this. I have been giving it some thought, but it is a thorny issue
and I have not found a good solution (yet?).

The root of the issue is alluded to in Debian Policy[1]: sharing and diverting
configuration files is at best discouraged and likely to be broken.

On that basis I am minded to close this as wontfix. Does that seem reasonable?

Mark

[1]  
https://www.debian.org/doc/debian-policy/ch-files.html#sharing-configuration-files

I got into the same issue while using config-package-dev
(https://debathena.mit.edu/config-packages/).
I have a configuration package that divert `sshd_config`.



This is the same issue, but I'm using apt without force-new or anything.


I've followed the patch on #477773 from debathena page.





Put the dpkg-divert check in a function "follow_divert"
Call that function in "handle_file_args" function:

```
follow_divert() {
        dest_file="$1"
        opt_package="$2"

        # Follow dpkg-divert as though we are installed as part of $opt_package
        divert_line=$(dpkg-divert --listpackage "$dest_file")
        if [ -n "$divert_line" ]; then
                # name of the package or 'LOCAL' for a local diversion
                divert_package="$divert_line"

                if [ "$divert_package" != "$opt_package" ]; then
                        dest_file=$(dpkg-divert --truename "$dest_file")
                fi
        fi

        echo "$dest_file"
}
[...]

handle_file_args() {
[...]
        temp_new_file="$1"
        temp_dest_file=$(follow_divert "$2" "$opt_package")
[...]
}
```

What do you think ?


--
Alexis Murzeau
PGP: B7E6 0EBB 9293 7B06 BDBC  2787 E7BD 1904 F480 937F                |

But when upgrading openssh-server, ucf prompt the user as it detects changes in the symlinked config file. It seems that the added dpkg-divert check was already after the readlink at that time, so I'm wondering if the implementation ever worked. I tried to just implement what Hristo proposed and didn't find it too much hacky:

OpenPGP_0xE7BD1904F480937F.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature