Package: pipewire Version: 0.3.59-1 Severity: serious Justification: Policy §3.5
pipewire calls addgroup without a dependency on the adduser package, which can fail if no other package happens to have pulled in adduser. Until recently, apt hid this bug by depending on adduser, but now the base-passwd package creates the _apt user and it is entirely feasible to remove or not install adduser in container environments. Various packages that are in pipewire's transitive Recommends or otherwise normally installed on desktop-class systems (like dbus-system-bus-common and polkitd) will normally also pull in adduser, again hiding this bug, but polkit now depends on "adduser | systemd-sysusers", and I'm considering doing the same in dbus-system-bus-common. To reproduce: $ podman run --pull=always --rm -it debian:sid-slim # apt update # apt upgrade # apt purge adduser # apt install --no-install-recommends pipewire (Or use your favourite minimal container or chroot technology, if not podman.) Expected result: successful installation. (It's OK if pipewire is only partially functional without its Recommends.) Actual result: > Setting up pipewire:amd64 (0.3.59-1+b1) ... > /var/lib/dpkg/info/pipewire:amd64.postinst: 7: addgroup: not found Options for resolving this include: 1. depend on adduser 2. depend on passwd instead, and use groupadd, like samba does: https://salsa.debian.org/samba-team/samba/-/commit/1eb07efc2fb4d9ed1218e4af367539bcae255b9e (note that passwd is Priority: required but not Essential: yes, so it gets installed by debootstrap but technically still needs a dependency) 3. install /usr/lib/sysusers.d/pipewire.conf containing something like: g pipewire - - then use dh_installsysusers (debhelper compat level 14 or dh --with=installsysusers), but be prepared to get bug reports similar to #1014805, #1016006 from sysvinit users who are upset that debhelper has generated a dependency on "systemd | ..." 4. install /usr/lib/sysusers.d/pipewire.conf as above, but do not use dh_installsysusers, and instead set up the user from handwritten postinst code using systemd-sysusers, adduser and/or groupadd (with an appropriate dependency) I don't think there is yet project consensus on which one of those is best, unfortunately. smcv
