Debian Bug report logs - #843722
wants to write to /usr/local

Display info messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Thomas Lange <lange@informatik.uni-koeln.de>

To: submit@bugs.debian.org

Subject: wants to write to /usr/local

Date: Wed, 9 Nov 2016 05:07:35 +0100

Package: ca-certificates
Version: 20161102

My /usr/local file system is mounted read-only via NFS. This results
in an error:


stretch[~]# dpkg --configure ca-certificates
Setting up ca-certificates (20161102) ...
chmod: changing permissions of '/usr/local/share/ca-certificates': Read-only file system
dpkg: error processing package ca-certificates (--configure):
 subprocess installed post-installation script returned error exit status 1
 Errors were encountered while processing:
  ca-certificates
  
-- 
regards Thomas

Message #10 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Michael Shuler <michael@pbandjelly.org>

To: Thomas Lange <lange@informatik.uni-koeln.de>, 843722@bugs.debian.org

Subject: Re: Bug#843722: wants to write to /usr/local

Date: Wed, 9 Nov 2016 10:30:04 -0600

On 11/08/2016 10:07 PM, Thomas Lange wrote:
> My /usr/local file system is mounted read-only via NFS. This results
> in an error:
> 
> 
> stretch[~]# dpkg --configure ca-certificates
> Setting up ca-certificates (20161102) ...
> chmod: changing permissions of '/usr/local/share/ca-certificates': Read-only file system
> dpkg: error processing package ca-certificates (--configure):
>  subprocess installed post-installation script returned error exit status 1
>  Errors were encountered while processing:
>   ca-certificates

Thanks for the report. I'd bet we can come up with a conditional to
check this gracefully, so post-inst does not outright fail in this scenario.

-- 
Kind regards,
Michael

Message #15 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Thomas Lange <lange@informatik.uni-koeln.de>

To: 843722@bugs.debian.org

Date: Sun, 1 Jan 2017 19:40:08 +0100

There's still no fix. Do you need help for a fix?
-- 
regards Thomas

Message #20 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Michael Shuler <michael@pbandjelly.org>

To: Thomas Lange <lange@informatik.uni-koeln.de>, 843722@bugs.debian.org

Subject: Re: Bug#843722: (no subject)

Date: Tue, 3 Jan 2017 13:16:45 -0600

On 01/01/2017 12:40 PM, Thomas Lange wrote:
> There's still no fix. Do you need help for a fix?

If you have a patch idea, that would be great! Apologies for the delay
in getting something together to reproduce and test a fix.

-- 
Kind regards,
Michael

Message #25 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Antoine Beaupre <anarcat@orangeseeds.org>

To: Michael Shuler <michael@pbandjelly.org>, 843722@bugs.debian.org

Cc: Thomas Lange <lange@informatik.uni-koeln.de>

Subject: Re: Bug#843722: (no subject)

Date: Mon, 27 Mar 2017 10:37:59 -0400

[Message part 1 (text/plain, inline)]

On Tue, Jan 03, 2017 at 01:16:45PM -0600, Michael Shuler wrote:
> On 01/01/2017 12:40 PM, Thomas Lange wrote:
> > There's still no fix. Do you need help for a fix?
> 
> If you have a patch idea, that would be great! Apologies for the delay
> in getting something together to reproduce and test a fix.

how about this?

diff --git a/debian/ca-certificates.postinst b/debian/ca-certificates.postinst
index 21586bb..8db857c 100644
--- a/debian/ca-certificates.postinst
+++ b/debian/ca-certificates.postinst
@@ -47,8 +47,8 @@ case "$1" in
         # Handle upgrades and allow local admin to override:
         # e.g. dpkg-statoverride --add root staff 2775 /usr/local/share/ca-certificates
         elif ! dpkg-statoverride --list /usr/local/share/ca-certificates >/dev/null; then
-            chmod $(stat -c %a /usr/local) /usr/local/share/ca-certificates
-            chown $(stat -c %u /usr/local):$(stat -c %g /usr/local) /usr/local/share/ca-certificates
+            chmod $(stat -c %a /usr/local) /usr/local/share/ca-certificates || true
+            chown $(stat -c %u /usr/local):$(stat -c %g /usr/local) /usr/local/share/ca-certificates || true
         fi
 
         . /usr/share/debconf/confmodule

i am really not sure why the package needs to mess around with
/usr/local/ - i looked at the history, and it mostly seems designed as
"a means to add local certificates" (#476663) which hardly needs the
package to manage that directory at all: it would merely suffice to
document its use.

i would therefore recommend fixing the package like the above, but
*remove* the `mkdir` call completely so that, in the future, we merely
fix ownership for those directories and, eventually, remove the empty
ones.

a.

[signature.asc (application/pgp-signature, inline)]

Message #30 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Thomas Lange <lange@informatik.uni-koeln.de>

To: 843722@bugs.debian.org

Subject: I've tested the fix

Date: Mon, 17 Apr 2017 22:22:01 +0200

The fix works for me. Please try to fix it soon, so the fixed version
will be going into the stretch release.
-- 
regards Thomas

Message #35 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Michael Shuler <michael@pbandjelly.org>

To: Antoine Beaupre <anarcat@orangeseeds.org>, Thomas Lange <lange@informatik.uni-koeln.de>, 843722@bugs.debian.org

Subject: Re: Bug#843722: I've tested the fix

Date: Mon, 17 Apr 2017 15:36:43 -0500

On 04/17/2017 03:22 PM, Thomas Lange wrote:
> The fix works for me. Please try to fix it soon, so the fixed version
> will be going into the stretch release.

Thanks for the patch, Antoine, and confirmation, Thomas - I'll get an
upload ready as soon as I can.

-- 
Kind regards,
Michael

Message #42 received at 843722@bugs.debian.org (full text, mbox, reply):

From: Thomas Lange <lange@informatik.uni-koeln.de>

To: 843722@bugs.debian.org

Subject: please upload the fix

Date: Mon, 26 Jun 2017 17:04:41 +0200

It would be very nice if you could upload a new version fixing this
issue in the next two weeks.
-- 
regards Thomas

Message #49 received at 843722-close@bugs.debian.org (full text, mbox, reply):

From: Michael Shuler <michael@pbandjelly.org>

To: 843722-close@bugs.debian.org

Subject: Bug#843722: fixed in ca-certificates 20170717

Date: Mon, 14 Aug 2017 16:19:20 +0000

Source: ca-certificates
Source-Version: 20170717

We believe that the bug you reported is fixed in the latest version of
ca-certificates, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 843722@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Shuler <michael@pbandjelly.org> (supplier of updated ca-certificates package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 20 Jul 2017 00:18:08 -0500
Source: ca-certificates
Binary: ca-certificates ca-certificates-udeb
Architecture: source all
Version: 20170717
Distribution: unstable
Urgency: medium
Maintainer: Michael Shuler <michael@pbandjelly.org>
Changed-By: Michael Shuler <michael@pbandjelly.org>
Description:
 ca-certificates - Common CA certificates
 ca-certificates-udeb - Common CA certificates - udeb (udeb)
Closes: 721976 843722 858064
Changes:
 ca-certificates (20170717) unstable; urgency=medium
 .
   * Update to Standards-Version: 4.0.1
   * debian/ca-certificates.postinst:
     Prevent postinst failure on read-only /usr/local. Closes: #843722
   * mozilla/certdata2pem.py:
     Remove email-only roots from mozilla trust store. Closes: #721976
   * mozilla/{certdata.txt,nssckbi.h}:
     Update Mozilla certificate authority bundle to version 2.14.
     Closes: #858064
     The following certificate authorities were added (+):
     + "AC RAIZ FNMT-RCM"
     + "Amazon Root CA 1"
     + "Amazon Root CA 2"
     + "Amazon Root CA 3"
     + "Amazon Root CA 4"
     + "D-TRUST Root CA 3 2013"
     + "LuxTrust Global Root 2"
     + "TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1"
     The following certificate authorities were removed (-):
     - "AC Raiz Certicamara S.A."
     - "ApplicationCA - Japanese Government"
     - "Buypass Class 2 CA 1"
     - "ComSign CA"
     - "EBG Elektronik Sertifika Hizmet Saglayicisi"
     - "Equifax Secure CA"
     - "Equifax Secure eBusiness CA 1"
     - "Equifax Secure Global eBusiness CA"
     - "IGC/A"
     - "Juur-SK"
     - "Microsec e-Szigno Root CA"
     - "Root CA Generalitat Valenciana"
     - "RSA Security 2048 v3"
     - "S-TRUST Authentication and Encryption Root CA 2005 PN"
     - "S-TRUST Universal Root CA"
     - "SwissSign Platinum CA - G2"
     - "TC TrustCenter Class 3 CA II"
     - "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H6"
     - "UTN USERFirst Email Root CA"
     - "Verisign Class 1 Public Primary Certification Authority"
     - "Verisign Class 1 Public Primary Certification Authority - G3"
     - "Verisign Class 2 Public Primary Certification Authority - G2"
     - "Verisign Class 2 Public Primary Certification Authority - G3"
     - "Verisign Class 3 Public Primary Certification Authority"
     - "WellsSecure Public Root Certificate Authority"
Checksums-Sha1:
 4762ba4221be4bd7f26db5fb7b0cf39c09f26072 1506 ca-certificates_20170717.dsc
 4c093ceee1f1428d5aa7e9a5324b92961c0c0f06 293028 ca-certificates_20170717.tar.xz
 4b11fbd1e7bbfbe141c2bb2ffaa4749cb0cda784 136820 ca-certificates-udeb_20170717_all.udeb
 5b5b702688f44b85ac1dbc2c0333327723e9e591 177520 ca-certificates_20170717_all.deb
 f1b20c74a0eac3d41572b06b25c9e02274967189 5479 ca-certificates_20170717_amd64.buildinfo
Checksums-Sha256:
 da6268ff88e05c85c23c62add13d3d127087467d0c7e83974ca28db5543a252a 1506 ca-certificates_20170717.dsc
 e487639b641fa75445174734dd6e9d600373e3248b3d86a7e3c6d0f6977decd2 293028 ca-certificates_20170717.tar.xz
 c89bd92b2ee2b9b857b8122b2472acfc7799d2f33b2033d19c2f6234f89950f5 136820 ca-certificates-udeb_20170717_all.udeb
 ec7fae9258e341f839daf31dececa01650cb69889f36f87804825aa19ce4d291 177520 ca-certificates_20170717_all.deb
 315efbe3ae7645a83866d19e647205c0636a2037a7468eb69387c2f35094484f 5479 ca-certificates_20170717_amd64.buildinfo
Files:
 505735d2a22fda7c44d0d1fba3a4f0b9 1506 misc optional ca-certificates_20170717.dsc
 55a6bb6b98afb16b3cde8e3ad1e262eb 293028 misc optional ca-certificates_20170717.tar.xz
 b8f8b88d829e5ce75d9b6cfc0f3ac19d 136820 debian-installer optional ca-certificates-udeb_20170717_all.udeb
 072bc2525247789bb62a78ee40a9d878 177520 misc optional ca-certificates_20170717_all.deb
 9073b884dd76050e3e45682ef8b0dd1a 5479 misc optional ca-certificates_20170717_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEbBAEBCAAGBQJZkcpnAAoJEFb2GnlAHawE9asH+OY8IWqgIcdgjetz3eZeNi2w
O6dLsHMrQ7fH3FHsD3GfkyTckxqFCrnqQ4U2wFdLTZbvSOjY4GVaUUC/lU3SqXIE
eYYVWF2wuTWb7QV/NzanwRDOh/SoaE9GFrsZK2jDIZ8ZwvsC4vV5Xa7oWmXSeQ2L
vy6PlQMXM7oJ7ccAPIom6MnfFuBt2Zrad9WFiPaE1diJFwzm+HTxLBHw0aAsPY/H
yFPcNUhzqwtWjs3i/GKN77yQ0/0C+KQjNE0MwYhYA2TmbvY0Oqj9iwqAL/neaJht
mlz1GXKbaKwimaudXkajAT6DZ9rHZEC8CSu2I3y/fbg6FHenlb9XGqGuJmnO2g==
=HsL2
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.