sks postinst uses dpkg-vendor, but doesn't depend on dpkg-dev (nor should it)

[Dustin Kirkland ]

A recent change to sks packaging uses the dpkg-vendor command to determine if the current OS derives from Ubuntu. dpkg-vendor is provided by the dpkg-dev package, which sks does not, and should not depend on.

In order for the postinst to behave properly, it needs to gracefully handle the situation where the dpkg-vendor command does not exist.

ubuntu@ip-10-195-165-105:~$ sudo apt-get install sks --reinstall
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 6 not upgraded.
Need to get 0 B/802 kB of archives.
After this operation, 0 B of additional disk space will be used.
(Reading database ... 25941 files and directories currently installed.)
Preparing to replace sks 1.1.1+dpkgv3-7ubuntu0.2 (using .../sks_1.1.1+dpkgv3-7ubuntu0.2_amd64.deb) ...
Stopping sks daemons: sksrecon.. sksdb.. done.
Unpacking replacement sks ...
Processing triggers for ureadahead ...
Processing triggers for man-db ...
Setting up sks (1.1.1+dpkgv3-7ubuntu0.2) ...
debian-sks uid check: ok
debian-sks homedir check: ok
/var/lib/dpkg/info/sks.postinst: 76: /var/lib/dpkg/info/sks.postinst: dpkg-vendor: not found
Starting sks daemons: Not starting sks (as configured in /etc/default/sks)

== SRU ==

=== IMPACT ===
This bug impacts any 12.04 server running SKS where dpkg-dev is not installed (which is often the case), and upgrades to the current package in precise-updates. dpkg-dev would drag in a handful of development level utilities and compilers that many administrators would not want on their production server.

=== TEST CASE ===
Take a 12.04 server installed prior to July 9, 2012, with SKS installed. In my case, I started a 12.04 server in EC2, and commented out the two lines in /etc/apt/sources.list referencing precise-updates. Install SKS:
 $ sudo apt-get update && sudo apt-get install -y sks
Then, uncomment the precise-updates lines in /etc/apt/sources.list, and upgrade SKS:
 $ sudo apt-get update && sudo apt-get install -y sks

=== REGRESSION POTENTIAL ===
As implemented, minimal.

=== MINIMAL PATCH ===
diff -Nru sks-1.1.3/debian/sks.postinst sks-1.1.3/debian/sks.postinst
--- sks-1.1.3/debian/sks.postinst 2012-07-02 06:19:39.000000000 -0500
+++ sks-1.1.3/debian/sks.postinst 2012-10-04 12:46:25.000000000 -0500
@@ -73,7 +73,8 @@
        if [ -r /var/lib/sks/berkeley_db.active ]; then
            OLD_BDB=$(cat /var/lib/sks/berkeley_db.active)
        else
- if dpkg-vendor --derives-from Ubuntu; then
+ if (type dpkg-vendor >/dev/null && dpkg-vendor --derives-from Ubuntu) || \
+ [ -e /etc/dpkg/origins/ubuntu ]; then
                if dpkg --compare-versions "$2" lt "1.1.1+dpkgv3-6.1"; then
                    OLD_BDB=4.7
                else

[Adam Conrad (adconrad)]

Try not to use "Fix Committed" for SRUs when you upload, as we use that to track when they land in -proposed (and set it automatically when we accept the SRU).

[Adam Conrad (adconrad)]

Err, also, rejecting your precise-proposed upload, was that meant to be a backport?

[Launchpad Janitor (janitor)]

This bug was fixed in the package sks - 1.1.3-1ubuntu3

---------------
sks (1.1.3-1ubuntu3) quantal; urgency=low

  * debian/sks.postinst: LP: #1061769
    - detect if Ubuntu system, even if dpkg-vendor is not available
 -- Dustin Kirkland <email address hidden> Thu, 04 Oct 2012 12:44:23 -0500

[Micah Gersten (micahg)]

We'll backport from quantal for backports, precise-proposed should be its own upload based on what's in -updates

[Adam Conrad (adconrad)]

I'm not sure if the (non-backports) precise package even has this bug (I haven't looked), but the -proposed upload I rejected was based on the -backports source, hence the reject. :P

[Micah Gersten (micahg)]

Yes, the package in precise-updates is affected as well: http://launchpadlibrarian.net/109152630/sks_1.1.1%2Bdpkgv3-7_1.1.1%2Bdpkgv3-7ubuntu0.1.diff.gz

[Adam Conrad (adconrad)]

Hello Dustin, or anyone else affected,

Accepted sks into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/sks/1.1.1+dpkgv3-7ubuntu0.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please change the bug tag from verification-needed to verification-done. If it does not, change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Stefano Rivera (stefanor)]

Whoops, thanks.

Mentioned this in my bug about this in Debian.

I don't particularly like checking for the existence of /etc/dpkg/origin/ubuntu. That exists on several of my Debian boxes... One is really supposed to parse default... But of course, that's painful. So, meh :)

[Brian Murray (brian-murray)]

The fix for this bug has been awaiting testing feedback in the -proposed repository for precise for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

[Stefano Rivera (stefanor)]

I can verify that this works

[Launchpad Janitor (janitor)]

This bug was fixed in the package sks - 1.1.1+dpkgv3-7ubuntu0.3

---------------
sks (1.1.1+dpkgv3-7ubuntu0.3) precise-proposed; urgency=low

  * debian/sks.postinst: LP: #1061769
    - detect if Ubuntu system, even if dpkg-vendor is not available
 -- Dustin Kirkland <email address hidden> Thu, 04 Oct 2012 14:21:40 -0500

[Colin Watson (cjwatson)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.