Installation of moonshot-trust-router package fails on Debian 8

[Jennifer Richards]

Installing moonshot-trust-router via apt on Debian 8 gives the following error:

Setting up moonshot-trust-router (1.5.1~2~deb80) ...
Job for tids.service failed. See 'systemctl status tids.service' and 'journalctl -xn' for details.
invoke-rc.d: initscript tids, action "start" failed.
dpkg: error processing package moonshot-trust-router (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 moonshot-trust-router
E: Sub-process /usr/bin/dpkg returned an error code (1)

Looking at the logs:

# systemctl status tids.service
● tids.service - Trust Identity Protocol Server
   Loaded: loaded (/lib/systemd/system/tids.service; disabled)
   Active: failed (Result: start-limit) since Fri 2016-09-02 19:09:59 UTC; 20s ago

Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Failed to start Trust Identity Protocol Server.
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Unit tids.service entered failed state.
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: tids.service holdoff time over, scheduling restart.
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Stopping Trust Identity Protocol Server...
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Starting Trust Identity Protocol Server...
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: tids.service start request repeated too quickly, refusing to start.
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Failed to start Trust Identity Protocol Server.
Sep 02 19:09:59 ip-172-31-37-133 systemd[1]: Unit tids.service entered failed state.

After this, the package is left in the "not fully installed or removed" state.

[Jennifer Richards (jennifer-k)]

Creating a valid /etc/default/trust_router file allows the tids service to start correctly, so the issue might be not creating this file on install. Not sure, though.

[Sam Hartman (hartmans)]

It's not clear that there's anything you can put in the default file that is generally applicable.
Note that according to debian policy, any conffile shipped in a package (anything under /etc definitely is) needs to have contents that are generally correct for most users.
You could create a default file in the postinst using debconf.
However, more generally, I think that you don't want the postinst to fail simply because the service failed to start.
In krb5 I had to do something like
        DH_OPTIONS= dh_installinit -pkrb5-kdc --error-handler=init_error -- def\
aults 18 18

And then in the postinst template
    # Failing to start should not break installs or upgrades
    init_error() {
    true
    }

You can take a look at debian/rules and debian/krb5-kdc.postinst from the krb5 package source.
It's going to be a bit more tricky for moonshot-trust-router because you're using dh in debian/rules rather than doing it by hand.

It may be that more modern version of debhelper and dh-systemd provide better solutions.

[Jennifer Richards (jennifer-k)]

From my perspective it'd be fine if it simply (cleanly) finished the install without starting the service if a suitable file is not present.

[Sam Hartman (hartmans)]

>>>>> "Jennifer" == Jennifer Richards <email address hidden> writes:

    >> From my perspective it'd be fine if it simply (cleanly) finished
    >> the
    Jennifer> install without starting the service if a suitable file is
    Jennifer> not present.

Agreed.
I was trying to give hints on how to do that.

[Stefan Paetow (stefan-paetow)]

Given that on a fresh install the file does not exist (and no reasonable defaults are provided by default), I'd expect the service not to be started in the first place... The Wiki tells people to set it to autostart *after* configuring the defaults?

[Jennifer Richards (jennifer-k)]

Resolving this by adding "--no-start" option to dh_installinit for the TIDS service. This disables starting the service on install/update, eliminating the error without requiring a configuration file.