Merge nginx from Debian unstable for noble

[Bryce Harrington]

Scheduled-For: Backlog
Upstream: tbd
Debian: 1.24.0-2
Ubuntu: 1.24.0-1ubuntu1

If it turns out this needs a sync rather than a merge, please change the tag 'needs-merge' to 'needs-sync', and (optionally) update the title as desired.

### New Debian Changes ###

nginx (1.24.0-2) unstable; urgency=medium

  * d/control added dependency nginx-common to nginx (Closes: 1039905)
    After nginx installation, the nginx-common package is installed
    automatically due to its dependencies. The nginx-common package includes
    the systemd unit, which becomes enabled and activated upon installation.
    When the nginx is removed, nginx-common package and the systemd unit will
    remain in the system. Adding a dependency nginx-common to nginx solves
    this problem.
  * d/control fixed binNMU safe dependency declaration nginx to nginx-common,
    nginx is 'any', nginx-common is 'all' -> dependency '= ${source:Version}'
  * d/rules removed override_dh_strip, migration to automatic debug symbols is
    already done, fixes debug-symbol-migration-possibly-complete lint. warning
  * d/po/ro.po added Romanian debconf translation. (Closes: 1033084),
    Thanks to Remus-Gabriel Chelu
  * d/po/sv.po added Swedish debconf translation. (Closes: 1050443),
    Thanks to Peter Kvillegård
  * d/conf/mime.types added video/ogg, video/x-matroska (Closes: 1028144)
  * d/p/CVE-2023-44487.patch adds additional mitigations for CVE-2023-44487
    that according to NGINX developers on nginx-devel are already suitably
    mitigated with the default config options for keepalive. (Closes: 1053770)
  * d/control added nginx-dev dependency on ${nginx:abi}
  * d/debhelper/nginx_mod.pm automatic libnginx-mod-stream dependencies

 -- Jan Mojžíš <email address hidden> Wed, 11 Oct 2023 01:17:51 +0200

nginx (1.24.0-1) unstable; urgency=medium

  * New upstream version 1.24.0
  * nginx ABI release: nginx-abi-1.24.0-1
  * d/libnginx-mod.abisubstvars update version constraints of the 3rd party
    modules
  * d/p/bug-{1024605,973861}.patch removed, fixed in upstream
  * d/copyright: updated copyright for files src/event/ngx_event_udp.h,
    src/os/win32/ngx_dlopen

 -- Jan Mojžíš <email address hidden> Tue, 27 Jun 2023 23:19:31 +0200

nginx (1.22.1-9) unstable; urgency=medium

  * d/control: nginx-common Breaks+Replaces: nginx (<< 1.22.1-8)
    (Closes: 1032929)

 -- Jan Mojžíš <email address hidden> Tue, 14 Mar 2023 16:19:32 +0100

nginx (1.22.1-8) unstable; urgency=medium

  * Main change:
    Configuration files returned to nginx-common package. This fixes
    the serious problem of losing configuration files during upgrade.
    This is a rollback of a change made in 1.22.1-6 (Closes: 1032517)
  * d/control: fix nginx-full dependencies
  * d/libnginx-mod.abisubstvars: update libnginx-mod-http-lua version

 -- Jan Mojžíš <email address hidden> Tue, 14 Mar 2023 06:53:32 +0100

nginx (1.22.1-7) unstable; urgency=medium

  * nginx ABI release: nginx-abi-1.22.1-7
  * nginx ABI: Nginx now provides nginx-abi-<VERSION> to better manage
    dependencies between nginx and 3rd party modules. Credit to Jérémy Lal.
  * switched to libpcre2 (Closes: 1000013)
  * d/p/bug-973861: added, lingering close for connections with pipelined
    requests. The patch is backported from the upstream. (Closes: 973861)
  * d/gbb.conf: switched to debian branch main (debian-branch = main)
  * d/copyright: updated to be compatible with 'cme update dpkg-copyright'

 -- Jan Mojžíš <email address hidden> Mon, 13 Feb 2023 13:04:16 +0100

nginx (1.22.1-6) unstable; urgency=medium

  * Main change:
    Nginx binary moved to package nginx, also moved basic
    configuration files from nginx-common to package nginx.
    The packages nginx-{light,core,extras,common} are replaced
    by a metapackage. (Closes: 1025763)
    Users should simply install 'nginx' and 'libnginx-mod-...'
    instead of these packages.
  * Additional changes:
    * d/nginx-{light,core,extras,full,common}.NEWS: added warning that
      nginx-{light,core,extras,full,common} are deprecated
    * d/control: fixed dependencies for safe binNMU
    * d/copyright: updated debian/* copyright
    * d/copyright: added missing copyright for d/apport/*
    * d/copyright: added missing GPL-2+ copyright for d/debhelper/dh_nginx
    * d/copyright: added missing copyright for d/help/examples/nginx_modsite
    * d/po/it.po: added Italian debconf translation. (Closes: 1019160)
    * d/control: removed dependency on obsolete package lsb-base
    * d/control: bump Standards-Version: 4.6.2, no changes

 -- Jan Mojžíš <email address hidden> Wed, 08 Feb 2023 17:20:27 +0100

nginx (1.22.1-5) unstable; urgency=medium

  [ Jan Mojžíš ]
  * Since version 1.22.1-5 all third party modules are removed from Debian NGINX
    package and all these modules are maintained in separate external packages.
    Removed namely these remaining modules:
      - libnginx-mod-http-geoip2
      - libnginx-mod-stream-geoip2

### Old Ubuntu Delta ###

nginx (1.24.0-1ubuntu1) mantic; urgency=low

  * Merge with Debian unstable. Remaining changes:
    - Branding for Ubuntu
      + d/p/ubuntu-branding.patch: add Ubuntu branding
      + d/t/branding: Add autopkgtest to validate branding presence
    - d/control: Drop the Lua module (libnginx-mod-http-lua) as a
      dependency for NGINX (Server Team Decision) - future support
      for Lua module now requires resty-core from OpenResty, meaning that if
      we want to continue to support the Lua module, we have to start becoming
      OpenResty - users should just use OpenResty at this point for Lua.
    - d/control: let nginx-core depend on geoip2 instead of geoip.
    - d/t/control: Drop autopkgtest dependencies on libnginx-mod-http-lua too

 -- Gianfranco Costamagna <email address hidden> Wed, 28 Jun 2023 08:48:23 +0200

[Bryce Harrington (bryce)]

Looks like Gianfranco has already uploaded the merge to -proposed

nginx (1.24.0-2ubuntu1) noble; urgency=low

  * Merge from Debian unstable. Remaining changes:
    - Branding for Ubuntu
      + d/p/ubuntu-branding.patch: add Ubuntu branding
      + d/t/branding: Add autopkgtest to validate branding presence
    - d/control: Drop the Lua module (libnginx-mod-http-lua) as a
      dependency for NGINX (Server Team Decision) - future support
      for Lua module now requires resty-core from OpenResty, meaning that if
      we want to continue to support the Lua module, we have to start becoming
      OpenResty - users should just use OpenResty at this point for Lua.
    - d/control: let nginx-core depend on geoip2 instead of geoip.
    - d/t/control: Drop autopkgtest dependencies on libnginx-mod-http-lua too

[Thomas Ward (teward)]

Don't forget that despite the merge, we'll have a ton of NGINX modules we need to import too to make it work. Most of the modules that aren't core are separated into their own libnginx packages now...

[Bryce Harrington (bryce)]

teward, speaking of which, there is indeed a migration issue for nginx against one of these split out modules, libnginx-mod-http-geoip2. The issue appears to be not that the module isn't imported, but rather that nginx appears to expect its version to be equivalent to its own, but it isn't:

Package: nginx-core
Architecture: all
Depends: libnginx-mod-http-geoip2 (>= ${libnginx-mod-geoip2:Version}),
         libnginx-mod-http-geoip2 (<< ${libnginx-mod-geoip2:Version}.1~),

So nginx's autopkgtest fails:

# https://autopkgtest.ubuntu.com/results/autopkgtest-noble/noble/amd64/n/nginx/20231122_220741_d4ae7@/log.gz
2440s The following packages have unmet dependencies:
2440s nginx-core : Depends: libnginx-mod-http-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
2440s Depends: libnginx-mod-stream-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
2440s E: Unable to correct problems, you have held broken packages.
2440s ssi-module-test FAIL badpkg

And the module also fails:

# https://autopkgtest.ubuntu.com/results/autopkgtest-noble/noble/amd64/libn/libnginx-mod-http-geoip2/20231122_213148_b4894@/log.gz
:
131s
131s The following packages have unmet dependencies:
131s nginx-core : Depends: libnginx-mod-http-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
131s Depends: libnginx-mod-stream-geoip2 (< 1:3.4-4.1~) but 1:3.4-5build1 is to be installed
131s E: Unable to correct problems, you have held broken packages.
131s generic FAIL badpkg

I wonder if the better approach may be to drop the versioned dependencies from nginx-core for modules that now live in their own source packages. What do you think?

[Thomas Ward (teward)]

@bharrington

Refer to my IRC poke.

Proper way to handle this would be to depend as nginx-full in Debian does - https://salsa.debian.org/nginx-team/nginx/-/blob/main/debian/control#L129 - and replace the existing dependency lines with this:

libnginx-mod-http-geoip2 (>= ${libnginx-mod-geoip2:Version}~),

... which would match how we restructured in Debian for these external dependencies.