/usr/share/man/man8/idmap_rfc2307.8.gz has moved package without an appropriate Breaks/Replaces

Thank you for the bug report. I was unable to reproduce the issue when installing winbind and samba-libs and doing various upgrades. However both packages do provide /usr/share/man/man8/idmap_rfc2307.8.gz. It's possible that the version of samba-libs you have and the version of winbind you are upgrading to have slightly different versions of the file. It may be worth deleting the file then attempting to apt upgrade again. If that works for you or if you have any other ideas please let us know

Ah, the description of this bug matched a pattern I'm familiar with.

In Kinetic, /usr/share/man/man8/idmap_rfc2307.8.gz is shipped by samba-libs. In Lunar, it's shipped by winbind instead. So winbind should declare Breaks/Replaces on the samba in Kinetic. There is a Breaks/Replaces declared, but the version number doesn't seem high enough.

It looks to me like this is a packaging bug that needs further investigation. Are any other files affected?

In Lunar's samba 4.17.7, the breaks/replaces in the winbind package is this[0]:

# 4.16.6+dfsg-5 idmap_{script,rfc2307}.8 moved samba{,-libs} => winbind
Breaks: samba (<< 2:4.16.6+dfsg-5~), samba-libs (<< 2:4.16.6+dfsg-5~),
Replaces: samba (<< 2:4.16.6+dfsg-5~), samba-libs (<< 2:4.16.6+dfsg-5~),

This was correct for the released[1] version of kinetic, which is 4.16.4, but a security update[2] bumped that to 4.16.8, rendering that breaks/replaces ineffective because of the version.

0. https://git.launchpad.net/ubuntu/+source/samba/tree/debian/control?h=ubuntu/lunar#n397
1. https://launchpad.net/ubuntu/+source/samba/2:4.16.4+dfsg-2ubuntu1
2. https://launchpad.net/ubuntu/+source/samba/2:4.16.8+dfsg-0ubuntu1.1

Julio, did you use dist-upgrade to upgrade from 22.10 to 23.04, or do-release-upgrade?

I just did a do-release-upgrade, and didn't have it crash, but that's because do-release-upgrade does something differently:

Unpacking winbind (2:4.17.7+dfsg-1ubuntu1) over (2:4.16.8+dfsg-0ubuntu1.1) ...^M
dpkg: warning: overriding problem because --force enabled:^M
dpkg: warning: trying to overwrite '/usr/share/man/man8/idmap_rfc2307.8.gz', which is also in package samba-libs:amd64 2:4.16.8+dfsg-0ubuntu1.1^M
dpkg: warning: overriding problem because --force enabled:^M
dpkg: warning: trying to overwrite '/usr/share/man/man8/idmap_script.8.gz', which is also in package samba 2:4.16.8+dfsg-0ubuntu1.1^M
Preparing to unpack .../23-samba-common-bin_2%3a4.17.7+dfsg-1ubuntu1_amd64.deb ...^M

See, the problem did happen there, but dpkg was told to stomp on it and continue.

> This was correct for the released[1] version of kinetic, which is 4.16.4, but a security update[2] bumped that to 4.16.8, rendering that breaks/replaces ineffective because of the version.

This is interesting and worth recording as a security regression in the archive, even if it turns out to be mitigated by do-release-upgrade.

Kinetic is EOL, and the remaining upgrade paths no longer experience this problem *currently*:

jammy or earlier to lunar or later: not affected, because jammy has samba 4.15.13 which is less than 4.16.5 (where the B/R was introduced)
lunar to mantic: not affected, because lunar is already 4.17.7 which has the B/R for << 4.16.5

The only remaining scenario is if jammy or focal get a samba version update, much like kinetic did, that advances its version *past* 4.16.5. Looking at the history of samba upgrades in the security pocket, that could still happen. Focal, for example, was released with 4.11.6, and is currently at 4.15.13.

So at the moment:
- current situation does not exhibit the bug anymore
- when the upgrade is done with do-release-upgrade, which is the recommended way of upgrading an ubuntu release, the bug is worked around by the tool

That being said, current kinetic users, faced with an EOL of their release, will definitely want to upgrade to a supported ubuntu release, and will face this bug if they don't use do-release-upgrade. And since the fix will NOT be in the kinetic release, but in lunar and later, it's perhaps still worth it. I'm on the fence, really, with both by ubuntu developer and SRU team member hats on. Maybe with a block-proposed tag for lunar.

To clarify, restarting samba due to an upgrade can be a big deal (in terms of service interruption), and lunar users would see no benefit in this upgrade. This only benefits who is upgrading from kinetic.

Hello Julio, or anyone else affected,

Accepted samba into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.17.7+dfsg-1ubuntu2.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

All autopkgtests for the newly accepted samba (2:4.17.7+dfsg-1ubuntu2.1) for lunar have finished running.
The following regressions have been reported in tests triggered by the package:

adsys/0.11.0 (arm64, armhf)
ffmpeg/unknown (amd64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#samba

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Hello Julio, or anyone else affected,

Accepted samba into lunar-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/samba/2:4.17.7+dfsg-1ubuntu2.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-lunar to verification-done-lunar. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-lunar. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Removing block-proposed because another SRU was just accepted.

All autopkgtests for the newly accepted samba (2:4.17.7+dfsg-1ubuntu2.1) for lunar have finished running.
The following regressions have been reported in tests triggered by the package:

adsys/0.11.0 (arm64, armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#samba

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

All autopkgtests for the newly accepted samba (2:4.17.7+dfsg-1ubuntu2.2) for lunar have finished running.
The following regressions have been reported in tests triggered by the package:

freeradius/3.2.1+dfsg-1 (amd64)
gvfs/1.50.4-1 (arm64, s390x)
libsoup3/3.4.0-1 (armhf)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/lunar/update_excuses.html#samba

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

This bug was fixed in the package samba - 2:4.18.6+dfsg-1ubuntu1

---------------
samba (2:4.18.6+dfsg-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2031655, LP: #2031619). Remaining changes:
    - debian/control: Ubuntu i386 binary compatibility:
      + drop ceph support
      + enable the liburing vfs module, except on i386 where liburing is
        not available
    - d/t/control, d/t/util,d/t/samba-ad-dc-provisioning-internal-dns:
      samba AD DC provisioning and domain join tests with internal DNS
      (LP #1977746, LP #2011745)
  * Dropped:
    - build-depend on libglusterfs-dev only on !i386 arches
      [In 2:4.18.5+dfsg-2]
    - Add changes to fix uncaught exception when updating old password
      containing regex metacharacters by simplifying samba-tool password
      redaction (LP #2002949).
      + d/p/lib-cmdline-Return-if-the-commandline-was-redacted-i.patch
      + d/p/lib-cmdline-Also-redact-newpassword-in-samba_cmdline.patch
      + d/p/lib-cmdline-Also-burn-the-password2-parameter-if-giv.patch
      + d/p/samba-tool-Use-samba.glue.get_burnt_cmdline-rather-t.patch
      + d/p/python-Add-glue.burn_commandline-method.patch
      + d/p/python-Move-PyList_AsStringList-to-common-code-so-we.patch
      + d/p/python-Remove-const-from-PyList_AsStringList.patch
        [Fixed upstream in 4.18.6]
  * Added:
    - d/control: adjust breaks/replaces for file move that Debian did in
      4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
      file conflict in a dist-upgrade from earlier Ubuntu releases, like
      Kinetic (LP: #2024663)
    - d/rules: ceph is not available in Ubuntu i386, disable it

 -- Andreas Hasenack <email address hidden> Thu, 17 Aug 2023 09:52:00 -0300

Lunar verification

Reproducing the bug. Starting on kinetic with:

ubuntu@k-samba-2024663:~$ apt-cache policy samba-libs
samba-libs:
  Installed: 2:4.16.8+dfsg-0ubuntu1.2
  Candidate: 2:4.16.8+dfsg-0ubuntu1.2
  Version table:
 *** 2:4.16.8+dfsg-0ubuntu1.2 500
        500 http://br.archive.ubuntu.com/ubuntu kinetic-updates/main amd64 Packages
        500 http://br.archive.ubuntu.com/ubuntu kinetic-security/main amd64 Packages
        100 /var/lib/dpkg/status

After do-release-upgrade to lunar finishes, we confirm the bug is ther:
$ grep "trying to overwrite" /var/log/dist-upgrade/apt-term.log -B 2
Unpacking winbind (2:4.17.7+dfsg-1ubuntu2) over (2:4.16.8+dfsg-0ubuntu1.2) ...
dpkg: warning: overriding problem because --force enabled:
dpkg: warning: trying to overwrite '/usr/share/man/man8/idmap_rfc2307.8.gz', which is also in package samba-libs:amd64 2:4.16.8+dfsg-0ubuntu1.2
dpkg: warning: overriding problem because --force enabled:
dpkg: warning: trying to overwrite '/usr/share/man/man8/idmap_script.8.gz', which is also in package samba 2:4.16.8+dfsg-0ubuntu1.2

We can also see this used the non-proposed samba packages from lunar: 2:4.17.7+dfsg-1ubuntu2

Repeating the process now, but with proposed enabled:

Confirmed lunar-proposed was used by do-release-upgrade:
Checking for installed snaps

Calculating snap size requirements

Updating repository information
Get:1 http://br.archive.ubuntu.com/ubuntu lunar InRelease [267 kB]
Get:2 http://br.archive.ubuntu.com/ubuntu lunar-proposed InRelease [255 kB]
Get:3 http://br.archive.ubuntu.com/ubuntu lunar-updates InRelease [109 kB]
Get:4 http://br.archive.ubuntu.com/ubuntu lunar-backports InRelease [99.8 kB]
Get:5 http://br.archive.ubuntu.com/ubuntu lunar-security InRelease [109 kB]
(...)

Note this will get not just samba from lunar-proposed, but whatever else is there. It's deemed ok for this SRU verification. A better test would be to enable lunar-proposed and pin only the samba packages.

After do-release-upgrade --allow-third-party is finished, there are messages about "trying to overwrite", like before:

ubuntu@k-samba-2024663:~$ grep "trying to overwrite" /var/log/dist-upgrade/apt-term.log -B 2
ubuntu@k-samba-2024663:~$

And winbind was unpacked just fine:
ubuntu@k-samba-2024663:~$ grep "Unpacking winbind" /var/log/dist-upgrade/apt-term.log -4
Unpacking samba (2:4.17.7+dfsg-1ubuntu2.2) over (2:4.16.8+dfsg-0ubuntu1.2) ...
Preparing to unpack .../18-samba-libs_2%3a4.17.7+dfsg-1ubuntu2.2_amd64.deb ...
Unpacking samba-libs:amd64 (2:4.17.7+dfsg-1ubuntu2.2) over (2:4.16.8+dfsg-0ubuntu1.2) ...
Preparing to unpack .../19-winbind_2%3a4.17.7+dfsg-1ubuntu2.2_amd64.deb ...
Unpacking winbind (2:4.17.7+dfsg-1ubuntu2.2) over (2:4.16.8+dfsg-0ubuntu1.2) ...
Preparing to unpack .../20-samba-common-bin_2%3a4.17.7+dfsg-1ubuntu2.2_amd64.deb ...
Unpacking samba-common-bin (2:4.17.7+dfsg-1ubuntu2.2) over (2:4.16.8+dfsg-0ubuntu1.2) ...
Preparing to unpack .../21-samba-vfs-modules_2%3a4.17.7+dfsg-1ubuntu2.2_amd64.deb ...
Unpacking samba-vfs-modules:amd64 (2:4.17.7+dfsg-1ubuntu2.2) over (2:4.16.8+dfsg-0ubuntu1.2) ...

And finally, we can see that the lunar-proposed version was used: 2:4.17.7+dfsg-1ubuntu2.2

Lunar v...

The DEP8 tests are also clean now.

This bug was fixed in the package samba - 2:4.17.7+dfsg-1ubuntu2.2

---------------
samba (2:4.17.7+dfsg-1ubuntu2.2) lunar; urgency=medium

  * d/p/issue-when-updating-old-passwd-containing-regex-metachars.patch:
    Add changes to fix uncaught exception when updating old password
    containing regex metacharacters by simplifying samba-tool password
    redaction (LP: #2002949).

samba (2:4.17.7+dfsg-1ubuntu2.1) lunar; urgency=medium

  * d/control: adjust breaks/replaces for file move that Debian did in
    4.16.6+dfsg-5, and Ubuntu only did in 4.17.7+dfsg-1ubuntu1, to avoid
    file conflict in a dist-upgrade from earlier Ubuntu releases, like
    Kinetic (LP: #2024663)

 -- Michal Maloszewski <email address hidden> Sun, 20 Aug 2023 13:57:29 +0200

The verification of the Stable Release Update for samba has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.