Move debug symbols back to the main archive

dak currently allows a binary upload to include debug symbol packages
that don't appear in the overrides file or the Binary field of the
changes file, so long as they have the appropriate
'Auto-Built-Package' field and their name matches another binary
package in the upload plus the '-dbgsym' suffix.

For architectures with code signing enabled, our binary uploads never
match this condition as the corresponding binary package has the
'-unsigned' suffix and the debug symbols package does not.  Since we
do list the debug symbol packages in the Binary field, they do get
added to the overrides file when accepted through the NEW queue, but
they are automatically pruned from there some time later.  Later
uploads then have to go through NEW even though they are not
introducing new binary packages.  This would be a big problem for
stable security updates.

For now, move debug symbols back to the main archive with the old
'-dbg' suffix.  Keep them enabled for all architectures.
This commit is contained in:
Ben Hutchings 2017-04-16 18:33:50 +01:00
parent 6ef03e0be7
commit b4b1be4c52
5 changed files with 9 additions and 5 deletions

View File

@ -499,7 +499,7 @@ class Gencontrol(Base):
'debian/%s.%s' % (image_main['Package'], name))
if build_debug:
self._substitute_file('image-dbg.lintian-override', vars,
'debian/linux-image-%s%s-dbgsym.lintian-overrides' %
'debian/linux-image-%s%s-dbg.lintian-overrides' %
(vars['abiname'], vars['localversion']))
def process_changelog(self):

2
debian/changelog vendored
View File

@ -19,6 +19,8 @@ linux (4.9.18-2) UNRELEASED; urgency=medium
* [mips*/octeon] Set NR_CPUS=64 to allow for Cavium CN7890
* [arm64] Set NR_CPUS=256 to allow for multi-SoC systems
* [powerpc/powerpc-smp,powerpcspe] Explicitly set NR_CPUS=4
* Move debug symbols back to the main archive, to avoid problems with the
current handling in dak
[ Salvatore Bonaccorso ]
* ping: implement proper locking (CVE-2017-2671)

4
debian/rules.real vendored
View File

@ -453,7 +453,7 @@ install-image_$(ARCH)_$(FEATURESET)_$(FLAVOUR)_bug:
printf "RELEASE='$(REAL_VERSION)'\nDISTRIBUTOR='$(DISTRIBUTOR)'\nSOURCEVERSION='$(SOURCEVERSION)'\nPACKAGE_NAME='$(PACKAGE_NAME)'\nPACKAGE_VERSION='$(SOURCEVERSION)'" > $(PACKAGE_DIR)/usr/share/bug/$(PACKAGE_NAME)/info
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): REAL_VERSION = $(ABINAME)$(LOCALVERSION)
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): PACKAGE_NAME = linux-image-$(REAL_VERSION)-dbgsym
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): PACKAGE_NAME = linux-image-$(REAL_VERSION)-dbg
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): PACKAGE_DIR = debian/$(PACKAGE_NAME)
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): DEBUG_DIR = $(PACKAGE_DIR)/usr/lib/debug
install-image-dbg_$(ARCH)_$(FEATURESET)_$(FLAVOUR): DIR = $(BUILD_DIR)/build_$(ARCH)_$(FEATURESET)_$(FLAVOUR)
@ -485,7 +485,7 @@ endif
ln -s boot/vmlinux-$(REAL_VERSION) $(DEBUG_DIR)/
mkdir -p $(DEBUG_DIR)/lib/modules/$(REAL_VERSION)
ln -s ../../../boot/vmlinux-$(REAL_VERSION) $(DEBUG_DIR)/lib/modules/$(REAL_VERSION)/vmlinux
+$(MAKE_SELF) install-base GENCONTROL_ARGS='-DAuto-Built-Package=debug-symbols'
+$(MAKE_SELF) install-base
install-udeb_$(ARCH): export KW_DEFCONFIG_DIR=debian/installer
install-udeb_$(ARCH): export KW_CONFIG_DIR=debian/installer/$(ARCH)

View File

@ -1,6 +1,8 @@
Package: linux-image-@abiname@@localversion@-dbgsym
Package: linux-image-@abiname@@localversion@-dbg
Build-Profiles: <!stage1>
Depends: ${misc:Depends}
Section: debug
Priority: extra
Description: Debug symbols for linux-image-@abiname@@localversion@
This package provides the detached debug symbols for the Linux kernel
and modules in linux-image-@abiname@@localversion@.

View File

@ -1,2 +1,2 @@
# Kernel dbg packages contain a full image with debug data
linux-image-@abiname@@localversion@-dbgsym: dbg-package-missing-depends
linux-image-@abiname@@localversion@-dbg: dbg-package-missing-depends