/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to debian/mandos.postinst

  • Committer: Teddy Hogeborn
  • Date: 2019-07-14 22:39:15 UTC
  • mto: This revision was merged to the branch mainline in revision 384.
  • Revision ID: teddy@recompile.se-20190714223915-aqjkms3t3taa6tye
Only use sanitizing options when debugging

The C compiler's sanitizing options introduce code in the output
binary which is fragile and not very security conscious.  It has
become clear that sanitizing is only really meant for use while
debugging.

As a side effect, this makes compilation faster, as the Makefile, for
production builds, no longer runs the compiler repeatedly to find all
its currently supported sanitizing options.

* Makefile (DEBUG): Add "$(SANITIZE)".
  (SANITIZE): Comment out.
  (CFLAGS): Remove "$(SANITIZE)".
  (plugins.d/mandos-client): Revert back to use plain $(LINK.c), since
                             we no longer need to remove the leak
                             sanitizer by overriding CFLAGS.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/mandos.postinst
15
15
# If prerm fails during replacement due to conflict:
16
16
#       <postinst> abort-remove in-favour <new-package> <version>
17
17
 
 
18
. /usr/share/debconf/confmodule
 
19
 
18
20
set -e
19
21
 
20
22
case "$1" in
53
55
            chown _mandos:_mandos /var/lib/mandos
54
56
            chmod u=rwx,go= /var/lib/mandos
55
57
        fi
 
58
 
 
59
        if dpkg --compare-versions "$2" eq "1.8.0-1" \
 
60
                || dpkg --compare-versions "$2" eq "1.8.0-1~bpo9+1"; then
 
61
            if grep --quiet --regexp='^[[:space:]]*key_id[[:space:]]*=[[:space:]]*[Ee]3[Bb]0[Cc]44298[Ff][Cc]1[Cc]149[Aa][Ff][Bb][Ff]4[Cc]8996[Ff][Bb]92427[Aa][Ee]41[Ee]4649[Bb]934[Cc][Aa]495991[Bb]7852[Bb]855[[:space:]]*$' /etc/mandos/clients.conf; then
 
62
                sed --in-place \
 
63
                    --expression='/^[[:space:]]*key_id[[:space:]]*=[[:space:]]*[Ee]3[Bb]0[Cc]44298[Ff][Cc]1[Cc]149[Aa][Ff][Bb][Ff]4[Cc]8996[Ff][Bb]92427[Aa][Ee]41[Ee]4649[Bb]934[Cc][Aa]495991[Bb]7852[Bb]855[[:space:]]*$/d' \
 
64
                    /etc/mandos/clients.conf
 
65
                invoke-rc.d mandos restart
 
66
                db_version 2.0
 
67
                db_fset mandos/removed_bad_key_ids seen false
 
68
                db_reset mandos/removed_bad_key_ids
 
69
                db_input critical mandos/removed_bad_key_ids || true
 
70
                db_go
 
71
                db_stop
 
72
            fi
 
73
        fi
 
74
 
 
75
        gnutls_version=$(dpkg-query --showformat='${Version}' \
 
76
                                    --show libgnutls30 \
 
77
                                    2>/dev/null || :)
 
78
        if [ -n "$gnutls_version" ] \
 
79
               && dpkg --compare-versions $gnutls_version ge 3.6.6; then
 
80
            db_version 2.0
 
81
            db_input critical mandos/key_id || true
 
82
            db_go
 
83
            db_stop
 
84
        fi
56
85
        ;;
57
86
    
58
87
    abort-upgrade|abort-deconfigure|abort-remove)