DFSG NEW review for libpam-xdg version 0.8.5-1

Summary

• Licensing is DFSG-compliant and debian/copyright is accurate: Yes
• Packaging is of good quality: No
• Issues: 0 blocker, 1 important, 2 minor
• debian/watch: version 5
• debian/copyright: machine-readable
• Scan before the review: nothing found

Licensing

debian/copyright is DEP-5 and complete for this four-file upstream tree. Every upstream file (pam_xdg.c, pam_xdg.8, makefile, .gitignore) carries the same ISC grant and the single holder Steffen Nurpmeso; debian/* is attributed to Mark Hindley, also ISC. The ISC text is reproduced in full in the stand-alone License paragraph, matching the per-file notices word for word, and no file carries a different licence or a non-free term. The scan's holder check found nothing missing.

Packaging

The packaging is small and mostly idiomatic (compat 14, single-binary add-on, correct multiarch security directory, pam-auth-update in postinst/prerm), but Conflicts: logind is a hard conflict with the virtual package provided by both libpam-systemd and libpam-elogind, so installing this package would remove systemd's (or elogind's) PAM session module and with it systemd itself. Two smaller faults: Multi-Arch: foreign on a package shipping a shared object, and a build that ignores dpkg-buildflags (and whose own linker hardening is disabled by a typo).

Issues

1. [important] [packaging] Conflicts: logind conflicts with libpam-systemd and libpam-elogind, so installing libpam-xdg removes the system's session manager

• Files: debian/control:14
• Basis: checked, in the package or with a reference tool
• Evidence: Conflicts: logind in the libpam-xdg stanza; apt-cache show logind answers "logind is a virtual package ... provided by libpam-elogind 255.17-1debian8 and libpam-systemd 262.1-1".
• Problem: Policy 7.5: a name in Conflicts behaves as if every package providing that virtual package had been named, so libpam-xdg can never be installed alongside libpam-systemd (which Depends on systemd) or libpam-elogind. apt would have to remove the logind provider - on a default Debian system that means systemd, systemd-sysv and everything depending on them - to install a PAM helper module. Nothing in the package documents or needs such a conflict: the pam-configs profile and the module itself can be disabled selectively.
• Fix: Drop the package-level Conflicts. If pam_xdg must not run at the same time as pam_systemd/pam_elogind, express that in the pam-configs profile with its own Conflicts: key (e.g. Conflicts: systemd in debian/src/pam-configs/xdg), which makes pam-auth-update disable the other profile instead of removing its package; or, at most, use Breaks plus an explanatory note if co-installation really is unsafe.

2. [minor] [packaging] Multi-Arch: foreign on a package whose main file is an architecture-dependent shared object

• Files: debian/control:12-13
• Basis: checked, in the package or with a reference tool
• Evidence: Architecture: any with Multi-Arch: foreign; the package installs usr/lib/${DEB_HOST_MULTIARCH}/security/pam_xdg.so (debian/install:2).
• Problem: Policy 5.6.34.2: a package must not be marked Multi-Arch: foreign if any part of its interface is architecture-dependent, and shared libraries are named there as inherently architecture-dependent. PAM modules in Debian (libpam-systemd, libpam-modules) are Multi-Arch: same.
• Fix: Change to Multi-Arch: same (the pam-configs file under /usr/share/pam-configs is identical across architectures, so co-installation is fine), or drop the field.

3. [minor] [packaging] Build ignores dpkg-buildflags and its own linker hardening flags expand to nothing

• Files: makefile:26, makefile:36-38, debian/rules:9-10
• Basis: checked, in the package or with a reference tool
• Evidence: makefile:36-37 define LDF_SUN= and LDF_X=-Wl,-z,relro -Wl,-z,now ... -fPIE -pie, but makefile:38 uses $(SULDF_X)/$(SULDF_SUN), undefined names that expand to the empty string; makefile:26 is CFLAGS =, an unconditional assignment, and debian/rules passes no flags.
• Problem: make(1) gives makefile assignments precedence over environment values (only -e inverts this, make(1) --environment-overrides), and dh(1) exports the dpkg-buildflags values as CFLAGS/LDFLAGS. So the compiler never sees the Debian defaults (-g for dbgsym, -ffile-prefix-map, -fstack-clash-protection and the rest) and the module is linked with only -shared: no BIND_NOW and no full RELRO, because the intended -Wl,-z,relro -Wl,-z,now are lost to the SULDF_* typo.
• Fix: Patch makefile to use CFLAGS ?= / LDFLAGS ?= so the dpkg-buildflags values are used, or append the flags in debian/rules (dh_auto_build -- CFLAGS="$(CFLAGS)" LDFLAGS="$(LDFLAGS)"), and fix $(SULDF_X)/$(SULDF_SUN) to $(LDF_X)/$(LDF_SUN); forward the typo upstream.

Verified

• Whole tree inspected: .gitignore, makefile, pam_xdg.8, pam_xdg.c and every file under debian/ (changelog, control, copyright, gbp.conf, install, postinst, prerm, rules, source/format, src/pam-configs/xdg); .pc/ and debian/watch left aside as instructed.
• All four upstream files carry SPDX-License-Identifier: ISC and Copyright (c) 2021-2024 / 2022-2024 Steffen Nurpmeso; the ISC text in debian/copyright matches the per-file grant verbatim, so the later 2021 - 2026 date merely extends the term and is not a discrepancy worth reporting.
• The pre-scan listed no files: its holder check on the three scanned files reported every holder named in debian/copyright, and it flagged no built files, minified code, PDFs or non-free wording. No .so, .o or other build artifact is present in the source tree.
• No vendored third-party code: the only source is the single pam_xdg.c, which includes just PAM, libc and sys headers; there is no embedded library.
• Session-Final: in debian/src/pam-configs/xdg is valid: /usr/sbin/pam-auth-update strips a -Final suffix from profile keys (line 719-720, "Auth-Final is now just called Auth").
• usr/lib/${DEB_HOST_MULTIARCH}/security/ in debian/install is a supported debhelper substitution at compat 13+ (debhelper(7), "Substitutions in debhelper config files": DEB_HOST_* expands to the dpkg-architecture value).
• --with=single-binary resolves: /usr/share/perl5/Debian/Debhelper/Sequence/single_binary.pm exists and adds --destdir=debian/tmp/ to dh_auto_install, which is what override_dh_auto_install and debian/install assume.
• libpam-runtime (which ships pam-auth-update) is Priority: required and Multi-Arch: foreign according to apt-cache, so the postinst/prerm calls without a Depends on it are not a fault.
• debian/rules installs the module into the multiarch PAM module directory used by libpam-modules, and the pam-configs profile references it by name, so it is found at login; the man page is installed through debian/install and dh_compress.
• The .dsc (0.8.5-1, 3.0 quilt, Standards-Version 4.7.4) matches debian/control, and Standards-Version 4.7.4 is current against the review system's Policy 4.7.
• Changelog: libpam-xdg (0.8.5-1) unstable, non-native version, dated the day before the review; no bug closures claimed, no missing entries.
• uscan found the packaged version as the newest upstream release (upstream 0.8.5, packaged 0.8.5).

Not confirmed

• Architecture: any, but the upstream makefile hardcodes x86-oriented flags (-fcf-protection=full, -fstrict-overflow). Whether every release architecture's GCC accepts them (arm64, ppc64el, s390x, riscv64) was not checked; a build on such an architecture would show it. The amd64 build presumably the maintainer ran does not.

Proposed changes

None.