Bug 34397 - libnss uses bogus pretrans script (uses /bin/sh), fails bootstrapping
Summary: libnss uses bogus pretrans script (uses /bin/sh), fails bootstrapping
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal minor
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL:
Whiteboard: MGA9-64-OK,MGA9-32-OK
Keywords: advisory, validated_update
Depends on: 34393
Blocks:
  Show dependency treegraph
 
Reported: 2025-06-26 17:39 CEST by Christian Lohmaier
Modified: 2025-07-11 20:53 CEST (History)
5 users (show)

See Also:
Source RPM: nss-3.111.0-1.mga9.src.rpm
CVE:
Status comment:


Attachments

Description Christian Lohmaier 2025-06-26 17:39:24 CEST
Description of problem:
rpm's pretrans scripts are run before any package installation is run, as such the scripts must not depend on any interpreter/only lua is allowed.

The problem occurs when creating livecd or similar chroots from scratch, then the pretrans script fails because there is nothing that would provide /bin/sh to run the script

Also the pretrans script certainly doesn't need to be pretrans:
pretrans scriptlet (using /bin/sh):
if [ -f /usr/lib64/libnssckbi.so -a ! -L /usr/lib64/libnssckbi.so ]; then
  rm -f /usr/lib64/libnssckbi.so
fi

That could just as well be done in the regular %pre script (that is run after the dependencies were installed, so /bin/sh is available)

But I also don't quite see the point in having the script in the first place. I guess the file's owner was moved from libnss to p11-kit-trust and use of a transitional package was avoided with that? But the lib64nss3 package still owns the symlink, so none of that should be necessary in the first place.

tldr: 
* the %pretrans script seems unnecessary/pointless
* if it is required, it should be rewritten to lua, similar to https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Replacement/#_scriptlet_to_replace_a_symlink_to_a_directory_with_a_directory 

%pretrans -p <lua>
path="/usr/lib64/libnssckbi.so"
st=posix.stat(path)
if st and st.type == "regular" then
  os.remove(path)
end

(the existing pretrans script doesn't remove dangling symlinks, so it's not removed in that snippet either)
Comment 1 Lewis Smith 2025-06-28 20:45:10 CEST
Thank you for this learned report.
Assuming it applies to just nss, assigning to nicolasS who nurses that.
If it is more generic, it should go to mageiatools.
CC'ing Jani who knows about this sort of thing.

Assignee: bugsquad => nicolas.salguero
CC: (none) => jani.valimaa

Comment 2 Jani Välimaa 2025-07-07 19:32:04 CEST
Yep, I'd say %pretrans scriptlet is useless nowadays. Pushed nss-3.113.0-1.1.mga9 without %pretrans to mga9 core/updates_testing.

SRPMS:
nss-3.113.0-1.1.mga9

RPMS:
lib(64)nss-devel-3.113.0-1.1.mga9
lib(64)nss-static-devel-3.113.0-1.1.mga9
lib(64)nss3-3.113.0-1.1.mga9
nss-3.113.0-1.1.mga9
nss-doc-3.113.0-1.1.mga9

Depends on: (none) => 34393
Assignee: nicolas.salguero => qa-bugs

katnatek 2025-07-07 22:37:46 CEST

Keywords: (none) => advisory

Comment 3 katnatek 2025-07-08 01:15:07 CEST
RH x86_64

installing lib64nss3-3.113.0-1.1.mga9.x86_64.rpm nss-3.113.0-1.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/2: nss                   ##################################################################################################
      2/2: lib64nss3             ##################################################################################################
      1/2: removing lib64nss3-2:3.113.0-1.mga9.x86_64
                                 ##################################################################################################
      2/2: removing nss-2:3.113.0-1.mga9.x86_64
                                 ##################################################################################################

strace chromium-browser shows

openat(AT_FDCWD, "/lib64/libnss3.so", O_RDONLY|O_CLOEXEC) = 3

Browser works OK

strace pidgin shows
openat(AT_FDCWD, "/lib64/libnss3.so", O_RDONLY|O_CLOEXEC) = 13

OK for me
Comment 4 Morgan Leijström 2025-07-08 18:16:40 CEST
Clean update and use with firefox on both i585 (just small test) and x86_64 in use on three machines for some hours of various surfing.

CC: (none) => fri

Comment 5 Herman Viaene 2025-07-09 16:07:40 CEST
MGA9-64 server Plasma Wayland on Compaq H000SB
No installation issues.
Run firefox under strace to be sure mib64nss items are used: they show up.
So  for me good, awaiting some more tests?

CC: (none) => herman.viaene

Comment 6 katnatek 2025-07-10 19:31:39 CEST
I think is good set of test

Whiteboard: (none) => MGA9-64-OK,MGA9-32-OK
CC: (none) => andrewsfarm

Comment 7 Thomas Andrews 2025-07-10 21:02:37 CEST
Validating.

Keywords: (none) => validated_update
CC: (none) => sysadmin-bugs

Comment 8 Mageia Robot 2025-07-11 20:53:20 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGAA-2025-0067.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.