[gentoo-user] WARNING: Do not update your system on ~amd64

[gentoo-user] WARNING: Do not update your system on ~amd64

[Andreas Fink]

Hello,
I've noticed a problem with the current PAM update to
sys-libs/pam-1.4.0.
The update adds passwdqc USE to sys-auth/pambase, which pulls in
sys-auth/passwdqc. However sys-auth/passwdqc fails to build on my
system, and leaves me with an installed sys-libs/pam-1.4.0 which is
broken and does not allow any new login.
The end result is that sys-libs/pam-1.4.0 was successfully merged but
sys-auth/pambase will not be merged, due to a build failure in passwdqc.
Disabling the USE flag passwdqc for pambase allows an update to pambase
too, and logins work again.
This is a warning to anyone out there who updates daily and runs an
~amd64.

One system that I updated and restarted, I cannot login to it anymore
(or ssh into it). Another system that I updated and currently am
writing from, I'm still logged in after the broken update. and I can
see the following error message (before disabling the USE flag passwdqc
for the package pambase):
PAM unable to dlopen(/lib64/security/pam_cracklib.so): /lib64/security/pam_cracklib.so: cannot open shared object file: No such file or directory
PAM adding faulty module: /lib64/security/pam_cracklib.so

After doing a
USE=-passwdqc emerge -a1 pambase
the error messages disappear from the system logs and I am able to
login to my machine again. However if you reboot with the broken state
you will have a hard time updating it, since you cannot login to your
machine anymore and need a chroot from a live system.

The bug report for passwdqc is here:
https://bugs.gentoo.org/728528

Cheers
Andreas

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1027 bytes --]

On Wed, 17 Jun 2020 07:34:41 +0200, Andreas Fink wrote:

> I've noticed a problem with the current PAM update to
> sys-libs/pam-1.4.0.
> The update adds passwdqc USE to sys-auth/pambase, which pulls in
> sys-auth/passwdqc. However sys-auth/passwdqc fails to build on my
> system, and leaves me with an installed sys-libs/pam-1.4.0 which is
> broken and does not allow any new login.
> The end result is that sys-libs/pam-1.4.0 was successfully merged but
> sys-auth/pambase will not be merged, due to a build failure in passwdqc.
> Disabling the USE flag passwdqc for pambase allows an update to pambase
> too, and logins work again.
> This is a warning to anyone out there who updates daily and runs an
> ~amd64.

Thanks for the heads up. To play safe, I emerge passwdqc before emerging
@world. It actually emerge without complaint on the three systems I
tried. I also made sure I could SSH in after updating PAM before
terminating the existing session.


-- 
Neil Bothwick

IBM: Itty Bitty Mentality

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Peter Humphrey]

On Wednesday, 17 June 2020 09:29:39 BST Neil Bothwick wrote:
> On Wed, 17 Jun 2020 07:34:41 +0200, Andreas Fink wrote:
> > I've noticed a problem with the current PAM update to
> > sys-libs/pam-1.4.0.
> > The update adds passwdqc USE to sys-auth/pambase, which pulls in
> > sys-auth/passwdqc. However sys-auth/passwdqc fails to build on my
> > system, and leaves me with an installed sys-libs/pam-1.4.0 which is
> > broken and does not allow any new login.
> > The end result is that sys-libs/pam-1.4.0 was successfully merged but
> > sys-auth/pambase will not be merged, due to a build failure in passwdqc.
> > Disabling the USE flag passwdqc for pambase allows an update to pambase
> > too, and logins work again.
> > This is a warning to anyone out there who updates daily and runs an
> > ~amd64.
> 
> Thanks for the heads up. To play safe, I emerge passwdqc before emerging
> @world. It actually emerge without complaint on the three systems I
> tried. I also made sure I could SSH in after updating PAM before
> terminating the existing session.

MAKEOPTS="-j1" emerge -1 passwdqc worked here. Sys-libs/pam had already 
installed by the time passwdqc failed the first time. Sys-auth/pam is not in my 
update list, but sys-auth/pambase is, and has installed without protest.

-- 
Regards,
Peter.

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Andreas Fink]

On Wed, 17 Jun 2020 09:51:13 +0100
Peter Humphrey <peter@prh.myzen.co.uk> wrote:

> On Wednesday, 17 June 2020 09:29:39 BST Neil Bothwick wrote:
> > On Wed, 17 Jun 2020 07:34:41 +0200, Andreas Fink wrote:
> > > I've noticed a problem with the current PAM update to
> > > sys-libs/pam-1.4.0.
> > > The update adds passwdqc USE to sys-auth/pambase, which pulls in
> > > sys-auth/passwdqc. However sys-auth/passwdqc fails to build on my
> > > system, and leaves me with an installed sys-libs/pam-1.4.0 which is
> > > broken and does not allow any new login.
> > > The end result is that sys-libs/pam-1.4.0 was successfully merged but
> > > sys-auth/pambase will not be merged, due to a build failure in passwdqc.
> > > Disabling the USE flag passwdqc for pambase allows an update to pambase
> > > too, and logins work again.
> > > This is a warning to anyone out there who updates daily and runs an
> > > ~amd64.
> >
> > Thanks for the heads up. To play safe, I emerge passwdqc before emerging
> > @world. It actually emerge without complaint on the three systems I
> > tried. I also made sure I could SSH in after updating PAM before
> > terminating the existing session.
>
> MAKEOPTS="-j1" emerge -1 passwdqc worked here. Sys-libs/pam had already
> installed by the time passwdqc failed the first time. Sys-auth/pam is not in my
> update list, but sys-auth/pambase is, and has installed without protest.
>

Either USE="-passwdqc" for pambase or MAKEOPTS="-j1" for passwdqc works
consistently for me too. I think you just need to make sure that
pam+pambase are both updated before logging out ;)
One system that I had to rescue from a live system + chroot :(

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 1212 bytes --]

On Wed, 17 Jun 2020 11:03:00 +0200, Andreas Fink wrote:

> > > Thanks for the heads up. To play safe, I emerge passwdqc before
> > > emerging @world. It actually emerge without complaint on the three
> > > systems I tried. I also made sure I could SSH in after updating PAM
> > > before terminating the existing session.  
> >
> > MAKEOPTS="-j1" emerge -1 passwdqc worked here. Sys-libs/pam had
> > already installed by the time passwdqc failed the first time.
> > Sys-auth/pam is not in my update list, but sys-auth/pambase is, and
> > has installed without protest. 
> 
> Either USE="-passwdqc" for pambase or MAKEOPTS="-j1" for passwdqc works
> consistently for me too. I think you just need to make sure that
> pam+pambase are both updated before logging out ;)
> One system that I had to rescue from a live system + chroot :(

Interestingly, I've now emerged passwordqc successfully on four systems,
with MAKEOPTS ranging from -j2 to j8. Only the 4th failed, and that
worked when I went from -j4 to -j3. This appears to be a bit of a
borderline case, which may explain why it slipped through.


-- 
Neil Bothwick

If at first you don't succeed, give up. No use being a damn fool.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Peter Humphrey]

On Wednesday, 17 June 2020 10:38:54 BST Neil Bothwick wrote:
> On Wed, 17 Jun 2020 11:03:00 +0200, Andreas Fink wrote:
> > > > Thanks for the heads up. To play safe, I emerge passwdqc before
> > > > emerging @world. It actually emerge without complaint on the three
> > > > systems I tried. I also made sure I could SSH in after updating PAM
> > > > before terminating the existing session.
> > > 
> > > MAKEOPTS="-j1" emerge -1 passwdqc worked here. Sys-libs/pam had
> > > already installed by the time passwdqc failed the first time.
> > > Sys-auth/pam is not in my update list, but sys-auth/pambase is, and
> > > has installed without protest.
> > 
> > Either USE="-passwdqc" for pambase or MAKEOPTS="-j1" for passwdqc works
> > consistently for me too. I think you just need to make sure that
> > pam+pambase are both updated before logging out ;)
> > One system that I had to rescue from a live system + chroot :(
> 
> Interestingly, I've now emerged passwordqc successfully on four systems,
> with MAKEOPTS ranging from -j2 to j8. Only the 4th failed, and that
> worked when I went from -j4 to -j3. This appears to be a bit of a
> borderline case, which may explain why it slipped through.

And today, pam and pambase are restored to their earlier versions because sddm 
requires them. But sddm has not changed versions, so why did portage want to 
upgrade pam and pambase on Wednesday?

-- 
Regards,
Peter.

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Neil Bothwick]

[-- Attachment #1: Type: text/plain, Size: 477 bytes --]

On Fri, 19 Jun 2020 10:55:46 +0100, Peter Humphrey wrote:

> And today, pam and pambase are restored to their earlier versions
> because sddm requires them. But sddm has not changed versions, so why
> did portage want to upgrade pam and pambase on Wednesday?

The sddm ebuild has changed without changing the version

-	pam? ( sys-libs/pam )
+	pam? ( <=sys-libs/pam-1.3.1_p20200128-r1 )


-- 
Neil Bothwick

I used to live in the real world, but I got evicted.

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Arve Barsnes]

On Fri, 19 Jun 2020 at 12:49, Neil Bothwick <neil@digimed.co.uk> wrote:
>
> On Fri, 19 Jun 2020 10:55:46 +0100, Peter Humphrey wrote:
>
> > And today, pam and pambase are restored to their earlier versions
> > because sddm requires them. But sddm has not changed versions, so why
> > did portage want to upgrade pam and pambase on Wednesday?
>
> The sddm ebuild has changed without changing the version
>
> -       pam? ( sys-libs/pam )
> +       pam? ( <=sys-libs/pam-1.3.1_p20200128-r1 )

I only got a message about skipping sddm on my world update, so
apparently I'm now running an unsupported pam version. Rebooting
worked just fine though, so what I gain/lose by staying like this is
unknown.

Regards,
Arve

[gentoo-user] Re: WARNING: Do not update your system on ~amd64

[Nikos Chantziaras]

On 19/06/2020 15:31, Arve Barsnes wrote:
> On Fri, 19 Jun 2020 at 12:49, Neil Bothwick <neil@digimed.co.uk> wrote:
>>
>> On Fri, 19 Jun 2020 10:55:46 +0100, Peter Humphrey wrote:
>>
>>> And today, pam and pambase are restored to their earlier versions
>>> because sddm requires them. But sddm has not changed versions, so why
>>> did portage want to upgrade pam and pambase on Wednesday?
>>
>> The sddm ebuild has changed without changing the version
>>
>> -       pam? ( sys-libs/pam )
>> +       pam? ( <=sys-libs/pam-1.3.1_p20200128-r1 )
> 
> I only got a message about skipping sddm on my world update, so
> apparently I'm now running an unsupported pam version. Rebooting
> worked just fine though, so what I gain/lose by staying like this is
> unknown.

I lost my Plasma auto login. SDDM would just display a black screen at 
boot rather than log me in automatically.

Fixing it was easy though:

   emerge -a1 =sys-auth/pambase-20200304 =sys-libs/pam-1.3.1_p20200128-r1

Re: [gentoo-user] Re: WARNING: Do not update your system on ~amd64

[Viktar Patotski]

[-- Attachment #1: Type: text/plain, Size: 1487 bytes --]

Hi All,

First of all thanks for this thread! It helped me a lot. In short:

I was not able to login to my notebook after battery discharge reboot...
Thanks, I always have Gentoo live USB drive. So:

1. I booted to livecd
2. chrooted to my system (thanks I still not encrypted my hdd)
3. emerge --ask --update --newuse --deep @world
4. reboot
5. Happy Login!

:-)

Viktar Patotski

On Fri, Jun 19, 2020 at 5:44 PM Nikos Chantziaras <realnc@gmail.com> wrote:

> On 19/06/2020 15:31, Arve Barsnes wrote:
> > On Fri, 19 Jun 2020 at 12:49, Neil Bothwick <neil@digimed.co.uk> wrote:
> >>
> >> On Fri, 19 Jun 2020 10:55:46 +0100, Peter Humphrey wrote:
> >>
> >>> And today, pam and pambase are restored to their earlier versions
> >>> because sddm requires them. But sddm has not changed versions, so why
> >>> did portage want to upgrade pam and pambase on Wednesday?
> >>
> >> The sddm ebuild has changed without changing the version
> >>
> >> -       pam? ( sys-libs/pam )
> >> +       pam? ( <=sys-libs/pam-1.3.1_p20200128-r1 )
> >
> > I only got a message about skipping sddm on my world update, so
> > apparently I'm now running an unsupported pam version. Rebooting
> > worked just fine though, so what I gain/lose by staying like this is
> > unknown.
>
> I lost my Plasma auto login. SDDM would just display a black screen at
> boot rather than log me in automatically.
>
> Fixing it was easy though:
>
>    emerge -a1 =sys-auth/pambase-20200304 =sys-libs/pam-1.3.1_p20200128-r1
>
>
>

[-- Attachment #2: Type: text/html, Size: 2202 bytes --]

[gentoo-user] Re: WARNING: Do not update your system on ~amd64

[Nikos Chantziaras]

On 21/06/2020 00:41, Viktar Patotski wrote:
> I was not able to login to my notebook after battery discharge reboot... 
> Thanks, I always have Gentoo live USB drive. So:
> 
> 1. I booted to livecd
> 2. chrooted to my system (thanks I still not encrypted my hdd)
> 3. emerge --ask --update --newuse --deep @world
> 4. reboot
> 5. Happy Login!

Yeah, problem seems fixed now. pam, pambase and sddm received revision 
bumps today and now everything is working for me again without needing 
to downgrade.

Re: [gentoo-user] WARNING: Do not update your system on ~amd64

[Rich Freeman]

On Wed, Jun 17, 2020 at 1:34 AM Andreas Fink <finkandreas@web.de> wrote:
>
> The bug report for passwdqc is here:
> https://bugs.gentoo.org/728528
>

Since this thread seems to still be a thing, I'll point out that this
bug was fixed not too long after this thread started.  At this point
there is probably little reason to worry about this update.  Certainly
at the time the warning was useful.

It was just a multi-threaded build issue.  Hard to believe upstream
devs still are creating these issues in the era of Ryzen, but it was
fixed with forcing -j1 in the ebuild.  If you see problems like this
setting -j1 via package.env will generally address the problem.  And
yes, the fact that sometimes it failed and other times it didn't is
the hallmark of these sorts of issues - it is a race condition.

-- 
Rich