[Pkg-nginx-maintainers] Bug#1147527: closed by Jan Mojžíš <noreply at salsa.debian.org> (reply to 1147527 at bugs.debian.org, Jan Mojžíš <janmojzis at debian.org>) (Bug#1147527 fixed in nginx)

[Camden Narzt]

Oh sorry, I dunno the etiquette around these things, everything’s perfect now.

Cheers,

Camden

On Sep 17, 2026, at 11:13 PM, Debian Bug Tracking System <owner at bugs.debian.org> wrote:

This is an automatic notification regarding your Bug report
which was filed against the nginx-dev package:

#1147527: nginx-dev: Missing header file in nginx-dev after backport

It has been closed by Jan Mojžíš <noreply at salsa.debian.org> (reply to 1147527 at bugs.debian.org,  Jan Mojžíš <janmojzis at debian.org>).

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Jan Mojžíš <noreply at salsa.debian.org> (reply to 1147527 at bugs.debian.org,  Jan Mojžíš <janmojzis at debian.org>) by
replying to this email.


--
1147527: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147527
Debian Bug Tracking System
Contact owner at bugs.debian.org with problems

From: Jan Mojžíš <noreply at salsa.debian.org>
Subject: Bug#1147527 fixed in nginx
Date: September 17, 2026 at 11:09:56 PM MDT
To: 1147527-done at bugs.debian.org
Reply-To: 1147527 at bugs.debian.org, Jan Mojžíš <janmojzis at debian.org>


Hello,

Bug #1147527 in nginx reported by you has been fixed in the Git repository.
You can see the commit message below and you can check the diff of the fix at:

https://salsa.debian.org/nginx-team/nginx/-/commit/540580b6fe456a2033602e85f2bb631a4bd4f7f2

------------------------------------------------------------------------
Import Debian changes 1.26.3-3+deb13u9

nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium
.
 * d/p/CVE-2026-42533.patch update: keep private script headers out of
   auto/modules' ngx_module_deps so third-party modules can be built
   against nginx-dev. (Closes: #1147527)
 * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load
   a minimal third-party dynamic HTTP module.
------------------------------------------------------------------------

(this message was generated automatically)
--
Greetings

https://bugs.debian.org/1147527



From: Camden Narzt <camden.narzt at hotmail.com>
Subject: nginx-dev: Missing header file in nginx-dev after backport
Date: September 12, 2026 at 11:26:47 AM MDT
To: Debian Bug Tracking System <submit at bugs.debian.org>


Package: nginx-dev
Version: 1.26.3-3+deb13u8
Severity: important
X-Debbugs-Cc: camden.narzt at hotmail.com, team at security.debian.org

Dear Maintainer,

  * What led up to the situation?

Debian backported a fix for CVE-2026-42533 and released 1.26.3-3+deb13u8.

  * What exactly did you do (or not do) that was effective (or ineffective)?

I tried to build my nginx-dynamic-module package against the new nginx-dev package version.

  * What was the outcome of this action?

Make throws the error: make[2]: *** No rule to make target 'src/http/ngx_http_script.hh', needed by 'objs/addon/nginx_module/ngx_http_passenger_module.o'. Stop.

  * What outcome did you expect instead?

Make succeeds.


  * Investigation
# on debian 13:
apt update && apt install -y nginx-dev
# snipped output from apt
dpkg -L nginx-dev | grep -F 'ngx_http_script.hh'
find /usr/share/nginx/src -name 'ngx_http_script.hh' -o -name 'ngx_stream_script.hh'
ls -l /usr/share/nginx/src/src/http/ngx_http_script.hh
ls: cannot access '/usr/share/nginx/src/src/http/ngx_http_script.hh': No such file or directory


auto/modules was patched to include src/http/ngx_http_script.hh and that file is added to the source tree: https://mail-archive.com/debian-bugs-dist%40lists.debian.org/msg2120411.html?utm_source=chatgpt.com

but that file isn't present in the nginx-dev package.




-- System Information:
Debian Release: 13.6
 APT prefers stable-updates
 APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: arm64 (aarch64)

Kernel: Linux 6.8.0-117-generic (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect

Versions of packages nginx-dev depends on:
ii  debhelper [debhelper-compat]  13.24.2
ii  libexpat1-dev [libexpat-dev]  2.8.3-1~deb13u1
ii  libgd-dev                     2.3.3-14~deb13u1
ii  libgeoip-dev                  1.6.12-11.2~deb13u1
ii  libpcre2-dev                  10.46-1~deb13u2
ii  libperl-dev                   5.40.1-6+deb13u1
ii  libssl-dev                    3.5.7-1~deb13u2
ii  libxslt1-dev                  1.1.35-1.2+deb13u3
ii  nginx [nginx-abi-1.26.3-1]    1.26.3-3+deb13u8
ii  po-debconf                    1.0.21+nmu1
ii  zlib1g-dev                    1:1.3.dfsg+really1.3.1-1+b1

nginx-dev recommends no packages.

nginx-dev suggests no packages.

-- no debconf information



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-nginx-maintainers/attachments/20260918/9154d974/attachment-0001.htm>