[Pkg-nginx-maintainers] Bug#1153098: nginx-dev: conf_flags corrupted when built with dash 0.5.13, modules FTBFS

[Sebastien Bacher]

Source: nginx
Version: 1.30.4-7ubuntu1
Severity: important
Tags: patch ftbfs
X-Debbugs-Cc: seb128 at ubuntu.com
User: ubuntu-devel at lists.ubuntu.com
Usertags: origin-ubuntu tenacious ubuntu-patch

Dear Maintainer,

nginx-dev built with dash 0.5.13 ships a broken /usr/share/nginx/src/conf_flags,
and every module built against it fails to build. Debian still has dash
0.5.12, so you don't see it yet, but Ubuntu has dash 0.5.13 and all 25 nginx
module rebuilds there fail on every architecture.

debian/rules writes the file with:

	echo "NGX_CONF_FLAGS=( $${flags} )" > $(BUILDDIR_src)/conf_flags

and the flags contain:

	--override-system="$(... | sed 's/-.*$//; s/^./\U&/; s/Gnu/\U&/g;')"

Since 0.5.13, the dash echo builtin understands the \uXXXX and \UXXXXXXXX
escapes (they came with $'...' support, upstream commit 776424a8f915 "parser:
Add dollar single quote"). Here no hex digits follow \U, and dash writes a NUL
byte in its place:

	$ grep -ao 's/^./.&/' /usr/share/nginx/src/conf_flags | od -c
	0000000   s   /   ^   .   /  \0   &   /  \n

The sed expression then no longer uppercases the first letter, so a module
build calls configure with --override-system=linux. auto/os/conf only matches
"Linux:*", so the build falls back to the generic Unix configuration and never
includes src/os/unix/ngx_linux_config.h. That means _GNU_SOURCE is not defined
(note accept4(), sched_setaffinity() and strerrordesc_np() reported "not
found"), and glibc then doesn't define struct in6_pktinfo:

	checking for OS
	 + linux 3.16.0 x86_64
	...
	src/event/ngx_event_udp.h:46:27: error: field 'pkt6' has incomplete type
	   46 |     struct in6_pktinfo    pkt6;

Full log (libnginx-mod-http-auth-jwt, built against nginx-dev 1.30.6-2ubuntu1):
https://launchpadlibrarian.net/883485254/buildlog_ubuntu-tenacious-amd64.libnginx-mod-http-auth-jwt_2.5.0-3build1_BUILDING.txt.gz

The attached patch writes the file with printf '%s\n', which doesn't
interpret backslashes in its argument, so it works with any /bin/sh. The only
Ubuntu delta in debian/rules is --build=Ubuntu, so this affects Debian as soon
as dash 0.5.13 reaches unstable. Ubuntu bug: https://bugs.launchpad.net/bugs/2173081

Thanks,
Sebastien


-- System Information:
Debian Release: forky/sid
  APT prefers resolute-updates
  APT policy: (500, 'resolute-updates'), (500, 'resolute-security'), (500, 'resolute'), (100, 'resolute-backports')
Architecture: amd64 (x86_64)

Kernel: Linux 7.0.0-42-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
-------------- next part --------------
Description: write nginx-dev's conf_flags with printf instead of echo
 The --override-system flag contains the sed expression 's/^./\U&/'.
 dash 0.5.13's echo builtin parses \U as a Unicode escape and, with no hex
 digits after it, writes a NUL byte, so modules configure for a generic OS
 instead of Linux and fail to build.
Author: Sebastien Bacher <sebastien.bacher at canonical.com>
Forwarded: not-needed
Last-Update: 2026-11-05

--- a/debian/rules
+++ b/debian/rules
@@ -104,7 +104,7 @@ override_dh_auto_build-indep:
 	sed -i '/^# create Makefile/,/^END$$/d' $(BUILDDIR_src)/auto/make $(BUILDDIR_src)/auto/init $(BUILDDIR_src)/auto/install
 	find $(CURDIR)/src -type f -name '*.h' -printf 'src/%P\0' | tar -C $(CURDIR) --null --files-from - -c | tar -C $(BUILDDIR_src)/ -x
 	if [ -e $(CURDIR)/configure ]; then cp $(CURDIR)/configure $(BUILDDIR_src)/; fi
-	echo "NGX_CONF_FLAGS=( $${flags} )" > $(BUILDDIR_src)/conf_flags
+	printf '%s\n' "NGX_CONF_FLAGS=( $${flags} )" > $(BUILDDIR_src)/conf_flags
 	pod2man debian/debhelper/dh_nginx > $(BUILDDIR_src)/dh_nginx.1
 
 override_dh_install-arch: