[Pkg-swan-devel] Bug#787810: Bug#787810: libstrongswan-standard-plugins not installed during dist-upgrade

Fri Jun 5 18:50:36 UTC 2015

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On 05/06/15 15:43, Yves-Alexis Perez wrote:
> On Fri, Jun 05, 2015 at 12:31:46PM +0200, Daniel Pocock wrote:
>> Package: libstrongswan-standard-plugins Version: 5.2.1-6 
>> Severity: serious
>> 
>> I've marked this bug serious because it can lead to a loss of 
>> connectivity for remote users.
>> 
>> The system was running fine with strongSwan on wheezy using
>> ECDSA
>> 
>> The system was upgraded to jessie using apt-get dist-upgrade
>> 
>> After upgrade, the VPN would not start
>> 
>> "ipsec up peer" would complain:
>> 
>> no private key found for 'fromcert'
>> 
>> Looking at the ipsec start logs in syslog, I observed the
>> errors:
>> 
>> building CRED_PRIVATE_KEY - ECDSA failed, tried 2 builders 
>> loading private key from 'hostKey.der' failed ... building
>> CRED_CERTIFICATE - ANY failed, tried 1 builders loading
>> certificate from 'hostCert.der' failed
>> 
>> Installing the missing package and restarting ipsec resolved the
>> issue:
>> 
>> apt-get install libstrongswan-standard-plugins ipsec stop ipsec
>> start
>> 
> Hi,
> 
> libstrongswan (which is a dependency of the various charon daemons)
> as a Recommends: on libstrongswan-standard-plugins so if you
> install Recommends: I think it /should/ be the case.
> 

Thanks for the prompt feedback

I tend to be a bit cautious about installing all recommended packages
on dist-upgrade, mainly because of disk usage.

Many of the systems I've worked with have deliberately small
partitions (they are usually virtual servers) and even without all
recommended packages, each upgrade tends to grow the disk usage and
require some re-arranging of LVM.  Even on my laptop, it is just a
pain to backup if I let the disk usage grow too much.

Do you feel these plugins definitely need to be in a separate package?

Do you think you could use a metapackage for upgraders, with a
mandatory dependency on the plugins, so they end up with the same
plugins they had before?