[Pkg-utopia-maintainers] Bug#1023758: pipewire: calls addgroup without an adduser dependency

[Simon McVittie]

Package: pipewire
Version: 0.3.59-1
Severity: serious
Justification: Policy §3.5

pipewire calls addgroup without a dependency on the adduser package,
which can fail if no other package happens to have pulled in adduser.
Until recently, apt hid this bug by depending on adduser, but now the
base-passwd package creates the _apt user and it is entirely feasible to
remove or not install adduser in container environments.

Various packages that are in pipewire's transitive Recommends or otherwise
normally installed on desktop-class systems (like dbus-system-bus-common
and polkitd) will normally also pull in adduser, again hiding this
bug, but polkit now depends on "adduser | systemd-sysusers", and I'm
considering doing the same in dbus-system-bus-common.

To reproduce:

$ podman run --pull=always --rm -it debian:sid-slim
# apt update
# apt upgrade
# apt purge adduser
# apt install --no-install-recommends pipewire

(Or use your favourite minimal container or chroot technology, if not
podman.)

Expected result: successful installation. (It's OK if pipewire is only
partially functional without its Recommends.)

Actual result:

> Setting up pipewire:amd64 (0.3.59-1+b1) ...
> /var/lib/dpkg/info/pipewire:amd64.postinst: 7: addgroup: not found

Options for resolving this include:

1. depend on adduser

2. depend on passwd instead, and use groupadd, like samba does:
   https://salsa.debian.org/samba-team/samba/-/commit/1eb07efc2fb4d9ed1218e4af367539bcae255b9e
   (note that passwd is Priority: required but not Essential: yes, so it
   gets installed by debootstrap but technically still needs a dependency)

3. install /usr/lib/sysusers.d/pipewire.conf containing something like:

       g pipewire - -

   then use dh_installsysusers (debhelper compat level 14 or
   dh --with=installsysusers), but be prepared to get bug reports similar
   to #1014805, #1016006 from sysvinit users who are upset that debhelper
   has generated a dependency on "systemd | ..."

4. install /usr/lib/sysusers.d/pipewire.conf as above, but do not use
   dh_installsysusers, and instead set up the user from handwritten
   postinst code using systemd-sysusers, adduser and/or groupadd
   (with an appropriate dependency)

I don't think there is yet project consensus on which one of those is best,
unfortunately.

    smcv