Version in base suite: 1.26.3-3+deb13u7 Version in overlay suite: 1.26.3-3+deb13u8 Base version: nginx_1.26.3-3+deb13u8 Target version: nginx_1.26.3-3+deb13u9 Base file: /srv/ftp-master.debian.org/ftp/pool/main/n/nginx/nginx_1.26.3-3+deb13u8.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/n/nginx/nginx_1.26.3-3+deb13u9.dsc changelog | 9 +++ patches/CVE-2026-42533.patch | 17 ------ tests/control | 4 + tests/nginx-dev-test.sh | 53 +++++++++++++++++++++ tests/nginx-dev-test/config | 7 ++ tests/nginx-dev-test/ngx_http_autopkgtest_module.c | 34 +++++++++++++ 6 files changed, 108 insertions(+), 16 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp07l_ehi/nginx_1.26.3-3+deb13u8.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpp07l_ehi/nginx_1.26.3-3+deb13u9.dsc: no acceptable signature found diff -Nru nginx-1.26.3/debian/changelog nginx-1.26.3/debian/changelog --- nginx-1.26.3/debian/changelog 2026-09-04 17:02:15.000000000 +0000 +++ nginx-1.26.3/debian/changelog 2026-09-15 09:28:28.000000000 +0000 @@ -1,3 +1,12 @@ +nginx (1.26.3-3+deb13u9) trixie-security; urgency=medium + * d/p/CVE-2026-42533.patch update: keep private script headers out of + auto/modules' ngx_module_deps so third-party modules can be built + against nginx-dev. (Closes: #1147527) + * d/t/nginx-dev-test.sh add, verify that nginx-dev can build and load + a minimal third-party dynamic HTTP module. + + -- Jan Mojžíš Tue, 15 Sep 2026 09:28:28 +0000 + nginx (1.26.3-3+deb13u8) trixie-security; urgency=medium * d/t/abicheck add, detect unintended API changes in the nginx-dev diff -Nru nginx-1.26.3/debian/patches/CVE-2026-42533.patch nginx-1.26.3/debian/patches/CVE-2026-42533.patch --- nginx-1.26.3/debian/patches/CVE-2026-42533.patch 2026-09-04 17:02:15.000000000 +0000 +++ nginx-1.26.3/debian/patches/CVE-2026-42533.patch 2026-09-15 09:28:28.000000000 +0000 @@ -55,23 +55,8 @@ Origin: backport, https://github.com/nginx/nginx/commit/b767540492e8c79a58bc26034d3bab2f708b7bd1 Bug: https://my.f5.com/manage/s/article/K000162097 Forwarded: not-needed -Last-Update: 2026-07-26 +Last-Update: 2026-09-14 --- -diff -Naur treeA/auto/modules treeC/auto/modules ---- a/auto/modules -+++ b/auto/modules -@@ -77,6 +77,7 @@ - src/http/ngx_http_cache.h \ - src/http/ngx_http_variables.h \ - src/http/ngx_http_script.h \ -+ src/http/ngx_http_script.hh \ - src/http/ngx_http_upstream.h \ - src/http/ngx_http_upstream_round_robin.h" - ngx_module_srcs="src/http/ngx_http.c \ -@@ -1058 +1059,2 @@ -- src/stream/ngx_stream_script.h \ -+ src/stream/ngx_stream_script.h \ -+ src/stream/ngx_stream_script.hh \ diff -Naur treeA/src/http/modules/ngx_http_fastcgi_module.c treeC/src/http/modules/ngx_http_fastcgi_module.c --- a/src/http/modules/ngx_http_fastcgi_module.c 2025-02-05 19:07:30.000000000 +0800 +++ b/src/http/modules/ngx_http_fastcgi_module.c 2026-07-26 07:34:06.512868602 +0800 diff -Nru nginx-1.26.3/debian/tests/control nginx-1.26.3/debian/tests/control --- nginx-1.26.3/debian/tests/control 2026-09-04 17:02:15.000000000 +0000 +++ nginx-1.26.3/debian/tests/control 2026-09-15 09:28:28.000000000 +0000 @@ -153,3 +153,7 @@ Tests: abicheck Restrictions: allow-stderr skippable Depends: nginx-dev + +Tests: nginx-dev-test.sh +Restrictions: allow-stderr +Depends: nginx-dev, build-essential diff -Nru nginx-1.26.3/debian/tests/nginx-dev-test/config nginx-1.26.3/debian/tests/nginx-dev-test/config --- nginx-1.26.3/debian/tests/nginx-dev-test/config 1970-01-01 00:00:00.000000000 +0000 +++ nginx-1.26.3/debian/tests/nginx-dev-test/config 2026-09-15 09:28:28.000000000 +0000 @@ -0,0 +1,7 @@ +ngx_addon_name=ngx_http_autopkgtest_module + +ngx_module_type=HTTP +ngx_module_name=ngx_http_autopkgtest_module +ngx_module_srcs="$ngx_addon_dir/ngx_http_autopkgtest_module.c" + +. auto/module diff -Nru nginx-1.26.3/debian/tests/nginx-dev-test/ngx_http_autopkgtest_module.c nginx-1.26.3/debian/tests/nginx-dev-test/ngx_http_autopkgtest_module.c --- nginx-1.26.3/debian/tests/nginx-dev-test/ngx_http_autopkgtest_module.c 1970-01-01 00:00:00.000000000 +0000 +++ nginx-1.26.3/debian/tests/nginx-dev-test/ngx_http_autopkgtest_module.c 2026-09-15 09:28:28.000000000 +0000 @@ -0,0 +1,34 @@ +#include +#include +#include + +static ngx_http_module_t ngx_http_autopkgtest_module_ctx = { + NULL, /* preconfiguration */ + NULL, /* postconfiguration */ + + NULL, /* create main configuration */ + NULL, /* initialize main configuration */ + + NULL, /* create server configuration */ + NULL, /* merge server configuration */ + + NULL, /* create location configuration */ + NULL /* merge location configuration */ +}; + +ngx_module_t ngx_http_autopkgtest_module = { + NGX_MODULE_V1, + &ngx_http_autopkgtest_module_ctx, + NULL, + NGX_HTTP_MODULE, + + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + NULL, + + NGX_MODULE_V1_PADDING +}; diff -Nru nginx-1.26.3/debian/tests/nginx-dev-test.sh nginx-1.26.3/debian/tests/nginx-dev-test.sh --- nginx-1.26.3/debian/tests/nginx-dev-test.sh 1970-01-01 00:00:00.000000000 +0000 +++ nginx-1.26.3/debian/tests/nginx-dev-test.sh 2026-09-15 09:28:28.000000000 +0000 @@ -0,0 +1,53 @@ +#!/bin/sh +set -eu + +# nginx binary is in the /usr/sbin +PATH="/usr/sbin:${PATH}" +export PATH + +nginx_src=/usr/share/nginx/src +test_dir="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" +module_src="$test_dir/nginx-dev-test" +build_dir="$AUTOPKGTEST_TMP/build" +module="$build_dir/ngx_http_autopkgtest_module.so" + +mkdir -p "$build_dir" + +# conf_flags contains a Bash array, so use Bash for the build commands. +bash -eu -o pipefail -c ' + module_src=$1 + build_dir=$2 + nginx_src=$3 + + # Match Debian::Debhelper::Buildsystem::nginx_mod: evaluate conf_flags + # from the external module source directory. + cd "$module_src" + . "$nginx_src/conf_flags" + + cd "$nginx_src" + ./configure \ + "${NGX_CONF_FLAGS[@]}" \ + --add-dynamic-module="$module_src" \ + --builddir="$build_dir" + + make -f "$build_dir/Makefile" modules +' sh "$module_src" "$build_dir" "$nginx_src" + +test -s "$module" + +# Verify that the resulting module is loadable by the matching nginx binary. +cat >"$AUTOPKGTEST_TMP/nginx.conf" <