Chapitre 5. Problèmes à connaître pour Stretch

Table des matières

5.1. Upgrade specific items for Stretch
5.1.1. Noteworthy obsolete packages
5.1.2. Deprecated components for Stretch
5.1.3. Things to do post upgrade before rebooting
5.1.4. Minimum requirements for 32-bit Intel is now i686 (with a minor exception)
5.2. Limitations de la prise en charge de sécurité
5.2.1. État de sécurité des navigateurs web
5.2.2. Manque de prise en charge de sécurité pour l'écosystème autour de libv8 et Node.js
5.3. Package specific issues
5.3.1. Older ciphers and SSH1 protocol disabled in OpenSSH by default
5.3.2. Possible backwards incompatible changes to APT
5.3.3. The Xorg server is no longer setuid root by default
5.3.4. Upstart removed

Parfois, des changements ont des effets de bord que nous ne pouvons pas raisonnablement éviter sans nous exposer à des bogues à un autre endroit. Cette section documente les problèmes que nous connaissons. Veuillez également lire l'errata, la documentation des paquets concernés, les rapports de bogues et les autres sources d'informations mentionnées en Section 6.1, « Lectures pour aller plus loin ».

5.1. Upgrade specific items for Stretch

This section covers items related to the upgrade from Jessie to Stretch

5.1.1. Noteworthy obsolete packages

The following is a list of known and noteworthy obsolete packages (see Section 4.8, « Paquets obsolètes » for a description).

The list of obsolete packages includes:

  • TODO; add items here

5.1.2. Deprecated components for Stretch

With the next release of Debian 10 (codenamed Buster) some features will be deprecated. Users will need to migrate to other alternatives to prevent trouble when updating to 10.

This includes the following features:

  • TODO: Add items if any

5.1.3. Things to do post upgrade before rebooting

When apt-get dist-upgrade has finished, the « formal » upgrade is complete, but there are some other things that should be taken care of before the next reboot.

      add list of items here

5.1.4. Minimum requirements for 32-bit Intel is now i686 (with a minor exception)

The 32-bit PC support (known as the Debian architecture "i386") now no longer covers a plain i586 processor. The new baseline is the i686, although some i586 processors (e.g. the "AMD Geode") will remain supported.

The supported i586 processors have all the features of an i686 processor except the "long NOP" (NOPL) instruction. The following shell script may be a useful indicator (assuming only one processor is installed in the machine):

if grep -q '^flags.*\bfpu\b.*\btsc\b.*\bcx8\b.*\bcmov\b' /proc/cpuinfo; then
	echo "OK (assuming all CPUs are of the same type)"
	echo "NOT OK: Missing one or more of the required CPU extensions"

If your machine is not compatible with this requirement, it is recommended that you stay with Jessie for the reminder of its support cycle. For more information, please refer to the mail thread Defaulting to i686 for the Debian i386 architecture.

5.2. Limitations de la prise en charge de sécurité

Il y a certains paquets pour lesquels Debian ne peut pas garantir de rétroportages de base pour les problèmes de sécurité. Ceux-ci sont couverts dans les sous-sections suivantes.

Note that the package debian-security-support helps to track security support status of installed packages.

5.2.1. État de sécurité des navigateurs web

Debian 9 inclut plusieurs moteurs de navigateur web qui sont affectés par un flot continu de vulnérabilités de sécurité. Ce taux élevé de vulnérabilités ainsi que le manque partiel de prise en charge amont sous la forme de branches maintenues à long terme rendent difficiles les corrections de sécurité rétroportées. De plus, les interdépendances des bibliothèques rendent impossible la mise à niveau vers une nouvelle version. Par conséquent les navigateurs basés sur les moteurs webkit, qtwebkit et khtml sont inclus dans Stretch mais ne sont pas couverts par une prise en charge complète de la sécurité. Ces navigateurs ne devraient pas être utilisés sur des sites web non fiables.

Pour un usage général de navigation web, nous recommandons Iceweasel et Chromium.

Chromium − bien qu'il soit construit sur Webkit − est un paquet sans dépendance, qui sera maintenu à jour en reconstruisant les versions actuelles de Chromium pour stable. Iceweasel et Icedove seront également maintenus à jour en reconstruisant les versions ESR actuelles pour stable.

5.2.2. Manque de prise en charge de sécurité pour l'écosystème autour de libv8 et Node.js

La plate-forme Node.js est construite sur libv8-3.14 qui souffre d'un grand nombre de problèmes de sécurité, mais le projet et l'équipe de sécurité manquent de volontaires suffisamment intéressés et souhaitant investir beaucoup de temps pour corriger ces problèmes.

Malheureusement, cela signifie que libv8-3.14, nodejs et l'écosystème de paquets node-* associé ne devraient pas être actuellement utilisés avec du contenu non sûr, par exemple des données non validées depuis Internet.

In addition, these packages will not receive any security updates during the lifetime of the Stretch release.

5.3. Package specific issues

In most cases, packages should upgrade smoothly between Jessie and Stretch. There are a small number of cases where some intervention may be required, either before or during the upgrade; these are detailed below on a per-package basis.

5.3.1. Older ciphers and SSH1 protocol disabled in OpenSSH by default

The OpenSSH 7 release has disabled some older ciphers and the SSH1 protocol by default. Please be careful when upgrading machines, where you only have SSH access.

Please refer to the OpenSSH documentation for more information.

5.3.2. Possible backwards incompatible changes to APT

This section covers some of the incompatible changes to APT that may affect your system. APT now fetches files with an unprivileged user ("_apt")

APT will now attempt to discard all root privileges before fetching files from mirrors. APT can detect some common cases where this will fail and fallback to fetching things as root with a warning. However, it may fail to detect some exotic setups (e.g. uid-specific firewall rules).

If you experience issues with this feature, please change to the "_apt" user and check that it:

  • has read access to files in /var/lib/apt/lists and /var/cache/apt/archives.

  • has read access to the APT trust store (/etc/apt/trusted.gpg and /etc/apt/trusted.gpg.d/)

  • can resolve DNS names and download files. Example methods for testing:

    # From the dnsutils package (if using tor, please check with tor-resolve instead).
    $ nslookup >/dev/null || echo "Cannot resolve"
    $ wget -q -O- > /dev/null || echo "Cannot download index page of"

    For DNS issues, please check that /etc/resolv.conf is readable. New requirements for APT repository


This section only applies if you have (or intend to use) third-party repositories enabled or if you maintain an APT repositories.

To improve the download stability and ensure security of the downloaded content, APT now requires the following from an APT repository:

  • The InRelease file must be available

  • All metadata must include at least SHA256 checksums of all items. This includes the gpg signature of the InRelease file.

  • Signatures on the InRelease file should be done with a key at the size of 2048 bit or larger.

If you rely on a third-party repository that cannot comply with the above, please urge them to upgrade their repository. More information about the InRelease file can be found on the Debian Wikipedia.

5.3.3. The Xorg server is no longer setuid root by default


This change only applies if your X Display Manager supports running X as rootless (or if you start X manually via startx). Currently the only known display manager supporting this is gdm. Other display managers simply start X as root regardless of this change.

This reduces the risk of privilege escalation via bugs in the X server. However, it has some requirements for working:

  • It needs logind and libpam-systemd.

  • It needs a kernel video driver (as Xorg cannot talk directly to the hardware anymore).

  • It needs to run on the virtual console it was started from.

When run as a regular user, the Xorg log will be available from ~/.local/share/xorg/.

If these requirements are not possible, please install the xserver-xorg-legacy package to reinstate the setuid Xorg.

5.3.4. Upstart removed

Due to the lack of upstream maintainers, the Upstart init system has been removed from Stretch. If your system relies on this package, you should note that it will not be updated during the lifetime of Debian 9, and starting from Debian 10 (Buster), upstart jobs could be removed from packages.

Please consider switching to a supported init system, like systemd or openrc.