The assertion message suggests that it should be able to be bypassed by
specifying a valid service directory, however that is not the case.

Fix the assertions, so that they can be bypassed by specifying a valid service
directory.

During the PAM conversation, `pam_gnome_keyring` will try to unlock the
login keyring. If the keyring created by gnome-initial-setup hasn't
changed ownership, then `gnome-initial-setup-copy-worker` can't move it
in place and `gnome-keyring-daemon` will try to create a new login
keyring. This either means the keyring created in g-i-s is lost or g-k-d
gets confused about a keyring that shows up after initializing but
before it's received the unlock/create request.

Similarly, the systemd user session is started by `pam_systemd` and will
trigger any number of services that might consume the config files g-i-s
has created.

To ensure that files are ready before any consumers have started, chown
them right after the user credentials have been established but before
the PAM session has been started.

Helps: https://gitlab.gnome.org/GNOME/gnome-keyring/-/issues/137

This was already handled but avoids a static analyzer warning.

The remote display factory has a counter of how many remote displays
are. With that counter when there's at least one, block suspend, when
there's none unblock suspend.

This is necessary because other sessions might want to suspend without
being aware that there might be remote sessions being used. On suspend
the RDP client would disconnect and that makes the remote session die.
In the future the sessions would not die on disconnecting, but still is
undesirable the RDP client disconnecting.

- Block suspend when remote displays are active
- Support S0ix suspend when deciding if nvidia should use wayland
- Misc fixes
- Translation updates

Update to upstream version '46.2'
with Debian dir cbc24a8e96c9efcd380c4954f3b720695875d92c

Sebastian Andrzej Siewior authored Jan 24, 2024 and Jeremy Bícha committed Jul 01, 2024

The argument "-extensions v3_ca" for req is invalid and not considered.
Earlier versions of openssl silently ignored that argument, openssl 3.2
throws an error now:
|  openssl req -batch -new -nodes … -extensions v3_ca …
| Error adding request extensions from section v3_ca
| 0071DD54987F0000:error:11000079:X509 V3 routines:v2i_AUTHORITY_KEYID:no issuer certificate:../crypto/x509/v3_akid.c:156:
| 0071DD54987F0000:error:11000080:X509 V3 routines:X509V3_EXT_nconf_int:error in extension:../crypto/x509/v3_conf.c:48:section=v3_ca, name=authorityKeyIdentifier, value=keyid:always,issuer:always

Remove the not relevant argument "-extensions v3_ca".

Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>

Closes: #1061458

tagging package gdm3 version debian/46.2-1

* tag 'debian/46.2-1': (22 commits)
  releasing package gdm3 version 46.2-1
  Adapt autopkgtest for openssl3.2
  Drop 2 patches applied in new release
  New upstream release
  Version 46.2
  remote-display-factory: Block suspend when any remote display exists
  Update Hindi translation
  Update German translation
  Update Portuguese translation
  Update Friulian translation
  Update Korean translation
  gdm-sessions: Handle return value on systemd calls
  gdm-server: Avoid potential NULL deferences
  Update Brazilian Portuguese translation
  Update Dutch translation
  Update Thai translation
  Update Serbian (Latin) translation
  Update Serbian translation
  manager: Move g-i-s chown to when PAM authentication completed
  Update Kabyle translation
  ...