Skip to content

v1.5.4 — pkexec dependency fix (important for system backups)

Choose a tag to compare

View all tags
@amplogik amplogik released this 22 Jul 20:53
· 3 commits to main since this release
v1.5.4
a6707bc

This release fixes a packaging bug that can leave all privileged operations non-functional on a clean install — system backups, archive deletion, maintenance, crontab install, and system config writes.

The bug

debian/control declared polkitd | policykit-1. Since Debian 12 / Ubuntu 23.04 the old policykit-1 package was split, and polkitd ships only the daemon — /usr/bin/pkexec is now its own binary package.

A minimal install could therefore satisfy every declared dependency and still have no pkexec, breaking every privileged helper path. Existing installs often had pkexec pulled in by a desktop environment and never noticed.

Fixed: Depends now includes pkexec | policykit-1 — the alternation also covers older releases where policykit-1 still shipped the binary.

Also added to Recommends: a graphical polkit authentication agent. This is Recommends rather than Depends because GNOME's agent lives inside gnome-shell and Provides: nothing, so no alternation can express "this desktop already has one". pkexec falls back to its own textual agent for CLI use regardless.

Archive provenance fix

timetraveller/__init__.py still said 1.5.0 while the changelog and pyproject.toml said 1.5.3. This was not cosmetic: worker.py stamps archives with created_by=f"timetraveller {__version__}", so every archive written by v1.5.1 through v1.5.3 falsely claims it was created by 1.5.0.

Existing archives keep the wrong stamp; archives written from v1.5.4 onward are correct. The version lives in three places, not the two the release process had assumed.

If escalation still fails after upgrading

If you administer the machine remotely (RDP/SSH), polkit may deny outright with no password prompt, which looks like escalation is missing rather than refused. The shipped policies set allow_inactive=no, and remote logind sessions report Remote=yes with an empty Seat=. Diagnose without triggering a prompt:

pkcheck --action-id com.timetraveller.run-system-backup --process $$
# exit 1 = flat deny (inactive/remote session);  exit 2 = challenge, a prompt would appear

To allow it for admins, add /etc/polkit-1/rules.d/49-timetraveller-remote.rules:

polkit.addRule(function(action, subject) {
    if (action.id.indexOf("com.timetraveller.") !== 0) return polkit.Result.NOT_HANDLED;
    if (!subject.isInGroup("sudo")) return polkit.Result.NOT_HANDLED;
    return polkit.Result.AUTH_ADMIN_KEEP;
});

This still requires a password — it only lifts the remote-session restriction.

Install

sudo apt install ./timetraveller_1.5.4_all.deb
Assets 3
Loading