Werk #22167: Agent bakery: Keep all scriptlets of a plug-in for one package step
| Component | Agent bakery | ||||
| Title | Agent bakery: Keep all scriptlets of a plug-in for one package step | ||||
| Date | Oct 16, 2026 | ||||
| Level | Trivial Change | ||||
| Class | Bug Fix | ||||
| Compatibility | Compatible - no manual interaction needed | ||||
| Checkmk versions & editions |
|
Since Checkmk 2.5.0, the agent bakery could drop scriptlets without any
notice. A bakery plug-in may yield more than one scriptlet for the same
package step, for example two postinst scriptlets. Only the last of these
scriptlets made it into the baked DEB, RPM or Solaris package. The agent
bakery now adds all of them, in the order in which the plug-in yields them.
The bug affects bakery plug-ins from MKPs that use the bakery API. It also affects the ruleset Remote alert handlers (Linux), which ships with Checkmk. If more than one rule of this ruleset matched a host, the package installed only the SSH key of the last rule. If the rules named more than one user, uninstalling or upgrading the package removed the SSH keys of one user only.
Bake and deploy your agents again after the update. An affected package may
have left old SSH keys in the file ~/.ssh/authorized_keys of a handler
user. These keys end with the comment mk-remote-alert-handler-<hash>, in
which <hash> is the hash of the old agent package. You can delete them by
hand.