From 4f651ffed57882671a2103328090364972dd3bb3 Mon Sep 17 00:00:00 2001
From: pbr <pbr@weneed.beer>
Date: Wed, 30 Sep 2026 22:55:05 +0200
Subject: [PATCH] fix(post-install): divert gzip instead of replacing it for
 pigz

A gzip package update overwrote the pigz wrapper, and uninstall could
restore a stale gzip.original over a newer binary. Use dpkg-divert
(--no-rename, gzip is Essential), migrate existing installs, and also
divert the /usr path on bookworm so a PVE 8 -> 9 upgrade keeps working.
---
 .../post_install/customizable_post_install.sh | 38 +++++++++++++------
 scripts/post_install/uninstall-tools.sh       | 23 ++++++++++-
 2 files changed, 47 insertions(+), 14 deletions(-)

diff --git a/scripts/post_install/customizable_post_install.sh b/scripts/post_install/customizable_post_install.sh
index 24c44e5e..cd79bc20 100644
--- a/scripts/post_install/customizable_post_install.sh
+++ b/scripts/post_install/customizable_post_install.sh
@@ -1682,20 +1682,34 @@ EOF
         msg_ok "$(translate "pigz wrapper script created")"
     fi
 
-    # Replace gzip with pigz wrapper
+    # Replace gzip with pigz wrapper. gzip is diverted so package updates
+    # land in gzip.distrib instead of overwriting the wrapper.
     msg_info "$(translate "Replacing gzip with pigz wrapper...")"
-    if [ ! -f /bin/gzip.original ]; then
-        mv -f /bin/gzip /bin/gzip.original && \
-        pmx_write_file /bin/gzip < /bin/pigzwrapper && \
-        chmod +x /bin/gzip
-        msg_ok "$(translate "gzip replaced with pigz wrapper successfully")"
-    elif ! cmp -s /bin/gzip /bin/pigzwrapper; then
-        pmx_write_file /bin/gzip < /bin/pigzwrapper && \
-        chmod +x /bin/gzip
-        msg_ok "$(translate "gzip replaced with pigz wrapper successfully")"
-    else
-        msg_ok "$(translate "gzip replaced with pigz wrapper successfully")"
+    local gz src
+    gz=$(dpkg -L gzip 2>/dev/null | grep -m1 -xE '(/usr)?/bin/gzip')
+    gz=${gz:-/usr/bin/gzip}
+    if [ -z "$(dpkg-divert --listpackage "$gz")" ]; then
+        # Older versions swapped gzip by hand and kept it as gzip.original.
+        # Use that as the real binary, unless a gzip update already put a
+        # newer one back.
+        src="$gz"
+        [ -f /bin/gzip.original ] && [ "$(head -c 2 "$gz")" = "#!" ] && src=/bin/gzip.original
+        pmx_write_file "$gz.distrib" < "$src" && chmod 755 "$gz.distrib"
+        pmx_remove_file /bin/gzip.original
+        pmx_record_execution "Divert gzip" "dpkg-divert --local --no-rename --divert $gz.distrib --add $gz"
+        dpkg-divert --local --no-rename --divert "$gz.distrib" --add "$gz" >/dev/null
+        # Bookworm ships /bin/gzip, trixie /usr/bin/gzip. Divert the /usr
+        # path too so a PVE 8 -> 9 upgrade doesn't overwrite the wrapper.
+        # It needs its own target: /bin/gzip.distrib is the same file, and
+        # dpkg deletes it when it drops the old /bin/gzip (DEP17).
+        [ "$gz" = /bin/gzip ] && dpkg-divert --local --no-rename --divert /usr/bin/gzip.distrib-usr --add /usr/bin/gzip >/dev/null
     fi
+    # Left over from the bookworm diversion after upgrading to trixie.
+    [ "$gz" = /usr/bin/gzip ] && [ -n "$(dpkg-divert --listpackage /bin/gzip)" ] && dpkg-divert --local --no-rename --remove /bin/gzip >/dev/null
+    if ! cmp -s "$gz" /bin/pigzwrapper; then
+        pmx_write_file "$gz" < /bin/pigzwrapper
+    fi
+    msg_ok "$(translate "gzip replaced with pigz wrapper successfully")"
 
     msg_success "$(translate "pigz configuration completed")"
     register_tool "pigz" true "$FUNC_VERSION"
diff --git a/scripts/post_install/uninstall-tools.sh b/scripts/post_install/uninstall-tools.sh
index 3605c7a7..289b2dcd 100644
--- a/scripts/post_install/uninstall-tools.sh
+++ b/scripts/post_install/uninstall-tools.sh
@@ -1068,11 +1068,30 @@ uninstall_pigz() {
     local FUNC_VERSION="1.0"
     pmx_journal_context "uninstall_pigz" "$FUNC_VERSION"
     msg_info2 "$(translate 'Reverting pigz wrapper...')"
-    if [[ -f /bin/gzip.original ]]; then
-        pmx_write_file /bin/gzip < /bin/gzip.original
+    local gz p real
+    gz=$(dpkg -L gzip 2>/dev/null | grep -m1 -xE '(/usr)?/bin/gzip')
+    gz=${gz:-/usr/bin/gzip}
+    real=$(dpkg-divert --truename "$gz")
+    if [[ "$real" != "$gz" ]]; then
+        pmx_write_file "$gz" < "$real"
+        pmx_record_execution "Remove gzip diversion" "dpkg-divert --local --no-rename --remove $gz"
+        dpkg-divert --local --no-rename --remove "$gz" >/dev/null
+        pmx_remove_file "$real"
+        msg_ok "$(translate 'Restored original /bin/gzip')"
+    elif [[ -f /bin/gzip.original ]]; then
+        # Older, non-diverted install. A gzip update may already have put a
+        # newer binary back; don't overwrite that with the stale copy.
+        [[ "$(head -c 2 "$gz")" == "#!" ]] && pmx_write_file "$gz" < /bin/gzip.original
         pmx_remove_file /bin/gzip.original
         msg_ok "$(translate 'Restored original /bin/gzip')"
     fi
+    # Second diversion added on bookworm (see configure_pigz).
+    for p in /bin/gzip /usr/bin/gzip; do
+        real=$(dpkg-divert --truename "$p")
+        [[ "$real" == "$p" ]] && continue
+        dpkg-divert --local --no-rename --remove "$p" >/dev/null
+        rm -f "$real"
+    done
     pmx_remove_file /bin/pigzwrapper
     pmx_edit_file /etc/vzdump.conf 's/^pigz: 1/#pigz: 1/' 2>/dev/null || true
     pmx_record_execution "Purge pigz package" "apt-get purge -y pigz"