--- libnss-nonlocal-2.1.orig/debian/control
+++ libnss-nonlocal-2.1/debian/control
@@ -0,0 +1,60 @@
+Source: libnss-nonlocal
+Section: debathena/libs
+Priority: optional
+Maintainer: Anders Kaseorg <andersk@mit.edu>
+Vcs-Git: git://andersk.mit.edu/nss_nonlocal.git
+Vcs-Browser: http://andersk.mit.edu/gitweb/nss_nonlocal.git
+Standards-Version: 3.9.4
+Build-Depends: debhelper (>= 7.0.50~),
+ autotools-dev, dh-autoreconf,
+ gcc-multilib [amd64 i386] | gcc-4.1 (<< 4.1.2) [amd64 i386],
+ libc6-dev-i386 [amd64], libc6-dev-amd64 [i386],
+ lsb-release
+
+Package: libnss-nonlocal
+Architecture: any
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: libnss-nonlocal-common
+Description: nsswitch proxy module to prevent local account spoofing
+ This nsswitch module acts as a proxy for other nsswitch modules like 
+ hesiod, but prevents non-local users from potentially gaining local 
+ privileges by spoofing local UIDs and GIDs.
+
+Package: lib32nss-nonlocal
+Architecture: amd64
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: libnss-nonlocal-common
+Description: nsswitch proxy module to prevent local account spoofing (32-bit library)
+ This nsswitch module acts as a proxy for other nsswitch modules like 
+ hesiod, but prevents non-local users from potentially gaining local 
+ privileges by spoofing local UIDs and GIDs.
+ .
+ This package contains a 32-bit version of the library for compatibility 
+ on 64-bit architectures.
+
+Package: lib64nss-nonlocal
+Architecture: i386
+Pre-Depends: ${misc:Pre-Depends}
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Recommends: libnss-nonlocal-common
+Description: nsswitch proxy module to prevent local account spoofing (64-bit library)
+ This nsswitch module acts as a proxy for other nsswitch modules like 
+ hesiod, but prevents non-local users from potentially gaining local 
+ privileges by spoofing local UIDs and GIDs.
+ .
+ This package contains a 64-bit version of the library for compatibility 
+ on 32-bit architectures.
+
+Package: libnss-nonlocal-common
+Architecture: all
+Pre-Depends: ${misc:Pre-Depends}, adduser
+Depends: ${misc:Depends}
+Description: nsswitch proxy module to prevent local account spoofing (common package)
+ This nsswitch module acts as a proxy for other nsswitch modules like 
+ hesiod, but prevents non-local users from potentially gaining local 
+ privileges by spoofing local UIDs and GIDs.
+ .
+ This package creates the system users and groups that have special 
+ meanings to nss_nonlocal.
--- libnss-nonlocal-2.1.orig/debian/libnss-nonlocal-common.preinst
+++ libnss-nonlocal-2.1/debian/libnss-nonlocal-common.preinst
@@ -0,0 +1,50 @@
+#!/bin/sh
+# preinst script for libnss-nonlocal-common
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    install|upgrade)
+	if ! getent passwd nss-nonlocal-users >/dev/null; then
+	    adduser --system --no-create-home --home /nonexistent \
+		--gecos 'Magic user for local group whitelist' \
+		nss-nonlocal-users
+	fi
+	if ! getent group nss-local-users >/dev/null; then
+	    addgroup --system nss-local-users
+	fi
+	if ! getent group nss-nonlocal-users >/dev/null; then
+	    addgroup --system nss-nonlocal-users
+	fi
+	;;
+
+    abort-upgrade)
+	;;
+
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
+
+
--- libnss-nonlocal-2.1.orig/debian/lib64nss-nonlocal.install
+++ libnss-nonlocal-2.1/debian/lib64nss-nonlocal.install
@@ -0,0 +1 @@
+lib64/*
--- libnss-nonlocal-2.1.orig/debian/copyright
+++ libnss-nonlocal-2.1/debian/copyright
@@ -0,0 +1,30 @@
+This package was created as part of the Debathena Project
+<http://debathena.mit.edu/> of the MIT Student Information Processing
+Board.
+
+The source code was obtained from the Git repository at
+<git://andersk.mit.edu/nss_nonlocal.git>, and is licensed as follows:
+
+  Copyright © 2007–2010 Anders Kaseorg <andersk@mit.edu> and Tim
+  Abbott <tabbott@mit.edu>
+
+  nss_nonlocal is free software; you can redistribute it and/or modify
+  it under the terms of the GNU Lesser General Public License as
+  published by the Free Software Foundation; either version 2.1 of the
+  License, or (at your option) any later version.
+
+  nss_nonlocal is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public
+  License along with nss_nonlocal; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+  02110-1301 USA
+
+On Debian systems, the complete text of the GNU Lesser General Public
+License can be found in /usr/share/common-licenses/LGPL-2.1 .
+
+The Debian packaging is Copyright © 2007–2010 Tim Abbott and Anders
+Kaseorg, and has the same license as the original software.
--- libnss-nonlocal-2.1.orig/debian/rules
+++ libnss-nonlocal-2.1/debian/rules
@@ -0,0 +1,67 @@
+#!/usr/bin/make -f
+
+DEB_HOST_MULTIARCH ?= $(shell dpkg-architecture -qDEB_HOST_MULTIARCH)
+
+# Work around http://bugs.debian.org/572077 (debhelper < 7.4.16)
+binary: binary-arch binary-indep ;
+
+%:
+	dh $@ --with autoreconf
+
+all_flavors = libnss-nonlocal
+libnss-nonlocal_configure_args += --prefix=/
+libnss-nonlocal_dh_install = 'lib/*'
+
+ifneq ($(DEB_HOST_MULTIARCH),)
+    export DH_COMPAT = 9
+    libnss-nonlocal_configure_args += --libdir='$${prefix}/lib/$(DEB_HOST_MULTIARCH)'
+    libnss-nonlocal_dh_install = 'lib/$(DEB_HOST_MULTIARCH)/*'
+    libnss-nonlocal_dh_gencontrol = -- -DMulti-Arch=same
+else ifeq ($(shell hash dpkg-buildflags 2>/dev/null && echo y),y)
+    all_configure_args += $(foreach var,CFLAGS CPPFLAGS LDFLAGS,"$(var)=$$(dpkg-buildflags --get $(var))")
+endif
+
+IS_UBUNTU := $(if $(filter Ubuntu,$(shell lsb_release -is)),y)
+LIBC6_VERSION := $(shell dpkg-query --showformat='$${Version}' --show libc6)
+libc6_ge = $(shell dpkg --compare-versions '$(LIBC6_VERSION)' ge '$(1)' && echo y)
+
+all_flavors += lib32nss-nonlocal
+# i386_configure_target in eglibc/debian/sysdeps/amd64.mk
+ifeq ($(or $(IS_UBUNTU),$(call libc6_ge,2.8+20080809)),y)
+lib32nss-nonlocal_configure_args += --build=i686-linux
+else
+lib32nss-nonlocal_configure_args += --build=i486-linux
+endif
+# i386_CC in eglibc/debian/sysdeps/amd64.mk
+lib32nss-nonlocal_configure_args += CC='$(CC) -m32'
+# i386_slibdir in eglibc/debian/sysdeps/amd64.mk
+ifeq ($(or $(IS_UBUNTU),$(call libc6_ge,2.9-14~)),y)
+lib32nss-nonlocal_configure_args += --prefix=/ --libdir='$${prefix}/lib32'
+lib32nss-nonlocal_dh_install = 'lib32/*'
+else
+lib32nss-nonlocal_configure_args += --prefix=/emul/ia32-linux
+lib32nss-nonlocal_dh_install = 'emul/ia32-linux/*'
+endif
+
+all_flavors += lib64nss-nonlocal
+# amd64_configure_target in eglibc/debian/sysdeps/i386.mk
+lib64nss-nonlocal_configure_args += --build=x86_64-linux
+# amd64_CC in eglibc/debian/sysdeps/i386.mk
+lib64nss-nonlocal_configure_args += CC='$(CC) -m64 -D__x86_64__'
+# amd64_slibdir in eglibc/debian/sysdeps/i386.mk
+lib64nss-nonlocal_configure_args += --prefix=/ --libdir="\$${prefix}/lib64"
+
+flavors := $(filter $(all_flavors),$(shell dh_listpackages))
+
+define do_overrides
+override_$(1): $(addsuffix _$(1),$(2))
+$(addsuffix _$(1),$(filter-out REMAINING,$(2))): %_$(1):
+	$(1) -p$$* $(3)
+REMAINING_$(1): $(addsuffix _$(1),$(filter-out REMAINING,$(2)))
+	$(1) --remaining-packages $(4)
+
+endef
+
+$(eval $(foreach auto,configure build install test clean,$(call do_overrides,dh_auto_$(auto),$(flavors),-Bdebian/build_$$* -- $$(all_$(auto)_args) $$($$*_$(auto)_args))))
+$(eval $(call do_overrides,dh_install,$(flavors) REMAINING,$$($$*_dh_install)))
+$(eval $(call do_overrides,dh_gencontrol,libnss-nonlocal REMAINING,$$($$*_dh_gencontrol)))
--- libnss-nonlocal-2.1.orig/debian/libnss-nonlocal-common.postrm
+++ libnss-nonlocal-2.1/debian/libnss-nonlocal-common.postrm
@@ -0,0 +1,51 @@
+#!/bin/sh
+# postrm script for libnss-nonlocal-common
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <postrm> `remove'
+#        * <postrm> `purge'
+#        * <old-postrm> `upgrade' <new-version>
+#        * <new-postrm> `failed-upgrade' <old-version>
+#        * <new-postrm> `abort-install'
+#        * <new-postrm> `abort-install' <old-version>
+#        * <new-postrm> `abort-upgrade' <old-version>
+#        * <disappearer's-postrm> `disappear' <overwriter>
+#          <overwriter-version>
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    purge)
+	if getent passwd nss-nonlocal-users >/dev/null; then
+	    deluser --system nss-nonlocal-users || :
+	fi
+	if getent group nss-local-users >/dev/null; then
+	    delgroup --system nss-local-users || :
+	fi
+	if getent group nss-nonlocal-users >/dev/null; then
+	    delgroup --system nss-nonlocal-users || :
+	fi
+	;;
+
+    remove|upgrade|failed-upgrade|abort-install|abort-upgrade|disappear)
+	;;
+
+    *)
+        echo "postrm called with unknown argument \`$1'" >&2
+        exit 1
+	;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
--- libnss-nonlocal-2.1.orig/debian/changelog
+++ libnss-nonlocal-2.1/debian/changelog
@@ -0,0 +1,189 @@
+libnss-nonlocal (2.1-0debathena1) unstable; urgency=low
+
+  * New upstream release.
+    - Support Automake 1.12.
+    - Guard one-time initialization with memory barriers.
+    - Make initgroups_dyn succeed when adding only magic groups.
+  * Rewrite packaging with Debhelper 7.
+  * Move magic user and group creation to separate libnss-nonlocal-common
+    package.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Thu, 13 Jun 2013 04:43:16 -0400
+
+libnss-nonlocal (2.0-0debathena2) unstable; urgency=low
+
+  * Pre-Depend adduser.
+  * Don’t Build-Depend debhelper 9.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Thu, 16 Aug 2012 20:38:35 -0400
+
+libnss-nonlocal (2.0-0debathena1) unstable; urgency=low
+
+  * New upstream release.
+    - Fix errno saving and restoring.
+    - Document nss-nonlocal-users and nss-local-users groups in README.
+    - Allow local whitelisting of nonlocal user and group memberships,
+      using the magic local ‘nss-nonlocal-users’ user and group.
+  * Create magic ‘nss-nonlocal-users’ user.
+  * Remove obsolete exclusion of glibc-private dependency.
+  * Use automake 1.10 and autoconf 2.61.
+  * Add multiarch support for distros from the future.
+  * Disable dh_buildinfo, which currently fails at multiarch.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Wed, 30 Mar 2011 04:57:36 -0400
+
+libnss-nonlocal (1.11-0debathena3) unstable; urgency=low
+
+  * Remove the workaround for buggy CDBS $(CC) splitting (fixed upstream).
+  * Fix cross-compiling on karmic and lucid.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Wed, 23 Jun 2010 21:17:50 -0400
+
+libnss-nonlocal (1.11-0debathena2) unstable; urgency=low
+
+  * Install lib32nss-nonlocal to the right place on Ubuntu.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Wed, 23 Jun 2010 03:50:33 -0400
+
+libnss-nonlocal (1.11-0debathena1) unstable; urgency=low
+
+  * New upstream release.
+    - Check that a nonlocal lookup by id returns the right id.
+    - Update licensing to LGPLv2.1+.
+    - Change syslog priority when removing local groups from non-local
+      users
+  * Update build flags for biarch packages (fixes lib32nss-nonlocal path
+    on squeeze).
+  * Fix FTBFS on squeeze due to CDBS’s buggy splitting of multiword
+    $(CC) (Debian bug #576967).
+  * Disable CDBS cross-building logic, to fix a mysterious FTBFS where
+    configure --host fails to find nm.
+  * Bump Standards-Version to 3.8.4 (no changes required).
+  * Bump Debhelper compatibility level to 6.
+  * Set maintainer to me.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Mon, 03 May 2010 00:45:14 -0400
+
+libnss-nonlocal (1.10-0debathena1) unstable; urgency=low
+
+  * New upstream version.
+    - Disallow numeric nonlocal user/group names that look like local
+      uid/gids.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Fri, 23 Oct 2009 13:49:43 -0400
+
+libnss-nonlocal (1.9-0debathena2) unstable; urgency=low
+
+  * Also build a biarch lib32nss-nonlocal or lib64nss-nonlocal package.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Fri, 19 Jun 2009 23:54:38 -0400
+
+libnss-nonlocal (1.9-0debathena1) unstable; urgency=low
+
+  * New upstream version.
+    - Corrects an out-of-memory error in the presence of very large local
+      groups.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Sun, 24 May 2009 17:30:08 -0400
+
+libnss-nonlocal (1.8-0debathena4) unstable; urgency=low
+
+  * Only exclude glibc-private for new enough libc6, because old
+    dpkg-shlibdeps does not support -x.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Thu, 05 Feb 2009 01:59:08 -0500
+
+libnss-nonlocal (1.8-0debathena3) unstable; urgency=low
+
+  * Force exclusion of glibc-private dependency.  This is necessary for
+    libnss-nonlocal to build and install with libc6 2.9 in Ubuntu Jaunty
+    and Debian experimental, which now generates an invalid dependency on
+    glibc-private for uses of private glibc symbols.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Sun, 01 Feb 2009 00:26:31 -0500
+
+libnss-nonlocal (1.8-0debathena2) unstable; urgency=low
+
+  * Change "Debian-Athena Project" to "Debathena Project".
+  * Remove debian/control from version control.
+  * Clean up debian/copyright.
+
+ -- Tim Abbott <tabbott@mit.edu>  Sat, 24 Jan 2009 18:03:22 -0500
+
+libnss-nonlocal (1.8-0debathena1) unstable; urgency=low
+
+  * Correct the buffer size passed to realloc.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Sat, 09 Aug 2008 22:41:57 -0400
+
+libnss-nonlocal (1.7-0debathena1) unstable; urgency=low
+
+  * Replace the magic buflen hack with explicit iteration over the nss
+    chain, so that getpwent/getgrent works with nscd enabled.
+  * Fix some memory leaks.
+  * Autotoolfiscate.
+  * Code cleanup.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Tue, 29 Jul 2008 06:57:53 -0400
+
+libnss-nonlocal (1.6-0debathena1) unstable; urgency=low
+
+  * Use a version script to hide internal symbols.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Sat, 15 Mar 2008 06:42:02 -0400
+
+libnss-nonlocal (1.5-0debathena1) unstable; urgency=low
+
+  * Add support for NSS_NONLOCAL_IGNORE environment variable, which
+    causes nss_nonlocal to pretend there are no nonlocal users.  This
+    allows us to support letting adduser add users and groups with the
+    same name as a nonlocal user/group.
+
+ -- Tim Abbott <tabbott@mit.edu>  Mon, 25 Feb 2008 19:12:30 -0500
+
+libnss-nonlocal (1.4-0debathena1) unstable; urgency=low
+
+  * Bug fixes and cleanups.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Fri, 15 Feb 2008 21:39:50 -0500
+
+libnss-nonlocal (1.3-0debathena2) unstable; urgency=low
+
+  * Set maintainer to debathena@mit.edu.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 29 Jan 2008 22:18:25 -0500
+
+libnss-nonlocal (1.3-0debathena1) unstable; urgency=low
+
+  * Have initgroups() only add nonlocal groups to nonlocal users.
+  * If a group called nss-local-users exists, add local users to it.
+  * If a group called nss-nonlocal-users exists, add nonlocal users to it.
+  * Create nss-local-users and nss-nonlocal-users at installation.
+
+ -- Tim Abbott <tabbott@mit.edu>  Tue, 29 Jan 2008 22:11:37 -0500
+
+libnss-nonlocal (1.2) unstable; urgency=low
+
+  * Use a magic buflen instead of thread-local variables, to avoid
+    strange problems on sarge.
+  * Don't link with pthread.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Tue, 07 Aug 2007 22:00:28 -0400
+
+libnss-nonlocal (1.1) unstable; urgency=low
+
+  * Link with pthread to be safe.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Fri, 03 Aug 2007 21:24:17 -0400
+
+libnss-nonlocal (1.0-0debathena2) unstable; urgency=low
+
+  * Section: debathena/libs.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Mon, 23 Jul 2007 14:14:46 -0400
+
+libnss-nonlocal (1.0-0debathena1) unstable; urgency=low
+
+  * Initial release.
+
+ -- Anders Kaseorg <andersk@mit.edu>  Thu, 19 Jul 2007 21:07:50 -0400
--- libnss-nonlocal-2.1.orig/debian/compat
+++ libnss-nonlocal-2.1/debian/compat
@@ -0,0 +1 @@
+7
