GitLab

Debian Buster included them, it should be enough to have a Debian release as
transition period. So drop them, no longer required.

The code in prerm is left so we can clean old symlinks when deleting the
package.

While at it, introduce a new NEWS entry to explain this and other important
changes in this release.
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

Deal first with update-alternatives, then do the symlink cleanup.

This avoids errors like this:

Removing iptables (1.8.2-2) ...
update-alternatives: warning: forcing reinstallation of alternative
 /usr/sbin/iptables-nft because link group iptables is broken
update-alternatives: warning: forcing reinstallation of alternative
 /usr/sbin/ip6tables-nft because link group ip6tables is broken
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

To be dropped in the buster+1 release cycles, so we don't break people
hardcoding the path to iptables.

Closes: #911777
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

Merge the binary package into the main iptables package now that compat tools
are the main ones.

While at it, move all binaries to /usr/sbin/ instead of /sbin. No reason for
them to live there.

TODO:
 * actual tests for symlinking issues
 * adjust manpages
 * check update-alternatives
 * check relationships
 * check READMEs etc
 * wrap-and-sort
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

Now the old iptables binary is server at /sbin/iptables-legacy.
Then, using the update-alternatives system one can choose which binary is going
to provide the actual /sbin/iptables tool, either iptables-legacy or
the newer iptables-compat (nf_tables compat).

The compat version is given more priority by default.
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>