Only fall back to "dns" if nss-resolve is not installed (for the architecture
of the calling program). Once it is, we never want to fall back to "dns" as
that breaks enforcing DNSSEC verification and also pointlessly retries NXDOMAIN
failures.
LP: #1624071
This reverts commit 792434de9e.
This will break on a multi-arch system where e. g. libnss-resolve:amd64 is
installed, but not :i386, and an i386 package tries to resolve a name.
Thanks to Felipe Sateler for spotting that!
Just keep the regexp cleanup from the above commit.
debian/libnss-resolve.postinst: Replace "dns" entry with "resolve", as
libnss-resolve already falls back to dns if resolved is not available. This
avoids querying failing DNS twice. Conversely, replace "resolv" with "dns" in
postrm.
Also fix the unsafe substitution in postrm: We want to match on full words,
thus use \b to match word boundaries. \Q and \E have no effect as none of the
characters in "resolve" are special regex characters.
