Debians commandline package manager https://git.kalnischkies.de/apt/atom?h=2.7.4 2023-09-16T10:53:07Z 2023-09-16T10:53:07Z Julian Andres Klode julian.klode@canonical.com 2023-09-16T10:53:07Z urn:sha1:da2c2f702fb448857d94304adea0ecd3984c9c15 2023-09-16T10:37:31Z Julian Andres Klode julian.klode@canonical.com 2023-09-16T10:34:48Z urn:sha1:99c888b5eabbb7008bf4451bc62c277f28bb925f As of bookworm, merged-usr is mandatory, and people got caught in the crosshairs of the dpkg fsys-unmessusr debacle and inadvertently reverted back to an unmerged configuration and continue to remain on an unsupported system unknowingly. Help them by erroring out when they are installing packages on /, they are not in a chroot, and a usrmerge package is available. 2023-08-02T10:04:32Z Julian Andres Klode julian.klode@canonical.com 2023-08-01T11:59:09Z urn:sha1:5576e7f76da73f3f5217f90d816cc19b6c0a5a77 If we know both SHA256, and they're different, the packages are. This approach stores the SHA256 only at runtime, avoiding the overhead of storing it on-disk, because when we update repositories we update all of them anyhow. Note that pkgCacheGenerator is hidden, so we can just modify its ABI, hooray. Closes: #931175 LP: #2029268 2023-07-12T14:49:19Z Julian Andres Klode julian.klode@canonical.com 2023-06-27T15:11:06Z urn:sha1:5dcb36e7af4bd65211ac4937e5e7feac8c85683c We did not handle multiple components properly, add a contrib component to the test case. 2023-07-11T13:49:18Z Julian Andres Klode jak@debian.org 2023-07-11T13:49:18Z urn:sha1:f26a15a3f9b020dcd5c5203bd73133c8d647c99c Do not fail on systems running in FIPSmode. See merge request apt-team/apt!295 2023-07-11T13:47:17Z Julian Andres Klode jak@debian.org 2023-07-11T13:47:17Z urn:sha1:7bb2b81090b1a5bd9ebb49a0d9fd5cfd9ddab95f dist-upgrade: Revert phased updates using keeps only See merge request apt-team/apt!299 2023-07-07T12:28:59Z Julian Andres Klode julian.klode@canonical.com 2023-07-07T12:24:52Z urn:sha1:68ef41ea912f4879b0ee43419c13a3a8c9bfcd22 This fixes an issue where phased updates gain new dependencies and cause them to be installed despite themselves not being installed. In the cause of investigation, it turned out that we also need to evaluate the candidate version at those early stage rather than the install version (which is only valid *after* MarkInstall). This does not fully resolve the problem: If an update pulls in a phased update, depends are still being installed. Resolving this while ensuring that phased updates cannot uninstall packages requires us to do a minimization of changes by trying to keep back each new install removal and then seeing if any dependency is being broken by it. This is more complex and will happen later. 2023-07-05T08:57:26Z Julian Andres Klode julian.klode@canonical.com 2023-07-03T09:13:00Z urn:sha1:89dd48bdea93849246fc33b447d6d7ad52bb1c4b In the bug, mutter was kept back due to phasing and the new gnome-shell depended on that, and was therefore kept back as well, however, gnome-shell-common was not broken, and apt decided to continue upgrading it by removing gnome-shell and the ubuntu desktop meta packages. This is potentially a regression of LP#1990586 where we added keep back calls to the start of the dist-upgrade to ensure that we do not mark stuff for upgrade in the first place that depends on phasing updates, however it was generally allowed by the resolver to also do those removals. To fix this, we need to resolve the update normally and then use ResolveByKeepInternal to keep back any changes broken by held back packages. However, doing so breaks test-bug-591882-conkeror because ResolveByKeep keeps back packages for broken Recommends as well, which is not something we generally want to do in a dist-upgrade after we already decided to upgrade it. To circumvent that issue, extend the pkgProblemResolver to allow a package to be policy broken, and mark all packages that already were already going to be policy broken to be allowed to be that, such that we don't try to undo their installs. LP: #2025462 2023-06-27T17:21:47Z Julian Andres Klode julian.klode@canonical.com 2023-06-27T17:14:43Z urn:sha1:aba813975abb880f8b27d659147f7760c02f99e7 We want to gently steer users towards having Signed-By for each source such that we can retire a shared keyring across sources which improves resilience against configuration issues and incompetent malicious actors. 2023-05-29T12:28:20Z A. Maitland Bottoms bottoms@debian.org 2023-05-29T12:28:20Z urn:sha1:668451def296afeb0c358a7d80ff39dc546defab Initialize using gcrypt's GCRYCTL_NO_FIPS_MODE, available since gcrypt version 1.10.0, otherwise apt aborts on FIPS enabled systems.