Do not require force-loopbreak on Protected packages

dpkg will be changed in 1.20.8 to not require --force-remove for
deconfiguration anymore, but we want to decouple our changes from the
dpkg ones, so let's always pass --force-remove-protected when installing
packages such that we can deconfigure protected packages.

Closes: #983014

3 files changed, 61 insertions, 5 deletions

diff --git a/apt-pkg/deb/dpkgpm.cc b/apt-pkg/deb/dpkgpm.cc
index c496538cc..a8f99a855 100644
--- a/apt-pkg/deb/dpkgpm.cc
+++ b/apt-pkg/deb/dpkgpm.cc
@@ -1824,6 +1824,9 @@ bool pkgDPkgPM::Go(APT::Progress::PackageManager *progress)
 	 case Item::Install:
 	 ADDARGC("--unpack");
 	 ADDARGC("--auto-deconfigure");
+	 // dpkg < 1.20.8 needs --force-remove-protected to deconfigure protected packages
+	 if (dpkgProtectedField)
+	    ADDARGC("--force-remove-protected");
 	 break;
       }
 
diff --git a/apt-pkg/packagemanager.cc b/apt-pkg/packagemanager.cc
index 0c6998def..ad7612bc3 100644
--- a/apt-pkg/packagemanager.cc
+++ b/apt-pkg/packagemanager.cc
@@ -652,8 +652,7 @@ bool pkgPackageManager::EarlyRemove(PkgIterator Pkg, DepIterator const * const D
 
    // Essential packages get special treatment
    bool IsEssential = false;
-   if ((Pkg->Flags & pkgCache::Flag::Essential) != 0 ||
-       (Pkg->Flags & pkgCache::Flag::Important) != 0)
+   if ((Pkg->Flags & pkgCache::Flag::Essential) != 0)
       IsEssential = true;
 
    /* Check for packages that are the dependents of essential packages and
@@ -663,8 +662,7 @@ bool pkgPackageManager::EarlyRemove(PkgIterator Pkg, DepIterator const * const D
       for (pkgCache::DepIterator D = Pkg.RevDependsList(); D.end() == false &&
 	   IsEssential == false; ++D)
 	 if (D->Type == pkgCache::Dep::Depends || D->Type == pkgCache::Dep::PreDepends)
-	    if ((D.ParentPkg()->Flags & pkgCache::Flag::Essential) != 0 ||
-	        (D.ParentPkg()->Flags & pkgCache::Flag::Important) != 0)
+	    if ((D.ParentPkg()->Flags & pkgCache::Flag::Essential) != 0)
 	       IsEssential = true;
    }
 
diff --git a/test/integration/test-essential-force-loopbreak b/test/integration/test-essential-force-loopbreak
index f585e9c42..2eba0a96a 100755
--- a/test/integration/test-essential-force-loopbreak
+++ b/test/integration/test-essential-force-loopbreak
@@ -18,6 +18,19 @@ Breaks: sysvinit-core'
 
 buildsimplenativepackage 'systemd-sysv' 'native' '2~break' 'sid-break' 'Breaks: sysvinit (<< 2), sysvinit-core'
 
+# one more time, with Protected
+insertinstalledpackage 'protected-sysvinit' 'native' '1' 'Protected: yes'
+
+buildsimplenativepackage 'protected-sysvinit' 'native' '2' 'sid' 'Pre-Depends: protected-sysvinit-core | protected-systemd-sysv
+Protected: yes'
+buildsimplenativepackage 'protected-sysvinit-core' 'native' '2' 'sid'
+
+buildsimplenativepackage 'protected-systemd-sysv' 'native' '2~conflict' 'sid-conflict' 'Conflicts: protected-sysvinit (<< 2)
+Breaks: protected-sysvinit-core'
+
+buildsimplenativepackage 'protected-systemd-sysv' 'native' '2~break' 'sid-break' 'Breaks: protected-sysvinit (<< 2), protected-sysvinit-core'
+
+
 setupaptarchive
 
 cp -a rootdir/var/lib/dpkg/status dpkg.status.backup
@@ -33,7 +46,7 @@ The following NEW packages will be installed:
   systemd-sysv
 The following packages will be upgraded:
   sysvinit
-1 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
+1 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
 E: This installation run will require temporarily removing the essential package sysvinit:$(getarchitecture 'native') due to a Conflicts/Pre-Depends loop. This is often bad, but if you really want to do it, activate the APT::Force-LoopBreak option.
 E: Internal Error, Could not early remove sysvinit:$(dpkg --print-architecture) (2)" aptget install systemd-sysv -t "$1" -s
 	# ensure that really nothing happens
@@ -52,3 +65,45 @@ E: Internal Error, Could not early remove sysvinit:$(dpkg --print-architecture)
 
 testforcebreak 'sid-conflict'
 testforcebreak 'sid-break'
+
+testnoforcebreak() {
+	cp -a dpkg.status.backup rootdir/var/lib/dpkg/status
+	rm -f rootdir/var/lib/apt/extended_states
+	testequalor2 "Reading package lists...
+Building dependency tree...
+The following additional packages will be installed:
+  protected-sysvinit
+The following NEW packages will be installed:
+  protected-systemd-sysv
+The following packages will be upgraded:
+  protected-sysvinit
+1 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
+Inst protected-systemd-sysv (2~$1 sid-$1 [$(getarchitecture 'native')]) [protected-systemd-sysv:$(getarchitecture 'native') on protected-sysvinit:$(getarchitecture 'native')] []
+Conf protected-systemd-sysv:$(getarchitecture 'native') broken
+ Breaks:protected-sysvinit:$(getarchitecture 'native')
+ []
+Inst protected-sysvinit [1] (2 sid [$(getarchitecture 'native')])
+Conf protected-sysvinit (2 sid [$(getarchitecture 'native')])
+E: Conf Broken protected-systemd-sysv:$(getarchitecture 'native')" "Reading package lists...
+Building dependency tree...
+The following additional packages will be installed:
+  protected-sysvinit
+The following NEW packages will be installed:
+  protected-systemd-sysv
+The following packages will be upgraded:
+  protected-sysvinit
+1 upgraded, 1 newly installed, 0 to remove and 1 not upgraded.
+Remv protected-sysvinit [1]
+Inst protected-systemd-sysv (2~conflict sid-conflict [$(getarchitecture 'native')])
+Conf protected-systemd-sysv (2~conflict sid-conflict [$(getarchitecture 'native')])
+Inst protected-sysvinit [1] (2 sid [$(getarchitecture 'native')])
+Conf protected-sysvinit (2 sid [$(getarchitecture 'native')])" aptget install protected-systemd-sysv -t "sid-$1" -s
+
+    # we check with 'real' packages here as the simulation reports a 'Conf broken'
+	cp -a dpkg.status.backup rootdir/var/lib/dpkg/status
+	testsuccess aptget install protected-systemd-sysv -y -t "sid-$1"
+	testdpkginstalled 'protected-sysvinit' 'protected-systemd-sysv'
+}
+
+testnoforcebreak 'conflict'
+testnoforcebreak 'break'