Only protect two kernels, not last installed one

The kernel autoremoval algorithm was written to accomodate
for Ubuntu's boot partition sizing, which was written to
accomodate 3 kernels - 2 installed ones + a new one being
unpacked.

It seems that when the algorithm was designed, it was overlooked
that it actually kept 3 kernels.

LP: #1968154

6 files changed, 13 insertions, 47 deletions

diff --git a/apt-pkg/algorithms.cc b/apt-pkg/algorithms.cc
index fb0b7dca7..09fd78329 100644
--- a/apt-pkg/algorithms.cc
+++ b/apt-pkg/algorithms.cc
@@ -1514,9 +1514,6 @@ std::string GetProtectedKernelsRegex(pkgCache *cache, bool ReturnRemove)
    // needs to be initialized to 0s, might not be set up.
    utsname uts{};
    std::string bootedVersion;
-   std::string lastInstalledVersion;
-
-   std::string lastInstalledUname = _config->Find("APT::LastInstalledKernel");
 
    // Get currently booted version, but only when not on reproducible build.
    if (getenv("SOURCE_DATE_EPOCH") == 0)
@@ -1548,8 +1545,6 @@ std::string GetProtectedKernelsRegex(pkgCache *cache, bool ReturnRemove)
 
       if (pkgUname == uts.release)
 	 bootedVersion = pkgVersion;
-      if (pkgUname == lastInstalledUname)
-	 lastInstalledVersion = pkgVersion;
    }
 
    if (version2unames.size() == 0)
@@ -1567,19 +1562,13 @@ std::string GetProtectedKernelsRegex(pkgCache *cache, bool ReturnRemove)
 	 std::clog << "Keeping booted kernel " << bootedVersion << std::endl;
       keep.insert(bootedVersion);
    }
-   if (not lastInstalledVersion.empty())
-   {
-      if (Debug)
-	 std::clog << "Keeping installed kernel " << lastInstalledVersion << std::endl;
-      keep.insert(lastInstalledVersion);
-   }
    if (latest != version2unames.rend())
    {
       if (Debug)
 	 std::clog << "Keeping latest kernel " << latest->first << std::endl;
       keep.insert(latest->first);
    }
-   if (keep.size() < 3 && previous != version2unames.rend())
+   if (keep.size() < 2 && previous != version2unames.rend())
    {
       if (Debug)
 	 std::clog << "Keeping previous kernel " << previous->first << std::endl;
@@ -1596,8 +1585,6 @@ std::string GetProtectedKernelsRegex(pkgCache *cache, bool ReturnRemove)
    for (auto &pattern : _config->FindVector("APT::VersionedKernelPackages"))
    {
       // Legacy compatibility: Always protected the booted uname and last installed uname
-      if (not lastInstalledUname.empty())
-	 ss << "|^" << pattern << "-" << escapeSpecial(lastInstalledUname) << "$";
       if (*uts.release)
 	 ss << "|^" << pattern << "-" << escapeSpecial(uts.release) << "$";
       for (auto const &kernel : version2unames)
diff --git a/debian/apt.auto-removal.sh b/debian/apt.auto-removal.sh
deleted file mode 100644
index eef550a53..000000000
--- a/debian/apt.auto-removal.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/sh
-set -e
-
-eval $(apt-config shell APT_CONF_D Dir::Etc::parts/d)
-test -n "${APT_CONF_D}" || APT_CONF_D="/etc/apt/apt.conf.d"
-config_file="${APT_CONF_D}/01autoremove-kernels"
-
-generateconfig() {
-	cat <<EOF
-// DO NOT EDIT! File autogenerated by $0
-APT::LastInstalledKernel "$1";
-EOF
-}
-generateconfig "$@" > "${config_file}.dpkg-new"
-mv -f "${config_file}.dpkg-new" "$config_file"
-chmod 444 "$config_file"
diff --git a/debian/apt.maintscript b/debian/apt.maintscript
index 296f83bd5..f37a9e27a 100644
--- a/debian/apt.maintscript
+++ b/debian/apt.maintscript
@@ -1,3 +1,4 @@
 rm_conffile /etc/apt/apt.conf.d/20changelog 1.2.4~
 # we use a systemd timer unit now
 rm_conffile /etc/cron.daily/apt 1.2.10~
+rm_conffile /etc/kernel/postinst.d/apt-auto-removal 2.4.5~
diff --git a/debian/apt.postinst b/debian/apt.postinst
index 837b46b7b..8a623f2fd 100755
--- a/debian/apt.postinst
+++ b/debian/apt.postinst
@@ -7,4 +7,9 @@ if [ "$1" = 'configure' ]; then
 	    --no-create-home --quiet _apt || true
 fi
 
+if [ "$1" = "configure" ] && [ -n "$2" ] && dpkg --compare-versions -- "$2" le-nl "2.4.5~"; then
+    rm -f /etc/apt/apt.conf.d/01autoremove-kernels
+fi
+
+
 #DEBHELPER#
diff --git a/debian/rules b/debian/rules
index 7997739fa..8a110f7a1 100755
--- a/debian/rules
+++ b/debian/rules
@@ -29,7 +29,6 @@ override_dh_install-arch:
 	dh_install -papt -Xmethods/curl -Xmethods/curl+https -Xmethods/curl+http
 	dh_install --remaining
 	install -m 644 debian/apt.conf.autoremove debian/apt/etc/apt/apt.conf.d/01autoremove
-	install -m 755 debian/apt.auto-removal.sh debian/apt/etc/kernel/postinst.d/apt-auto-removal
 
 override_dh_gencontrol:
 	dh_gencontrol -- -Vapt:keyring="$(shell ./vendor/getinfo keyring-package)"
diff --git a/test/integration/test-kernel-helper-autoremove b/test/integration/test-kernel-helper-autoremove
index 8dac44b93..208bd1425 100755
--- a/test/integration/test-kernel-helper-autoremove
+++ b/test/integration/test-kernel-helper-autoremove
@@ -29,15 +29,6 @@ testsuccess aptmark auto "$CURRENTKERNEL" "${CURRENTKERNEL}-dbg" "${CURRENTKERNE
 testsuccess aptmark hold "${CURRENTKERNEL}-rt"
 
 testprotected() {
-	rm -f rootdir/etc/apt/apt.conf.d/01autoremove-kernels protected.list
-
-	testsuccess runapt sh "${TESTDIR}/../../debian/apt.auto-removal.sh" "$@"
-	testfailure test -s rootdir/tmp/testsuccess.output
-
-	msgtest 'Check kernel autoremoval protection list' 'is created'
-	testsuccess --nomsg test -e rootdir/etc/apt/apt.conf.d/01autoremove-kernels
-	testfilestats 'rootdir/etc/apt/apt.conf.d/01autoremove-kernels' '%U:%G:%a' '=' "${TEST_DEFAULT_USER}:${TEST_DEFAULT_GROUP}:444"
-
     testsuccess --nomsg apt -o Debug::PkgAutoRemove=1 autoremove -s
     grep "Kernel protection regex" rootdir/tmp/testsuccess.output | cut -f2- -d: | tr '|' '\n' | sed 's/\s*//g' | sort -u > protected.list
 
@@ -134,8 +125,6 @@ msgmsg "install unknown kernel"
 testprotected 1.0.0-2-ungeneric
 msgtest 'Check kernel autoremoval protection list does not include' 'old kernel'
 testfailure --nomsg grep '^\^linux-.*-1\\\.0\\\.0-2-generic\$$' protected.list
-msgtest 'Check kernel autoremoval protection list does include' 'unknown installed kernel'
-testsuccess --nomsg grep '^\^linux-.*-1\\\.0\\\.0-2-ungeneric\$$' protected.list
 export COLUMNS=9
 testsuccessequal "Reading package lists...
 Building dependency tree...
@@ -152,17 +141,17 @@ unset COLUMNS
 
 msgmsg "install an old kernel"
 testprotected 1.0.0-2-generic
-msgtest 'Check kernel autoremoval protection list includes' 'installed kernel'
-testsuccess --nomsg grep '^\^linux-.*-1\\\.0\\\.0-2-generic\$$' protected.list
 export COLUMNS=9
 testsuccessequal "Reading package lists...
 Building dependency tree...
 Reading state information...
 The following packages will be REMOVED:
   linux-headers-1000000-1-generic
+  linux-image-1.0.0-2-generic
   ${CURRENTKERNEL}-dbg
-0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
+0 upgraded, 0 newly installed, 3 to remove and 0 not upgraded.
 Remv linux-headers-1000000-1-generic [100.0.0-1]
+Remv linux-image-1.0.0-2-generic [1.0.0-2]
 Remv ${CURRENTKERNEL}-dbg [5-1]" aptget autoremove -s
 unset COLUMNS
 
@@ -173,8 +162,9 @@ testsuccessequal "Reading package lists...
 Building dependency tree...
 Reading state information...
 The following packages will be REMOVED:
-  linux-headers-1000000-1-generic ${CURRENTKERNEL}-dbg
-0 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.
+  linux-headers-1000000-1-generic linux-image-1.0.0-2-generic ${CURRENTKERNEL}-dbg
+0 upgraded, 0 newly installed, 3 to remove and 0 not upgraded.
 Remv linux-headers-1000000-1-generic [100.0.0-1]
+Remv linux-image-1.0.0-2-generic [1.0.0-2]
 Remv ${CURRENTKERNEL}-dbg [5-1]" aptget autoremove -s
 unset COLUMNS