select kernels to protect from autoremove based on Debian version

This is basically a rewrite of the script with the general idea of
finding the Debian version of the installed kernels – as multiple
flavours will have the same Debian version – select the two newest of
them and translate them back to versions found in package names.

This way we avoid e.g. kernel and kernel-rt to use up the protected
slots even through they are basically the same kernel (just a different
flavour) so it is likely that if kernel doesn't work for some reason,
kernel-rt will not either.

This also deals with foreign kernel packages, kernels on hold and partly
installed kernels (in case multiple kernels are installed in the same
apt run) in a hopefully sensible way.

Closes: 787827

1 files changed, 24 insertions, 50 deletions

diff --git a/debian/apt.auto-removal.sh b/debian/apt.auto-removal.sh
index 807c6f745..f615fa677 100644
--- a/debian/apt.auto-removal.sh
+++ b/debian/apt.auto-removal.sh
@@ -1,72 +1,45 @@
 #!/bin/sh
 set -e
-
-# Author: Steve Langasek <steve.langasek@canonical.com>
-#
 # Mark as not-for-autoremoval those kernel packages that are:
 #  - the currently booted version
 #  - the kernel version we've been called for
-#  - the latest kernel version (determined using rules copied from the grub
-#    package for deciding which kernel to boot)
-#  - the second-latest kernel version, if the booted kernel version is
-#    already the latest and this script is called for that same version,
-#    to ensure a fallback remains available in the event the newly-installed
-#    kernel at this ABI fails to boot
-# In the common case, this results in exactly two kernels saved, but it can
-# result in three kernels being saved.  It's better to err on the side of
-# saving too many kernels than saving too few.
+#  - the latest kernel version (as determined by debian version number)
+#  - the second-latest kernel version
 #
-# We generate this list and save it to /etc/apt/apt.conf.d instead of marking
-# packages in the database because this runs from a postinst script, and apt
-# will overwrite the db when it exits.
-
+# In the common case this results in two kernels saved (booted into the
+# second-latest kernel, we install the latest kernel in an upgrade), but
+# can save up to four. Kernel refers here to a distinct release, which can
+# potentially be installed in multiple flavours counting as one kernel.
 
 eval $(apt-config shell APT_CONF_D Dir::Etc::parts/d)
 test -n "${APT_CONF_D}" || APT_CONF_D="/etc/apt/apt.conf.d"
-config_file=${APT_CONF_D}/01autoremove-kernels
+config_file="${APT_CONF_D}/01autoremove-kernels"
 
 eval $(apt-config shell DPKG Dir::bin::dpkg/f)
 test -n "$DPKG" || DPKG="/usr/bin/dpkg"
 
-installed_version="$1"
-running_version="$(uname -r)"
 
+list="$(${DPKG} -l | awk '/^[ih][^nc][ ]+(linux|kfreebsd|gnumach)-image-[0-9]+\./ && $2 !~ /-dbg$/ && $2 !~ /-dbgsym$/ { print $2,$3; }' \
+   | sed -e 's#^\(linux\|kfreebsd\|gnumach\)-image-##' -e 's#:[^:]\+ # #')"
+debverlist="$(echo "$list" | cut -d' ' -f 2 | sort --unique --reverse --version-sort)"
 
-version_test_gt ()
-{
-	local version_test_gt_sedexp="s/[._-]\(pre\|rc\|test\|git\|old\|trunk\)/~\1/g"
-	local version_a="`echo "$1" | sed -e "$version_test_gt_sedexp"`"
-	local version_b="`echo "$2" | sed -e "$version_test_gt_sedexp"`"
-	$DPKG --compare-versions "$version_a" gt "$version_b"
-	return "$?"
-}
-
-list="$(${DPKG} -l | awk '/^ii[ ]+(linux|kfreebsd|gnumach)-image-[0-9]+\./ && $2 !~ /-dbg$/ { print $2 }' | sed -e 's#\(linux\|kfreebsd\|gnumach\)-image-##')"
-
-latest_version=""
-previous_version=""
-for i in $list; do
-	if version_test_gt "$i" "$latest_version"; then
-		previous_version="$latest_version"
-		latest_version="$i"
-	elif version_test_gt "$i" "$previous_version"; then
-		previous_version="$i"
-	fi
-done
-
-if [ "$latest_version" != "$installed_version" ] \
-   || [ "$latest_version" != "$running_version" ] \
-   || [ "$installed_version" != "$running_version" ]
-then
-	# We have at least two kernels that we have reason to think the
-	# user wants, so don't save the second-newest version.
-	previous_version=
+if [ -n "$1" ]; then
+	installed_version="$(echo "$list" | awk "\$1 == \"$1\" { print \$2;exit; }")"
+fi
+unamer="$(uname -r)"
+if [ -n "$unamer" ]; then
+	running_version="$(echo "$list" | awk "\$1 == \"$unamer\" { print \$2;exit; }")"
 fi
+latest_version="$(echo "$debverlist" | sed -n 1p)"
+previous_version="$(echo "$debverlist" | sed -n 2p)"
 
-kernels="$(echo "$latest_version
+debkernels="$(echo "$latest_version
 $installed_version
 $running_version
-$previous_version" | sort -u | sed -e 's#\.#\\.#g' )"
+$previous_version" | sort -u | sed -e '/^$/ d')"
+kernels="$( (echo "$1
+$unamer"; for deb in $debkernels; do echo "$list" | awk "\$2 == \"$deb\" { print \$1; }"; done; ) \
+   | sed -e 's#\.#\\.#g' -e '/^$/ d' | sort -u)"
 
 generateconfig() {
 	cat <<EOF
@@ -83,3 +56,4 @@ EOF
 }
 generateconfig > "${config_file}.dpkg-new"
 mv "${config_file}.dpkg-new" "$config_file"
+chmod 444 "$config_file"