Packages with security updates kept back

DonkeeeyKong · Jul 11th 2024

Maybe the output of the following commands is helpful:

Code

cat /etc/apt/apt.conf.d/* | grep "APT::Default-Release"

and

Code

apt-cache policy

ryecoaaron · Jul 11th 2024

Quote from cmvmot

Is there a way to just reset all of my apt sources and apt preferences to the defaults for OMV 7?

sudo rm -v /etc/apt/sources.list.d/*

sudo find /etc/apt/preferences.d/ -type f ! -name 'openmediavault-local.pref' -print -delete

sudo omv-salt deploy run apt

sudo omv-aptclean repos

cmvmot · Jul 13th 2024

Quote from ryecoaaron

sudo rm -v /etc/apt/sources.list.d/*
sudo find /etc/apt/preferences.d/ -type f ! -name 'openmediavault-local.pref' -print -delete
sudo omv-salt deploy run apt
sudo omv-aptclean repos

Thanks, I tried this but unfortunately no change.

cmvmot · Jul 13th 2024

Quote from DonkeeeyKong
Maybe the output of the following commands is helpful:
Code
cat /etc/apt/apt.conf.d/* | grep "APT::Default-Release"
and
Code
apt-cache policy

Thank you, the first command returned nothing. The second one:

Code

Package files:
 100 /var/lib/dpkg/status
     release a=now
 500 https://openmediavault.github.io/packages sandworm/main amd64 Packages
     release o=openmediavault.org archive,a=sandworm,n=sandworm,l=openmediavault.org archive,c=main,b=amd64
     origin openmediavault.github.io
 500 http://packages.openmediavault.org/public sandworm/main amd64 Packages
     release o=openmediavault.org archive,a=sandworm,n=sandworm,l=openmediavault.org archive,c=main,b=amd64
     origin packages.openmediavault.org
 500 http://security.debian.org/debian-security bookworm-security/non-free-firmware amd64 Packages
     release v=12,o=Debian,a=stable-security,n=bookworm-security,l=Debian-Security,c=non-free-firmware,b=amd64
     origin security.debian.org
 500 http://security.debian.org/debian-security bookworm-security/contrib amd64 Packages
     release v=12,o=Debian,a=stable-security,n=bookworm-security,l=Debian-Security,c=contrib,b=amd64
     origin security.debian.org
 500 http://security.debian.org/debian-security bookworm-security/main amd64 Packages
     release v=12,o=Debian,a=stable-security,n=bookworm-security,l=Debian-Security,c=main,b=amd64
     origin security.debian.org
 100 http://httpredir.debian.org/debian bookworm-backports/non-free amd64 Packages
     release o=Debian Backports,a=stable-backports,n=bookworm-backports,l=Debian Backports,c=non-free,b=amd64
     origin httpredir.debian.org
 100 http://httpredir.debian.org/debian bookworm-backports/contrib amd64 Packages
     release o=Debian Backports,a=stable-backports,n=bookworm-backports,l=Debian Backports,c=contrib,b=amd64
     origin httpredir.debian.org
 100 http://httpredir.debian.org/debian bookworm-backports/main amd64 Packages
     release o=Debian Backports,a=stable-backports,n=bookworm-backports,l=Debian Backports,c=main,b=amd64
     origin httpredir.debian.org
 500 https://openmediavault-plugin-developers.github.io/packages/debian sandworm/main amd64 Packages
     release n=sandworm,c=main,b=amd64
     origin openmediavault-plugin-developers.github.io
 990 https://download.docker.com/linux/debian bookworm/stable amd64 Packages
     release o=Docker,a=bookworm,l=Docker CE,c=stable,b=amd64
     origin download.docker.com
 500 https://deb.debian.org/debian bookworm-updates/non-free amd64 Packages
     release v=12-updates,o=Debian,a=stable-updates,n=bookworm-updates,l=Debian,c=non-free,b=amd64
     origin deb.debian.org
 500 https://deb.debian.org/debian bookworm-updates/contrib amd64 Packages
     release v=12-updates,o=Debian,a=stable-updates,n=bookworm-updates,l=Debian,c=contrib,b=amd64
     origin deb.debian.org
 500 https://deb.debian.org/debian bookworm-updates/main amd64 Packages
     release v=12-updates,o=Debian,a=stable-updates,n=bookworm-updates,l=Debian,c=main,b=amd64
     origin deb.debian.org
 990 https://deb.debian.org/debian bookworm/non-free amd64 Packages
     release v=12.6,o=Debian,a=stable,n=bookworm,l=Debian,c=non-free,b=amd64
     origin deb.debian.org
 990 https://deb.debian.org/debian bookworm/contrib amd64 Packages
     release v=12.6,o=Debian,a=stable,n=bookworm,l=Debian,c=contrib,b=amd64
     origin deb.debian.org
 990 https://deb.debian.org/debian bookworm/main amd64 Packages
     release v=12.6,o=Debian,a=stable,n=bookworm,l=Debian,c=main,b=amd64
     origin deb.debian.org
Pinned packages:

Display More

ryecoaaron · Jul 13th 2024

Quote from cmvmot

I tried this but unfortunately no change.

Output would be helpful. We can't see your system.

Your system still has the regular debian repo pinned at 990. omv and omv-extras are not doing this and it is causing the problem. What is the output of: ls -al /etc/apt/preferences.d/

cmvmot · Jul 14th 2024

Quote from ryecoaaron

Output would be helpful. We can't see your system.

Your system still has the regular debian repo pinned at 990. omv and omv-extras are not doing this and it is causing the problem. What is the output of: ls -al /etc/apt/preferences.d/

Code

total 16
drwxr-xr-x  2 root root 4096 Jul 11 19:48 .
drwxr-xr-x 14 root root 4096 Feb 21 20:28 ..
-rw-r--r--  1 root root  299 Jul 11 19:47 openmediavault-kernel-backports.pref
-rw-r--r--  1 root root   44 May  4  2017 openmediavault-local.pref

ryecoaaron · Jul 14th 2024

That doesn't make much sense. What about: sudo grep -r 990 /etc/apt/*

cmvmot · Jul 15th 2024

Quote from ryecoaaron

That doesn't make much sense. What about: sudo grep -r 990 /etc/apt/*

returns nothing. Is that bad? This is the contents of /etc/apt:

Code

total 84
drwxr-xr-x  14 root root  4096 Feb 21 20:28 .
drwxrwxr-x 110 root root 12288 Jul 11 19:51 ..
-rw-r--r--   1 root root    33 Feb 21 20:23 apt.conf
drwxr-xr-x   2 root root  4096 Jul 11 19:48 apt.conf.d
drwxr-xr-x   2 root root  4096 Dec  7  2020 auth.conf.d
drwxr-xr-x   2 root root  4096 Feb 21 22:11 keyrings
-rw-r--r--   1 root root   150 Feb 21 20:28 listchanges.conf
drwxr-xr-x   2 root root  4096 Jul 11 19:48 listchanges.conf.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 post-invoke.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 preferences.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 pre-invoke.d
-rw-r--r--   1 root root   286 Feb 21 20:23 sources.list
-rw-r--r--   1 root root     0 Mar 10  2019 sources.list~
drwxr-xr-x   2 root root  4096 Jul 11 19:48 sources.list.d
-rw-r--r--   1 root root  3539 May 30  2021 trusted.gpg
-rw-r--r--   1 root root  1206 Mar 30  2018 trusted.gpg~
drwxr-xr-x   2 root root  4096 Feb 21 22:16 trusted.gpg.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 update-post-invoke.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 update-post-invoke-success.d
drwxr-xr-x   2 root root  4096 Jul 11 19:48 update-pre-invoke.d

Display More

ryecoaaron · Jul 15th 2024

Quote from cmvmot

Is that bad?

It isn't good because it pins the regular debian repo packages higher than the debian security repo packages. I don't know how it is doing that based the output you have given me. The only ways I know to pin a repo/package are in /etc/apt/

ryecoaaron · Jul 16th 2024

Can you post the output of:

sudo apt-mark showhold

cmvmot · Jul 16th 2024

Quote from ryecoaaron

Can you post the output of:

sudo apt-mark showhold

No output for that one.

Pendrragon · Jul 16th 2024

I would be a second test-person with the same problem and the same outputs here. Perhaps it aligns with the mergerfs-problem I had days ago.

ryecoaaron · Jul 17th 2024

Quote from cmvmot

No output for that one.

I have zero ideas on how that repo is pinned like that then.

Quote from Pendrragon

I would be a second test-person with the same problem and the same outputs here. Perhaps it aligns with the mergerfs-problem I had days ago

Yes, you have the same debian issue pinned at 990 issue. OMV and omv-extras are not doing this though. And based on output I have asked for, I don't know how it can possibly be pinned at 990. Unless someone wants to send me an image of their OS disk, someone with the issue is going to have to figure it out.

DonkeeeyKong · Jul 17th 2024

There seems to be some exotic apt configuration here. Can we see the whole output of head -vn -0 /etc/apt/apt.conf.d/* and cat /etc/apt/apt.conf andecho $APT_CONFIG?

Also maybe cat /etc/apt/preferences and head -vn -0 /etc/apt/preferences.d/*.

If none of this has helpful output, I am out of ideas as well.

cmvmot · Jul 18th 2024

Quote from ryecoaaron

I have zero ideas on how that repo is pinned like that then.
Yes, you have the same debian issue pinned at 990 issue. OMV and omv-extras are not doing this though. And based on output I have asked for, I don't know how it can possibly be pinned at 990. Unless someone wants to send me an image of their OS disk, someone with the issue is going to have to figure it out.

I'm also stumped, I searched for the number 990 in the entirety of /etc/apt and it doesn't appear anywhere. I have no idea where it could be getting that priority from.

cmvmot · Jul 18th 2024

Quote from DonkeeeyKong

There seems to be some exotic apt configuration here. Can we see the whole output of head -vn -0 /etc/apt/apt.conf.d/* and cat /etc/apt/apt.conf andecho $APT_CONFIG?

Also maybe cat /etc/apt/preferences and head -vn -0 /etc/apt/preferences.d/*.

If none of this has helpful output, I am out of ideas as well.

Here you go:

Code

root@joe:~# head -vn -0 /etc/apt/apt.conf.d/*
==> /etc/apt/apt.conf.d/00CDMountPoint <==
Acquire::cdrom {
  mount "/media/cdrom";
};
Dir::Media::MountPath "/media/cdrom";

==> /etc/apt/apt.conf.d/00recommends <==
APT::Install-Recommends "false";
Aptitude::Recommends-Important "false";

==> /etc/apt/apt.conf.d/00trustcdrom <==
APT::Authentication::TrustCDROM "true";

==> /etc/apt/apt.conf.d/01autoremove <==
APT
{
  NeverAutoRemove
  {
        "^firmware-linux.*";
        "^linux-firmware$";
        "^linux-image-[a-z0-9]*$";
        "^linux-image-[a-z0-9]*-[a-z0-9]*$";
  };

  VersionedKernelPackages
  {
        # kernels
        "linux-.*";
        "kfreebsd-.*";
        "gnumach-.*";
        # (out-of-tree) modules
        ".*-modules";
        ".*-kernel";
  };

  Never-MarkAuto-Sections
  {
        "metapackages";
        "tasks";
  };

  Move-Autobit-Sections
  {
        "oldlibs";
  };
};

==> /etc/apt/apt.conf.d/20apt-show-versions <==
// When Apt's cache is updated (i.e. apt-get update)
APT::Update::Post-Invoke-Success {
"test -x /usr/bin/apt-show-versions || exit 0 ; apt-show-versions -i";
};

==> /etc/apt/apt.conf.d/20auto-upgrades <==
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

==> /etc/apt/apt.conf.d/20listchanges <==
DPkg::Pre-Install-Pkgs { "/usr/bin/apt-listchanges --apt || test $? -lt 10"; };
DPkg::Tools::Options::/usr/bin/apt-listchanges::Version "2";
DPkg::Tools::Options::/usr/bin/apt-listchanges::InfoFD "20";
Dir::Etc::apt-listchanges-main "listchanges.conf";
Dir::Etc::apt-listchanges-parts "listchanges.conf.d";

==> /etc/apt/apt.conf.d/70debconf <==
// Pre-configure all packages with debconf before they are installed.
// If you don't like it, comment it out.
DPkg::Pre-Install-Pkgs {"/usr/sbin/dpkg-preconfigure --apt || true";};

==> /etc/apt/apt.conf.d/95openmediavault-periodic <==
// See /usr/lib/apt/apt.systemd.daily
APT::Periodic::Enable "1";
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::CleanInterval "7";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Verbose "1";

==> /etc/apt/apt.conf.d/95openmediavault-unattended-upgrades <==
// https://otremba.net/wiki/Automatische_Updates_(Debian)
// Auto-install security packages only.
Unattended-Upgrade::Origins-Pattern {
  "origin=Debian,codename=${distro_codename},label=Debian-Security";
  "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::InstallOnShutdown "false";
Unattended-Upgrade::Mail "root";
Unattended-Upgrade::MailReport "on-change";
Unattended-Upgrade::Sender "root";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "false";
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
Unattended-Upgrade::Remove-Unused-Dependencies "false";
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::SyslogEnable "false";
Unattended-Upgrade::OnlyOnACPower "false";
Unattended-Upgrade::Skip-Updates-On-Metered-Connections "false";
Unattended-Upgrade::Verbose "true";
Unattended-Upgrade::Debug "false";
Unattended-Upgrade::Allow-downgrade "false";
Unattended-Upgrade::Allow-APT-Mark-Fallback "true";

==> /etc/apt/apt.conf.d/99dpkgnotify <==
DPkg::Post-Invoke {"if [ -x /usr/bin/dpkgnotify ]; then /usr/bin/dpkgnotify; fi;";};

==> /etc/apt/apt.conf.d/99openmediavault-apt-hooks <==
APT::Update::Pre-Invoke { "if [ -d /etc/apt/update-pre-invoke.d/ ]; then run-parts /etc/apt/update-pre-invoke.d || true; fi"; };
APT::Update::Post-Invoke { "if [ -d /etc/apt/update-post-invoke.d/ ]; then run-parts /etc/apt/update-post-invoke.d || true; fi"; };
APT::Update::Post-Invoke-Success { "if [ -d /etc/apt/update-post-invoke-success.d/ ]; then run-parts /etc/apt/update-post-invoke-success.d || true; fi"; };
// Note, the DPkg hooks are only triggered by `apt` tools, not when running `dpkg` manually.
// See https://wiki.debian.org/AptConfiguration#apt.conf
DPkg::Pre-Invoke { "if [ -d /etc/apt/pre-invoke.d/ ]; then run-parts /etc/apt/pre-invoke.d || true; fi"; };
DPkg::Post-Invoke { "if [ -d /etc/apt/post-invoke.d/ ]; then run-parts /etc/apt/post-invoke.d || true; fi"; };

==> /etc/apt/apt.conf.d/99openmediavault-localrepository <==
// Ensure that the local package repository files exists.
APT::Update::Pre-Invoke { ". /etc/default/openmediavault; if [ ! -e ${OMV_DPKGARCHIVE_DIR}/Packages ]; then echo Building local package repository ...; cd ${OMV_DPKGARCHIVE_DIR} && apt-ftparchive packages . > Packages && apt-ftparchive release . > Release; fi"; };
DPkg::Pre-Invoke { ". /etc/default/openmediavault; if [ ! -e ${OMV_DPKGARCHIVE_DIR}/Packages ]; then echo Building local package repository ...; cd ${OMV_DPKGARCHIVE_DIR} && apt-ftparchive packages . > Packages && apt-ftparchive release . > Release; fi"; };

==> /etc/apt/apt.conf.d/99openmediavault-mkaptidx <==
// Create the plugin index.
APT::Update::Post-Invoke-Success { "which omv-mkaptidx >/dev/null 2>&1 || exit 0; omv-mkaptidx >/dev/null || true"; };
DPkg::Post-Invoke { "which omv-mkaptidx >/dev/null 2>&1 || exit 0; omv-mkaptidx >/dev/null || true"; };

==> /etc/apt/apt.conf.d/99openmediavault-norecommends <==
APT::Install-Recommends "false";
==> /etc/apt/apt.conf.d/99openmediavault-nosuggests <==
APT::Install-Suggests "false";

Display More

Code

root@joe:~# cat /etc/apt/apt.conf
APT::Default-Release "bookworm";

Code

root@joe:~# echo $APT_CONFIG

Code

root@joe:~# cat /etc/apt/preferences
cat: /etc/apt/preferences: No such file or directory

Code

root@joe:~# head -vn -0 /etc/apt/preferences.d/*
==> /etc/apt/preferences.d/openmediavault-kernel-backports.pref <==
Package: linux-base
Pin: release a=bookworm-backports
Pin-Priority: 500

Package: linux-headers-*
Pin: release a=bookworm-backports
Pin-Priority: 500

Package: linux-image-*
Pin: release a=bookworm-backports
Pin-Priority: 500

Package: firmware-*
Pin: release a=bookworm-backports
Pin-Priority: 500

==> /etc/apt/preferences.d/openmediavault-local.pref <==
Package: *
Pin: origin ""
Pin-Priority: 995

Display More

DonkeeeyKong · Jul 18th 2024

Quote from cmvmot

Code

root@joe:~# cat /etc/apt/apt.conf
APT::Default-Release "bookworm";

That's your problem. Where does this file come from? This sets bookworm as target release (priority 990) and prevents packages from bookworm-security from being installed: https://wiki.debian.org/AptCon…with_APT::Default-Release

Removing this file (/etc/apt/apt.conf) should solve your problem.

ryecoaaron · Jul 18th 2024

Quote from DonkeeeyKong

Removing this file (/etc/apt/apt.conf) should solve your problem.

Thanks for finding that!

votdev · Jul 18th 2024

Quote from DonkeeeyKong

That's your problem. Where does this file come from? This sets bookworm as target release (priority 990) and prevents packages from bookworm-security from being installed: https://wiki.debian.org/AptCon…with_APT::Default-Release

Removing this file (/etc/apt/apt.conf) should solve your problem.

Thanks for your investigation.

The issue will be fixed in next version, see https://github.com/openmediava…42c957a7f0efae4bbee7931ed.

cmvmot · Jul 19th 2024

Quote from DonkeeeyKong

That's your problem. Where does this file come from? This sets bookworm as target release (priority 990) and prevents packages from bookworm-security from being installed: https://wiki.debian.org/AptCon…with_APT::Default-Release

Removing this file (/etc/apt/apt.conf) should solve your problem.

Thank you! This solved the problem for me!

Packages with security updates kept back

Participate now!

Similar Threads

Debian repositories no longer have "Release file"

OMV auto-uninstalled while upgrade vom 5 to 6 on Rock64

DNS not resolving on OMV 6.0.42-2 after setting interface DNS

OMV not upgrading to latest via CLI ('5 not upgraded')