regression: apt.postint fails if never previously configured

[David Röthlisberger]

[Impact]
bootstrapping a system with apt that fixes #1968154 fails in focal and bionic, as they try to execute the config file that is being removed.

This is not a problem on updates, only on new installs, so impact is limited to bootstrapping tools that enable -updates, such as mmdebstrap.

[Test case]

bootstrapping with -updates enabled can easily be tested with mmdebstrap:

mmdebstrap -v focal ~/Projects/Ubuntu/Scratch/focal

for example, on focal:

Setting up apt (2.0.8) ...
/var/lib/dpkg/info/apt.postinst: 65: /etc/kernel/postinst.d/apt-auto-removal: not found
dpkg: error processing package apt (--configure):
 installed apt package post-installation script subprocess returned error exit status 127

[Regression potential]
We remove 5 lines from the shell postinst script, there could be syntax errors? But then we'd see those during upgrades, so practically none.

[Original bug report]
#1968154 removed `/etc/kernel/postinst.d/apt-auto-removal` in this patch:
https://git.launchpad.net/ubuntu/+source/apt/commit/?id=f9d2d993687c0d5223c241956ef6a0aabcf15bf0

...but `apt.postinst` still tries to run it:

    # create kernel autoremoval blacklist on update
    if dpkg --compare-versions "$2" lt 0.9.9.3; then
        /etc/kernel/postinst.d/apt-auto-removal
    fi

If I understand correctly, "$2" is the most-recently-configured-version, and if it's empty `dpkg --compare-versions lt` will evaluate to true.

This fails when I'm building a focal (20.04) userspace from scratch:

    $ dpkg --configure -a
    [...]
    Setting up apt (2.0.8) ...
    /var/lib/dpkg/info/apt.postinst: 65: /etc/kernel/postinst.d/apt-auto-removal: not found
    dpkg: error processing package apt (--configure):
     installed apt package post-installation script subprocess returned error exit status 127

It works with apt 2.0.6.

[David Kalnischkies (donkult)]

jftr: I removed this if in git commit 938889b20268ec92be1bff67750f7adf03f52c1b, which was shipped with 2.1.12 – that might explain why it isn't effecting releases with later versions and why it was missed.

[Julian Andres Klode (juliank)]

Yup I'm going to push updated bionic and focal SRUs for this next week

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Julian Andres Klode (juliank)]

@David I was able to reproduce this with mmdebstrap as it uses -updates pocket, but not with debootstrap as it only uses the release pockets. Which tool were you using to bootstrap your system?

It's possible we might just want keep the fix in -proposed and not release it to updates if it does not affect the supported bootstrapping tools.

[David Röthlisberger (drothlis)]

> Which tool were you using to bootstrap your system?

My own build system (which I wrote about for LWN: https://lwn.net/Articles/821367/ ).

[David Röthlisberger (drothlis)]

P.S. I have worked around this in my build system (by creating an empty executable script at the location that apt.postinst is expecting before I call dpkg --configure) so I'm not worried. When I reported this I didn't realise it wouldn't affect debootstrap.

[Julian Andres Klode (juliank)]

It might, I just might miss the right setting, I don't really know.

[Chris Halse Rogers (raof)]

Hello David, or anyone else affected,

Accepted apt into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apt/2.0.9 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Patric Mai (schwarzerkaiser)]

Hi Everyone!
Can confirm this resolves the issue on my end when bootstrapping latest ubuntu focal using mmdebstrap (0.4.1 from apt repo) and the proposed version of apt 2.0.9 (by adding focal-proposed to sources list) - bootstrapping now works fine again without any errors!

Kind regards

[Gary Chapman (chaps+us.ibm.com)]

The IBM Secure Service Container (SSC) environment uses Ubuntu 20.04 for zLinux. During our periodic package refresh, apt 2.0.8 caused this failure in the debootstrap step of our build process:

Setting up apt (2.0.8) ...
/var/lib/dpkg/info/apt.postinst: 65: /etc/kernel/postinst.d/apt-auto-removal: not found
dpkg: error processing package apt (--configure):
 installed apt package post-installation script subprocess returned error exit status 127

(as reported here). We backed off to apt 2.0.6 for current sprint/release and joined this bug.

Downloaded this proposed fix
Get:1 http://us.ports.ubuntu.com/ubuntu-ports focal-proposed/main s390x apt s390x 2.0.9 [1,251 kB]
Get:2 http://us.ports.ubuntu.com/ubuntu-ports focal-proposed/main s390x libapt-pkg6.0 s390x 2.0.9 [772 kB]
Get:1 http://us.ports.ubuntu.com/ubuntu-ports focal-proposed/main s390x apt-utils s390x 2.0.9 [200 kB]

subsequent debootstrap:
Setting up libapt-pkg6.0:s390x (2.0.9) ...
Setting up apt (2.0.9) ...
Setting up apt-utils (2.0.9) ...
completes normally

[Julian Andres Klode (juliank)]

Hi Gary,

how do you invoke debootstrap so it uses packages from the the updates pocket? I wasn't able to with --extra-suites=focal-updates, but I might have missed something.

But then I guess we should actually release that fix too.

[Gary Chapman (chaps+us.ibm.com)]

juliank - No. Our "overly complex" build must support environments without direct access to the ubuntu servers. Therefore we download all needed Ubuntu packages as a front-end step, putting them in an IBM-internal archive. At build time, reprepro is used to put them in to a local filesystem repo which then feeds debootstrap. The front-end step certainly downloads from focal-updates, always using apt-get download.

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted apt (2.0.9) for focal have finished running.
The following regressions have been reported in tests triggered by the package:

livecd-rootfs/2.664.41 (ppc64el, arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/focal/update_excuses.html#apt

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Sebastian Unger (sebunger44)]

Any idea when the fix for this will be published? We too use debootstrap off a focal package archive that has updates merged in so new installations don't have to immediately upgrade 100s of packages. Currently installations fail because of this.

[Sebastien Bacher (seb128)]

@Sebastian, the SRU needs to be verified for the fix to move to updates, maybe you could help testing the proposed version to help there?

[David Röthlisberger (drothlis)]

@seb128 Does this still need additional testing? See comments #11 & #12.

[Julian Andres Klode (juliank)]

Set the verification done tags based on my the confirmation in #11 and #12 of what I see in my pre-upload testing, and also double checked as described - with mmdebstrap with proposed enabled, it installed apt 2.0.9 successfully

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 2.0.9

---------------
apt (2.0.9) focal; urgency=medium

  * postinst: Do not run removed kernel postinst.d script (LP: #1974456)

 -- Julian Andres Klode <email address hidden> Tue, 24 May 2022 15:08:25 +0200

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for apt has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Łukasz Zemczak (sil2100)]

Hello David, or anyone else affected,

Accepted apt into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apt/1.6.16 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Verified.

For bionic I ran

mmdebstrap -v --keyring /usr/share/keyrings/ubuntu-archive-keyring.gpg --aptopt='Acquire::http::proxy "http://localhost:8000/";' bionic bionic-proposed http://archive.ubuntu.com/ubuntu 'deb http://archive.ubuntu.com/ubuntu/ bionic-proposed main'

to enable proposed and this succeeded with

Setting up apt (1.6.16) ...

[Chris Halse Rogers (raof)]

Hello David, or anyone else affected,

Accepted apt into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apt/1.6.17 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Julian Andres Klode (juliank)]

Reverified for 1.6.17 as per #23

[Ubuntu SRU Bot (ubuntu-sru-bot)]

All autopkgtests for the newly accepted apt (1.6.17) for bionic have finished running.
The following regressions have been reported in tests triggered by the package:

unattended-upgrades/1.1ubuntu1.18.04.14 (s390x)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/bionic/update_excuses.html#apt

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package apt - 1.6.17

---------------
apt (1.6.17) bionic; urgency=medium

  * Bump cache minor version for kernel collection.
    The previous update introduced the new kernel autoremoval code which
    collects kernels in the cache as providers of a $kernel package.
    We need to bump the cache minor version for this as otherwise the
    $kernel package might not exist and all kernels end up autoremovable
    until a package got installed or sources updated.

apt (1.6.16) bionic; urgency=medium

  * postinst: Do not run removed kernel postinst.d script (LP: #1974456)

apt (1.6.15) bionic; urgency=medium

  * Revert "Protect currently running kernel at run-time"
  * Backport Determine autoremovable kernels at run-time (LP: #1615381) as of
    2.4.5; including the change to only protect two kernels, not last installed
    one (LP: #1968154)

 -- Julian Andres Klode <email address hidden> Fri, 12 Aug 2022 12:38:33 +0200