Unattended upgrades falls back to adjust all upgradable packages in attempt to install held packages

[Balint Reczey]

[Impact]

 * The fix for LP: #1821101 allowed installing packages for which APT's resolver could not find solution for without adjusting other packages, but also tries to adjust many packages to install packages which are held back.

[Test Case]

 * Set up a system where systemd (or a package that can't be upgraded without also upgrading other packages) need to be upgraded to the version in -security.

 * Mark systemd on hold
   apt-mark hold systemd

 * Observe u-u falling back to adjusting all upgradable packages in unfixed versions and adjusting only a few in fixed versions:

# unattended-upgrade --verbose --debug
...

adjusting candidate version: libnss-systemd=237-3ubuntu10.19
falling back to marking libnss-systemd, then adjusting changes
package libnss-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
falling back to adjusting all packages
adjusting candidate version: 2ping=4.1-1
...

  Fixed:
...
adjusting candidate version: libnss-systemd=237-3ubuntu10.19
falling back to adjusting libnss-systemd's dependencies recursively
adjusting candidate version: libnss-systemd=237-3ubuntu10.19
adjusting candidate version: libkmod2=24-1ubuntu3
adjusting candidate version: mount=2.31.1-0.4ubuntu3
adjusting candidate version: libmount1=2.31.1-0.4ubuntu3
...

[Regression Potential]

 * The less extensive fallback may not find solutions for installing packages with special relationships that the full fallback could have found, but I don't know about such special cases in the archive and the autopkgtest cover a fair set of popular packages. Keeping back those packages seems to be better than spending a lot of CPU time on finding a few solutions - which still was not enough to find _all_ solutions.

[Other Info]

Originally reported at: https://bugs.launchpad.net/ubuntu/+source/unattended-upgrades/+bug/1396787/comments/21

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 1.10ubuntu5

---------------
unattended-upgrades (1.10ubuntu5) disco; urgency=medium

  * Adjust only transitive dependencies in the fallback
    when a package from an allowed origin can't be marked to install/upgrade.
    This is a much lighter approach than marking every upgradable package because
    the full fallback was triggered on packages held back as well, using an
    excessive amount of CPU time.
    Also it crashed with packages not having any version in allowed origins.
    (LP: #1824804, #1824949)

 -- Balint Reczey <email address hidden> Tue, 16 Apr 2019 08:54:49 +0200

[Pavel (spvkgn)]

How to get fix for Bionic?

[Balint Reczey (rbalint)]

On the way but could not start the sru process due to releasing Disco.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted unattended-upgrades into disco-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unattended-upgrades/1.10ubuntu5.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-disco to verification-done-disco. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-disco. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

An upload of unattended-upgrades to cosmic-proposed has been rejected from the upload queue for the following reason: "Some bugs are missing valuable SRU information and changelog links to an unrelated, old bug #182480. Please fix an re-upload.".

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted unattended-upgrades into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unattended-upgrades/1.5ubuntu3.18.10.4 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted unattended-upgrades into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unattended-upgrades/1.1ubuntu1.18.04.11 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello Balint, or anyone else affected,

Accepted unattended-upgrades into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/unattended-upgrades/1.1ubuntu1.18.04.7~16.04.3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Balint Reczey (rbalint)]

Verified 1.10ubuntu5.1 on Disco.

Discos' 1.10ubuntu5 already had the fix to not fall back to mark all upgradable packages, it just received follow-up commits to all kinds of dependencies and skip held packages earlier.

root@dd-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-=============-============-===========================================
ii unattended-upgrades 1.10ubuntu5.1 all automatic installation of security upgrades
root@dd-lp-1824804:~# apt-mark showhold
systemd
root@dd-lp-1824804:~# unattended-upgrade --verbose --debug
Running on the development release
Initial blacklist :
Initial whitelist:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=disco, o=Ubuntu,a=disco-security, o=UbuntuESM,a=disco
...
Checking: console-setup ([<Origin component:'main' archive:'disco-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: console-setup=1.178ubuntu12
Checking: console-setup-linux ([<Origin component:'main' archive:'disco-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: console-setup-linux=1.178ubuntu12
Checking: keyboard-configuration ([<Origin component:'main' archive:'disco-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: keyboard-configuration=1.178ubuntu12
Checking: libnss-systemd ([<Origin component:'main' archive:'disco' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
package libnss-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
falling back to adjusting libnss-systemd's dependencies recursively
package libnss-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
sanity check failed for: set()
Checking: libpam-systemd ([<Origin component:'main' archive:'disco' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
package libpam-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
falling back to adjusting libpam-systemd's dependencies recursively
package libpam-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
sanity check failed for: set()
Checking: libsystemd0 ([<Origin component:'main' archive:'disco' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
package libsystemd0 upgradable but fails to be marked for upgrade (E:Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.)
falling back to adjusting libsystemd0's dependencies recursively
package libsystemd0 upgradable but fails to be marked for upgrade (E:Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held pack...

[Balint Reczey (rbalint)]

Verified 1.5ubuntu3.18.10.4 on Cosmic:

Buggy version:
root@cc-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-==================-============-===========================================
ii unattended-upgrades 1.5ubuntu3.18.10.3 all automatic installation of security upgrades
root@cc-lp-1824804:~# unattended-upgrade --verbose --debug
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=cosmic, o=Ubuntu,a=cosmic-security, o=UbuntuESM,a=cosmic
...
Checking: libnss-systemd ([<Origin component:'main' archive:'cosmic-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: libnss-systemd=239-7ubuntu10.12
falling back to marking libnss-systemd, then adjusting changes
package libnss-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
falling back to adjusting all packages
adjusting candidate version: 2to3=3.6.6-1
adjusting candidate version: amphora-agent=3.0.0-0ubuntu2
adjusting candidate version: aodh-api=7.0.0-0ubuntu3
...

Fixed version:
root@cc-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-==================-============-===========================================
ii unattended-upgrades 1.5ubuntu3.18.10.4 all automatic installation of security upgrades
root@cc-lp-1824804:~# unattended-upgrade --verbose --debug
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=cosmic, o=Ubuntu,a=cosmic-security, o=UbuntuESM,a=cosmic
...
Checking: libnss-systemd ([<Origin component:'main' archive:'cosmic-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: libnss-systemd=239-7ubuntu10.12
falling back to adjusting libnss-systemd's dependencies recursively
adjusting candidate version: libnss-systemd=239-7ubuntu10.12
adjusting candidate version: libidn11=1.33-2.2ubuntu1
adjusting candidate version: libsystemd0=239-7ubuntu10.12
adjusting candidate version: libpam0g=1.1.8-3.6ubuntu2
...

[Balint Reczey (rbalint)]

Verified 1.1ubuntu1.18.04.11 on Bionic:

Old version:

root@bb-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-===================-============-===========================================
ii unattended-upgrades 1.1ubuntu1.18.04.10 all automatic installation of security upgrades
root@bb-lp-1824804:~# unattended-upgrade --verbose --debug
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=bionic, o=Ubuntu,a=bionic-security, o=UbuntuESM,a=bionic
Using (^linux-image-[0-9]+\.[0-9\.]+-.*|^linux-headers-[0-9]+\.[0-9\.]+-.*|^linux-image-extra-[0-9]+\.[0-9\.]+-.*|^linux-modules-[0-9]+\.[0-9\.]+-.*|^linux-modules-extra-[0-9]+\.[0-9\.]+-.*|^linux-signed-image-[0-9]+\.[0-9\.]+-.*|^kfreebsd-image-[0-9]+\.[0-9\.]+-.*|^kfreebsd-headers-[0-9]+\.[0-9\.]+-.*|^gnumach-image-[0-9]+\.[0-9\.]+-.*|^.*-modules-[0-9]+\.[0-9\.]+-.*|^.*-kernel-[0-9]+\.[0-9\.]+-.*|^linux-backports-modules-.*-[0-9]+\.[0-9\.]+-.*|^linux-modules-.*-[0-9]+\.[0-9\.]+-.*|^linux-tools-[0-9]+\.[0-9\.]+-.*|^linux-cloud-tools-[0-9]+\.[0-9\.]+-.*) regexp to find kernel packages
Using (^linux-image-4\.18\.0\-18\-generic$|^linux-headers-4\.18\.0\-18\-generic$|^linux-image-extra-4\.18\.0\-18\-generic$|^linux-modules-4\.18\.0\-18\-generic$|^linux-modules-extra-4\.18\.0\-18\-generic$|^linux-signed-image-4\.18\.0\-18\-generic$|^kfreebsd-image-4\.18\.0\-18\-generic$|^kfreebsd-headers-4\.18\.0\-18\-generic$|^gnumach-image-4\.18\.0\-18\-generic$|^.*-modules-4\.18\.0\-18\-generic$|^.*-kernel-4\.18\.0\-18\-generic$|^linux-backports-modules-.*-4\.18\.0\-18\-generic$|^linux-modules-.*-4\.18\.0\-18\-generic$|^linux-tools-4\.18\.0\-18\-generic$|^linux-cloud-tools-4\.18\.0\-18\-generic$) regexp to find running kernel packages
Checking: libpam-systemd ([<Origin component:'main' archive:'bionic-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>])
adjusting candidate version: libpam-systemd=237-3ubuntu10.19
falling back to marking libpam-systemd, then adjusting changes
package libpam-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
falling back to adjusting all packages
adjusting candidate version: 2ping=4.1-1
adjusting candidate version: 2to3=3.6.5-3
adjusting candidate version: amavisd-new=1:2.11.0-1ubuntu1
adjusting candidate version: amavisd-new-postfix=1:2.11.0-1ubuntu1
adjusting candidate version: amd64-microcode=3.20180524.1~ubuntu0.18.04.1
adjusting candidate version: aodh-api=6.0.0-0ubuntu1
adjusting candidate version: aodh-common=6.0.0-0ubuntu1
adjusting candidate version: aodh-doc=6.0.0-0ubuntu1
adjusting candidate version: aodh-evaluator=6.0.0-0ubuntu1
adjusting candidate version: aodh-expirer=6.0.0-0ubuntu1
adjusting candidate version: aodh-listener=6.0.0-0ubuntu1
adjusting candidate version: aodh-notifier=6.0.0-0ubuntu1
adjusting candidate version: ap...

[Balint Reczey (rbalint)]

Xenial was not affected by this bug due to the fix of LP: #1821101 was not released to Xenial.

The fix for LP: #1821101 however will be released including the fix for the regression for this bug thus the verification of this regression fix is needed.

Verified 1.1ubuntu1.18.04.7~16.04.3 on Xenial:

Original version:
root@x-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-==========================-============-===========================================
ii unattended-upgrades 1.1ubuntu1.18.04.7~16.04.2 all automatic installation of security upgrades
root@x-lp-1824804:~# unattended-upgrade --verbose --debug
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=xenial, o=Ubuntu,a=xenial-security, o=UbuntuESM,a=xenial
...
Checking: libpam-systemd ([<Origin component:'main' archive:'xenial-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>, <Origin component:'main' archive:'xenial-security' origin:'Ubuntu' label:'Ubuntu' site:'security.ubuntu.com' isTrusted:True>])
package libpam-systemd upgradable but fails to be marked for upgrade (E:Unable to correct problems, you have held broken packages.)
Checking: libsystemd0 ([<Origin component:'main' archive:'xenial-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>, <Origin component:'main' archive:'xenial-security' origin:'Ubuntu' label:'Ubuntu' site:'security.ubuntu.com' isTrusted:True>])
package libsystemd0 upgradable but fails to be marked for upgrade (E:Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.)
Checking: systemd ([<Origin component:'main' archive:'xenial-updates' origin:'Ubuntu' label:'Ubuntu' site:'archive.ubuntu.com' isTrusted:True>, <Origin component:'main' archive:'xenial-security' origin:'Ubuntu' label:'Ubuntu' site:'security.ubuntu.com' isTrusted:True>])
pkg systemd is on hold
sanity check failed
pkgs that look like they should be upgraded:
Fetched 0 B in 0s (0 B/s)
fetch.run() result: 0
blacklist: []

Fixed version:
root@x-lp-1824804:~# dpkg -l unattended-upgrades | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-===================-==========================-============-===========================================
ii unattended-upgrades 1.1ubuntu1.18.04.7~16.04.3 all automatic installation of security upgrades
root@x-lp-1824804:~# unattended-upgrade --verbose --debug
Initial blacklisted packages:
Initial whitelisted packages:
Starting unattended upgrades script
Allowed origins are: o=Ubuntu,a=xenial, o=Ubuntu...

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for unattended-upgrades has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 1.5ubuntu3.18.10.4

---------------
unattended-upgrades (1.5ubuntu3.18.10.4) cosmic; urgency=medium

  * Detect changes to moved conffiles (LP: #1823872)
  * Add tests for checking conffile moves.
    Build depend on and use equivs to generate new test packages
  * Detect unchanged moved conffiles.
    When a package moves a conffile properly without any change no conffile
    prompt needs to be shown thus the package can be upgraded unattended.
    (LP: #1823872)
    - Split() conffile data to set of names only once
    - Don't parse dpkg conffile db when there are no conffiles in the package
  * Skip sending email when no package had to be installed, upgraded or removed
    (LP: #1821103) (Closes: #924554)
  * Make sure autoremovals don't start with a dirty cache and remove other
    packages (LP: #1824341)
  * Continue applying minimal sets when one set can't be marked for upgrade.
    Thanks to Anderson Luiz Alves for the patch, it needed minor modifications
    (LP: #1824341)
  * Stop raising NoAllowedOriginError when marking packages to upgrade/install
    fails (LP: #1824876)
  * Adjust only transitive dependencies in the fallback when a package from an
    allowed origin can't be marked to install/upgrade.
    This is a much lighter approach than marking every upgradable package
    because the full fallback was triggered on packages held back as well,
    using an excessive amount of CPU time.
    Also it crashed with packages not having any version in allowed origins.
    (LP: #1824804, #1824949)
    - Follow all kinds of transitive dependencies when adjusting dependencies
    - Don't crash collecting transitive dependencies when package has no
      candidate (LP: #1825886)
  * Skip trying to upgrade held packages in call_adjusted() (LP: #1824804)
  * Use mark_install_adjusted() in rewind_cache()
    The original cache had packages marked with adjustments thus rewinding
    should also do adjustments to reach the same state.
    Also not using mark_install_adjusted() crashes when apt raises error on
    held packages. (LP: #1826157)
    - test_rewind: Update test to check if adjustend rewinding took place

 -- Balint Reczey <email address hidden> Fri, 26 Apr 2019 18:55:30 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 1.1ubuntu1.18.04.11

---------------
unattended-upgrades (1.1ubuntu1.18.04.11) bionic; urgency=medium

  * Detect changes to moved conffiles (LP: #1823872)
    - Add tests for checking conffile moves.
      Build depend on and use equivs to generate new test packages
    - Split() conffile data to set of names only once
    - Don't parse dpkg conffile db when there are no conffiles in the package
  * Detect unchanged moved conffiles.
    When a package moves a conffile properly without any change no conffile
    prompt needs to be shown thus the package can be upgraded unattended.
    (LP: #1823872)
  * Skip sending email when no package had to be installed, upgraded or removed
    (LP: #1821103) (Closes: #924554)
  * Make sure autoremovals don't start with a dirty cache and remove other
    packages (LP: #1824341)
  * Continue applying minimal sets when one set can't be marked for upgrade.
    Thanks to Anderson Luiz Alves for the patch, it needed minor modifications
    (LP: #1824341)
  * Stop raising NoAllowedOriginError when marking packages to upgrade/install
    fails (LP: #1824876)
  * Adjust only transitive dependencies in the fallback when a package from an
    allowed origin can't be marked to install/upgrade.
    This is a much lighter approach than marking every upgradable package
    because the full fallback was triggered on packages held back as well,
    using an excessive amount of CPU time.
    Also it crashed with packages not having any version in allowed origins.
    (LP: #1824804, #1824949)
  * Skip trying to upgrade held packages in call_adjusted() (LP: #1824804)
  * Follow all kinds of transitive dependencies when adjusting dependencies
  * Don't crash collecting transitive dependencies when package has no candidate
    (LP: #1825886)
  * Use mark_install_adjusted() in rewind_cache()
    The original cache had packages marked with adjustments thus rewinding
    should also do adjustments to reach the same state.
    Also not using mark_install_adjusted() crashes when apt raises error on
    held packages. (LP: #1826157)
    - test_rewind: Update test to check if adjustend rewinding took place

 -- Balint Reczey <email address hidden> Mon, 29 Apr 2019 12:13:14 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 1.1ubuntu1.18.04.7~16.04.3

---------------
unattended-upgrades (1.1ubuntu1.18.04.7~16.04.3) xenial; urgency=medium

  * Detect changes to moved conffiles (LP: #1823872)
    - Add tests for checking conffile moves.
      Build depend on and use equivs to generate new test packages
    - Split() conffile data to set of names only once
    - Don't parse dpkg conffile db when there are no conffiles in the package
  * Detect unchanged moved conffiles.
    When a package moves a conffile properly without any change no conffile
    prompt needs to be shown thus the package can be upgraded unattended.
    (LP: #1823872)
  * Skip sending email when no package had to be installed, upgraded or removed
    (LP: #1821103) (Closes: #924554)
  * Make sure autoremovals don't start with a dirty cache and remove other
    packages (LP: #1824341)
  * Continue applying minimal sets when one set can't be marked for upgrade.
    Thanks to Anderson Luiz Alves for the patch, it needed minor modifications
    (LP: #1824341)
  * Stop raising NoAllowedOriginError when marking packages to upgrade/install
    fails (LP: #1824876)
  * Adjust only transitive dependencies in the fallback when a package from an
    allowed origin can't be marked to install/upgrade.
    This is a much lighter approach than marking every upgradable package
    because the full fallback was triggered on packages held back as well,
    using an excessive amount of CPU time.
    Also it crashed with packages not having any version in allowed origins.
    (LP: #1824804, #1824949)
  * Skip trying to upgrade held packages in call_adjusted() (LP: #1824804)
  * Follow all kinds of transitive dependencies when adjusting dependencies
  * Don't crash collecting transitive dependencies when package has no candidate
    (LP: #1825886)
  * Use mark_install_adjusted() in rewind_cache()
    The original cache had packages marked with adjustments thus rewinding
    should also do adjustments to reach the same state.
    Also not using mark_install_adjusted() crashes when apt raises error on
    held packages. (LP: #1826157)
    - test_rewind: Update test to check if adjustend rewinding took place
  * do_auto_remove() is successful unless a commit() operation fails
    (LP: #1795696)
  * Compare apt.package.Version objects and not the versions' string
    representation. (LP: #1820888)
    This prevented adjusting candidates when the strings sorted differently.
    Also extend tests to catch issue.
  * Fall back to adjusting more packages' candidates
    when a package from an allowed origin can't be marked to install/upgrade.
    (LP: #1821101)

 -- Balint Reczey <email address hidden> Mon, 29 Apr 2019 12:23:14 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package unattended-upgrades - 1.10ubuntu5.1

---------------
unattended-upgrades (1.10ubuntu5.1) disco; urgency=medium

  * Skip trying to upgrade held packages in call_adjusted() (LP: #1824804)
  * Follow all kinds of transitive dependencies when adjusting dependencies
    (LP: #1824804)
  * Detect unchanged moved conffiles.
    When a package moves a conffile properly without any change no conffile
    prompt needs to be shown thus the package can be upgraded unattended even
    when the conffile is changed locally. (LP: #1823872)
  * Don't crash collecting transitive dependencies when package has no candidate
    (LP: #1825886)
  * Use mark_install_adjusted() in rewind_cache()
    The original cache had packages marked with adjustments thus rewinding
    should also do adjustments to reach the same state.
    Also not using mark_install_adjusted() crashes when apt raises error on
    held packages. (LP: #1826157)
    - test_rewind: Update test to check if adjusted rewinding took place

 -- Balint Reczey <email address hidden> Fri, 26 Apr 2019 15:00:50 +0200