Package: apt
Severity: normal
Tags: upstream
Hello,
I am running a fresh Debian 13 (Trixie) installation on a server where I
installed CloudPanel. After CloudPanel adds its own APT repository, APT
starts repeatedly suggesting a “DOWNGRADING: sgml-base” operation, even
though the installed version and the candidate version are identical.
This only happens when the CloudPanel repository provides a "trixie main"
component. If I comment out that “main” line and keep only the
PHP/nginx/varnish components, the issue disappears.
Because of that, I think this is an interaction problem between APT’s
resolver and a third-party repository that declares itself as “trixie main”
while also mirroring packages such as sgml-base.
I am copying CloudPanel support, since this behavior concerns both Debian
and CloudPanel’s repository structure.
------------------------------------------------------------
System information
------------------------------------------------------------
- Distribution: Debian 13 (Trixie), minimal install
- APT: default version from Trixie (I can provide exact `apt --version` if
needed)
- CloudPanel installed from its official installer
- MariaDB official repository enabled
- Netdata official repository enabled
The relevant APT repository configuration files are:
/etc/apt/sources.list.d/debian.sources
/etc/apt/sources.list.d/mariadb.list
/etc/apt/sources.list.d/netdata.sources
/etc/apt/sources.list.d/packages.cloudpanel.io.list
------------------------------------------------------------
Problem summary
------------------------------------------------------------
As soon as CloudPanel’s repo line
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie main
is present, running:
apt update && apt upgrade
produces:
DOWNGRADING:
sgml-base
even though `apt policy sgml-base` shows the same version from both the
local Debian mirror and the CloudPanel “trixie main” repository.
This happens on a fully up-to-date system with no real pending upgrades,
just this misleading “downgrade” of sgml-base.
------------------------------------------------------------
Exact commands and output
------------------------------------------------------------
1) Repository configuration (current files)
Contents of `/etc/apt/sources.list.d/debian.sources`:
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian.list
Suites: trixie trixie-updates trixie-backports
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian-security.list
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Contents of `/etc/apt/sources.list.d/mariadb.list`:
deb [arch=amd64,arm64] https://mirror.mariadb.org/repo/11.8/debian
trixie main
Contents of `/etc/apt/sources.list.d/netdata.sources`:
X-Repolib-Name: Netdata stable repository
Types: deb
URIs: http://repository.netdata.cloud/repos/stable/debian/
Suites: trixie/
Signed-By: /usr/share/keyrings/netdata-archive-keyring.gpg
By-Hash: Yes
Enabled: Yes
X-Repolib-Name: Netdata repository configuration repository
Types: deb
URIs: http://repository.netdata.cloud/repos/repoconfig/debian/
Suites: trixie/
Signed-By: /usr/share/keyrings/netdata-archive-keyring.gpg
By-Hash: Yes
Enabled: Yes
Contents of `/etc/apt/sources.list.d/packages.cloudpanel.io.list`
(problematic case):
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie main
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie nginx
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.1
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.2
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.3
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.4
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.0
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.1
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.2
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.3
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.4
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.5
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie proftpd
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie varnish-7
For reference, here is the combined grep of all APT sources:
# grep -RhE '^(deb|Types:)' /etc/apt/sources.list
/etc/apt/sources.list.d/
Types: deb
Types: deb
Types: deb deb-src
Types: deb deb-src
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie main
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie nginx
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.1
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.2
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.3
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.4
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.0
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.1
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.2
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.3
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.4
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.5
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie proftpd
deb https://d17k9fuiwb52nc.cloudfront.net/ trixie varnish-7
deb [arch=amd64,arm64] https://mirror.mariadb.org/repo/11.8/debian
trixie main
2) apt policy output for the affected package
# apt policy sgml-base
sgml-base:
Installed: 1.31+nmu1
Candidate: 1.31+nmu1
Version table:
*** 1.31+nmu1 500
500 mirror+file:/etc/apt/mirrors/debian.list trixie/main amd64
Packages
100 /var/lib/dpkg/status
1.31+nmu1 1000
1000 https://d17k9fuiwb52nc.cloudfront.net trixie/main amd64
Packages
Note: the same version (1.31+nmu1) is available from both Debian’s mirror
and CloudPanel’s “trixie main” repository.
3) apt upgrade behavior
With the above configuration, running:
apt update && apt upgrade
produces:
DOWNGRADING:
sgml-base
Summary:
Upgrading: 0, Installing: 0, Downgrading: 1, Removing: 0, Not
Upgrading: 0
Download size: 12.0 kB
Space needed: 0 B / 394 GB available
Even though “downgrading” here is only reinstalling the same version from
another origin, it is misleading and keeps reappearing.
------------------------------------------------------------
What I tried and workaround
------------------------------------------------------------
If I comment out the “main” line in the CloudPanel repo:
# deb https://d17k9fuiwb52nc.cloudfront.net/ trixie main
and keep the component-specific lines (php-*, nginx, varnish-7, proftpd),
then:
apt update && apt upgrade
no longer shows any “DOWNGRADING: sgml-base” messages, and the system
behaves as expected.
This suggests that the combination of:
- a local Debian mirror providing sgml-base, and
- a third-party repo declaring “trixie main” and also providing sgml-base
is triggering APT’s resolver to treat sgml-base as coming preferably from
the CloudPanel repo and to present that as a “downgrade”, even though the
version number is identical.
------------------------------------------------------------
What I would expect
------------------------------------------------------------
Either:
1. APT should detect that the version is identical across origins and avoid
presenting it as a “downgrade” operation, or
2. At least warn more clearly that the operation is simply reinstalling the
same version from another origin, not a real downgrade.
>From the CloudPanel side, it might also be preferable that their repository
does *not* declare itself as a full “trixie main” component if it intends
only to provide PHP, nginx, varnish and related packages, to avoid
overlapping with Debian base packages like sgml-base.
------------------------------------------------------------
If you need more details (exact apt version, dpkg -l, full apt logs) I can
provide them.
Thank you very much for your work on Debian.
Best regards,
Olegário
