Jira (PUP-9564) Puppet upgrades debian packages with pending updates when setting them on hold

[Karsten Heymann (JIRA)]

Title: Message Title

Karsten Heymann created an issue   Puppet / PUP-9564 Puppet upgrades debian packages with pending updates when setting them on hold Issue Type: Bug Affects Versions: PUP 4.10.12 Assignee: Unassigned Created: 2019/03/15 5:56 AM Priority: Normal Reporter: Karsten Heymann Puppet Version: 4.10.x, probably other too Puppet Server Version: OS Name/Version: Debian 8, probably other versions too If puppet sets a package with a pending upgrade on hold (ensure=>held), the pending upgrade is installed before the package is set on hold. Describe steps to reproduce: 1. Show available versions # apt-cache policy openssl openssl: Installed: 1.0.1t-1+deb8u11 Candidate: 1.0.1t-1+deb8u11 Version table: *** 1.0.1t-1+deb8u11 0 500 http://mirror.ip-platform.net/debian-security/ jessie/updates/main amd64 Packages 100 /var/lib/dpkg/status 1.0.1t-1+deb8u8 0 500 http://mirror.ip-platform.net/debian/ jessie/main amd64 Packages    2. Downgrade package:   # puppet resource package openssl ensure=1.0.1t-1+deb8u8 Notice: /Package[openssl]/ensure: ensure changed '1.0.1t-1+deb8u11' to '1.0.1t-1+deb8u8' package { 'openssl': ensure => '1.0.1t-1+deb8u8', } 3. Set package on hold:   # puppet resource --debug package openssl ensure=held [...] Debug: Prefetching apt resources for package Debug: Executing '/usr/bin/dpkg-query -W --showformat '${Status} ${Package} ${Version}\n'' Debug: Executing: '/usr/bin/apt-get -q -y -o DPkg::Options::=--force-confold install openssl' Debug: Executing: 'dpkg --set-selections' Notice: /Package[openssl]/ensure: ensure changed '1.0.1t-1+deb8u8' to 'held' Debug: Finishing transaction 28203320 Debug: Storing state Debug: Stored state in 0.45 seconds Debug: Executing: '/usr/bin/dpkg-query -W --showformat '${Status} ${Package} ${Version}\n' openssl' package { 'openssl': ensure => '1.0.1t-1+deb8u11', } 4. Now the package has been upgraded: # apt-cache policy openssl openssl: Installed: 1.0.1t-1+deb8u11 Candidate: 1.0.1t-1+deb8u11 Version table: 1.0.2l-1~bpo8+1 0 200 http://mirror.ip-platform.net/debian/ jessie-backports/main amd64 Packages *** 1.0.1t-1+deb8u11 0 500 http://mirror.ip-platform.net/debian-security/ jessie/updates/main amd64 Packages 100 /var/lib/dpkg/status 1.0.1t-1+deb8u8 0 500 http://mirror.ip-platform.net/debian/ jessie/main amd64 Packages     Desired Behavior: The package version stays unchanged and the package is marked on-hold. Actual Behavior: The package has been upgraded and is on hold. This is counterintuitive and also not reflected by the agent output, especially as the "on hold" setting may be performed especially to prevent the pending upgrade from being installed. Probable cause: The reason this happens is the apt-get install line marked bold above. If the package already is installed, it should not happen.   Add Comment   This message was sent by Atlassian JIRA (v7.7.1#77002-sha1:e75ca93) -- You received this message because you are subscribed to the Google Groups "Puppet Bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to puppet-bugs+unsubscr...@googlegroups.com. To post to this group, send email to puppet-bugs@googlegroups.com. Visit this group at https://groups.google.com/group/puppet-bugs. For more options, visit https://groups.google.com/d/optout.