apt-get dist-upgrade keeping back some packets

[Gionatan Danti]

Hi all,
I have a question about apt-get dist-upgrade refusing to update some
packages:

root@localhost:/var/log/apt# apt-get dist-upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed
libnss-mymachines libnss-systemd libpam-systemd libpython3-dev
libpython3-stdlib libpython3.10 libpython3.10-dev libpython3.10-minimal
libpython3.10-stdlib libsystemd0 libudev1
python3 python3-dev python3-distutils python3-gdbm python3-lib2to3
python3-minimal python3-tk python3.10 python3.10-dev python3.10-minimal
systemd systemd-container systemd-sysv systemd-timesyncd udev
The following packages will be upgraded:
bind9-dnsutils bind9-host bind9-libs libpcre2-8-0 python3-oauthlib
5 upgraded, 0 newly installed, 0 to remove and 29 not upgraded.
5 standard security updates
Need to get 1,719 kB of archives.
After this operation, 3,072 B of additional disk space will be used.
Do you want to continue? [Y/n] n
Abort.

To update, I had to specify all the packages on the command line after
the dist-upgrade command (or use aptitude full-upgrade). Enabling debug
via resulted in something similar to that:

root@localhost:/etc/apt# apt-get -oDebug::pkgProblemResolver=1
-oDebug::BuildDep=1 -oDebug::pkgDepCache::AutoInstall=1
-oDebug::pkgDepCache::Marker=1 -oDebug::pkgOrderList=1
-oDebug::pkgProblemResolver::ShowScores=1 -oDebug::pkgDpkgPm=1
-opkgDPkgPm::Item=1 dist-upgrade 2>&1 | less
Calculating upgrade...Starting pkgProblemResolver with broken count: 0
Settings used to calculate pkgProblemResolver::Scores::
Required => 3
Important => 2
Standard => 1
Optional => -1
Extra => -2
Essentials => 100
InstalledAndNotObsolete => 1
Pre-Depends => 1
Depends => 1
Recommends => 1
Suggests => 0
Conflicts => -1
Breaks => -1
Replaces => 0
Obsoletes => 0
Enhances => 0
AddProtected => 10000
AddEssential => 5000
Show Scores
10539 libsystemd0:amd64 < 249.11-0ubuntu3.6 @ii pmK >
10419 python3:amd64 < 3.10.6-1~22.04 @ii pmK >
10320 libudev1:amd64 < 249.11-0ubuntu3.6 @ii pmK >
10206 python3-minimal:amd64 < 3.10.6-1~22.04 @ii pmK >
10206 libpython3-stdlib:amd64 < 3.10.6-1~22.04 @ii pmK >
10150 systemd-sysv:amd64 < 249.11-0ubuntu3.6 @ii pmK >
...

It seems to me that some package is marked as Protected. However,
running dpkg on one of these packages show no
protected/essential/important flag:

root@localhost:/var/cache# dpkg-query -Wf 'package:${Package}
arch:${Architecture} bugs:${Bugs} ess:${Essential} pri:${Priority}
pro:${Protected} imp:${Important}\n' libsystemd0
package:libsystemd0 arch:amd64 bugs: ess:no pri:optional pro:no imp:

So, why apt-get dist-upgrade refuses to upgrade? How it collect the list
of protected packages?
Thanks.

--
Danti Gionatan
Supporto Tecnico
Assyoma S.r.l. - www.assyoma.it
email: g.d...@assyoma.it - in...@assyoma.it
GPG public key ID: FF5F32A8

[Greg Wooledge]

On Fri, Sep 23, 2022 at 01:04:26AM +0200, Gionatan Danti wrote:
> root@localhost:/var/log/apt# apt-get dist-upgrade
> Reading package lists... Done
> Building dependency tree... Done
> Reading state information... Done
> Calculating upgrade... Done
> The following packages have been kept back:
> grub-efi-amd64 grub-efi-amd64-bin grub-efi-amd64-signed libnss-mymachines
> libnss-systemd libpam-systemd libpython3-dev libpython3-stdlib libpython3.10
> libpython3.10-dev libpython3.10-minimal libpython3.10-stdlib libsystemd0
> libudev1
> python3 python3-dev python3-distutils python3-gdbm python3-lib2to3
> python3-minimal python3-tk python3.10 python3.10-dev python3.10-minimal
> systemd systemd-container systemd-sysv systemd-timesyncd udev
> The following packages will be upgraded:
> bind9-dnsutils bind9-host bind9-libs libpcre2-8-0 python3-oauthlib

You've either got a Frankendebian system, or a pin. Or both.

Review your sources.list and sources.list.d/* and see if you've mixed
different branches, or different operating systems.

Or pick a package from the "kept back" list, and do an "apt-cache policy
pkgname" on it. See whether it's pinned, or has a version that's ahead
of stable, and then try to remember what you did to achieve that state.

[Peter Hillier-Brook]

I've had a similar problem in the recent past with <sudo apt upgrade>. I
resolved it by running Synaptic, which solved the issue with no reported
errors.

I'm running pure Bullseye with no manually pinned packages.

Peter HB

[Gionatan Danti]

On Thu, 22 Sep 2022 19:33:20 -0400 Greg Wooledge wrote:
> You've either got a Frankendebian system, or a pin. Or both.

> Review your sources.list and sources.list.d/* and see if you've mixed
> different branches, or different operating systems.

> Or pick a package from the "kept back" list, and do an "apt-cache
> policy
> pkgname" on it. See whether it's pinned, or has a version that's ahead
> of stable, and then try to remember what you did to achieve that state.

It was my thinking as well, but no source.list changes on this system,
no pinning, no apt-mark. Nothing.

Using libsystemd0 as an example, apt-cache policy shown the installed
packages with score 100, and an available update with score 500. Still,
the update was not installed until I manually specified the package on
the apt-get dist-upgrade command line.

Full disclosure: this specific system is an Ubuntu installation. I wrote
here because the issue seems with how apt-get identifies protected
packages, rather than distro-related.

On Fri, 23 Sep 2022 01:48:38 +0100, Peter Hillier-Brook

> I've had a similar problem in the recent past with <sudo apt upgrade>.
> I resolved it by running Synaptic, which solved the issue with no
> reported errors.
> I'm running pure Bullseye with no manually pinned packages.

Yep, the issue seems confined to apt-get: issuing aptitude full-upgrade
worked flawlessy.

Regards.

[Gionatan Danti]

On Fri, 23 Sep 2022 07:51:15 +0200 Gionatan Danti wrote:

> Using libsystemd0 as an example, apt-cache policy shown the installed
> packages
> with score 100, and an available update with score 500. Still, the
> update was
> not installed until I manually specified the package on the
> apt-get dist-upgrade command line.

Ok, I went to the bottom: it was due to phased updates not selecting my
machine for applying the update. Disabling it via -o
APT::Get::Always-Include-Phased-Updates=1 force apt-get dist-upgrade to
update anything.

I hope this can be useful for others.
Thanks.