apt-pinning: how to avoid installing of all-new packages?

[Adrian Zaugg <adi@ente.limmat.ch>]

Dear list

How do I prevent apt in a mixed stable/testing environment from 
installing packages that first time appear in testing using apt-pinning?

Right now gcc-4.4-base would get installed on a mixed system by apt-get 
upgrade, since it does arrange well with all required libraries found in 
stable. It depends furthermore on libk5crypto3, which isn't in stable 
neither, libk5crypto3's dependencies are fullfilled aswell. Once 
installed you run into the bug #566988, which means apache, postgresql, 
ssh, ... do not run anymore. Until this bug has been fixed I want to 
prevent apt from installing packages from testing, that are not found in 
stable, except such, that I mention explicitly in /etc/apt/preferences. 
How can this be achieved?


Thank you, Adrian.


PS: If you see the error:
relocation error: /usr/lib/libkrb5.so.3: symbol krb5_hmac, version 
k5crypto_3_MIT not defined in file libk5crypto.so.3 with link time reference
you were hit by the above mentioned bug. To solve, do the following:

	apt-get remove --purge libk5crypto3

(You may need to purge others for hygienic reasons.) Then

	apt-get install --reinstall libkrb53

...and finally prevent apt from reinstalling libk5crypto3. How? Read the 
answers...