Le 03/11/2018 à 04:01, David Christensen a écrit :
On 11/2/18 5:17 PM, Steve McIntyre wrote:There is a bug here, and I think it's possibly in tasksel. Mutt is not on the installation CD, and neither are its dependencies libgpgme11 and libnotmuch4. *However*, the installer has automatically added security.debian.org to the sources.list of the new system and peformed an "apt-get update". This found a security update for mutt, and mutt is Priority: standard so tasksel decided it should be installed. But the dependencies are not on security.debian.org and not on the CD --> problem.
(...)
I view the fact that the d-i couldn't obtain a security update package to be a defect in the Debian security package distribution chain. If 'apt-get update' finds that a security update package is available and the d-i wants to install that package, then 'apt-get update' must be able to download that package. Which package do I file a bug report against?
IMO, debian-installer. We cannot expect tasksel to check that all required dependencies for any selected package are available. The installer should not automatically enable the security archive without adding a normal mirror too in order to have consistent sources, even when installing from a large DVD or BD image. Also, if you install from an old image, adding only the security archive may miss security updates which have been moved to the main archive. This gives a false sense of security.