Bug#440242: apt-get dist-upgrade removed xlock

[Zefram <zefram@fysh.org>]

Package: apt
Severity: important

I have cron-apt invoking apt-get dist-upgrade nightly  My
/etc/apt/sources.list references the `stable' distribution only.
Two weeks ago the nightly upgrade picked up the switch to etch.  In the
course of this upgrade it removed the xlockmore package, breaking my X
environment which uses the xlock program.  The xlockmore maintainer has
explained that that package is not available in etch; presumably this
is why apt-get decided to remove it.

I believe it is a bug for apt-get to have removed a selected package for
which there was no replacement package.  (Had I not noticed that xlock
failed to invoke, I might have left my X desktop unlocked, so I considered
flagging this as a security bug.)  I would not object to the xlockmore
package being removed in favour of some superseding package that provides
xlock in its place, but in this case there was no replacement.  It seems
to me that this is a failure to keep the `stable' distribution stable.

My /etc/apt/sources.list is

deb http://ftp.uk.debian.org/debian/ stable main
deb-src http://ftp.uk.debian.org/debian/ stable main
deb http://security.debian.org/ stable/updates main

The cron-apt output for the etch upgrade begins thus:

CRON-APT RUN [/etc/cron-apt/config]: Fri Aug 17 04:00:01 UTC 2007
CRON-APT SLEEP: 481, Fri Aug 17 04:08:02 UTC 2007
CRON-APT ACTION: 3-download
CRON-APT LINE: dist-upgrade -y -o APT::Get::Show-Upgraded=true
Reading Package Lists...
Building Dependency Tree...
The following packages will be REMOVED:
  base-config gcj-3.3 gcj-3.4 lbxproxy libdps1 libgcj5-dev libgmp3 libmodplug0
  libnewt0.51 libxft1 netkit-inetd ntp-server proxymngr xfree86-common xfwp
  xlibs xlockmore xserver-common
The following NEW packages will be installed:
  busybox cpp-4.1 cupsys-common debian-archive-keyring dmidecode dpkg-dev

I note that this lists several packages being removed, among them
xlockmore.  I was under the impression that I was using most of these
packages, but evidently (with the exception of xlockmore) they have been
suitably replaced.  For example, I run ntpd, which presumably used to
involve the ntp-server package, but now appears to be supplied by the
ntp package.

-zefram