Bug#935910: apt: Should be less tolerant of dpkg errors when forcing removal

[Mark Hindley <mark@hindley.org.uk>]

Package: apt
Version: 1.8.3
Severity: important

Dear apt maintainers,

This report is a result of my investigation of #934491 which shows that when
trying to migrate a sid install from systemd to sysvinit and elogind by the most
obvious route it is possible to break the system in a way that is difficult to
recover with the fairly simple command:

 apt install libpam-elogind sysvinit-core

I think the root cause of the issue is the way apt invokes dpkg when forcing
removals which is not sufficiently responsive to errors.

In this case apt's dpkg commands are:

 echo 'libpam-systemd:amd64 deinstall' | /usr/bin/dpkg --set-selections 
 echo 'systemd-sysv:amd64 deinstall' | /usr/bin/dpkg --set-selections 
 echo 'systemd:amd64 deinstall' | /usr/bin/dpkg --set-selections 
 echo 'libsystemd0:amd64 deinstall' | /usr/bin/dpkg --set-selections 
 /usr/bin/dpkg --status-fd 18 --no-triggers --force-depends --remove libpam-systemd:amd64 
 /usr/bin/dpkg --status-fd 18 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/libpam-elogind_241.3-1+debian1_amd64.deb 
 /usr/bin/dpkg --status-fd 18 --no-triggers --force-depends --remove systemd-sysv:amd64 
 /usr/bin/dpkg --status-fd 18 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/sysvinit-core_2.96~beta-1_amd64.deb 
 /usr/bin/dpkg --status-fd 18 --no-triggers --force-depends --remove systemd:amd64 libsystemd0:amd64 
   ^^^ The line above causes the problem ^^^
 /usr/bin/dpkg --status-fd 18 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/libelogind0_241.3-1+debian1_amd64.deb 
 /usr/bin/dpkg --status-fd 18 --no-triggers --configure libelogind0:amd64 
 /usr/bin/dpkg --status-fd 18 --no-triggers --unpack --auto-deconfigure /var/cache/apt/archives/elogind_241.3-1+debian1_amd64.deb 
 /usr/bin/dpkg --status-fd 18 --configure --pending 

The problem is caused by the invocation forcing the removal of systemd and
libsystemd0. If systemd is pid 1 then its prerm will fail to prevent
removal. However, dpkg still continues to remove libsystemd0 as requested
*before* exiting and signalling an error. apt then stops in response to the dpkg
error. The system is then broken as there is no libsystemd.so.0 installed which
apt itself requires.

My solution is to invoke dpkg with --abort-after=1.  The command line

 apt install -o DPkg::Options::="--abort-after=1" install libpam-elogind sysvinit-core

no longer breaks a sid systemd system. This means that dpkg exits immediately
after the systemd prerm fails and libsystemd0 remains installed. The
dependencies can then be fixed with apt.

I suggest that --abort-after=1 should be apt's default when forcing package
removal.

Thanks

Mark