[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1041708: apt: Manpages have wrong advice on APT::Default-Release preventing security updates



On Fri, Aug 18, 2023 at 11:24:22AM +0200, Raphael Hertzog wrote:
> > > As you may have noticed, the 'stable' doesn't include 'stable-updates'
> > > either and that isn't new – and also part of the reason for this funny
> > > regex. I was surprised then I discovered that entry the first time in
> > > the release notes as we were never asked about it.
> > 
> > Looking at the apt.conf and apt_preference manpages there is still no
> > mention of the regex support, perhaps this should be documented there?
> 
> Agreed. It would be nice to document that we can use regex here and
> that it actually makes sense to do so as most Debian release are actually
> composed of multiple repositories.

The problem is that regex is NOT supported at the moment.
It happens to work in most commands, but it e.g. doesn't in 'source'.

Before we could (leaving alone the question if we should) document it
as supported, we would need to check all commands and fix those which do
not work with it. Nobody did in the last couple of years.

So the only reasonable solution for this request so far is to document
it explicitly as not supported… which helps exactly nobody.


To quote myself from this very thread:
| Anyway, easiest way to not have these problems is to not use the option
| at all.


Step back and question why you want to use the option. There are
probably easier and simpler ways. Adding backports e.g. doesn't need
pinning at all (it comes by default with 100). Adding unstable to stable
might be a bad idea to begin with, but is certainly better dealt with
a pin against unstable rather than trying to catch all your "good"
"stable" repos in a regex to filter out the one bad "unstable" apple.


In preferences the regex actually works and is documented, which is the
deeper reason behind APT::Default-Release working with regex or not as
certain commands can rely on the preferences infrastructure while
a command like 'source' can currently not and hence implements it
differently without support for a lot of things possible elsewhere.


If you can come up with a list of use cases for that option (personally,
I don't see a good one) without too much by-catch we might be able to
implement a transition notice like I did for non-free-firmware.
Too late, too little, but at least it would prevent future misuse.


Best regards

David Kalnischkies

Attachment: signature.asc
Description: PGP signature


Reply to: