Package: apt
Severity: normal
Tags: upstream
Hello,
I am running a fresh Debian 13 (Trixie) installation on a server where I installed CloudPanel. After CloudPanel adds its own APT repository, APT starts repeatedly suggesting a “DOWNGRADING: sgml-base” operation, even though the installed version and the candidate version are identical.
This only happens when the CloudPanel repository provides a "trixie main" component. If I comment out that “main” line and keep only the PHP/nginx/varnish components, the issue disappears.
Because of that, I think this is an interaction problem between APT’s resolver and a third-party repository that declares itself as “trixie main” while also mirroring packages such as sgml-base.
I am copying CloudPanel support, since this behavior concerns both Debian and CloudPanel’s repository structure.
------------------------------------------------------------
System information
------------------------------------------------------------
- Distribution: Debian 13 (Trixie), minimal install
- APT: default version from Trixie (I can provide exact `apt --version` if needed)
- CloudPanel installed from its official installer
- MariaDB official repository enabled
- Netdata official repository enabled
The relevant APT repository configuration files are:
/etc/apt/sources.list.d/debian.sources
/etc/apt/sources.list.d/mariadb.list
/etc/apt/sources.list.d/netdata.sources
/etc/apt/sources.list.d/packages.cloudpanel.io.list
------------------------------------------------------------
Problem summary
------------------------------------------------------------
As soon as CloudPanel’s repo line
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie main
is present, running:
apt update && apt upgrade
produces:
DOWNGRADING:
sgml-base
even though `apt policy sgml-base` shows the same version from both the local Debian mirror and the CloudPanel “trixie main” repository.
This happens on a fully up-to-date system with no real pending upgrades, just this misleading “downgrade” of sgml-base.
------------------------------------------------------------
Exact commands and output
------------------------------------------------------------
1) Repository configuration (current files)
Contents of `/etc/apt/sources.list.d/debian.sources`:
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian.list
Suites: trixie trixie-updates trixie-backports
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Types: deb deb-src
URIs: mirror+file:///etc/apt/mirrors/debian-security.list
Suites: trixie-security
Components: main
Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
Contents of `/etc/apt/sources.list.d/mariadb.list`:
deb [arch=amd64,arm64]
https://mirror.mariadb.org/repo/11.8/debian trixie main
Contents of `/etc/apt/sources.list.d/netdata.sources`:
X-Repolib-Name: Netdata stable repository
Types: deb
URIs:
http://repository.netdata.cloud/repos/stable/debian/ Suites: trixie/
Signed-By: /usr/share/keyrings/netdata-archive-keyring.gpg
By-Hash: Yes
Enabled: Yes
X-Repolib-Name: Netdata repository configuration repository
Types: deb
URIs:
http://repository.netdata.cloud/repos/repoconfig/debian/ Suites: trixie/
Signed-By: /usr/share/keyrings/netdata-archive-keyring.gpg
By-Hash: Yes
Enabled: Yes
Contents of `/etc/apt/sources.list.d/packages.cloudpanel.io.list` (problematic case):
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie main
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie nginx
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.1
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.2
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.3
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.4
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.0
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.1
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.2
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.3
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.4
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.5
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie proftpd
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie varnish-7
For reference, here is the combined grep of all APT sources:
# grep -RhE '^(deb|Types:)' /etc/apt/sources.list /etc/apt/sources.list.d/
Types: deb
Types: deb
Types: deb deb-src
Types: deb deb-src
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie main
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie nginx
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.1
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.2
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.3
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-7.4
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.0
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.1
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.2
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.3
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.4
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie php-8.5
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie proftpd
deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie varnish-7
deb [arch=amd64,arm64]
https://mirror.mariadb.org/repo/11.8/debian trixie main
2) apt policy output for the affected package
# apt policy sgml-base
sgml-base:
Installed: 1.31+nmu1
Candidate: 1.31+nmu1
Version table:
*** 1.31+nmu1 500
500 mirror+file:/etc/apt/mirrors/debian.list trixie/main amd64 Packages
100 /var/lib/dpkg/status
1.31+nmu1 1000
1000
https://d17k9fuiwb52nc.cloudfront.net trixie/main amd64 Packages
Note: the same version (1.31+nmu1) is available from both Debian’s mirror and CloudPanel’s “trixie main” repository.
3) apt upgrade behavior
With the above configuration, running:
apt update && apt upgrade
produces:
DOWNGRADING:
sgml-base
Summary:
Upgrading: 0, Installing: 0, Downgrading: 1, Removing: 0, Not Upgrading: 0
Download size: 12.0 kB
Space needed: 0 B / 394 GB available
Even though “downgrading” here is only reinstalling the same version from another origin, it is misleading and keeps reappearing.
------------------------------------------------------------
What I tried and workaround
------------------------------------------------------------
If I comment out the “main” line in the CloudPanel repo:
# deb
https://d17k9fuiwb52nc.cloudfront.net/ trixie main
and keep the component-specific lines (php-*, nginx, varnish-7, proftpd), then:
apt update && apt upgrade
no longer shows any “DOWNGRADING: sgml-base” messages, and the system behaves as expected.
This suggests that the combination of:
- a local Debian mirror providing sgml-base, and
- a third-party repo declaring “trixie main” and also providing sgml-base
is triggering APT’s resolver to treat sgml-base as coming preferably from the CloudPanel repo and to present that as a “downgrade”, even though the version number is identical.
------------------------------------------------------------
What I would expect
------------------------------------------------------------
Either:
1. APT should detect that the version is identical across origins and avoid presenting it as a “downgrade” operation, or
2. At least warn more clearly that the operation is simply reinstalling the same version from another origin, not a real downgrade.
From the CloudPanel side, it might also be preferable that their repository does *not* declare itself as a full “trixie main” component if it intends only to provide PHP, nginx, varnish and related packages, to avoid overlapping with Debian base packages like sgml-base.
------------------------------------------------------------
If you need more details (exact apt version, dpkg -l, full apt logs) I can provide them.
Thank you very much for your work on Debian.
Best regards,
Olegário