Devuan bug report logs - #294
task-kde-desktop silently pulls in unattended-upgrades

Full log

Message #5 received at submit@bugs.devuan.org (full text, mbox, reply):

Received: (at submit) by bugs.devuan.org; 17 Feb 2019 11:30:03 +0000
Return-Path: <olaf@ueda.ne.jp>
Delivered-To: devuanbugs@dyne.org
Received: from tupac3.dyne.org [195.169.149.119]
	by fulcanelli with IMAP (fetchmail-6.3.26)
	for <debbugs@localhost> (single-drop); Sun, 17 Feb 2019 12:30:03 +0100 (CET)
Received: from mo-sw.mose-mail.jp (mo-sw1505-0.mose-mail.jp [210.130.202.8])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by vm6.ganeti.dyne.org (Postfix) with ESMTPS id 39723F60927
	for <submit@bugs.devuan.org>; Sun, 17 Feb 2019 12:24:00 +0100 (CET)
Received: by mo-sw.mose-mail.jp (mose-mo-sw1505) id x1HBNvM1013181; Sun, 17 Feb 2019 20:23:57 +0900
Received: from quark (localhost [127.0.0.1])
	by mbox.mose-mail.jp (mose-mbox1510) id x1HBNoQc027422
	for <submit@bugs.devuan.org>; Sun, 17 Feb 2019 20:23:50 +0900
Received: from olaf (uid 1000)
	(envelope-from olaf@ueda.ne.jp)
	id 18172e
	by quark (DragonFly Mail Agent v0.11);
	Sun, 17 Feb 2019 20:23:49 +0900
User-agent: mu4e 0.9.18; emacs 25.1.1
From: Olaf Meeuwissen <paddy-hack@member.fsf.org>
To: submit@bugs.devuan.org
Subject: task-kde-desktop silently pulls in unattended-upgrades
Date: Sun, 17 Feb 2019 20:23:48 +0900
Message-ID: <87h8d2slob.fsf@member.fsf.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="=-=-="

[Message part 1 (text/plain, inline)]

Package: tasksel
Version: 3.48+devuan1

This came up on the mailing list[1] and Katolaz asked if I could submit
a bug report against this package so it would not be forgotten.

 [1]: https://lists.dyne.org/lurker/thread/20190214.170424.6845e4be.en.html

The general consensus on the mailing list was that unattended-upgrades
should not "slip in a standard Devuan install unnoticed".

On the mailing list I provided details based on ASCII but I figured it
would be more useful to look at beowulf.  The following is based on an
up-to-date (2019-02-17) Docker image[2].

 [2]: docker pull registry.gitlab.com/paddy-hack/devuan/slim:beowulf

First off, I must say that the approach I used on the mailing list is
flawed.  It does not handle the case of alternatives correctly as it
chases down dependency relations for *all* listed alternatives.  This
leads to false positives.

# All desktop tasks listed all desktop tasks as their dependencies in
# the case Recommends: are allowed :-/

So I followed a slightly different approach and did dry-run installs in
my devuan/slim:beowulf Docker image.

After installing tasksel, I ran

  tasksel --list-tasks \
    | awk '$2 ~ /desktop/ { print $2 }' \
    | while read task; do
        package=$(tasksel --task-packages $task)
        apt-get --dry-run install --install-recommends \
                $package > $package.install-recommends-dry-run
      done
  grep -l unattended-upgrades *.install-recommends-dry-run

That yielded

  task-kde-desktop.install-recommends-dry-run

So the KDE desktop task is the only supported Devuan desktop tasks that
would "slip in unattended-upgrades unnoticed".

I've attached the output of

  apt-cache depends --recurse --no-suggests --no-conflicts --no-breaks \
            --no-enhances --no-replaces task-kde-desktop

so you check for yourself but unattended-upgrades gets pulled in via a
rather complex dependency chain that may not be easy to break :-/

# Much, much more so with beowulf than in ascii.

I think the easiest way to get out of this "mess" is to downgrade the
dependency on unattended-upgrades from a Recommends: to a Suggests: in
python3-software-properties.

Hope this helps,
--
Olaf Meeuwissen, LPIC-2            FSF Associate Member since 2004-01-27
 GnuPG key: F84A2DD9/B3C0 2F47 EA19 64F4 9F13  F43E B8A4 A88A F84A 2DD9
 Support Free Software                        https://my.fsf.org/donate
 Join the Free Software Foundation              https://my.fsf.org/join

[task-kde-desktop.depends (text/plain, attachment)]

Send a report that this bug log contains spam.