Skip to content

Commit 1b2051b

Browse files
tjjh89017c-po
andcommitted
openssl: T9083: fix APT detected package downgrade despite identical versions
VyOS rolling APT repo (packages.vyos.net/repositories/rolling) publishing its own openssl/libssl3 packages, pinned at priority 600 (higher than Debian's 500) causes a "poisoning" of the APT cache policy inside the chroot: openssl: Installed: 3.0.20-1~deb12u2 Candidate: 3.0.20-1~deb12u2 Version table: * 3.0.20-1~deb12u2 500 <- debian bookworm + bookworm-security * 3.0.20-1~deb12u2 600 <- packages.vyos.net rolling (same version string, higher pin) * 3.0.17-1~deb12u2 500 <- bookworm-updates This results in APT seeing a version-string tie between Debian's build and the VyOS repo build of the same package and, because of the pin-priority swap, classifies switching to the VyOS repo copy as a "downgrade". This is fixed by appending a clear VyOS related marked to the package version, preventing any possible downgrade detection. Signed-off-by: Date Huang <tjjh89017@hotmail.com> Co-authored-by: Christian Breunig <christian@breunig.cc>
1 parent 5e2e9a3 commit 1b2051b

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

scripts/package-build/openssl/package.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@
22
name = "openssl"
33
commit_id = "debian/openssl-3.0.20-1_deb12u2"
44
scm_url = "https://salsa.debian.org/debian/openssl.git"
5-
build_cmd = "dpkg-buildpackage -us -uc -tc -b"
5+
build_cmd = "sed -i '1s/)/+vyos1)/' debian/changelog && dpkg-buildpackage -us -uc -tc -b"

0 commit comments

Comments
 (0)