• Bug#1109515: Bug#1109655: Bug#1109513: Likely golang-github-golang-prot

    From Jochen Sprickerhof@21:1/5 to All on Tue Jul 29 15:50:01 2025
    * Reinhard Tartler <[email protected]> [2025-07-29 06:31]:
    I did a slight variation: First I started with:

    PKG=golang-github-denverdino-aliyungo-dev; mmdebstrap \
    --chrooted-customize-hook="set -x ; apt -y install $PKG && sed -e
    s/bookworm/trixie/ -i /etc/apt/sources.list && apt update" \
    --chrooted-customize-hook=bash bookworm /dev/null


    Then I copied the resulting deb files into /tmp/mmdebstrap.*/packages

    And added the following to /tmp/mmdebstrap.*/etc/apt/sources.list:

    deb [trusted=true] file:///packages ./


    Also, inside the chroot I created the necessary index files with:

    apt-ftparchive packages . > Packages
    apt-ftparchive release . > Release

    Then, after an `apt-get update && apt-get dist-upgrade`, I didn't end up
    with held back packages:

    root@x1:/packages# apt update
    Get:1 file:/packages ./ InRelease
    Ign:1 file:/packages ./ InRelease
    Get:2 file:/packages ./ Release [816 B]
    Get:2 file:/packages ./ Release [816 B]
    Get:3 file:/packages ./ Release.gpg
    Ign:3 file:/packages ./ Release.gpg
    Get:4 file:/packages ./ Packages [3385 B]
    Hit:5 http://security.debian.org/debian-security trixie-security InRelease >Hit:6 http://deb.debian.org/debian trixie InRelease
    Hit:7 http://deb.debian.org/debian trixie-updates InRelease
    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    159 packages can be upgraded. Run 'apt list --upgradable' to see them. >root@x1:/packages# apt dist-upgrade
    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    Calculating upgrade... Done
    The following packages were automatically installed and are no longer >required:
    libapt-pkg6.0 libargon2-1 libc-dev-bin libc6-dev libcrypt-dev libgnutls30
    libnsl-dev libnsl2
    libprotobuf-dev libprotobuf-lite32t64 libprotobuf32t64 libprotoc32t64
    libtasn1-6 libtirpc-dev libunistring2
    linux-libc-dev protobuf-compiler protoc-gen-go-1-3 rpcsvc-proto zlib1g-dev
    Use 'apt autoremove' to remove them.
    The following packages will be REMOVED:
    golang-github-golang-protobuf-1-3-dev golang-goprotobuf-dev libdb5.3
    libelf1 libext2fs2 libgdbm-compat4
    libgdbm6 libhogweed6 libnettle8 libprotobuf-lite32 libprotobuf32
    libprotoc32 libreadline8 libssl3 libtirpc3
    The following NEW packages will be installed:
    gcc-14-base golang-github-golang-protobuf-1-5-dev
    golang-github-google-go-cmp-dev
    golang-google-protobuf-dev libapt-pkg7.0 libdb5.3t64 libelf1t64
    libext2fs2t64 libgdbm-compat4t64
    libgdbm6t64 libhogweed6t64 liblastlog2-2 libnettle8t64 libperl5.40
    libprotobuf-lite32t64 libprotobuf32t64
    libprotoc32t64 libreadline8t64 libsqlite3-0 libssl3t64 libtirpc3t64
    libunistring5 login.defs
    openssl-provider-legacy perl-modules-5.40 sqv
    The following packages will be upgraded:
    adduser apt apt-utils base-files base-passwd bash bsdutils coreutils cpio
    cron cron-daemon-common dash
    debconf debconf-i18n debian-archive-keyring debianutils diffutils
    dmidecode dmsetup dpkg e2fsprogs fdisk
    findutils gcc-12-base golang-github-denverdino-aliyungo-dev gpgv grep
    gzip hostname ifupdown init
    init-system-helpers iproute2 iputils-ping isc-dhcp-client isc-dhcp-common
    kmod less libacl1 libapparmor1
    libargon2-1 libattr1 libaudit-common libaudit1 libblkid1 libbpf1 libbsd0
    libbz2-1.0 libc-bin libc-dev-bin
    libc6 libc6-dev libcap-ng0 libcap2 libcap2-bin libcom-err2 libcrypt-dev
    libcrypt1 libcryptsetup12
    libdebconfclient0 libdevmapper1.02.1 libedit2 libfdisk1 libffi8
    libfile-find-rule-perl libgcc-s1
    libgcrypt20 libgmp10 libgpg-error0 libgssapi-krb5-2 libidn2-0 libip4tc2
    libjansson4 libjson-c5 libk5crypto3
    libkeyutils1 libkmod2 libkrb5-3 libkrb5support0 liblocale-gettext-perl
    liblz4-1 liblzma5 libmd0 libmnl0
    libmount1 libncursesw6 libnewt0.52 libnftables1 libnftnl11 libnsl-dev
    libnsl2 libp11-kit0 libpam-modules
    libpam-modules-bin libpam-runtime libpam0g libpcre2-8-0 libpopt0
    libproc2-0 libprotobuf-dev libseccomp2
    libselinux1 libsemanage-common libsemanage2 libsepol2 libslang2
    libsmartcols1 libss2 libstdc++6
    libsystemd-shared libsystemd0 libtasn1-6 libtext-charwidth-perl
    libtext-iconv-perl libtinfo6
    libtirpc-common libtirpc-dev libudev1 libuuid1 libxtables12 libxxhash0
    libzstd1 linux-libc-dev login
    logrotate logsave mawk mount nano ncurses-base ncurses-bin netbase
    nftables passwd perl perl-base procps
    protobuf-compiler protoc-gen-go-1-3 readline-common sed sensible-utils
    systemd systemd-sysv sysvinit-utils
    tar tasksel tasksel-data tzdata udev usrmerge util-linux util-linux-extra
    vim-common vim-tiny whiptail
    zlib1g zlib1g-dev
    158 upgraded, 26 newly installed, 15 to remove and 0 not upgraded.
    Need to get 73.1 MB/73.3 MB of archives.
    After this operation, 89.1 MB of additional disk space will be used.
    Do you want to continue? [Y/n]

    I believe this is a more realistic test than patching the apt internal
    files, as I don't
    claim to be an expert on apt internals at all

    I failed to reproduce this. I did:

    gbp clone vcsgit:golang-github-golang-protobuf-1-5
    cd golang-github-golang-protobuf-1-5/
    dch -i '' -D unstable
    git deborig
    sbuild
    cd ..
    mmdebstrap --customize-hook='copy-in \
    golang-github-golang-protobuf-1-5-dev_1.5.4-1.1_all.deb \
    protoc-gen-go-1-5_1.5.4-1.1_amd64.deb /opt' \
    --chrooted-customize-hook="set -x ; apt -y install \
    golang-github-denverdino-aliyungo-dev apt-utils && cd /opt && \
    apt-ftparchive packages . > Packages && \
    apt-ftparchive release . > Release && \
    echo 'deb [trusted=true] file:///opt ./' >> /etc/apt/sources.list && \
    sed -e s/bookworm/trixie/ -i /etc/apt/sources.list && \
    apt update && apt dist-upgrade" bookworm /dev/null

    And I still get:

    The following packages have been kept back:
    golang-github-denverdino-aliyungo-dev

    Can you please verify?

    Cheers Jochen

    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEc7KZy9TurdzAF+h6W//cwljmlDMFAmiIzrMACgkQW//cwljm lDMA+Q/9HuaFJRf2NnAHKxzADVXEL5GWr0trY6/zbIzsJ4eglHdMcDHuMzsHAUnB UaMX2VCLb04GS391cct8gXJCv9kyYwyNhFy1avFG7vb/DemrIms5xoNY3EqvhRcZ yw0YZWrxzKyLpKtnhFw88SQ/FOCVjMS8BDZSuRg02CUNMwDapSt2quVn9PF0gYwH wmiKNEbp22r3Hrx+KtTfyOvwi6pqwW5AY2xuAvFJRWhSiwIaEW1lLhZ0pPnrdcG4 M3H+BVy3XbuEA3yJL6oDPPxfa+vW0mwZW/WxSrzZHvsyxkKTdaV89wbfGM0N6fxF VZFGmoAOB6MZICiXOpZRj5yK0OoTOCS/3pQXNKETwqe0ONGW6IFLlONSfwFmB8qv BSsNaXRDsvv6g+9JE3FzAnXuu7cz+FEPDVzAJN64+qBZ4xHJfDrcQashMExJnoK/ 1lifcM9nXIPROuaa7T3uOAgV+Xq43XNlB8O/AUq9S2nuFc+FOP8FICVyLrD7HSsZ 662u5FiCvlobPxmSiI2GrGueLjcQ8pZfnRtQtC5pkUlaCTX9r4jCjAxR+M86VDu4 TdzvxVpmD16yf+qASAM17BwOjG4cM7P2mXO5LBywcN7xne4CYxvOIty/zaoESHmx 6eM+7kgwXPWsY/FCE3GC2wTfGC4GnL702vJBmTXdIOKkoAS4AzA=
    =K+kY
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)