fix(install): detect VERSION_CODENAME for kernel backport defaults#80
Conversation
ANYSCAN_KERNEL_BACKPORT_SUITE defaulted to bookworm-backports regardless of host. On the current Debian 13 (Trixie) AMI this means bookworm-backports/linux-image-cloud-amd64 resolves to 6.12.74 — the same kernel the metal already runs — so the opt-in completes "0 upgraded, 0 newly installed" and the operator gets a false green light without ever upgrading. Detect /etc/os-release VERSION_CODENAME and default the suite to <codename>-backports. Switch the default package to linux-image-amd64 (NOT linux-image-cloud-amd64) on non-bookworm suites, because trixie-backports cloud-amd64 is still 6.12 as of 2026-04 — only the non-cloud image jumps to 6.19. Operator-set ANYSCAN_KERNEL_BACKPORT_SUITE / _PACKAGE / _SOURCES_LIST still win — detection is just a smarter default. Source-list path is also derived from the resolved suite so the file matches. ANYSCAN_OS_RELEASE_FILE env override added so the test suite can inject a synthetic os-release without touching /etc/os-release on the test host. See PR #65 issuecomment-4338158487 (anygpt-48 c6in.metal bench) for the kernel-resolution trace.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e09c5159fc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| local codename="" | ||
| if [ -r "$release_file" ]; then | ||
| # shellcheck source=/dev/null | ||
| codename="$(. "$release_file" 2>/dev/null && printf '%s\n' "${VERSION_CODENAME:-}")" |
There was a problem hiding this comment.
detect_debian_codename() executes . "$release_file" where release_file is controllable via ANYSCAN_OS_RELEASE_FILE; this means arbitrary shell in that file will run as part of script startup (often as root), even when kernel backport install is disabled. Because this commit introduced the env override specifically for tests, a malformed or attacker-controlled file can now trigger command execution or early exits in production invocations that inherit environment variables. Read VERSION_CODENAME as data (e.g., grep/awk) rather than sourcing the file.
Useful? React with 👍 / 👎.
1 participant
Summary
ANYSCAN_KERNEL_BACKPORT_SUITEdefaulted tobookworm-backportsregardless of host. On the current Debian 13 (Trixie) AMI this meansbookworm-backports/linux-image-cloud-amd64resolves to6.12.74-2~bpo12+1— exactly the kernel the metal already runs — so the opt-in completes "0 upgraded, 0 newly installed" and the operator gets a false green light without ever upgrading.Source: PR #65 issuecomment-4338158487 (anygpt-48):
What changed
install-external-deps.sh— newdetect_debian_codename()helper reads/etc/os-release'sVERSION_CODENAME. Default suite is<codename>-backports. On non-bookworm suites the default package switches tolinux-image-amd64(NOTlinux-image-cloud-amd64— the cloud image intrixie-backportsis still 6.12 as of 2026-04). Sources-list path also follows the resolved suite (anyscan-<suite>.list).ANYSCAN_OS_RELEASE_FILEenv override added so the test suite can inject a synthetic os-release without touching/etc/os-releaseon the test host.ANYSCAN_KERNEL_BACKPORT_SUITE/_PACKAGE/_SOURCES_LISTstill win.Resolution per host
bookworm(Debian 12)bookworm-backportslinux-image-cloud-amd64anyscan-bookworm-backports.listtrixie(Debian 13, current AMI)trixie-backportslinux-image-amd64anyscan-trixie-backports.listbookworm-backportslinux-image-cloud-amd64Test plan
bash tools/test-install-external-deps-kernel-backport.sh→ 30 assertions pass (18 existing cases 1-4 still green with the legacy bookworm pin, 12 new assertions in cases 5-6 covering codename auto-detection)apt-get install -t trixie-backports linux-image-amd64, sources-list atanyscan-trixie-backports.list, no bookworm artifacts createdbookworm-backports / linux-image-cloud-amd64🤖 Generated with Claude Code