Skip to content

prevent 3007 from installing ever #619

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

prevent 3007 from installing ever #619

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions salt/base/salt.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,10 @@ salt-pin-config:
Package: salt-*
Pin: version 3006.*
Pin-Priority: 1001
Package: salt-*
Pin: version 3007.*
Pin-Priority: -10
Copy link
Member

@ewdurbin ewdurbin Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3007.* already has a lower priority, I believe this was due to unattended-upgrades ignoring pinning. my best guess is that the 3007 release that was picked up came through a security channel and pinning was bypasses.

Copy link
Member

@ewdurbin ewdurbin Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

psf-salt/salt/unattended-upgrades/config/50unattended-upgrades

Line 2 in d0a8c67

Unattended-Upgrade::Allowed-Origins {
Is probably where we need to include all origins so that they are taken into account together when selecting packages for unattended upgrades

Copy link
Member Author

@JacobCoffee JacobCoffee Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I figured it had lower priority but i was interpreting the man page of https://manpages.ubuntu.com/manpages/focal/man5/apt_preferences.5.html

P < 0
prevents the version from being installed

to mean that it will actually go beyond priority and just outright block/say no to installing any 3007.* thing

Copy link
Member Author

@JacobCoffee JacobCoffee Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

came through a security channel and pinning was bypasses.

is there any way to prevent that 😅

Copy link
Member Author

@JacobCoffee JacobCoffee Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe apt-mark hold but then we'd have to manually update :\

Copy link
Member

@ewdurbin ewdurbin Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://askubuntu.com/questions/1515902/how-to-get-unattended-upgrade-to-obey-apt-pinned-packages Seems to indicate this is known behavior/bug in unattended upgrades and offers a solution

- user: root
- group: root
- mode: "0644"
Expand Down