Bug#915109: apt upgrade needs limit or date cap

[Roland Hughes]

Package: apt
Version: apt 1.0.1ubuntu2 for amd64 compiled on Apr 12 2018 10:14:36


This is a much needed feature request but your Web site was totally unclear how to submit a feature request. apt upgrade needs some kind of limit or cap like:


sudo apt upgrade -asof=20180723


This is particularly necessary in the world of medical device developers and any other regulated industry where "Work Instructions" get filed with regulatory bodies on how to create, from scratch, a development environment. Many times these instructions say to install an LTS Debian based distro then


sudo apt update

sudo apt upgrade


The problem is, the repos have moved content wise since then and some update breaks the environment. A fantastic example as of today is the GUI software installer with Ubuntu 18.04 LTS. With a raw install of 18.04 you can copy in a .deb and use the GUI to install it. After applying all updates it no longer works.


The regulated world needs an "asof" qualifier so developer environments can be 100% recreatable without having to build an environment, disable apt, then make an ISO of said environment just so it can be reproducable.




------------------------------------------------------------------------
Disclaimer The information in this email and any attachments may contain proprietary and confidential information that is intended for the addressee(s) only. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or use of the contents of this information is prohibited. When addressed to our clients or vendors, any information contained in this e-mail or any attachments is subject to the terms and conditions in any governing contract. If you have received this e-mail in error, please immediately contact the sender and delete the e-mail.

[Debian Bug Tracking System]

Your message dated Fri, 30 Nov 2018 18:28:47 +0100
with message-id <***@crossbow>
and subject line Re: Bug#915109: apt upgrade needs limit or date cap
has caused the Debian Bug report #915109,
regarding apt upgrade needs limit or date cap
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)

[Roland Hughes]

This is not satisfactory.


The bug/lacking feature IS DEFINITELY IN APT.

________________________________
From: Debian Bug Tracking System <***@bugs.debian.org>
Sent: Friday, November 30, 2018 11:33:06 AM
To: Roland Hughes
Subject: Bug#915109 closed by David Kalnischkies <***@kalnischkies.de> (Re: Bug#915109: apt upgrade needs limit or date cap)

This is an automatic notification regarding your Bug report
which was filed against the apt package:

#915109: apt upgrade needs limit or date cap

It has been closed by David Kalnischkies <***@kalnischkies.de>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact David Kalnischkies <***@kalnischkies.de> by
replying to this email.


--
915109: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=915109
Debian Bug Tracking System
Contact ***@bugs.debian.org with problems




------------------------------------------------------------------------
Disclaimer The information in this email and any attachments may contain proprietary and confidential information that is intended for the addressee(s) only. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, retention or use of the contents of this information is prohibited. When addressed to our clients or vendors, any information contained in this e-mail or any attachments is subject to the terms and conditions in any governing contract. If you have received this e-mail in error, please immediately contact the sender and delete the e-mail.

[Julian Andres Klode]

What I rather clearly stated multiple times is that apt needs an
-asof=yyymmdd:hhmm parameter. The purpose of this parameter is to only
allow apt to apply updates pushed to the repository prior to that
timestamp. Anything later is ignored.

So, there's an easy way to achieve a cut off/reproduction. Run
update, record the SHA256 of the InRelease files and specify them
as documented / requested in bug 886745.

This works fine for Ubuntu at least. Another approach, considered
for image building in Ubuntu is to use a proxy that figures that
hash out by date using Launchpad API and injects itself into the build
process:

https://code.launchpad.net/~tobijk/livecd-rootfs/magic-proxy/+merge/357643

- this does not translate directly to arbitrary repositories, though.

That said, there is of course a caveat: Archive space is not unlimited,
so only a limited number of generations are kept. This lasts a few hours
maybe, but not a span of days.

A cut off date is imprecise and gives you less properties than the
existing solution, as the data can easily change with the same cut-off
date, for example, you run at 20:00, get the 18:00 archive state,
and then you run at 21:00 and your mirror has the 19:00 archive
state. Using concrete hashes of InRelease files allows you to produce
an exact state of a given repository. You'd have to contact a centralized
master instance to get the real "current" one.

PS. I'd spent some time learning how to quote emails, wrap your
lines, and express yourself as short as possible, so things are
understandable. This email is a good example in general, but a
bit verbose. It will be appreciated. Also get rid of the disclaimer
when posting to public audiences.