metas: point the umbrella straight at the concrete kernel #66

Merged

zach merged 1 commit from fix-umbrella-meta-autoremove into main 2026-10-12 10:08:00 +00:00

Conversation 0 Commits 1 Files changed 4 +79 -29

zach commented 2026-10-12 10:05:32 +00:00

Owner

Copy link

Problem

After the 7.1 → 7.2 line advance, apt full-upgrade on trixie fails:

Unsatisfied dependencies:
 linux-image-hardened-unredacted-7.1-amd64 : Depends: linux-image-7.1.13-hardened-unredacted-amd64 (= 7.1.13-hardened1) but it is not going to be installed
Error: Internal Error, AutoRemover broke stuff

apt ≥ 3.0 removes unused old kernels during full-upgrade/dist-upgrade (APT::Get::AutomaticRemove::Kernels). It only removes packages named after an old kernelrelease (APT::VersionedKernelPackages, ^linux-.*-<kr>$). The umbrella depended on the per-line meta (umbrella → <X.Y> meta → concrete). After an advance, the old line's meta was left auto-installed and unused. Its name has no kernelrelease in it, so apt removed the kernel, kept the meta that depends on it, and then refused the broken result. This would recur at every line advance.

Change

• build/build-debs.sh: the umbrella now depends directly on linux-<kind>-<kr> (= version), plus unredacted-hardened-defaults for the image. This is the same shape as Debian's linux-image-amd64. Per-line metas are unchanged and remain an opt-in series pin. Because users install them by hand, apt never autoremoves their kernel.
• Docs:
  • config-architecture.md describes the new shape and why the umbrella must not go through the per-line meta.
  • pinning.md documents the one-time cleanup for existing installs.
  • recovery.md covers the error itself.

Verification

I ran dummy packages under apt 3.0.3 in debian:trixie:

Scenario	Result
Old shape, through a 7.1 → 7.2 advance	Reproduces the error word for word
New shape, same history	Works; old kernel removed cleanly
New shape with a hand-installed 7.2 meta, through 7.3	Works; 7.2 kernel kept
Installed under the old shape, then new shape, through 7.3	Still fails at 7.3.3, because the stale auto-installed 7.2 meta remains
Same, after one apt autoremove	Works

I also ran the edited meta-emission code from build-debs.sh in the container and checked the generated Depends: fields. shellcheck reports no warnings. Plain apt upgrade never hits this, since it skips kernel autoremoval.

Follow-up: release note for the first release built from this

Every existing umbrella install has linux-image-hardened-unredacted-7.2-amd64 (and the headers meta, if installed) auto-installed. A packaging change alone can't remove it without breaking deliberate series pins, so the first release's notes need this:

One-time step: if you installed linux-image-hardened-unredacted-amd64 at v7.2.8-hardened1 or earlier, run sudo apt autoremove after upgrading. It removes the per-series meta (linux-image-hardened-unredacted-7.2-amd64, plus the headers one if present) that older releases installed automatically. Without this, a later series change can make apt full-upgrade fail with "AutoRemover broke stuff". To stay on 7.2 instead, run sudo apt-mark manual linux-image-hardened-unredacted-7.2-amd64.

🤖 Generated with Claude Code

## Problem After the 7.1 → 7.2 line advance, `apt full-upgrade` on trixie fails: ``` Unsatisfied dependencies: linux-image-hardened-unredacted-7.1-amd64 : Depends: linux-image-7.1.13-hardened-unredacted-amd64 (= 7.1.13-hardened1) but it is not going to be installed Error: Internal Error, AutoRemover broke stuff ``` apt ≥ 3.0 removes unused old kernels during `full-upgrade`/`dist-upgrade` (`APT::Get::AutomaticRemove::Kernels`). It only removes packages named after an old kernelrelease (`APT::VersionedKernelPackages`, `^linux-.*-<kr>$`). The umbrella depended on the per-line meta (umbrella → `<X.Y>` meta → concrete). After an advance, the old line's meta was left auto-installed and unused. Its name has no kernelrelease in it, so apt removed the kernel, kept the meta that depends on it, and then refused the broken result. This would recur at every line advance. ## Change - **`build/build-debs.sh`**: the umbrella now depends directly on `linux-<kind>-<kr> (= version)`, plus `unredacted-hardened-defaults` for the image. This is the same shape as Debian's `linux-image-amd64`. Per-line metas are unchanged and remain an opt-in series pin. Because users install them by hand, apt never autoremoves their kernel. - **Docs**: - `config-architecture.md` describes the new shape and why the umbrella must not go through the per-line meta. - `pinning.md` documents the one-time cleanup for existing installs. - `recovery.md` covers the error itself. ## Verification I ran dummy packages under apt 3.0.3 in `debian:trixie`: | Scenario | Result | |---|---| | Old shape, through a 7.1 → 7.2 advance | Reproduces the error word for word | | New shape, same history | Works; old kernel removed cleanly | | New shape with a hand-installed 7.2 meta, through 7.3 | Works; 7.2 kernel kept | | Installed under the old shape, then new shape, through 7.3 | **Still fails** at 7.3.3, because the stale auto-installed 7.2 meta remains | | Same, after one `apt autoremove` | Works | I also ran the edited meta-emission code from `build-debs.sh` in the container and checked the generated `Depends:` fields. shellcheck reports no warnings. Plain `apt upgrade` never hits this, since it skips kernel autoremoval. ## Follow-up: release note for the first release built from this Every existing umbrella install has `linux-image-hardened-unredacted-7.2-amd64` (and the headers meta, if installed) auto-installed. A packaging change alone can't remove it without breaking deliberate series pins, so the first release's notes need this: > **One-time step:** if you installed `linux-image-hardened-unredacted-amd64` at v7.2.8-hardened1 or earlier, run `sudo apt autoremove` after upgrading. It removes the per-series meta (`linux-image-hardened-unredacted-7.2-amd64`, plus the headers one if present) that older releases installed automatically. Without this, a later series change can make `apt full-upgrade` fail with "AutoRemover broke stuff". To stay on 7.2 instead, run `sudo apt-mark manual linux-image-hardened-unredacted-7.2-amd64`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

zach added 1 commit 2026-10-12 10:05:32 +00:00

metas: point the umbrella straight at the concrete kernel ... c380ba363c

After the 7.1 -> 7.2 line advance, `apt full-upgrade` on trixie failed with:

  linux-image-hardened-unredacted-7.1-amd64 : Depends:
    linux-image-7.1.13-hardened-unredacted-amd64 (= 7.1.13-hardened1)
    but it is not going to be installed
  Error: Internal Error, AutoRemover broke stuff

apt >= 3.0 removes unused old kernels during full-upgrade/dist-upgrade
(APT::Get::AutomaticRemove::Kernels), but only packages named after an old
kernelrelease (APT::VersionedKernelPackages, `^linux-.*-<kr>$`). The
umbrella depended on the per-line meta (umbrella -> <X.Y> meta -> concrete),
so an advance left the old line's meta auto-installed and unused. Its name
carries no kernelrelease, so apt removed the kernel, kept the meta that
depends on it, and then refused the broken result. That recurs at every
line advance, once the old line's last kernel is neither booted nor among
the two newest.

  - build/build-debs.sh: the umbrella now depends directly on
    linux-<kind>-<kr> (= version), plus unredacted-hardened-defaults for
    the image. This matches Debian's linux-image-amd64. Per-line metas are
    unchanged and remain an opt-in series pin. Installed by hand, they keep
    their kernel out of autoremoval.
  - docs: config-architecture.md describes the new shape and why the
    umbrella must not go via the per-line meta. pinning.md documents the
    one-time `apt autoremove` (or `apt-mark manual`) for installs from
    v7.2.8-hardened1 or earlier, which carry an auto-installed per-line
    meta. recovery.md covers the error itself.

Verified with dummy packages under apt 3.0.3 in debian:trixie. The old
shape reproduces the error verbatim. The new shape removes the old kernel
cleanly across an advance. A hand-pinned per-line meta keeps its kernel.
An install migrated from the old shape still fails at the next advance
unless the stale meta is autoremoved once, hence the docs. Plain
`apt upgrade` never hits this, since it skips kernel autoremoval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

zach merged commit 426fe93d4f into main 2026-10-12 10:08:00 +00:00

zach deleted branch fix-umbrella-meta-autoremove 2026-10-12 10:08:01 +00:00

zach referenced this pull request from a commit 2026-10-12 10:08:02 +00:00

Merge pull request 'metas: point the umbrella straight at the concrete kernel' (#66) from fix-umbrella-meta-autoremove into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted!66

No description provided.