Via bug 53782 an APT pinning via preup.sh and postup.sh for UCS@school 5.0v1 was set up to deliver certain packages in a newer version in case UCS@school is installed (→ please first read bug 53782 for the reasons!). The mechanism implemented there worked for the TEST appcenter. The release file stored there matched the APT pinning. On omar, however, the Release file is automatically regenerated when ./copy_from_appcenter.test.sh 5.0 ucsschool_20201208103021 is called and then the file contains a different "Label" entry, which no longer matches the pinning (see diff below). In addition, the Release file contains a (wrong) checksum for itself → is this a problem? --- appcenter.test/univention-repository/5.0/maintained/component/ucsschool_20201208103021/all/Release 2022-05-13 10:32:26.330167257 +0200 +++ appcenter/univention-repository/5.0/maintained/component/ucsschool_20201208103021/all/Release 2022-05-13 13:58:52.706936124 +0200 @@ -1,26 +1,21 @@ Codename: ucsschool_20201208103021/all -Date: Fri, 13 May 2022 08:32:26 +0000 -Label: ucs@school +Date: Fri, 13 May 2022 11:58:52 +0000 +Label: Univention Origin: Univention -Suite: apt Version: ucsschool_20201208103021 MD5Sum: - fbb0b869fd8306f3b3a2335585707b8d 182813 Packages - dc58cec6b230def9e1226d8e22d8b17a 33698 Packages.bz2 - de1778e268e62b92dfe03ceaa0ebc0c3 43739 Packages.gz - 4f242ed517a20bbe686a6ebed1286b8f 159 Release + 94621c9716b74e80cff988a00e9b6bb4 182813 Packages + df6dbf087611954fee2dc65cc24cfb70 33721 Packages.bz2 + 4fda26b1064356bf8f0997a86200168c 40110 Packages.gz [...] So the release of UCS@school 5.0v1 has effectively taken place WITHOUT the intended APT pinning. Changing the label in the release file after the fact causes apt-get on the existing UCS@school 5.0 systems to want to manually confirm the change for security reasons: E: Repository 'https://appcenter.software-univention.de/univention-repository/5.0/maintained/component ucsschool_20201208103021/all/ Release' changed its 'Label' value from 'Univention' to 'ucs@school' N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details. E: Repository 'https://appcenter.software-univention.de/univention-repository/5.0/maintained/component ucsschool_20201208103021/amd64/ Release' changed its 'Label' value from 'Univention' to 'ucs@school' N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details. Do we have a serious problem here? Or are the bugs fixed automatically by installing the errata updates afterwards?
Any new insights here, is this an issue relevant in production?
With the kopano app, we are doing the pinning a bit differently, maybe this also helps for the school update. https://appcenter-test.software-univention.de/univention-repository/5.0/maintained/component/kopano-core_20220630105644/all/preup.sh
Asked for clarification if the issue is still relevant.
Looks fixed to me: https://git.knut.univention.de/univention/ucsschool/-/commit/7444f2806ccb8a0f0745fb6c3688e8a73f02b1f7 https://git.knut.univention.de/univention/ucsschool/-/commit/304233c10c1664cf620cdba08f30a401a5bca6f6
Lets close with here: What I checked preup.sh test-appcenter -> OK https://appcenter-test.software-univention.de/univention-repository/5.0/maintained/component/ucsschool_20201208103021/all/preup.sh preup.sh appcenter -> OK https://appcenter.software-univention.de/univention-repository/5.0/maintained/component/ucsschool_20201208103021/all/preup.sh Signature preup.sh appcenter -> OK gpg --keyring /etc/apt/trusted.gpg.d/univention-archive-key-ucs-5x.gpg --verify preup.sh.gpg preup.sh preup.sh itself -> OK `bash preup.sh post 5.0-0` `apt policy ` ``` Package files: 100 /var/lib/dpkg/status release a=now 1002 https://appcenter.software-univention.de/univention-repository/5.0/maintained/component ucsschool_20201208103021/amd64/ Packages release v=ucsschool_20201208103021,o=Univention,n=ucsschool_20201208103021/amd64,l=Univention,c= origin appcenter.software-univention.de 1002 https://appcenter.software-univention.de/univention-repository/5.0/maintained/component ucsschool_20201208103021/all/ Packages release v=ucsschool_20201208103021,o=Univention,n=ucsschool_20201208103021/all,l=Univention,c= origin appcenter.software-univention.de 500 http://updates.knut.univention.de errata502/main amd64 Packages release v=5.0.2-errata,o=Univention,a=errata502,n=errata502,l=Univention Corporate Server,c=main,b=amd64 origin updates.knut.univention.de 500 http://updates.knut.univention.de ucs502/main amd64 Packages release v=5.0.2,o=Univention,a=ucs502,n=ucs502,l=Univention Corporate Server,c=main,b=amd64 origin updates.knut.univention.de Pinned packages: ``` Looks good to me -> Verified
Already uploaded to the appcenter -> Close If this error occurs again, please clone this bug.