Dear Maintainer, there is a critical error in `apt`: It's possible that packages markt as `manual` get removed during uninstall of other packages. To repoduce: ``` docker run -it debian:bookworm apt-get update apt-get install podman apt-get install -y reprepro dpkg-dev tree gpg apt-get remove -y reprepro dpkg-dev tree gpg ``` BTW, even if the cause is wrong metadata for one of the packages above this is a bug in the package manager, since metadata should not be able to override any user requests, this is a potential denial of service attack vector.
This is the expected behavior and not a bug. The new solver has flipped the behavior right now but that might not survive general release. But particularly it only flips the default for apt(8), not apt-get(8) - apt-get(8) is a mostly-bug-compatible retro computing frontend after all - it does not get behavior changes that can be avoided.
I've isolated the problematic package it's `gpg`. Since I don't know how to do it can someone please CC the maintainer of the `gpg` package? Anyways this is all quite confusing, `gpg` lists sources [1] to be `gnupg2` ant that package don't expose that bug. But this fact makes it easy to just pull `gpg` from the repo until this is fixed. By the way would it be possible to link the sources of the `gpg` package from [1]? [1] https://packages.debian.org/bookworm/gpg Am 27.08.25 um 12:53 schrieb Debian Bug Tracking System: -- Christian Mahnke cmahnke@gmail.com https://christianmahnke.de https://projektemacher.org
I'm sorry, but it's hard to believe that this behaviour is intentional, since `apt-mark manual podman` (in this example) doesn't keep `podman` either... How is one supposed to have a working system that way? Am 27.08.25 um 13:07 schrieb Debian Bug Tracking System: -- Christian Mahnke cmahnke@gmail.com https://christianmahnke.de https://projektemacher.org
Your reproducer doesn't show which package gets removed, and also it has no logs. It's mostly useless. apt offers a solution for the request you are making. You have to read and understand the solution before accepting it. Chris
* Christian Mahnke <cmahnke@gmail.com> [250827 13:34]: You cannot pass "-y" (= accept) and then complain that the solution is not acceptable. Chris
Hhi, that's not even the point: The bug is that installing a another package should not override the manual mark of a previously installed with auto... I haven't checked if one can mark it as essential first, but that shouldn't be necessary. Anyhow, if you're still insisting that this is expected behaviour then it certainly is. But the specification should be considered questionable or counterintuitive at best... Cheers, Christian Am 28.08.25 um 11:57 schrieb Chris Hofstaedtler: -- Christian Mahnke cmahnke@gmail.com https://christianmahnke.de https://projektemacher.org