Migrate what the TurnKey apt suites still provide, then remove them #7

New issue

Open

opened 2026-09-28 01:37:44 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-09-28 01:37:44 -03:00

(Migrated from github.com)

Measured on the wordpress-demo container, 2026-09-28, with its apt lists
populated (apt-get update inside the container). This is the list
Keel-Linux/common#6 asked for before the TurnKey suites can be removed, and
the plan per package. Nothing here is done yet. #6 deliberately left the
sources in place, because removing a source the build still needs is worse
than leaving it.

What is actually enabled

Two TurnKey suites, not three. turnkey-testing.sources ships
Enabled: no on a built appliance, so only trixie and trixie-security
resolve.

trixie-security from TurnKey carries exactly one package: tklbam
1.5.3+2+g31134d3, the version already installed. Debian's own security
updates come from security.debian.org directly. So "security through a
third party" is real, but what that suite actually delivers is one Hub
client, and it is in the drop list below.

The measurement

The TurnKey suites offer 141 package names. 39 are installed.
None of the 39 is available from Debian at all — there is no name the
TurnKey archive currently wins on. apt-cache policy over every installed
package finds 0 where TurnKey overrides Debian.
100 TurnKey-provided names are not installed; a dependency could pull
any of them.
Our own pool already serves confconsole, fab, inithooks, keel,
keel-archive-keyring, keel-transition, which is the proof the path
works.

There is also a pin, and it is the part that is easy to miss:

# overlays/bootstrap_apt/etc/apt/preferences, in the image as /etc/apt/preferences
Package: *
Pin: release o=turnkeylinux
Pin-Priority: 999

Debian is 500 and our own archive is 1001, so TurnKey sits above Debian
for every package it publishes. It shadows nothing today, measured; the day
TurnKey publishes a name Debian also has, it silently wins. The pin goes
with the sources.

The plan, per package

Move to our pool — 7

Appliance infrastructure with no Debian equivalent, all small, all already
built by us for other things. turnkey-netinfo is the base of the other
three Python ones.

Package	Installed	Why it has to stay	Installed reverse-dependencies
`turnkey-netinfo`	1.1.1	the network info library	`confconsole`, `turnkey-sysinfo`, `turnkey-version`
`turnkey-version`	1.1.3	`turnkey-version(1)` and the `sysversion` module, which parse `/etc/turnkey_version`	`turnkey-sysinfo`
`turnkey-sysinfo`	1.1.0	the console banner's system info	none
`turnkey-conffile`	1.1.2	the config library confconsole imports	`confconsole`
`turnkey-ssl`	3.1.1	`turnkey-make-ssl-cert`, used by the first-boot cert hook	`inithooks`
`tkl-installer`	0.1.2	the CLI installer for live images	none
`tkl-dhcpcd-ifupdown-glue`	0.1.3	keeps DHCP and `/etc/network/interfaces` in sync	none

Drop — 7

The TurnKey Hub is a TurnKey service. Keel has no equivalent and no account
on it, so these are clients of something we do not use. Nothing outside the
group depends on any of them.

Package	Installed	What it is
`tklbam`	1.5.3+2+g31134d3	Hub backup and migration
`tklbam-squid`	2.7.STABLE9-2.3.0-2turnkey+0	a tklbam dependency
`tklbam-squid-common`	2.7.STABLE9-2.3.0-2turnkey+0	a tklbam dependency
`turnkey-pypy2`	7.3.23+turnkey1	a pypy2 build whose only reverse-dependency is tklbam
`webmin-tklbam`	1.2.1	the tklbam webmin module
`hubdns`	1.4.0	Hub DNS client
`py3curl-wrapper`	2.1.2	only reverse-dependency is hubdns

Dropping these also removes a pypy2 interpreter and a squid fork from every
appliance, which is worth having on its own.

Drops with the sources — 1

Package	Installed	Why
`turnkey-keys`	0.1	it ships `/usr/share/keyrings/tkl-archive-keyring.gpg`, the key the TurnKey sources are signed with, plus the historical per-release keys. It exists to verify those sources; when they go it goes.

Decide — 24

webmin 2.660.turnkey0 and 23 modules: webmin-apache,
webmin-authentic-theme, webmin-custom, webmin-fail2ban,
webmin-fdisk, webmin-filemin, webmin-firewall, webmin-firewall6,
webmin-logviewer, webmin-lvm, webmin-mount, webmin-mysql,
webmin-passwd, webmin-phpini, webmin-postfix, webmin-raid,
webmin-software, webmin-sshd, webmin-systemd, webmin-time,
webmin-updown, webmin-useradmin, webmin-xterm.

This is 24 of the 39 and it is the whole weight of the item. webmin
itself is what the 23 modules depend on; the modules depend on nothing else
we would keep. Three ways out, and this issue is not the place to pick one
without measuring first:

Mirror TurnKey's builds into our pool. Cheapest, changes nothing an
operator sees, and keeps us shipping someone else's repackaging.
Build from upstream Webmin. Webmin publishes its own Debian
packages; TurnKey's .turnkey0 suffix is a repackaging with their theme
and module selection. More work, and the firewall and theme modules
would need checking against what conf/turnkey.d/webmin-* (15 conf
scripts) expects.
Drop webmin. Keel's own answer to "configure the machine" is
confconsole and the declarative instance description. Whether webmin
is wanted at all is a product decision, not a packaging one.

Suggested order: settle webmin first, because it decides whether this is a
7-package job or a 31-package one.

What closes this

The 7 infrastructure packages are in archive.keellinux.org.
The 7 Hub packages and turnkey-keys are off the appliance.
Webmin has a decision and it is carried out.
/etc/apt/sources.list.d/sources.sources,
security.sources.sources and turnkey-testing.sources no longer name
archive.turnkeylinux.org, and overlays/bootstrap_apt/etc/apt/preferences
no longer pins o=turnkeylinux.
A build of core and of one appliance succeeds with the sources gone.

Not in scope, but noticed while measuring

The generated filenames are sources.sources and
security.sources.sources, with the suffix doubled. It is cosmetic, and a
rename is not free: conf/turnkey.d/cronapt names
/etc/apt/sources.list.d/security.sources.sources explicitly (twice), and
machines already built would keep the old file alongside the new one. Worth
doing together with the removal above, when those files are being rewritten
anyway.

Follows Keel-Linux/common#6. Org-wide context: Keel-Linux/tracker#15.

Measured on the `wordpress-demo` container, 2026-09-28, with its apt lists populated (`apt-get update` inside the container). This is the list Keel-Linux/common#6 asked for before the TurnKey suites can be removed, and the plan per package. **Nothing here is done yet.** #6 deliberately left the sources in place, because removing a source the build still needs is worse than leaving it. ## What is actually enabled Two TurnKey suites, not three. `turnkey-testing.sources` ships `Enabled: no` on a built appliance, so only `trixie` and `trixie-security` resolve. `trixie-security` from TurnKey carries **exactly one package**: `tklbam` 1.5.3+2+g31134d3, the version already installed. Debian's own security updates come from `security.debian.org` directly. So "security through a third party" is real, but what that suite actually delivers is one Hub client, and it is in the drop list below. ## The measurement - The TurnKey suites offer **141 package names**. **39** are installed. - **None of the 39 is available from Debian at all** — there is no name the TurnKey archive currently wins on. `apt-cache policy` over every installed package finds **0** where TurnKey overrides Debian. - **100** TurnKey-provided names are not installed; a dependency could pull any of them. - Our own pool already serves `confconsole`, `fab`, `inithooks`, `keel`, `keel-archive-keyring`, `keel-transition`, which is the proof the path works. There is also a pin, and it is the part that is easy to miss: # overlays/bootstrap_apt/etc/apt/preferences, in the image as /etc/apt/preferences Package: * Pin: release o=turnkeylinux Pin-Priority: 999 Debian is 500 and our own archive is 1001, so TurnKey sits **above Debian** for every package it publishes. It shadows nothing today, measured; the day TurnKey publishes a name Debian also has, it silently wins. The pin goes with the sources. ## The plan, per package ### Move to our pool — 7 Appliance infrastructure with no Debian equivalent, all small, all already built by us for other things. `turnkey-netinfo` is the base of the other three Python ones. | Package | Installed | Why it has to stay | Installed reverse-dependencies | | --- | --- | --- | --- | | `turnkey-netinfo` | 1.1.1 | the network info library | `confconsole`, `turnkey-sysinfo`, `turnkey-version` | | `turnkey-version` | 1.1.3 | `turnkey-version(1)` and the `sysversion` module, which parse `/etc/turnkey_version` | `turnkey-sysinfo` | | `turnkey-sysinfo` | 1.1.0 | the console banner's system info | none | | `turnkey-conffile` | 1.1.2 | the config library confconsole imports | `confconsole` | | `turnkey-ssl` | 3.1.1 | `turnkey-make-ssl-cert`, used by the first-boot cert hook | `inithooks` | | `tkl-installer` | 0.1.2 | the CLI installer for live images | none | | `tkl-dhcpcd-ifupdown-glue` | 0.1.3 | keeps DHCP and `/etc/network/interfaces` in sync | none | ### Drop — 7 The TurnKey Hub is a TurnKey service. Keel has no equivalent and no account on it, so these are clients of something we do not use. Nothing outside the group depends on any of them. | Package | Installed | What it is | | --- | --- | --- | | `tklbam` | 1.5.3+2+g31134d3 | Hub backup and migration | | `tklbam-squid` | 2.7.STABLE9-2.3.0-2turnkey+0 | a tklbam dependency | | `tklbam-squid-common` | 2.7.STABLE9-2.3.0-2turnkey+0 | a tklbam dependency | | `turnkey-pypy2` | 7.3.23+turnkey1 | a pypy2 build whose only reverse-dependency is tklbam | | `webmin-tklbam` | 1.2.1 | the tklbam webmin module | | `hubdns` | 1.4.0 | Hub DNS client | | `py3curl-wrapper` | 2.1.2 | only reverse-dependency is hubdns | Dropping these also removes a pypy2 interpreter and a squid fork from every appliance, which is worth having on its own. ### Drops with the sources — 1 | Package | Installed | Why | | --- | --- | --- | | `turnkey-keys` | 0.1 | it ships `/usr/share/keyrings/tkl-archive-keyring.gpg`, the key the TurnKey sources are signed with, plus the historical per-release keys. It exists to verify those sources; when they go it goes. | ### Decide — 24 `webmin` 2.660.turnkey0 and 23 modules: `webmin-apache`, `webmin-authentic-theme`, `webmin-custom`, `webmin-fail2ban`, `webmin-fdisk`, `webmin-filemin`, `webmin-firewall`, `webmin-firewall6`, `webmin-logviewer`, `webmin-lvm`, `webmin-mount`, `webmin-mysql`, `webmin-passwd`, `webmin-phpini`, `webmin-postfix`, `webmin-raid`, `webmin-software`, `webmin-sshd`, `webmin-systemd`, `webmin-time`, `webmin-updown`, `webmin-useradmin`, `webmin-xterm`. This is 24 of the 39 and it is the whole weight of the item. `webmin` itself is what the 23 modules depend on; the modules depend on nothing else we would keep. Three ways out, and this issue is not the place to pick one without measuring first: 1. **Mirror TurnKey's builds into our pool.** Cheapest, changes nothing an operator sees, and keeps us shipping someone else's repackaging. 2. **Build from upstream Webmin.** Webmin publishes its own Debian packages; TurnKey's `.turnkey0` suffix is a repackaging with their theme and module selection. More work, and the firewall and theme modules would need checking against what `conf/turnkey.d/webmin-*` (15 conf scripts) expects. 3. **Drop webmin.** Keel's own answer to "configure the machine" is `confconsole` and the declarative instance description. Whether webmin is wanted at all is a product decision, not a packaging one. Suggested order: settle webmin first, because it decides whether this is a 7-package job or a 31-package one. ## What closes this - The 7 infrastructure packages are in `archive.keellinux.org`. - The 7 Hub packages and `turnkey-keys` are off the appliance. - Webmin has a decision and it is carried out. - `/etc/apt/sources.list.d/sources.sources`, `security.sources.sources` and `turnkey-testing.sources` no longer name `archive.turnkeylinux.org`, and `overlays/bootstrap_apt/etc/apt/preferences` no longer pins `o=turnkeylinux`. - A build of core and of one appliance succeeds with the sources gone. ## Not in scope, but noticed while measuring The generated filenames are `sources.sources` and `security.sources.sources`, with the suffix doubled. It is cosmetic, and a rename is not free: `conf/turnkey.d/cronapt` names `/etc/apt/sources.list.d/security.sources.sources` explicitly (twice), and machines already built would keep the old file alongside the new one. Worth doing together with the removal above, when those files are being rewritten anyway. Follows Keel-Linux/common#6. Org-wide context: Keel-Linux/tracker#15.