fix: drop the overlay's Keel source and 1001 pin; pin staging for the build only #18

Open

marcos-mendez wants to merge 2 commits from fix/drop-keel-apt-overlay into main

marcos-mendez commented

2026-10-02 12:05:18 -03:00

(Migrated from github.com)

Summary

Overlay files dropped. The overlay no longer ships /etc/apt/sources.list.d/keel.sources (apt.keellinux.org, disabled) or /etc/apt/preferences.d/keel (Pin-Priority 1001).
- At 1001, apt downgrades every package newer than the archive's (tracker#23).
- At those paths, a recipe overlay wins over the source and the 990 pin that Keel-Linux/common#30 ships. common#30's conf/turnkey.d/keel-apt therefore stops this build until this lands.
The 1001 pin had a second job. It let the build-time staging archive (Origin "Keel Linux") win over TurnKey's o=turnkeylinux pin at 999 when conf.d/main upgrades inithooks and confconsole. Without it, apt would pick TurnKey's 2.3.6. So conf.d/main now writes /etc/apt/preferences.d/keel-staging:
- Pin: release l=Keel Linux staging, at 1001, written just before the upgrade;
- removed by conf.d/zz-project-packages together with keel-staging.list (common#30's final removelist removes it too);
- pinned by Label, so common#30's "Keel pin must be 990" check does not match it.
New leftover check. The old grep -q '^Enabled: no' keel.sources becomes: fail the build if any apt source or pin of the image still names the build-time archive (trixie-staging, /srv/keel-apt, l=Keel Linux staging). This holds on today's common, where the image has no Keel source, and on common#30, where common ships it enabled.

Merge order: this PR, then the pool, then common#30 together with inithooks#34.

Test plan

tests/project-packages.bats (16 tests, RED first, kcov 100 percent, 35/35): the pin is removed, a leftover source or staging pin fails the build, and common's Keel source and 990 pin are left in place. tests/apt-files.bats (3 tests): neither overlay file, and the staging pin written before the upgrade.
CI green
The next build's boot test: the image has neither file nor any staging pin, and inithooks/confconsole are still the staging versions.

## Summary - **Overlay files dropped.** The overlay no longer ships `/etc/apt/sources.list.d/keel.sources` (apt.keellinux.org, disabled) or `/etc/apt/preferences.d/keel` (Pin-Priority 1001). - At 1001, apt downgrades every package newer than the archive's (tracker#23). - At those paths, a recipe overlay wins over the source and the 990 pin that Keel-Linux/common#30 ships. common#30's `conf/turnkey.d/keel-apt` therefore stops this build until this lands. - **The 1001 pin had a second job.** It let the build-time staging archive (Origin "Keel Linux") win over TurnKey's `o=turnkeylinux` pin at 999 when `conf.d/main` upgrades inithooks and confconsole. Without it, apt would pick TurnKey's 2.3.6. So `conf.d/main` now writes `/etc/apt/preferences.d/keel-staging`: - `Pin: release l=Keel Linux staging`, at 1001, written just before the upgrade; - removed by `conf.d/zz-project-packages` together with `keel-staging.list` (common#30's final removelist removes it too); - pinned by Label, so common#30's "Keel pin must be 990" check does not match it. - **New leftover check.** The old `grep -q '^Enabled: no' keel.sources` becomes: fail the build if any apt source or pin of the image still names the build-time archive (`trixie-staging`, `/srv/keel-apt`, `l=Keel Linux staging`). This holds on today's common, where the image has no Keel source, and on common#30, where common ships it enabled. Merge order: this PR, then the pool, then common#30 together with inithooks#34. ## Test plan - [x] `tests/project-packages.bats` (16 tests, RED first, kcov 100 percent, 35/35): the pin is removed, a leftover source or staging pin fails the build, and common's Keel source and 990 pin are left in place. `tests/apt-files.bats` (3 tests): neither overlay file, and the staging pin written before the upgrade. - [ ] CI green - [ ] The next build's boot test: the image has neither file nor any staging pin, and inithooks/confconsole are still the staging versions.

Some required checks are missing.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions