fix: pin at 990, and replace TurnKey's 19.0 sources, pin and keys #4

Merged

marcos-mendez merged 1 commit from fix/pin-990-debian-sources into main

2026-10-02 11:42:28 -03:00

marcos-mendez commented

2026-10-02 11:12:44 -03:00

(Migrated from github.com)

Summary

This is the migration for existing machines that the review of Keel-Linux/common#30 asked for (item 4).

Pin 990, not 1001 (tracker#23). At 1001, apt installed the Keel version even when it was older, so every package newer on the machine than in the archive was downgraded. At 990 the Keel build is still the candidate over any other archive, and a newer installed version is never replaced.
19.0 appliances. TurnKey's o=turnkeylinux pin at 999 would beat 990, so --apply now replaces what TurnKey's bootstrap left:
- It writes debian.sources (deb.debian.org, <codename> <codename>-updates) and security.sources (security.debian.org <codename>-security). Both are marked as written by this tool and keep the suites and components the appliance's own Debian stanzas had.
- Only then does it rename sources.sources, security.sources.sources, turnkey-testing.sources and a TurnKey-only /etc/apt/preferences to <name>.disabled-by-keel.
- It purges turnkey-keys with dpkg -P, after saving the files the package owns to /var/lib/keel/transition/turnkey-keys.tar. keel-archive-keyring is already required: --apply exits 6 without it.
Refusals (exit 5). These are refused, and then nothing is purged: a debian.sources or security.sources this tool did not write, other pins in /etc/apt/preferences, or a TurnKey stanza in a file the tool does not know.
--rollback. Renames every file back byte for byte, removes what the tool wrote, puts the key files back, and says to reinstall turnkey-keys.
README note. The README said that disabling the shared deb822 files needed a decision note. This follows decision 0039 (packages from Debian and the Keel repository only) and the review's request.
The help, README and man page are updated. Changelog 0.2.0. --version now says 0.2.0; it still said 0.1.0.
Follow-up. Keel-Linux/apt lib/pin.sh (bin/pin-file) still defaults to 1001 and should follow. The build-time pool pin at 1001 there is intended, because there a downgrade is the point.

Test plan

tests/turnkey19.bats, 12 tests, RED first. They cover apply, the hosts apt then reads, the purge through dpkg, byte-for-byte rollback of /etc/apt and the keyrings, idempotence, the three refusals, the fallback with no Debian stanza, and a real-apt check. In that check, apt (local archives, the pin --apply writes) upgrades TurnKey's inithooks 2.3.6 to 2.3.6+keel5 and keeps an installed confconsole +keel11 and a Keel rebuild. Nothing is DOWNGRADED.
Full suite: 110 tests pass. kcov is 99.1 percent overall, with lib/turnkey.sh at 100.
shellcheck lib/*.sh
CI green

## Summary This is the migration for existing machines that the review of Keel-Linux/common#30 asked for (item 4). - **Pin 990, not 1001 (tracker#23).** At 1001, apt installed the Keel version even when it was older, so every package newer on the machine than in the archive was downgraded. At 990 the Keel build is still the candidate over any other archive, and a newer installed version is never replaced. - **19.0 appliances.** TurnKey's `o=turnkeylinux` pin at 999 would beat 990, so `--apply` now replaces what TurnKey's bootstrap left: - It writes `debian.sources` (deb.debian.org, `<codename> <codename>-updates`) and `security.sources` (security.debian.org `<codename>-security`). Both are marked as written by this tool and keep the suites and components the appliance's own Debian stanzas had. - Only then does it rename `sources.sources`, `security.sources.sources`, `turnkey-testing.sources` and a TurnKey-only `/etc/apt/preferences` to `<name>.disabled-by-keel`. - It purges `turnkey-keys` with `dpkg -P`, after saving the files the package owns to `/var/lib/keel/transition/turnkey-keys.tar`. keel-archive-keyring is already required: `--apply` exits 6 without it. - **Refusals (exit 5).** These are refused, and then nothing is purged: a `debian.sources` or `security.sources` this tool did not write, other pins in `/etc/apt/preferences`, or a TurnKey stanza in a file the tool does not know. - **`--rollback`.** Renames every file back byte for byte, removes what the tool wrote, puts the key files back, and says to reinstall `turnkey-keys`. - **README note.** The README said that disabling the shared deb822 files needed a decision note. This follows decision 0039 (packages from Debian and the Keel repository only) and the review's request. - The help, README and man page are updated. Changelog 0.2.0. `--version` now says 0.2.0; it still said 0.1.0. - **Follow-up.** Keel-Linux/apt `lib/pin.sh` (`bin/pin-file`) still defaults to 1001 and should follow. The build-time pool pin at 1001 there is intended, because there a downgrade is the point. ## Test plan - [x] `tests/turnkey19.bats`, 12 tests, RED first. They cover apply, the hosts apt then reads, the purge through dpkg, byte-for-byte rollback of /etc/apt and the keyrings, idempotence, the three refusals, the fallback with no Debian stanza, and a real-apt check. In that check, apt (local archives, the pin --apply writes) upgrades TurnKey's inithooks 2.3.6 to 2.3.6+keel5 and keeps an installed confconsole +keel11 and a Keel rebuild. Nothing is DOWNGRADED. - [x] Full suite: 110 tests pass. kcov is 99.1 percent overall, with lib/turnkey.sh at 100. - [x] shellcheck lib/*.sh - [ ] CI green