bookworm vs proxmox: Packages libpam-systemd, libsystemd-shared, libsystemd0, libudev1, systemd, systemd-sysv, udev

[lopiuh]

Hi,

I have two questions:

1) Is it recomenended to pin proxomox packages with a prio >= 1000 (debian bookworm installation), so they get installed even if debian has newer versions?

Doing so will downgrade following packeges (compared to bookworm). If not, why are they present in the proxmox repositories anymore?

libpam-systemd
252.26-1~deb12u2 -> 252.12-pmx1

libsystemd-shared
252.26-1~deb12u2 -> 252.12-pmx1

libsystemd0
252.26-1~deb12u2 -> 252.12-pmx1

libudev1
252.26-1~deb12u2 -> 252.12-pmx1

systemd
252.26-1~deb12u2 -> 252.12-pmx1

systemd-sysv
252.26-1~deb12u2 -> 252.12-pmx1

udev
252.26-1~deb12u2 -> 252.12-pmx1

Yours lopiuh

 

[Maximiliano]

Hello,

Such modifications are not necessary. Whenever we ship the same software as Debian we do so with a higher version of what is (and will be) available in Debian repos.

 

[lopiuh]

Hi Maximiliano,

thanks for your answer. Could we elaborate a bit, please?

When you released the named packages initially, they had a higher version number than Debian, right?

Then Debian did updates and because of that the upstream's version number eventually got higher than Proxmox. This is the current state.

But how do you know that your patched version is no longer needed? You can't prevent the Debian version from getting installed if you do not pin your packages higher, can you?

So Debian's newer version gets installed, and if something breaks, you then release a PMX version again? But you can't prevent the "breakage" or bad behavior of the upstream version until you do, can you?

Isn't that a flaw in the process? Is pinning your packages and then deleting them from the repository a better approach?

I don't know if the Debian version will be installed if the package gets deleted from the repository, but if that is the case, it would be a better and more stable approach, wouldn't it?

Thanks,

lopiuh

 

[fabian]

there are different cases here:
- we backport a fix that we know Debian will pick up in their next upload (this was the case with systemd)
- we ship a newer upstream version (this is the case with ZFS, kernel, qemu, ceph, ifupdown2, .. sometimes with different package names) => Debian will never get that version in the current stable release, so we know our packages will always be newer
- special cases (e.g., parts of the secure boot stack require pinning to avoid being overtaken, so we ship a pinning snippet limited to those packages, and opt-in via a meta package that pulls in the related packages and installs the pinning snippet)

hope this clears things up!

 

[lopiuh]

Yes, that clears things up. "Pinning snippet" is done as a preference file by an installed package, isn't it? I do not need to place a pinning preference file by myself if I install PVE on a Debian Bookworm installation, right?

And thank you very much for your differentiating answer in your last reply.

 

[fabian]

yes. in this case, if you install `proxmox-secure-boot-support` it will install an apt preferences snippet pinning our shim packages.

 

[lopiuh]

Thanks again for your help.