[Simple-cdd-devel] Dependency errors due to security updates

[Vagrant Cascadian]

On 2017-03-03, David wrote:
> I am trying to build a basic Jessie CD, before customising it further.
>
> Using:
>
>      $ build-simple-cdd --dist jessie --logfile log.txt
>
> I get dependency failures for vim-tiny (and one other package):
>
> 2017-03-01 16:19:48,250 WARNING     package: vim-tiny
> 2017-03-01 16:19:48,250 WARNING     version: 2:7.4.488-7+deb8u1
...
> vim recently got a security bump to deb8u2 therefore 
> vim-common=7.4.488-7+deb8u1 is no longer available.  The full log shows:
>
> 2017-03-01 16:17:14,385 DEBUG mirror/reprepro stdout: deleting and 
> forgetting pool/main/v/vim/vim-common_7.4.488-7+deb8u1_amd64.deb
>
> However something still seems to be using vim-tiny=7.4.488-7+debu1, 
> which has also been superseded.
...
> Is there some way to ensure the most recent versions of all packages are 
> used?  Or disable these updates completely ready for a dist-upgrade 
> after install?

Thanks for the report...

I think this has to do with vim-tiny getting pulled in by the
"default-base" rules that simple-cdd is using, but it doesn't get added
to the list of packages pulled in via "default-security".

I think simple-cdd needs to generate a correlary to default-base for
each of security, updates, backports, etc. hopefully that will fix the
issue...

Please report a bug in the debian bug tracking system:

  https://www.debian.org/Bugs/Reporting


live well,
  vagrant
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 832 bytes
Desc: not available
URL: <http://lists.alioth.debian.org/pipermail/simple-cdd-devel/attachments/20170303/27809a50/attachment.sig>