Bugzilla – Bug 1177262
Zypper does not honor locked kernel packages
Last modified: 2022-09-22 07:24:29 UTC
Machine in question uses Kernel:stable repository for kernels. I am attempting to configure zypper to not also install kernels from the normal Leap 15.2 update repository. Presently, the 15.2 update repo provides 5.3.x kernels. The Kernel:stable repo provides 5.8.x kernels. Currently-installed kernel packages: # rpm -qa | grep kernel-default-5 kernel-default-5.8.11-1.1.gf4bb27a.x86_64 kernel-default-5.8.12-1.1.g79e03c2.x86_64 kernel-default-5.8.13-1.1.gea492d4.x86_64 Test #1: create a package lock for 5.3.* kernels: # zypper al kernel-default-5.3* kernel-default-devel-5.3* kernel-devel-5.3* kernel-source-5.3* kernel-syms-5.3* Specified locks have been successfully added. # zypper ll # | Name | Type | Repository --+---------------------------+---------+----------- 1 | kernel-default-5.3* | package | (any) 2 | kernel-default-devel-5.3* | package | (any) 3 | kernel-devel-5.3* | package | (any) 4 | kernel-source-5.3* | package | (any) 5 | kernel-syms-5.3* | package | (any) # zypper update <stuff> The following 11 NEW packages are going to be installed: kernel-default-5.3.18-lp152.44.1 kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.3.18-lp152.44.1 kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.3.18-lp152.44.1 kernel-devel-5.8.13-2.1.g08db7a3 kernel-preempt-devel kernel-source-5.3.18-lp152.44.1 kernel-source-5.8.13-2.1.g08db7a3 kernel-syms-5.3.18-lp152.44.1 kernel-syms-5.8.13-2.1.g08db7a3 <stuff> RESULTS: zypper ignores the package lock and wants to install 5.3.18 kernel. Test #2: Remove all package locks and create repository locks to prevent kernels from being installed from the 15.2 updates repository: # zypper al -r "openSUSE-Leap-15.2-Update" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel* Specified locks have been successfully added. # zypper ll # | Name | Type | Repository --+-----------------------+---------+------------ 1 | kernel-default* | package | repo-update 2 | kernel-default-devel* | package | repo-update 3 | kernel-devel* | package | repo-update 4 | kernel-macros* | package | repo-update 5 | kernel-source* | package | repo-update 6 | kernel-syms* | package | repo-update # zypper update <stuff> The following 11 NEW packages are going to be installed: kernel-default-5.3.18-lp152.19.2 kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.3.18-lp152.19.2 kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.3.18-lp152.19.2 kernel-devel-5.8.13-2.1.g08db7a3 kernel-preempt-devel kernel-source-5.3.18-lp152.19.2 kernel-source-5.8.13-2.1.g08db7a3 kernel-syms-5.3.18-lp152.19.2 kernel-syms-5.8.13-2.1.g08db7a3 <stuff> RESULTS: No change. The repository locks are ignored. zypper continues to want to install 5.3.18. Test #3: Remove those locks, create repository locks for Kernel:stable. # zypper al -r "Kernel:stable" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel* Specified locks have been successfully added. # zypper ll # | Name | Type | Repository --+-----------------------+---------+-------------- 1 | kernel-default* | package | Kernel:stable 2 | kernel-default-devel* | package | Kernel:stable 3 | kernel-devel* | package | Kernel:stable 4 | kernel-macros* | package | Kernel:stable 5 | kernel-source* | package | Kernel:stable 6 | kernel-syms* | package | Kernel:stable # zypper update <stuff> The following 6 NEW packages are going to be installed: kernel-default-5.3.18-lp152.44.1 kernel-default-devel-5.3.18-lp152.44.1 kernel-devel-5.3.18-lp152.44.1 kernel-preempt-devel kernel-source-5.3.18-lp152.44.1 kernel-syms-5.3.18-lp152.44.1 <stuff> RESULTS: The locks for Kernel:stable are honored. The 5.8.13 kernels are no longer marked for installation. Final test: Remove the Kernel:stable locks and create repository locks for "@System": # zypper al -r "@System" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel* Specified locks have been successfully added. # zypper ll # | Name | Type | Repository --+-----------------------+---------+----------- 1 | kernel-default* | package | (any) 2 | kernel-default-devel* | package | (any) 3 | kernel-devel* | package | (any) 4 | kernel-macros* | package | (any) 5 | kernel-source* | package | (any) 6 | kernel-syms* | package | (any) # zypper update <stuff> The following 31 items are locked and will not be changed by any action: Available: kernel-default-base kernel-default-base-rebuild kernel-default-debuginfo kernel-default-debugsource kernel-default-devel-debuginfo kernel-default-livepatch-devel kernel-devel-rt kernel-source-rt kernel-source-vanilla kernel-syms-rt <stuff> The following 9 package updates will NOT be installed: kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.8.13-2.1.g08db7a3 kernel-macros kernel-source-5.8.13-2.1.g08db7a3 kernel-syms-5.8.13-2.1.g08db7a3 libseccomp-devel ... <stuff> RESULTS: That also seems to work. No kernels are marked for installation now. ---------- So, I can create a repository lock to prevent kernels from being installed from Kernel:stable. I can create a global @System lock to prevent all kernels from being installed. But I seem to be unable to create a lock to specifically prevent 5.3.18 kernels from being installed from the 15.2 updates repo while still allowing kernels to be installed from Kernel:stable.
Upon closer examination, my conclusion about repository locks was incorrect. I neglected to look closely at the version of the 5.3.18 kernel that zypper marked for installation. It wasn't coming from the updates repo. It was coming from the 15.2 base repo. When I added repository locks for both the base- and updates repositories, zypper stopped attempting to install the 5.3.18 kernel. However, it seems like the package locks that I created in Test #1 should also have prevented installation. So I think there's still something wrong somewhere.
This is not how locks work. 'kernel-default-5.3*' would lock a package named 'kernel-default-5.3*' not 'kernel-default' with a version matching '5.3*'. In fact zypper supports just locking relative to an exact version ('>', '<' or '=' version). Matching versions might be a nice feature. We'll look into it...
We stay with the traditional capability matching 'name op version'. Matching versions in addition as string was considered to be more confusing.