apt repository broken when having only jammy and jammy-security apt-repos enabled

Thank you for taking the time to report this bug and helping to make Ubuntu better. It seems that your bug report is not filed about a specific source package though, rather it is just filed against Ubuntu in general. It is important that bug reports be filed about source packages so that people interested in the package can find the bugs about it. You can find some hints about determining what package your bug might be about at https://wiki.ubuntu.com/Bugs/FindRightPackage. You might also ask for help in the #ubuntu-bugs irc channel on Libera.chat.

To change the source package that this bug is filed about visit https://bugs.launchpad.net/ubuntu/+bug/2008465/+editstatus and add the package name in the text box next to the word Package.

[This is an automated message. I apologize if it reached you inappropriately; please just reply to this message indicating so.]

Following the recomendation to assign to a package because no reaction, but I assume this is a general relase process bug, though.

Thanks to a reply in the forum
https://ubuntuforums.org/showthread.php?t=2484515

looking at the ubuntu 22.0.4.1 point release notes
https://discourse.ubuntu.com/t/jammy-jellyfish-point-release-changes/29835/3
and there searching for "ldap" leaves to the "openldap - 2.5.13+dfsg-0ubuntu0.22.04.1" package update bug
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1983618

and there is reference to the bug
https://bugs.launchpad.net/ubuntu/+source/openldap/+bug/1977627
where "openldap (2.5.12+dfsg-0ubuntu0.22.04.1) jammy; urgency=medium"
was introduced.

These bugs are nearly unreadable to me.

I can not understand if openldap 2.5.12+dfsg-0ubuntu0.22.04.1 should be in the "jammy" repository or in the "jammy-updates" repository.

We have installed all our Ubuntu 18 server installs from the 18.04.1 server cd and never had the apt repo broken problem. Was that only luck?

So simple question:
If we want only jammy and jammy-security apt repos (see our sources.list in OP), do we need to install Ubuntu 22.04 server from the very first 22.04 live cd, and must not use the later 22.04.1 point release install cd ?

Hey,
it turns out this worked for most people but if you go into enough detail they start to disagree.
This was discussed [1], got "no it is not supported" [2] and people saying "yes we do" [3] and some people stating what I'd have expected [4] to be related to only-auto-update.

But no matter which is entirely true, this needs to be sorted out and documented better.
As well as then been made part of some testing and more considerations.
I'll try to organize a meeting at the next sprint with the right people.

Until then this isn't really an openldap question, it is more a release-team tasks on documentation. Depending where the discussion ends it might be something entirely else eventually, but for now that at least represents the state better.

[1]: https://irclogs.ubuntu.com/2023/03/01/%23ubuntu-release.html#t18:33
[2]: https://irclogs.ubuntu.com/2023/03/01/%23ubuntu-release.html#t18:38
[3]: https://irclogs.ubuntu.com/2023/03/01/%23ubuntu-release.html#t18:49
[4]: https://irclogs.ubuntu.com/2023/03/01/%23ubuntu-release.html#t19:05

Thanks Sergio for finding how to assign back to Ubuntu as a project.

In the meantime I think there are a couple of possible workarounds for this particular scenario.

1. Before putting the system into production, add -updates to sources.list, run apt update, install the required packages, remove -updates and run apt update again.

2. Install from non point release media (eg. the original 20.04 instead of 20.04.1). Note though that you won't get updates available since the original release, whereas many would be happy to have those and just prevent further updates during production.

Declining this for the Release Team. The documentation that says this configuration is supported is not owned by the Release Team. Reassigning to Security.

Anyway, in practice you will need to have -updates enabled when installing new packages in order for it to be guaranteed to work correctly. You can use apt preferences (pinning) to control whether packages are pulled from there by default.

Thanks that this bug is noticed and worked on.

Regarding
https://bugs.launchpad.net/ubuntu/+bug/2008465/comments/6

> 1. Before putting the system into production, add -updates to sources.list, run apt update, install the required packages, remove -updates and run apt update again.
It can always be the case that new packages will be installed later (we have bought extended security maintenance ESM, so the server will hopefully be productive for the next nine years). So this is not a clean solution (allthough I guess after some years the "jammy-security"-packages will be newer than the 22.04.1 point release "jammy-updates"-packages, so the probability to run into this issue will decrease)

> 2. [...] many would be happy to have those and just prevent further updates during production.
This is exactly our case. We want to have the biggest bugs being fixed in the 04.1 point release, be it security or just bugs, and wait for that point release before starting a new LTS release. But we do not want to have further bug-fixes, only security-updates.

Please give an update on the status of this essential issue.

There is no actionable item here on our part. The only true way to install a system without having -updates enabled is to install from the initial release isos, and not one of the point release isos.

The point releases isos are all built with -updates enabled, so using them will result in a system with packages from -updates, and while you can certainly try and turn off -updates, sooner or later you will hit issues.

The two options suggested in comment #6 are the only options available to you. You either:

1- leave -updates enabled
2- enable -updates temporarily when installing new packages (this option may also prevent some security updates from installing automatically if they require new dependencies)
3- install from the original release iso

I think an actionable item would be to cleanly document the content of comment #10.

It should be documented that iso point releaseses are mandatory -updates pocket if user wants to rule out nasty breakage completely.

E.g. in https://wiki.ubuntu.com/SecurityTeam/FAQ

behind
"Systems configured to use only the security pocket are also supported." should be written that the install iso has to be the initial release.

Ah yes, thanks for the suggestion, I've added a disclaimer to the wiki.