Bullseye migration stuck on "The following packages have been kept back"

Hi,

It’s my turn to try the migration, and I have some problems.

I’m on an amd64 Debian on an RPI4 with Yunohost installed.

I tried to migrate but it went wrong, and I tried to solve the problems step by step. I lost track of all the repairs I made, but I remember that I had to solve a GPG key problem for Raspberry Debain repo, and then I had a lot of packages “kept back”.

Currently the situation is:

admin@server:~ $ sudo apt-get update && sudo apt-get upgrade
Hit:1 http://deb.debian.org/debian bullseye InRelease
Hit:2 http://deb.debian.org/debian-security bullseye-security InRelease
Hit:3 http://archive.raspberrypi.org/debian bullseye InRelease
Hit:4 http://forge.yunohost.org/debian bullseye InRelease
Hit:5 http://deb.debian.org/debian bullseye-updates InRelease
Reading package lists... Done
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
  bind9-host bind9utils dirmngr dnsutils dpkg gnupg-utils gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm
  gpgv ldap-utils libc-bin libc-dev-bin libc6 libc6-dbg libc6-dev libcryptsetup12 libcurl3-gnutls libgnutls30
  libldap-2.4-2 libmount1 libpam-chksshpwd libpam-modules libpam-modules-bin libtiff5 libwbclient0 libxml2
  libxslt1.1 locales mount perl perl-base python3-lxml python3-spidev redis-server redis-tools rsyslog slapd
  util-linux
0 upgraded, 0 newly installed, 0 to remove and 42 not upgraded.

And I’m stuck there and I don’t know how to upgrade the kept back packets (I also tried the more agressive dist-upgarde).

I unistalled all the YNH app to make sure the problem was not here.

I tried “manual install” but there is too deep dependency problems:

admin@server:~ $ sudo apt-get install bind9-host bind9utils dirmngr dnsutils dpkg gnupg-utils gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm  gpgv ldap-utils libc-bin libc-dev-bin libc6 libc6-dbg libc6-dev libcryptsetup12 libcurl3-gnutls libgnutls30  libldap-2.4-2 libmount1 libpam-chksshpwd libpam-modules libpam-modules-bin libtiff5 libwbclient0 libxml2  libxslt1.1 locales mount perl perl-base python3-lxml python3-spidev redis-server redis-tools rsyslog slapd  util-linux
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 bind9-host : Depends: bind9-libs (>= 1:9.16.27) but it is not going to be installed
 bind9utils : Depends: bind9-utils but it is not going to be installed
 dirmngr : Depends: libgpg-error0 (>= 1.38) but 1.35-1 is to be installed
           Recommends: gnupg (= 2.2.27-2+deb11u2) but it is not going to be installed
 dnsutils : Depends: bind9-dnsutils but it is not going to be installed
 dpkg : PreDepends: libselinux1 (>= 3.1~) but 2.8-1+b1 is to be installed
 equivs : Depends: debhelper but it is not going to be installed
 gnupg-utils : Depends: libreadline8 (>= 6.0) but it is not installable
 gpg : Depends: libgpg-error0 (>= 1.38) but 1.35-1 is to be installed
       Depends: libreadline8 (>= 6.0) but it is not installable
       Recommends: gnupg (= 2.2.27-2+deb11u2) but it is not going to be installed
 gpg-agent : Depends: libgpg-error0 (>= 1.38) but 1.35-1 is to be installed
             Recommends: gnupg (= 2.2.27-2+deb11u2) but it is not going to be installed
 gpgconf : Depends: libreadline8 (>= 6.0) but it is not installable
 gpgsm : Depends: libgpg-error0 (>= 1.38) but 1.35-1 is to be installed
         Depends: libksba8 (>= 1.5.0) but 1.3.5-2 is to be installed
         Depends: libreadline8 (>= 6.0) but it is not installable
         Recommends: gnupg (= 2.2.27-2+deb11u2) but it is not going to be installed
 gpgv : Depends: libgpg-error0 (>= 1.38) but 1.35-1 is to be installed
 libc6 : Depends: libgcc-s1 but it is not installable
         Depends: libcrypt1 but it is not installable
         Recommends: libnss-nis but it is not installable
         Recommends: libnss-nisplus but it is not installable
 libc6-dev : Depends: libcrypt-dev but it is not installable
             Depends: libnsl-dev but it is not installable
             Breaks: python3.7 (< 3.7.7-1+b1) but 3.7.3-2+deb10u3 is to be installed
 libcryptsetup12 : Depends: libjson-c5 (>= 0.15) but it is not installable
 libcurl3-gnutls : Depends: libnettle8 but it is not installable
 libgnutls30 : Depends: libhogweed6 (>= 3.6) but it is not installable
               Depends: libnettle8 (>= 3.7~) but it is not installable
               Depends: libp11-kit0 (>= 0.23.18.1) but 0.23.15-2+deb10u1 is to be installed
               Depends: libtasn1-6 (>= 4.14) but 4.13-3 is to be installed
 libmount1 : Depends: libselinux1 (>= 3.1~) but 2.8-1+b1 is to be installed
 libpam-chksshpwd : Depends: libcrypt1 (>= 1:4.1.0) but it is not installable
 libpam-modules : PreDepends: libcrypt1 (>= 1:4.3.0) but it is not installable
                  PreDepends: libnsl2 (>= 1.0) but it is not installable
                  PreDepends: libselinux1 (>= 3.1~) but 2.8-1+b1 is to be installed
 libpam-modules-bin : Depends: libcrypt1 (>= 1:4.3.0) but it is not installable
                      Depends: libselinux1 (>= 3.1~) but 2.8-1+b1 is to be installed
 libtiff5 : Depends: libdeflate0 (>= 1.0) but it is not installable
            Depends: libzstd1 (>= 1.4.0) but 1.3.8+dfsg-3+deb10u2 is to be installed
 libwbclient0 : Depends: libicu67 (>= 67.1-1~) but it is not installable
                Depends: libtalloc2 (>= 2.3.1~) but 2.1.14-2 is to be installed
                Depends: libtevent0 (>= 0.10.2~) but it is not installable
 libxml2 : Depends: libicu67 (>= 67.1-1~) but it is not installable
 moulinette : Depends: python3-bottle (>= 0.12) but it is not going to be installed
              Depends: python3-prompt-toolkit but it is not going to be installed
              Depends: python3-pygments but it is not going to be installed
              Depends: python3-gevent-websocket but it is not going to be installed
 perl : Depends: libperl5.32 (= 5.32.1-4+deb11u1) but it is not going to be installed
 perl-base : PreDepends: libcrypt1 (>= 1:4.1.0) but it is not installable
 python3-lxml : Depends: python3 (>= 3.9~) but 3.7.3-1 is to be installed
                Recommends: python3-html5lib but it is not going to be installed
 python3-spidev : Depends: python3 (>= 3.9~) but 3.7.3-1 is to be installed
 redis-tools : Depends: liblzf1 (>= 1.5) but it is not installable
 rsyslog : Depends: libsystemd0 (>= 246) but 241-7~deb10u8 is to be installed
 slapd : Depends: libcrypt1 (>= 1:4.1.0) but it is not installable
         Depends: libperl5.32 (>= 5.32.0~rc1) but it is not going to be installed
 ssowat : Depends: nginx-extras (>= 1.6.2) but it is not going to be installed
 util-linux : PreDepends: libcrypt1 (>= 1:4.1.0) but it is not installable
              PreDepends: libselinux1 (>= 3.1~) but 2.8-1+b1 is to be installed
 yunohost : Depends: mariadb-server but it is not going to be installed
            Depends: openssh-server but it is not going to be installed
            Depends: unscd but it is not going to be installed
            Depends: postfix-policyd-spf-perl but it is not going to be installed
            Recommends: python3-pip but it is not going to be installed
            Recommends: unattended-upgrades but it is not going to be installed
            Recommends: libdbd-ldap-perl but it is not going to be installed
E: Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.

I have no idea what to do now… I’m about to reinstall the Debian and YNH… If anyone has another idea I would be very pleased!

Please avoid to run apt yourself, the migration is more complex than just running apt (dist-)upgrade

What happens if you try to re-run the migration ?

1 Like

Sorry I forgot to mention that I went to apt BECAUSE the migration failed in first place (that was the GPG key problem If I recall correcly).

Here are the logs of the migration I just tested at the moment:

https://paste.yunohost.org/raw/biyuqujuze

Ok so let’s check if

sudo apt-mark showhold

returns anything ?

Also I’m not super familiar with those gpg-wks* stuff and libc6-dbg sounds a bit unecessary to have ? So I would naively try to remove them and see what happens:

apt remove gpg-wks-client gpg-wks-server libc6-dbg --dry-run

Thanks for your very very fast answers!

admin@server:~ $ sudo apt-mark showhold
moulinette
ssowat
yunohost
yunohost-admin
admin@ynh:~ $ apt remove gpg-wks-client gpg-wks-server libc6-dbg --dry-run
NOTE: This is only a simulation!
      apt needs root privileges for real execution.
      Keep also in mind that locking is deactivated,
      so don't depend on the relevance to the real current situation!
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be REMOVED:
  gpg-wks-client gpg-wks-server libc6-dbg
0 upgraded, 0 newly installed, 3 to remove and 39 not upgraded.
Remv gpg-wks-client [2.2.12-1+deb10u2]
Remv gpg-wks-server [2.2.12-1+deb10u2]
Remv libc6-dbg [2.28-10+rpt2+rpi1+deb10u1]

So it seems harmless, so I tried to do it (without dry-run) and then to migrate again.

The results are here: https://paste.yunohost.org/raw/opibacadeb

Hmmmokay so let’s try

apt install bind9-host bind9utils dnsutils ldap-utils libldap-2.4-2 locales

Though I’m suspecting apt is gonna throw again a super long list of stuff it doesn’t want to install without actually explaining why @_@

You are right :sweat_smile: but, the list is smaller without libc6

admin@server:~ $ sudo apt install bind9-host bind9utils dnsutils ldap-utils libldap-2.4-2 locales
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 bind9-host : Depends: bind9-libs (>= 1:9.16.27) but it is not going to be installed
 bind9utils : Depends: bind9-utils but it is not going to be installed
 dnsutils : Depends: bind9-dnsutils but it is not going to be installed
 libldap-2.4-2 : Depends: libgnutls30 (>= 3.7.0) but 3.6.7-4+deb10u9 is to be installed
 locales : Depends: libc-bin (> 2.31)
 yunohost : Depends: slapd but it is not going to be installed
E: Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.

Zblerg so let’s keep on with the usual dance with apt until it spits out what’s the actual issue:

apt install bind9-host bind9utils dnsutils ldap-utils libldap-2.4-2 locales bind9-libs bind9-utils bind9-dnsutils libgnutls30 libc-bin slapd --dry-run

First step

admin@server:~ $ sudo apt install bind9-host bind9utils dnsutils ldap-utils libldap-2.4-2 locales bind9-libs bind9-utils bind9-dnsutils libgnutls30 libc-bin slapd --dry-run
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 bind9-libs : Depends: libjson-c5 (>= 0.15) but it is not installable
              Depends: libmaxminddb0 (>= 1.3.0) but it is not installable
              Depends: libuv1 (>= 1.34.2) but it is not installable
 libc-bin : Depends: libc6 (> 2.31) but 2.28-10+rpt2+rpi1+deb10u1 is to be installed
 libgnutls30 : Depends: libhogweed6 (>= 3.6) but it is not installable
               Depends: libnettle8 (>= 3.7~) but it is not installable
               Depends: libp11-kit0 (>= 0.23.18.1) but 0.23.15-2+deb10u1 is to be installed
               Depends: libtasn1-6 (>= 4.14) but 4.13-3 is to be installed
 slapd : Depends: libcrypt1 (>= 1:4.1.0) but it is not installable
         Depends: libperl5.32 (>= 5.32.0~rc1) but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Second step

sudo apt install bind9-host bind9utils dnsutils ldap-utils libldap-2.4-2 locales bind9-libs bind9-utils bind9-dnsutils libgnutls30 libc-bin slapd libjson-c5 libmaxminddb0 libuv1 libc6 libhogweed6 libnettle8 libp11-kit0 libtasn1-6 --dry-run
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package libjson-c5 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

Package libmaxminddb0 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

Package libuv1 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

Package libnettle8 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

Package libhogweed6 is not available, but is referred to by another package.
This may mean that the package is missing, has been obsoleted, or
is only available from another source

E: Package 'libjson-c5' has no installation candidate
E: Package 'libmaxminddb0' has no installation candidate
E: Package 'libuv1' has no installation candidate
E: Package 'libhogweed6' has no installation candidate
E: Package 'libnettle8' has no installation candidate

:exploding_head:

also:

admin@server:~ $ sudo apt remove libc-bin --dry-run
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages were automatically installed and are no longer required:
  libllvm7 libsensors-config libsensors5 sysstat
Use 'sudo apt autoremove' to remove them.
The following packages will be REMOVED:
  libc-bin locales postgresql-11
WARNING: The following essential packages will be removed.
This should NOT be done unless you know exactly what you are doing!
  libc-bin
0 upgraded, 0 newly installed, 3 to remove and 37 not upgraded.
Remv postgresql-11 [11.17-0+deb10u1]
Remv locales [2.28-10+rpt2+rpi1+deb10u1]
Remv libc-bin [2.28-10+rpt2+rpi1+deb10u1]

Eeeeh yeah we definitely want to keep libc-bin

However I’m thinking those packages are not necessary ?

apt remove bind9utils dnsutils  bind9-utils --dry-run

This is the result:

admin@server:~ $ apt remove bind9utils dnsutils  bind9-utils --dry-run
NOTE: This is only a simulation!
      apt needs root privileges for real execution.
      Keep also in mind that locking is deactivated,
      so don't depend on the relevance to the real current situation!
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Package 'bind9-utils' is not installed, so not removed
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 yunohost : Depends: dnsutils
            Depends: bind9utils
E: Error, pkgProblemResolver::Resolve generated breaks, this may be caused by held packages.

Hmoké so maybe those are not the actual issue… Back to libgnutls30, there’s definitely something funky because libhogweed6 and libnettle8 should definitely be available

So let’s check:

apt policy libnettle8
apt policy libhogweed6
admin@server:~ $ apt policy libnettle8
libnettle8:
  Installed: (none)
  Candidate: (none)
  Version table:
admin@server:~ $ apt policy libhogweed6
libhogweed6:
  Installed: (none)
  Candidate: (none)
  Version table:

I’m lost (not very familiar with packaging)…

Yeah debugging apt packages is a fraking mess and nobody should have to endure this madness …

The policy result is a big funky … Debian’s “base” repo is suppose to provide it, eg I have:

libnettle8:
  Installed: 3.7.3-1
  Candidate: 3.7.3-1
  Version table:
 *** 3.7.3-1 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages
        100 /var/lib/dpkg/status

And I see that you do seem to have the usual deb.debian.org properly configured in your /etc/apt/sources.list* (from the migration log earlier) …

So let’s double check with :

sudo cat /etc/apt/sources.list /etc/apt/sources.list.d/* | grep "^deb "

And also just in case, let’s re-run the apt policy with sudo though pretty sure that wont change the output:

sudo apt policy libhogweed6
admin@server:~ $ sudo cat /etc/apt/sources.list /etc/apt/sources.list.d/* | grep "^deb "
deb http://deb.debian.org/debian bullseye main contrib non-free
deb http://deb.debian.org/debian-security/ bullseye-security main contrib non-free
deb http://deb.debian.org/debian bullseye-updates main contrib non-free
deb http://archive.raspberrypi.org/debian/ bullseye main
deb http://forge.yunohost.org/debian/ bullseye stable
admin@server:~ $ sudo apt policy libhogweed6
libhogweed6:
  Installed: (none)
  Candidate: (none)
  Version table:

Unfortunately not much clues…

Zgrbl, let’s run apt update just in case somehow the cache was cleared recently? Then recheck apt policy ?

sudo apt update
sudo apt policy libhogweed6

The same…

Maybe this could be interesting:

admin@server:~ $ apt list --upgradable
Listing... Done
bind9-host/stable-security 1:9.16.27-1~deb11u1 arm64 [upgradable from: 1:9.11.5.P4+dfsg-5.1+deb10u7]
bind9utils/stable-security,stable-security 1:9.16.27-1~deb11u1 arm64 [upgradable from: 1:9.11.5.P4+dfsg-5.1+deb10u7]
dirmngr/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
dnsutils/stable-security,stable-security 1:9.16.27-1~deb11u1 arm64 [upgradable from: 1:9.11.5.P4+dfsg-5.1+deb10u7]
dpkg/stable-security 1.20.10 arm64 [upgradable from: 1.19.8]
gnupg-utils/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
gpg-agent/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
gpg/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
gpgconf/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
gpgsm/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
gpgv/stable-security 2.2.27-2+deb11u2 arm64 [upgradable from: 2.2.12-1+deb10u2]
ldap-utils/stable-security 2.4.57+dfsg-3+deb11u1 arm64 [upgradable from: 2.4.47+dfsg-3+deb10u7]
libc-bin/stable 2.31-13+rpt2+rpi1+deb11u3 arm64 [upgradable from: 2.28-10+rpt2+rpi1+deb10u1]
libc-dev-bin/stable 2.31-13+rpt2+rpi1+deb11u3 arm64 [upgradable from: 2.28-10+rpt2+rpi1+deb10u1]
libc6-dev/stable 2.31-13+rpt2+rpi1+deb11u3 arm64 [upgradable from: 2.28-10+rpt2+rpi1+deb10u1]
libc6/stable 2.31-13+rpt2+rpi1+deb11u3 arm64 [upgradable from: 2.28-10+rpt2+rpi1+deb10u1]
libcryptsetup12/stable-security 2:2.3.7-1+deb11u1 arm64 [upgradable from: 2:2.1.0-5+deb10u2]
libcurl3-gnutls/stable-security 7.74.0-1.3+deb11u2 arm64 [upgradable from: 7.64.0-4+deb10u3]
libgnutls30/stable-security 3.7.1-5+deb11u2 arm64 [upgradable from: 3.6.7-4+deb10u9]
libldap-2.4-2/stable-security 2.4.57+dfsg-3+deb11u1 arm64 [upgradable from: 2.4.47+dfsg-3+deb10u7]
libmount1/stable-security 2.36.1-8+deb11u1 arm64 [upgradable from: 2.33.1-0.1]
libpam-chksshpwd/stable 1.4.0-9+deb11u1+rpt2 arm64 [upgradable from: 1.3.1-5+rpt2]
libpam-modules-bin/stable 1.4.0-9+deb11u1+rpt2 arm64 [upgradable from: 1.3.1-5+rpt2]
libpam-modules/stable 1.4.0-9+deb11u1+rpt2 arm64 [upgradable from: 1.3.1-5+rpt2]
libtiff5/stable-security 4.2.0-1+deb11u1 arm64 [upgradable from: 4.1.0+git191117-2~deb10u4]
libwbclient0/stable-security 2:4.13.13+dfsg-1~deb11u5 arm64 [upgradable from: 2:4.9.5+dfsg-5+deb10u3]
libxml2/stable-security 2.9.10+dfsg-6.7+deb11u2 arm64 [upgradable from: 2.9.4+dfsg1-7+deb10u4]
libxslt1.1/stable-security 1.1.34-4+deb11u1 arm64 [upgradable from: 1.1.32-2.2~deb10u1]
locales/stable,stable 2.31-13+rpt2+rpi1+deb11u3 all [upgradable from: 2.28-10+rpt2+rpi1+deb10u1]
mount/stable-security 2.36.1-8+deb11u1 arm64 [upgradable from: 2.33.1-0.1]
perl-base/stable-security 5.32.1-4+deb11u1 arm64 [upgradable from: 5.28.1-6+deb10u1]
perl/stable-security 5.32.1-4+deb11u1 arm64 [upgradable from: 5.28.1-6+deb10u1]
python3-lxml/stable-security 4.6.3+dfsg-0.1+deb11u1 arm64 [upgradable from: 4.3.2-1+deb10u4]
python3-spidev/stable 20200602~200721-1 arm64 [upgradable from: 20200602~200721-1~buster]
redis-server/stable-security 5:6.0.16-1+deb11u2 arm64 [upgradable from: 5:5.0.14-1+deb10u2]
redis-tools/stable-security 5:6.0.16-1+deb11u2 arm64 [upgradable from: 5:5.0.14-1+deb10u2]
rsyslog/stable-security 8.2102.0-2+deb11u1 arm64 [upgradable from: 8.1901.0-1+deb10u2]
slapd/stable-security 2.4.57+dfsg-3+deb11u1 arm64 [upgradable from: 2.4.47+dfsg-3+deb10u7]
util-linux/stable-security 2.36.1-8+deb11u1 arm64 [upgradable from: 2.33.1-0.1]

I am sorry to let you go through all this. Maybe I should simply reinstall a new bullseye and YNH, then restore my settings, no?

As a developer I will always argue that we should go to the bottom of things to identify exactly what’s the root issue so that we can fix it for everybody, I know that people like to be like “let’s reinstall from scratch” but that’s not is not an acceptable answer project-wide … But if you’re more comfortable with reinstalling everything, go for it …

Right now I’m looking at Index of /debian/pool/main/n/nettle and I do see the libhogweed packages being available so I don’t understand how apt update / apt policy is not understanding they’re here …

1 Like