`apt-get install -t ${DIST}` fails to resolve package dependencies in some situations

Hi there, first of all thanks for this super useful action.

We of the LinuxCNC project use this action to verify our mesaflash debian package. Unfortunately, lately it's been failing due to a problem with apt's dependency resolver.

The problem is due to the current set of packages available in debian's package archive, in combination with the action's use of apt-get's "-t ${DISTRO}" argument. The problem is easily reproducible in a local docker container.

start a debian:bullseye container

$ docker run --tty --interactive debian:bullseye bash

apt-get update

root@9dc7d19b5bf7:/# apt-get update
Get:1 http://deb.debian.org/debian bullseye InRelease [116 kB]
Get:2 http://deb.debian.org/debian-security bullseye-security InRelease [48.4 kB]
Get:3 http://deb.debian.org/debian bullseye-updates InRelease [44.1 kB]
Get:4 http://deb.debian.org/debian bullseye/main amd64 Packages [8184 kB]
Get:5 http://deb.debian.org/debian-security bullseye-security/main amd64 Packages [194 kB]
Get:6 http://deb.debian.org/debian bullseye-updates/main amd64 Packages [14.6 kB]
Fetched 8600 kB in 4s (2283 kB/s)
Reading package lists... Done

The state of libtool

Note that libtool depends on libc6-dev.

root@9dc7d19b5bf7:/# apt-cache show libtool
Package: libtool
Version: 2.4.6-15
Installed-Size: 1198
Maintainer: Alastair McKinstry <mckinstry@debian.org>
Architecture: all
Depends: gcc | c-compiler, cpp, libc6-dev | libc-dev, file, autotools-dev
Recommends: libltdl-dev
Suggests: libtool-doc, autoconf (>> 2.50), automaken, gfortran | fortran95-compiler, gcj-jdk
Conflicts: autoconf (<= 2.12), automake (<= 1.3), libtool1.4
Description: Generic library support script
Description-md5: 40ea3da4a4ea75419ad95742898b3e52
Multi-Arch: foreign
Homepage: https://www.gnu.org/software/libtool/
Tag: devel::buildtools, devel::lang:c, devel::lang:c++, devel::lang:fortran,
 devel::lang:java, devel::library, implemented-in::c,
 implemented-in::java, implemented-in::shell, interface::commandline,
 role::devel-lib, role::program, scope::utility, suite::gnu
Section: devel
Priority: optional
Filename: pool/main/libt/libtool/libtool_2.4.6-15_all.deb
Size: 513428
MD5sum: 788c07aacc71775beabe81a67a3ca67f
SHA256: 557c52ba883e442504044d2329c0343c75b8df2073b440793c75651ccf4d3fe1

The state of libc6-dev

Note that there are two versions available, one in bullseye and one in bullseye-updates.

root@9dc7d19b5bf7:/# apt-cache policy libc6-dev
libc6-dev:
  Installed: (none)
  Candidate: 2.31-13+deb11u5
  Version table:
     2.31-13+deb11u5 500
        500 http://deb.debian.org/debian bullseye-updates/main amd64 Packages
     2.31-13+deb11u4 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages

Installing libtool from bullseye (like action-debian-package does) fails

root@9dc7d19b5bf7:/# apt-get install -t bullseye libtool
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 libtool : Depends: libc6-dev but it is not installable or
                    libc-dev
E: Unable to correct problems, you have held broken packages.

It works with `-t bullseye-updates`

root@9dc7d19b5bf7:/# apt-get install -t bullseye-updates libtool 
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  autoconf automake autotools-dev binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-10 file
  fontconfig-config fonts-dejavu-core gcc gcc-10 libasan6 libatomic1 libbinutils libbrotli1 libbsd0
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libdeflate0 libexpat1
  libfontconfig1 libfreetype6 libgcc-10-dev libgd3 libgdbm-compat4 libgdbm6 libgomp1 libisl23 libitm1
  libjbig0 libjpeg62-turbo liblsan0 libltdl-dev libltdl7 libmagic-mgc libmagic1 libmd0 libmpc3 libmpfr6
  libnsl-dev libperl5.32 libpng16-16 libquadmath0 libsigsegv2 libtiff5 libtirpc-dev libtsan0 libubsan1
  libwebp6 libx11-6 libx11-data libxau6 libxcb1 libxdmcp6 libxpm4 linux-libc-dev m4 manpages
  manpages-dev netbase perl perl-modules-5.32 sensible-utils ucf 
Suggested packages:
  autoconf-archive gnu-standards autoconf-doc gettext binutils-doc cpp-doc gcc-10-locales gcc-multilib
  make flex bison gdb gcc-doc gcc-10-multilib gcc-10-doc glibc-doc libgd-tools gdbm-l10n libtool-doc
  gfortran | fortran95-compiler gcj-jdk m4-doc man-browser perl-doc libterm-readline-gnu-perl
  | libterm-readline-perl-perl libtap-harness-archive-perl
The following NEW packages will be installed:
  autoconf automake autotools-dev binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-10 file
  fontconfig-config fonts-dejavu-core gcc gcc-10 libasan6 libatomic1 libbinutils libbrotli1 libbsd0
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libdeflate0 libexpat1
  libfontconfig1 libfreetype6 libgcc-10-dev libgd3 libgdbm-compat4 libgdbm6 libgomp1 libisl23 libitm1
  libjbig0 libjpeg62-turbo liblsan0 libltdl-dev libltdl7 libmagic-mgc libmagic1 libmd0 libmpc3 libmpfr6
  libnsl-dev libperl5.32 libpng16-16 libquadmath0 libsigsegv2 libtiff5 libtirpc-dev libtool libtsan0
  libubsan1 libwebp6 libx11-6 libx11-data libxau6 libxcb1 libxdmcp6 libxpm4 linux-libc-dev m4 manpages
  manpages-dev netbase perl perl-modules-5.32 sensible-utils ucf 
0 upgraded, 72 newly installed, 0 to remove and 1 not upgraded.
Need to get 65.5 MB of archives.
After this operation, 255 MB of additional disk space will be used.
Do you want to continue? [Y/n] n
Abort.

And it works if I omit `-t` entirely

root@9dc7d19b5bf7:/# apt-get install libtool
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  autoconf automake autotools-dev binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-10 file
  fontconfig-config fonts-dejavu-core gcc gcc-10 libasan6 libatomic1 libbinutils libbrotli1 libbsd0
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libdeflate0 libexpat1
  libfontconfig1 libfreetype6 libgcc-10-dev libgd3 libgdbm-compat4 libgdbm6 libgomp1 libisl23 libitm1
  libjbig0 libjpeg62-turbo liblsan0 libltdl-dev libltdl7 libmagic-mgc libmagic1 libmd0 libmpc3 libmpfr6
  libnsl-dev libperl5.32 libpng16-16 libquadmath0 libsigsegv2 libtiff5 libtirpc-dev libtsan0 libubsan1
  libwebp6 libx11-6 libx11-data libxau6 libxcb1 libxdmcp6 libxpm4 linux-libc-dev m4 manpages
  manpages-dev netbase perl perl-modules-5.32 sensible-utils ucf 
Suggested packages:
  autoconf-archive gnu-standards autoconf-doc gettext binutils-doc cpp-doc gcc-10-locales gcc-multilib
  make flex bison gdb gcc-doc gcc-10-multilib gcc-10-doc glibc-doc libgd-tools gdbm-l10n libtool-doc
  gfortran | fortran95-compiler gcj-jdk m4-doc man-browser perl-doc libterm-readline-gnu-perl
  | libterm-readline-perl-perl libtap-harness-archive-perl
The following NEW packages will be installed:
  autoconf automake autotools-dev binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-10 file
  fontconfig-config fonts-dejavu-core gcc gcc-10 libasan6 libatomic1 libbinutils libbrotli1 libbsd0
  libc-dev-bin libc-devtools libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libdeflate0 libexpat1
  libfontconfig1 libfreetype6 libgcc-10-dev libgd3 libgdbm-compat4 libgdbm6 libgomp1 libisl23 libitm1
  libjbig0 libjpeg62-turbo liblsan0 libltdl-dev libltdl7 libmagic-mgc libmagic1 libmd0 libmpc3 libmpfr6
  libnsl-dev libperl5.32 libpng16-16 libquadmath0 libsigsegv2 libtiff5 libtirpc-dev libtool libtsan0
  libubsan1 libwebp6 libx11-6 libx11-data libxau6 libxcb1 libxdmcp6 libxpm4 linux-libc-dev m4 manpages
  manpages-dev netbase perl perl-modules-5.32 sensible-utils ucf 
0 upgraded, 72 newly installed, 0 to remove and 1 not upgraded.
Need to get 65.5 MB of archives.
After this operation, 255 MB of additional disk space will be used.
Do you want to continue? [Y/n] n
Abort.

What's going on here?

The problem is that the debian:bullseye container was built with bullseye-updates enabled, so the installed version of libc6 is the one from bullseye-updates:

root@f31d136f7345:/# apt-cache policy libc6
libc6:
  Installed: 2.31-13+deb11u5
  Candidate: 2.31-13+deb11u5
  Version table:
 *** 2.31-13+deb11u5 500
        500 http://deb.debian.org/debian bullseye-updates/main amd64 Packages
        100 /var/lib/dpkg/status
     2.31-13+deb11u4 500
        500 http://deb.debian.org/debian bullseye/main amd64 Packages

All libc6-dev packages have a versioned dependency on the matching libc6, so the older libc6-dev in bullseye won't install with the newer libc6 from bullseye-updates:

root@f31d136f7345:/# apt-cache show libc6-dev
Package: libc6-dev   
Source: glibc
Version: 2.31-13+deb11u5
Installed-Size: 14507
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Architecture: amd64
Provides: libc-dev
Depends: libc6 (= 2.31-13+deb11u5), libc-dev-bin (= 2.31-13+deb11u5), linux-libc-dev, libcrypt-dev, libnsl
-dev
Suggests: glibc-doc, manpages-dev
Conflicts: libc0.1-dev, libc0.3-dev, libc6.1-dev
Breaks: libc6-dev-amd64-cross (<< 2.31~), libgcc-10-dev (<< 10-20200321-1~), libgcc-7-dev (<< 7.5.0-6~), l
ibgcc-8-dev (<< 8.4.0-2~), libgcc-9-dev (<< 9.3.0-5~), libperl5.26 (<< 5.26.1-3), python3.7 (<< 3.7.7-1+b1
), python3.8 (<< 3.8.2-1+b1)
Description: GNU C Library: Development Libraries and Header Files
Description-md5: 1bbdc717d9acdb44db940928d570e749
Multi-Arch: same
Homepage: https://www.gnu.org/software/libc/libc.html
Build-Essential: yes
Tag: devel::lang:c, devel::library, implemented-in::c, role::devel-lib,
 suite::gnu
Section: libdevel
Priority: optional
Filename: pool/main/g/glibc/libc6-dev_2.31-13+deb11u5_amd64.deb
Size: 2359020
SHA256: eb2cb7cf94d0513aea5b0ab5463b11e75c7a94121604b3f3eda0a7128ea28bc6

Package: libc6-dev
Source: glibc
Version: 2.31-13+deb11u4
Installed-Size: 14508
Maintainer: GNU Libc Maintainers <debian-glibc@lists.debian.org>
Architecture: amd64
Provides: libc-dev
Depends: libc6 (= 2.31-13+deb11u4), libc-dev-bin (= 2.31-13+deb11u4), linux-libc-dev, libcrypt-dev, libnsl
-dev
Suggests: glibc-doc, manpages-dev
Conflicts: libc0.1-dev, libc0.3-dev, libc6.1-dev
Breaks: libc6-dev-amd64-cross (<< 2.31~), libgcc-10-dev (<< 10-20200321-1~), libgcc-7-dev (<< 7.5.0-6~), l
ibgcc-8-dev (<< 8.4.0-2~), libgcc-9-dev (<< 9.3.0-5~), libperl5.26 (<< 5.26.1-3), python3.7 (<< 3.7.7-1+b1
), python3.8 (<< 3.8.2-1+b1)
Description: GNU C Library: Development Libraries and Header Files
Description-md5: 1bbdc717d9acdb44db940928d570e749
Multi-Arch: same
Homepage: https://www.gnu.org/software/libc/libc.html
Build-Essential: yes
Tag: devel::lang:c, devel::library, implemented-in::c, role::devel-lib,
 suite::gnu
Section: libdevel
Priority: optional
Filename: pool/main/g/glibc/libc6-dev_2.31-13+deb11u4_amd64.deb
Size: 2359752
MD5sum: 5dedeee9aa95d29dce351acfbd439aad
SHA256: 5f368eb89d102ccd23529a02fb17aaa1c15e7612506e22ef0c559b71f5049a91

What to do?

My initial reaction is to simply remove -t from the apt-get command line and let the package dependency resolver pick the package versions it wants from among the available options (as determined by the apt sources lists). I see that you added -t in commit e535e3a99c971b89f6e4f3b9330606e14aeba58d specifically to support backports. But is the -t really needed in that situation? Maybe I'm missing something about how the rest of the action is set up (I didn't look too closely), but it seems to me that as long as the apt sources are set up correctly, apt's package dependency resolver will pick the correct package version.

dawidd6 / action-debian-package