search

dotnet / docs

This repository contains .NET Documentation.
https://learn.microsoft.com/dotnet
Creative Commons Attribution 4.0 International
4.28k stars 5.91k forks source link

"apt preferences" recommendations to exclude distribution packages won't work internationally #34861

Closed SomeoneElseOSM closed 1 year ago

SomeoneElseOSM commented 1 year ago

The text currently says:

Make sure to replace with your distribution's package source, for example, on Ubuntu you would use archive.ubuntu.com.

This probably works in the US, but elsewhere the origin might be different. In the UK it is "gb.archive.ubuntu.com", and "archive.ubuntu.com" on it's own doesn't work. Setting "*archive.ubuntu.com" as the origin does seem (at this stage) to work:

Package: dotnet* aspnet* netstandard*
Pin: origin "*archive.ubuntu.com"
Pin-Priority: -10

I'd also suggest mentioning that:

apt policy dotnet-host

(or similar) can be used to verify the priority that has been set.

Document Details

⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.

Associated WorkItem - 86073

omajid commented 1 year ago

@mirespace Can you help us verify this suggestion?

omajid commented 1 year ago

cc @adegeo

mirespace commented 1 year ago

Hi!

I've been researching a bit to double-check the use of wildcards in the Pin field because, to my knowledge, it was allowed only for the Package field (https://wiki.debian.org/AptConfiguration#line-138). I didn't find anything else specific to this, and the fact is that the wildcard works (maybe only in bash).

Therefore, to play it safe, I would suggest replacing <your-package-source> with the output from

apt-cache policy '~ndotnet.*' | grep archive.ubuntu | cut -d"/" -f3 | sort -u

(I'm using '~ndotnet.*' because it works in both zsh and bash).

I really like the suggestion about the use of apt-cache policy for checking the preferences have been set correctly (good point!)

SomeoneElseOSM commented 1 year ago

Sorry to throw another spanner in the works, but something that I hadn't thought about until now is that Cloud service providers will typically apply a cloud config that defines a mirror rather than anything "archive.ubuntu".

An example line from an apt sources.list might be:

deb https://mirror.hetzner.com/ubuntu/security jammy-security main restricted

Perhaps a text caveat might work, or the (suggested elsewhere in bug reports external to this github project) option of making microsoft sources a very high priority, rather than ubuntu sources a low one?

mirespace commented 1 year ago

Nothing to sorry about!

Mmm... in that case, and because with the above command we are only checking for sources that contain dotnet packages, it would be safe to filter by '/ubuntu' instead of 'archive.ubuntu', without taking into account the packages from microsoft. So, the command according to these changes would be the following one:

apt-cache policy '~ndotnet.*' | grep -v microsoft | grep '/ubuntu' | cut -d"/" -f3 | sort -u

And create entrances in the apt_preferences file accordingly (i.e., in the case he/she has the security pocket available -set on source.list- , maybe two urls can come on the output).