dnf-automatic and dnf have different behaviour. (And a bit erratic)

[rafitadiaz]

In short: dnf-automatic shows pending updates dnf is not finding/installing them

---

Long explanation:

This was tested on a Rocky 9.3 with the rpm and dnf packages updated to the latest version

I have dnf-automatic configured to notify for security updates

upgrade_type = security
download_updates = yes
apply_updates = no

$ dnf-automatic
Last metadata expiration check: 3:03:00 ago on Thu 08 Aug 2024 10:04:52 AM UTC.
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.

And I got a email notification with this:

The following updates were downloaded on 'jenkins-test':  
================================================================================  
 Package              Arch    Version                      Repository      Size  
================================================================================  
Installing:  
 kernel               x86_64  5.14.0-427.28.1.el9_4        baseos         5.0 M  
 kernel-core          x86_64  5.14.0-427.28.1.el9_4        baseos          20 M  
 kernel-modules       x86_64  5.14.0-427.28.1.el9_4        baseos          38 M  
 libndp               x86_64  1.8-6.el9_4                  baseos          36 k
Upgrading:  
 kernel-tools         x86_64  5.14.0-427.28.1.el9_4        baseos         5.3 M  
 kernel-tools-libs    x86_64  5.14.0-427.28.1.el9_4        baseos         5.0 M  
Installing dependencies:  
 kernel-modules-core  x86_64  5.14.0-427.28.1.el9_4        baseos          32 M  
Removing:  
 kernel               x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel    0   
 kernel-core          x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   56 M  
 kernel-modules       x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   33 M  
 kernel-modules-core  x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   31 M

So if I want to do the upgrade manually I got:

$ sudo dnf upgrade --security
Last metadata expiration check: 2:42:18 ago on Wed 07 Aug 2024 08:44:30 AM UTC.
Dependencies resolved.
======================================================================================================================
 Package                   Architecture              Version                          Repository                 Size
======================================================================================================================
Upgrading:
 libndp                    x86_64                    1.8-6.el9_4                      baseos                     36 k

So just the libndp package, The kernel packages are not being upgraded
I also tried with a normal dnf upgrade without the --security flag

$ dnf upgrade kernel
Last metadata expiration check: 3:03:32 ago on Thu 08 Aug 2024 10:04:52 AM UTC.
Dependencies resolved.
Nothing to do.
Complete!

If I run again dnf-automatic --downloadupdates I still get notification for the kernel packages, I can see the packages downloaded in the cache but I can't install them via dnf

The only way I could do that was going to the cache folder an run a rpm manually.

$ rpm -Uvh *
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:kernel-modules-core-5.14.0-427.28################################# [  5%]
   2:kernel-core-5.14.0-427.28.1.el9_4################################# [ 10%]
   3:kernel-modules-5.14.0-427.28.1.el################################# [ 15%]
   4:kernel-tools-libs-5.14.0-427.28.1################################# [ 20%]
   5:kernel-tools-5.14.0-427.28.1.el9_################################# [ 25%]
   6:kernel-5.14.0-427.28.1.el9_4     ################################# [ 30%]

Now after reboot, dnf-automatic doesn't shows any pending update

$ dnf-automatic
Last metadata expiration check: 1:18:36 ago on Thu 08 Aug 2024 01:40:40 PM UTC.
No security updates needed, but 197 updates available

Questions:

• Why dnf-automatic with upgrade_type = security and dnf upgrade --security has different output behaviour?
• I was expecting that both tools should report/update the same packages.

[m-blaha]

So far, I haven’t found any difference between dnf upgrade --security and your dnf-automatic configuration.

If the issue is still reproducible, it might be helpful to gather more details about the resolved RPM transaction:

1. For dnf, run dnf upgrade --debugsolver to create a ./debugdata directory.
2. For dnf-automatic, add debug_solver = 1 to the [base] section of the /etc/dnf/automatic.conf file, and then run dnf-automatic from a different directory. Again, this will generate a ./debugdata directory with transaction details.

Comparing these two debugdata directories might provide insight into why the transactions differ.