Debian – Why Do Previous Versions of Debian Packages Vanish in the Repositories?

debianpackage-management

Scenario: In version controlled system configuration based on Puppet, Chef etc., it is required to reproduce a certain system state. This is done by explicitly specifying system package versions.

Recently we ran into a problem where certain package versions were missing in the Debian repositories. One example: The "patch" package was required in version 2.7.5-1+deb9u1, but only 2.7.5-1+deb9u2 was available. Another, even more severe example: "linux-headers-4.9.0-9-common" is required (due to the associated kernel being installed) and only "linux-headers-4.9.0-11-common" is available.

This makes it impossible to reproduce a certain state of a system.

The above packages are just examples (which I in fact encountered). I am interested in understanding and solving the general problem.

What is the idea behind these updates, 'vanishing' packages and package versions?

Where can I get previous versions (not really old versions, but versions that are a couple of weeks old) of Debian packages? It should be possible to automate the installation process in general way.

Best Answer

Being able to reproduce a specific setup, down to the exact version, is your requirement, not Debian’s.

Debian only supports a single version of each binary package in any given release; the counterpart of that is that great care is taken to ensure that package updates in any given release don’t introduce regressions, and when such care isn’t possible, to document that fact. Keeping multiple versions of a given package would only increase the support burden and the test requirements: for example, package maintainers would have to test updated packages against all available versions of the libraries they use, instead of only the currently-supported versions... Packages are only updated in a stable release when really necessary, i.e. to fix a serious bug (including security issues). In the kernel’s case, this sometimes means that the kernel ABI changes, and the package name changes as a result of that (to force rebuilds of dependent packages); there are meta-packages which you can pull in instead of hard-coding the ABI (linux-image-amd64, linux-headers-amd64, etc.).

There is however a workaround for your situation: every published source and binary package is archived on snapshot.debian.org. When you create a versioned setup, you can pick the corresponding snapshot (for example, one of the September 2019 snapshots) and use that as your repository URL:

deb https://snapshot.debian.org/archive/debian/20190930T084755Z/ buster main

If you end up relying on this, please use a caching mirror of some sort, for example Apt-Cacher NG. This will not only reduce the load on the snapshot server, it will ensure that you have a local copy of all the packages you need.

(The situation with regards to source packages is slightly more complex, and the archives do carry multiple versions of some source packages in a given release, because of licensing dependencies. But that’s not relevant here. Strictly speaking, Debian does provide multiple versions of some binaries in supported releases: the current version in the current point release, along with any updates in the security repositories and update repositories; the latter are folded in at the next point release. So maintaining a reproducible, version-controlled system configuration is feasible without resorting to snapshots, as long as you update it every time a point release is made.)