[Aptitude-devel] Bug#831858: aptitude sets already auto-installed packages as manually installed

[Vincent Lefevre]

Control: severity -1 important
Control: tags -1 security

I don't know whether this is related or a new bug, but auto-installed
packages via dependencies are also sometimes marked as manually
installed. This occurred on 2016-12-13 with:

[INSTALL, DEPENDENCIES] libmariadbclient18:amd64 10.0.28-2
[INSTALL, DEPENDENCIES] mariadb-common:amd64 10.0.28-2

and mariadb-common was marked as manually installed (no "A" in
aptitude's UI); the dpkg logs show just this install and usual
upgrades. The consequence is that mariadb-common was not proposed
for removal as it should be after a later upgrade, leaving a
security issue:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=850216

-- 
Vincent Lefèvre <vincent at vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)