Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In short:

Does any one out there, running ubuntu servers, tries to do it with the "-updates" release (like precise-updates) disabled? If so, how do you deal with ubuntu point releases (that include packages from -updates)?

This is way specific, and I didn't find anything about it in my searches. Please point me out to any previous question or maybe to a more appropriate forum you know for this.

Not so short:

It seems to me that the whole point in having -updates as a separate release is opting to not using it, and having just the security-related updates installed. That's what we try to do in our company.

Of course, you might need some package from -updates, and we do. So we leave the -updates on sources.list, but pin it to -10 ("don't use at all" priority). Specific packages we need from -updates are then pinned with a higher priority so they get selected. We have that setup automated already. It works well ... most of the time.

Problem arises if someone uses an image/CD of an ubuntu's point release (say 12.04.2, for example) to install a new machine. Point releases do include the -updates packages up to that time. When I try to install some new package (after disabling/pinning -updates) and that package depends on one of those -updates packages that came with the point release, I might get a broken package. Like in this case:

# apt-get install vim-nox -s
Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 vim-nox : Depends: vim-common (= 2:7.3.429-2ubuntu2) but 2:7.3.429-2ubuntu2.1 is to be installed
           Depends: vim-runtime (= 2:7.3.429-2ubuntu2) but 2:7.3.429-2ubuntu2.1 is to be installed
E: Unable to correct problems, you have held broken packages.

It's trying to install vim-nox from "precise", but vim-common and vim-runtime from precise-updates are already installed (by the base install, before I can change anything), and so it breaks.

Fiddling with the apt_preference priorities didn't help me. AFAICT dependencies don't affect apt's priority/selection algorithm, so it won't do the job.

Of course I can just ban the use of point release images, but that's kind of unfortunate. In a world of increasingly prebuilt images for every kind of virtualization platform, if I want to take advantage of them (even if only for testing), I have to search for old, sometimes deprecated (or non-existant) images made before the first point release.

Does anybody here has been through this?

share|improve this question
Looks like you just need to unpin the new packages you want to install, so they get pulled in from -updates, in situations like this? – dobey Sep 18 '13 at 21:47
Yeah @dobey, I really could override the pin for vim-nox, letting it install from -updates, but I didn't want vim-whatever from -updates in the first place. And I would have to do that for any package that depends on packages from -updates. By the point release .4 or .5, that might be a pretty large set I presume. – dgmorales Sep 19 '13 at 1:02
In Debian, this would be almost like putting out a new stable point-release containing packages from testing. I totally get the need and value of the -updates archive, and of getting those updates to point releases (keeping up with hardware changes), but maybe it would be more correct to move those packages to the regular archive (still wonder if I should fill bug about this). I know its not an easy call tough. – dgmorales Sep 19 '13 at 1:11

In short:

Only comment out the -updates entries in your sources.list. Or pin down them.

Not too short:

Seems that you want to mess up a bit with your pinning preferences. If you want to you could set that if you need to install a package from a no -updates repository, you could set the main repository to >1000 pin priority. This will tell apt-get to downgrade if necessary the packages to get them from this version:

Note that a priority above 1000 will allow even downgrades no matter the version of the prioritary package. This means that you can use priority 1001 for a stable source if you want to downgrade to the stable versions of the packages you have installed (let's say from testing) on the system.

As example lets see my own apt-pinning preferences:

cat /etc/apt/preferences.d/pinning
Package: iceweasel*
Pin: release a=experimental
Pin-Priority: 1990

apt-cache policy iceweasel
  Installed: 25.0~a2+20130830004004-1~bpo70+1
  Candidate: 25.0~a2+20130906004001-1
  Package pin: 25.0~a2+20130906004001-1
  Version table:
     25.0~a2+20130906004001-1 1990
        500 experimental/iceweasel-aurora i386 Packages
 *** 25.0~a2+20130830004004-1~bpo70+1 1990
        100 /var/lib/dpkg/status
     17.0.8esr-2 1990
        500 testing/main i386 Packages

As you can see, apt will prefer that the package iceweasel comes from the experimental branch instead of the testing and if it's necessary it will downgrade the package to comply with this preference.

share|improve this answer
Hello @braiam. I do pin -updates down. As I said in the question, my problem starts when I use CD/VM images that already contains packages from -updates. And you're right, I can use pin priorities > 1000 to remove the -updates packages from my systems, and I have done so many times. But relying on package downgrades repeatedly does not seem an acceptable solution to me. I believe downgrades are meant to be avoided whenever possible. – dgmorales Sep 24 '13 at 23:13
If you want to avoid downgrades just then use the updates. I don't see whenever you don't see the solution, you either pull packages with their respective dependencies or you get your system broken. Answering your comments, the point releases are only for LTS since downloading 2, 3, 6, 12, 18, 24 month worth of updates... is not funny for anyone. If you really cannot use distributions with fast releases you should use CentOS or Fedora. I use Debian testing and as such, I get myself exposed to bugs, if there is a package in sid that solve the bug I would pull it. – Braiam Sep 24 '13 at 23:24
All in all, I actually don't see why don't update, specially if it's for the sake of an updated system. If you don't like the point release, there is always the netiso that you downloads all the package in the installation time. Just select them all. – Braiam Sep 24 '13 at 23:25
Coming back to this after some time ... in some servers, I want the least changes possible in the software running on it, but still keep it secure. And that for me means applying security-updates only. Isn't that a valid approach? Enabling that approach isn't the reason for the separation of release, release-updates and release-security to begin with? – dgmorales Dec 17 '13 at 19:09
For now, I've set on either changing that approach and embracing the -updates release, or making my own images from an original unupdated release media (and them applying only security updates on top of it). – dgmorales Dec 17 '13 at 19:13

Try clearing vim and and starting over - worked for me

sudo apt-get remove vim-common
sudo apt-get clean && sudo apt-get purge
sudo apt-get update && sudo apt-get install vim 
share|improve this answer
That resolves the issue once for that particular package. I am looking for a more general solution, and one that doesn't involves downgrades by pinning. – dgmorales Dec 17 '13 at 19:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.