dnf-automatic and dnf have different behaviour. (And a bit erratic)

[rafitadiaz]

In short:
dnf-automatic shows pending updates dnf is not finding/installing them

---

Long explanation:

This was tested on a Rocky 9.3 with the rpm and dnf packages updated to the latest version

I have dnf-automatic configured to notify for security updates

upgrade_type = security
download_updates = yes
apply_updates = no

$ dnf-automatic
Last metadata expiration check: 3:03:00 ago on Thu 08 Aug 2024 10:04:52 AM UTC.
The downloaded packages were saved in cache until the next successful transaction.
You can remove cached packages by executing 'dnf clean packages'.

And I got a email notification with this:

The following updates were downloaded on 'jenkins-test':  
================================================================================  
 Package              Arch    Version                      Repository      Size  
================================================================================  
Installing:  
 kernel               x86_64  5.14.0-427.28.1.el9_4        baseos         5.0 M  
 kernel-core          x86_64  5.14.0-427.28.1.el9_4        baseos          20 M  
 kernel-modules       x86_64  5.14.0-427.28.1.el9_4        baseos          38 M  
 libndp               x86_64  1.8-6.el9_4                  baseos          36 k
Upgrading:  
 kernel-tools         x86_64  5.14.0-427.28.1.el9_4        baseos         5.3 M  
 kernel-tools-libs    x86_64  5.14.0-427.28.1.el9_4        baseos         5.0 M  
Installing dependencies:  
 kernel-modules-core  x86_64  5.14.0-427.28.1.el9_4        baseos          32 M  
Removing:  
 kernel               x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel    0   
 kernel-core          x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   56 M  
 kernel-modules       x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   33 M  
 kernel-modules-core  x86_64  5.14.0-284.18.1.el9_2.cloud  @cloud-kernel   31 M

So if I want to do the upgrade manually I got:

$ sudo dnf upgrade --security
Last metadata expiration check: 2:42:18 ago on Wed 07 Aug 2024 08:44:30 AM UTC.
Dependencies resolved.
======================================================================================================================
 Package                   Architecture              Version                          Repository                 Size
======================================================================================================================
Upgrading:
 libndp                    x86_64                    1.8-6.el9_4                      baseos                     36 k

So just the libndp package, The kernel packages are not being upgraded
I also tried with a normal dnf upgrade without the --security flag

$ dnf upgrade kernel
Last metadata expiration check: 3:03:32 ago on Thu 08 Aug 2024 10:04:52 AM UTC.
Dependencies resolved.
Nothing to do.
Complete!

If I run again dnf-automatic --downloadupdates I still get notification for the kernel packages, I can see the packages downloaded in the cache but I can't install them via dnf

The only way I could do that was going to the cache folder an run a rpm manually.

$ rpm -Uvh *
Verifying...                          ################################# [100%]
Preparing...                          ################################# [100%]
Updating / installing...
   1:kernel-modules-core-5.14.0-427.28################################# [  5%]
   2:kernel-core-5.14.0-427.28.1.el9_4################################# [ 10%]
   3:kernel-modules-5.14.0-427.28.1.el################################# [ 15%]
   4:kernel-tools-libs-5.14.0-427.28.1################################# [ 20%]
   5:kernel-tools-5.14.0-427.28.1.el9_################################# [ 25%]
   6:kernel-5.14.0-427.28.1.el9_4     ################################# [ 30%]

Now after reboot, dnf-automatic doesn't shows any pending update

$ dnf-automatic
Last metadata expiration check: 1:18:36 ago on Thu 08 Aug 2024 01:40:40 PM UTC.
No security updates needed, but 197 updates available

Questions:

• Why dnf-automatic with upgrade_type = security and dnf upgrade --security has different output behaviour?
• I was expecting that both tools should report/update the same packages.

[m-blaha]

So far, I haven’t found any difference between dnf upgrade --security and your dnf-automatic configuration.

If the issue is still reproducible, it might be helpful to gather more details about the resolved RPM transaction:

1. For dnf, run dnf upgrade --debugsolver to create a ./debugdata directory.
2. For dnf-automatic, add debug_solver = 1 to the [base] section of the /etc/dnf/automatic.conf file, and then run dnf-automatic from a different directory. Again, this will generate a ./debugdata directory with transaction details.

Comparing these two debugdata directories might provide insight into why the transactions differ.

[oandrieu]

I have the opposite issue, where dnf-automatic says there are no security updates, but dnf upgrade --security would install a bunch.

# dnf-automatic --no-installupdates --no-downloadupdates
Last metadata expiration check: 2:20:12 ago on Wed 23 Oct 2024 09:53:50 AM CEST.
No security updates needed, but 171 updates available

#  dnf updateinfo --security
Last metadata expiration check: 2:22:45 ago on Wed 23 Oct 2024 09:53:50 AM CEST.
Updates Information Summary: available
    3 Security notice(s)
        2 Important Security notice(s)
        1 Moderate Security notice(s)

# dnf upgrade --security
Last metadata expiration check: 2:23:41 ago on Wed 23 Oct 2024 09:53:50 AM CEST.
Dependencies resolved.
===============================================================================================================================================================================
 Package                                        Architecture                      Version                                          Repository                             Size
===============================================================================================================================================================================
Installing:
 kernel                                         x86_64                            5.14.0-427.40.1.el9_4                            baseos                                4.6 M
[…] 

Transaction Summary
===============================================================================================================================================================================
Install   5 Packages
Upgrade  12 Packages
Remove    5 Packages

(This is on Rocky Linux 9.4)

[ppisar]

I believe the discrepancy was fixed with commit 0b4b8cc.

[ppisar]

I would be glad if the affected people could test whether that commit fixes the issue for them.

[oandrieu]

@ppisar Indeed it does ! Thanks !

[ppisar]

Thanks for the testing.