Blocklist wildcard

[Perkka2]

Use Case

It would be good to be able to use wildcards in the blocklist, i have a package where i need to do some manual work when the kernel is updated, i would like to block the kernel updates from being updated.

The problem on atleast debian is that the package for the kernel image is linux-image-[version-number]
i have thus no way currentlyt to add the kernel to the block list to be able to manually update it later.

I would like to be able to add kernel-image-* to the blocklist

[kreeuwijk]

Due to how comparison of Array members works in the Puppet language, this is not so easy to accomplish. There's also a risk of unexpected behavior when trying to automatically construct regex comparison expressions from text-based strings with wildcard characters.

Instead, you could tell Puppet to mark this package as hold so that it will not try to update it:

package { "linux-image-${facts['kernelrelease']}":
  mark => 'hold',
}

[Perkka2]

I wish that would've worked, but marking the current kernel as hold does not stop it from wanting to install newer kernels.
So the feature would still be nice to have.

I ended up with writing a script that upon reboot after patching installed kernel headers, manually compiling the extra modules i needed and modprobing them.

Another thing that i kind of need that's also related to this issue is, adding packages to some kind of wait list.
Where the package waits for a specified amount of days/weeks before being installed. and this would also need to have wildcard support because of the kernel naming.

[fluidum]

Due to how comparison of Array members works in the Puppet language, this is not so easy to accomplish. There's also a risk of unexpected behavior when trying to automatically construct regex comparison expressions from text-based strings with wildcard characters.

Instead, you could tell Puppet to mark this package as hold so that it will not try to update it:

package { "linux-image-${facts['kernelrelease']}":
  mark => 'hold',
}

To save others time - the module doesn't respect apt-mark hold configured packages at all.

apt-mark showhold
linux-image-5.10.0-35-amd64
linux-image-amd64

mod 'puppet-patching_as_code', '3.0.1'
mod 'albatrossflavour-os_patching', '0.23.0'

In my case this module is mostly usable only by using patching_as_code::allowlist.
I would prefer using security_only if it honored exclusions.

Just throwing an idea out there: maybe at some point contributors could explore whether handling apt-mark hold through Hiera would make more sense than the current blocklist approach. And if that wouldn’t work, it would be helpful to know why.