nginx packages "kept back", `mod-brotli` and `mod-ssl-ct` will be removed

[fmonts]

nginx packages "kept back", `mod-brotli` and `mod-ssl-ct` will be removed

[oerdnj]

This was triggered by #2073

I will chase the remaining bugs soon as the time allows.

Generally speaking, you don’t need nginx-extra, you need to install modules that you are actually using

[tvvpm]

We are on the same situation on Debian 12.5:

root@web02:~# apt dist-upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be REMOVED:
libnginx-mod-brotli libnginx-mod-ssl-ct
The following packages will be upgraded:
debsuryorg-archive-keyring libnginx-mod-http-geoip libnginx-mod-http-image-filter libnginx-mod-http-xslt-filter
libnginx-mod-mail libnginx-mod-stream libnginx-mod-stream-geoip nginx nginx-common nginx-core
10 upgraded, 0 newly installed, 2 to remove and 0 not upgraded.

After upgrade NGINX stops working.

[brettt89]

We are also being impacted by this on Ubuntu 22.04.

It appears as though this version of libnginx-mod-ssl-ct has had changes to its postrm file in which the expected filename changed from 50-mod-ssl-ct.conf to 70-mod-ssl-ct.conf resulting in the symlink not being renamed when removed/purged.

This appears to only impacts upgrading from previous installation to newest, rather than fresh installation.

[tvvpm]

This appears to only impacts upgrading from previous installation to newest, rather than fresh installation.

In my case (debian 12.5) removing all NGINX packages and install them again does not work.

[ghbob]

Disclaimer: I am out of my depth here, take everything with a grain of salt :)

Concerning brotli, it has been replaced with a different package (at least for Jammy), see: #2086 (comment)

Most likely related as well: #2073

Server 1: broken nginx after apt full-upgrade (Ubuntu 22 / Jammy)

I had a similar issue yesterday when running apt full-upgrade on a Ubuntu 22 (my Ubuntu 20 setups didn't seem to have the same issue), that broke my Nginx setup (with ppa:ondrej/nginx-mainline).

The full-upgrade removed the old brotli package:
Removing libnginx-mod-brotli (1.25.3-1+ubuntu22.04.1+deb.sury.org+2) ...

which lead to

nginx[348999]: [emerg] 348999#348999: unknown directive "brotli" in /etc/nginx/some.conf:30

and the whole upgrade failing (I think).

What I did to fix it was to

1. disable the brotli configuration
2. installing: nginx-extras as well as the new package for brotli: libnginx-mod-http-brotli-filter and
3. running apt-get install --fix-broken to repair the failed upgrade.
4. Afterwards I could re-enabled the brotli configuration again.

Maybe installing the new brotli package beforehand would have helped, I don't know.

Server 2: no longer required packages on apt full-upgrade (Ubuntu 22 / Jammy)

Another Ubuntu 22 setup, without libnginx-mod-brotli installed though, currently looks like this before the upgrade:

apt full-upgrade
...
The following packages were automatically installed and are no longer required:
  geoip-database libgeoip1 libnginx-mod-http-geoip libnginx-mod-http-image-filter libnginx-mod-http-xslt-filter libnginx-mod-mail libnginx-mod-stream libnginx-mod-stream-geoip nginx-core
...
The following packages have been kept back:
  libgpgme11
The following packages will be upgraded:
  cloud-init libbrotli1 php8.2-cli php8.2-common php8.2-fpm php8.2-gd php8.2-intl php8.2-mbstring php8.2-mysql php8.2-opcache php8.2-readline php8.2-xml
12 upgraded, 0 newly installed, 0 to remove and 1 not upgraded.

The "no longer required" packages make me somewhat nervous, could someone with more knowledge explain what's going on here?

I think it's because nginx-core is to be removed because all of these flavours (light, core, full) are just nginx now?
The other to-be-removed dependencies were just dependencies of nginx-core but not nginx (according to apt show)?

What's currently the right way to run this upgrade on Ubuntu 22?

My best guess right now: install nginx-extras and libnginx-mod-http-brotli-filter (which itself is not part of nginx-extras?) before hand to keep the dependencies and not break brotli if it's configured somewhere?

Thanks!

[oerdnj]

This should be resolved in:

# apt-cache policy libnginx-mod-brotli libnginx-mod-ssl-ct
libnginx-mod-brotli:
  Installed: 1:1.0.0~rc+1.24.0-5+ubuntu22.04.1+deb.sury.org+4
  Candidate: 1:1.0.0~rc+1.24.0-5+ubuntu22.04.1+deb.sury.org+4
  Version table:
 *** 1:1.0.0~rc+1.24.0-5+ubuntu22.04.1+deb.sury.org+4 500
        500 https://ppa.launchpadcontent.net/ondrej/nginx/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status
libnginx-mod-ssl-ct:
  Installed: 1:1.3.2+1.24.0-2+ubuntu22.04.1+deb.sury.org+1
  Candidate: 1:1.3.2+1.24.0-2+ubuntu22.04.1+deb.sury.org+1
  Version table:
 *** 1:1.3.2+1.24.0-2+ubuntu22.04.1+deb.sury.org+1 500
        500 https://ppa.launchpadcontent.net/ondrej/nginx/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

If there are further problems, please open new issue with current description.

[fmonts]

This made it worse, a simple apt update && apt upgrade caused me huge downtime because nginx failed to update:

dpkg: error processing package nginx (--configure):
installed nginx package post-installation script subprocess returned error exit status 1
dpkg: dependency problems prevent configuration of libnginx-mod-http-image-filter:
libnginx-mod-http-image-filter depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-http-image-filter (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-stream:
libnginx-mod-stream depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-stream (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-ssl-ct:
libnginx-mod-ssl-ct depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provNo apport report written because the error message indicates its a followup error from a previous failure.
No apport report written because the error message indicates its a followup error from a previous failure.
No apport report written because MaxReports is reached already
No apport report written because MaxReports is reached already
No apport report written because MaxReports is reached already
No apport report written because MaxReports is reached already
ides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-ssl-ct (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of nginx-common:
nginx-common depends on nginx (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package nginx is not configured yet.
nginx-common depends on nginx (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package nginx is not configured yet.

dpkg: error processing package nginx-common (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-stream-geoip:
libnginx-mod-stream-geoip depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.
libnginx-mod-stream-geoip depends on libnginx-mod-stream (= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-stream is not configured yet.

dpkg: error processing package libnginx-mod-stream-geoip (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-http-xslt-filter:
libnginx-mod-http-xslt-filter depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-http-xslt-filter (--configure):
dependency problems - leaving unconfigured
Setting up linux-image-5.15.0-101-generic (5.15.0-101.111) ...
I: /boot/vmlinuz.old is now a symlink to vmlinuz-5.15.0-100-generic
I: /boot/initrd.img.old is now a symlink to initrd.img-5.15.0-100-generic
I: /boot/vmlinuz is now a symlink to vmlinuz-5.15.0-101-generic
I: /boot/initrd.img is now a symlink to initrd.img-5.15.0-101-generic
dpkg: dependency problems prevent configuration of libnginx-mod-http-geoip:
libnginx-mod-http-geoip depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-http-geoip (--configure):
dependency problems - leaving unconfigured
No apport report written because MaxReports is reached already
dpkg: dependency problems prevent configuration of libnginx-mod-http-brotli-filter:
libnginx-mod-http-brotli-filter depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-http-brotli-filter (--configure):
dependency problems - leaving unconfigured
No apport report written because MaxReports is reached already
dpkg: dependency problems prevent configuration of libnginx-mod-brotli:
libnginx-mod-brotli depends on libnginx-mod-http-brotli-filter; however:
Package libnginx-mod-http-brotli-filter is not configured yet.

dpkg: error processing package libnginx-mod-brotli (--configure):
dependency problems - leaving unconfigured
No apport report written because MaxReports is reached already
dpkg: dependency problems prevent configuration of nginx-core:
nginx-core depends on libnginx-mod-http-geoip (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-http-geoip is not configured yet.
nginx-core depends on libnginx-mod-http-geoip (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package libnginx-mod-http-geoip is not configured yet.
nginx-core depends on libnginx-mod-http-image-filter (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-http-image-filter is not configured yet.
nginx-core depends on libnginx-mod-http-image-filter (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package libnginx-mod-http-image-filter is not configured yet.
nginx-core depends on libnginx-mod-http-xslt-filter (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-http-xslt-filter is not configured yet.
nginx-core depends on libnginx-mod-http-xslt-filter (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
No apport report written because MaxReports is reached already
Package libnginx-mod-http-xslt-filter is not configured yet.
nginx-core depends on libnginx-mod-stream (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-stream is not configured yet.
nginx-core depends on libnginx-mod-stream (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package libnginx-mod-stream is not configured yet.
nginx-core depends on libnginx-mod-stream-geoip (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package libnginx-mod-stream-geoip is not configured yet.
nginx-core depends on libnginx-mod-stream-geoip (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package libnginx-mod-stream-geoip is not configured yet.
nginx-core depends on nginx (>= 1.25.4-3+ubuntu22.04.1+deb.sury.org+1); however:
Package nginx is not configured yet.
nginx-core depends on nginx (<< 1.25.4-3+ubuntu22.04.1+deb.sury.org+1.1~); however:
Package nginx is not configured yet.

dpkg: error processing package nginx-core (--configure):
dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of libnginx-mod-mail:
libnginx-mod-mail depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-mail (--configure):
dependency problems - leaving unconfigured
No apport report written because MaxReports is reached already
dpkg: dependency problems prevent configuration of libnginx-mod-http-brotli-static:
libnginx-mod-http-brotli-static depends on nginx-abi-1.24.0-1; however:
Package nginx-abi-1.24.0-1 is not installed.
Package nginx which provides nginx-abi-1.24.0-1 is not configured yet.

dpkg: error processing package libnginx-mod-http-brotli-static (--configure):
dependency problems - leaving unconfigured
No apport report written because MaxReports is reached already
Setting up linux-modules-extra-5.15.0-101-generic (5.15.0-101.111) ...
Setting up linux-modules-5.15.0-101-generic (5.15.0-101.111) ...
Setting up linux-image-generic (5.15.0.101.98) ...
Setting up linux-generic (5.15.0.101.98) ...
Processing triggers for libc-bin (2.35-0ubuntu3.6) ...
Processing triggers for ufw (0.36.1-4ubuntu0.1) ...
Processing triggers for man-db (2.10.2-1) ...
Processing triggers for php8.3-cli (8.3.4-1+ubuntu22.04.1+deb.sury.org+1) ...
Processing triggers for php8.3-fpm (8.3.4-1+ubuntu22.04.1+deb.sury.org+1) ...
Processing triggers for linux-image-5.15.0-101-generic (5.15.0-101.111) ...
/etc/kernel/postinst.d/initramfs-tools:
update-initramfs: Generating /boot/initrd.img-5.15.0-101-generic
I: The initramfs will attempt to resume from /dev/nvme1n1p3
I: (UUID=1551ae32-6c68-4425-ae6f-32e60dbb2404)
I: Set the RESUME variable to override this.
/etc/kernel/postinst.d/zz-update-grub:
Sourcing file /etc/default/grub' Sourcing file /etc/default/grub.d/init-select.cfg'
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-5.15.0-101-generic
Found initrd image: /boot/initrd.img-5.15.0-101-generic
Found linux image: /boot/vmlinuz-5.15.0-100-generic
Found initrd image: /boot/initrd.img-5.15.0-100-generic
Found linux image: /boot/vmlinuz-5.15.0-78-generic
Found initrd image: /boot/initrd.img-5.15.0-78-generic
Warning: os-prober will not be executed to detect other bootable partitions.
Systems on them will not be added to the GRUB boot configuration.
Check GRUB_DISABLE_OS_PROBER documentation entry.
Adding boot menu entry for UEFI Firmware Settings ...
done
Errors were encountered while processing:
nginx
libnginx-mod-http-image-filter
libnginx-mod-stream
libnginx-mod-ssl-ct
nginx-common
libnginx-mod-stream-geoip
libnginx-mod-http-xslt-filter
libnginx-mod-http-geoip
libnginx-mod-http-brotli-filter
libnginx-mod-brotli
nginx-core
libnginx-mod-mail
libnginx-mod-http-brotli-static
needrestart is being skipped since dpkg has failed
E: Sub-process /usr/bin/dpkg returned an error code (1)