Leap 15.2: How do I prevent new kernels from being installed from the updates repo?

English Install/Boot/Login
#1

Hi. One of my development machines run 15.2 and use the Kernel:stable repo for its kernel. This was a deliberate decision because this machine is used for out-of-tree device driver development and I can’t afford to be blindsided by a customer-reported bug due to a kernel API change should they decide to use a distribution based on a more recent kernel than 5.3 used by Leap 15.2. Kernel:stable repo tracks the upstream ‘stable’ kernel tree (5.8.x) so this works out pretty well for me.

Today, however, ‘zypper update’ wanted to install a 5.3.18 kernel from the normal updates repo. I don’t want to install 5.3.x on this machine. How do I tell zypper “Don’t install any kernel packages from the updates repo” ? If I lock kernel-default, that probably prevents updates from the Kernel:stable repo as well?

#2

Hi
It could be a patch coming through, add a lock to patch and package;


zypper al -t package kernel-default-5.3.* kernel-default-devel-5.3.*
zypper al -t patch kernel-default-5.3.* kernel-default-devel-5.3.*

You can also add a lock to a specific repo with the -r option (see zypper al --help) but you should be able to restrict as your wanting.

#3

Hi. Thanks for the response. So far, no luck.

First, attempt to add specific locks for 5.3*:


# zypper al kernel-default-5.3* kernel-default-devel-5.3* kernel-devel-5.3* kernel-source-5.3* kernel-syms-5.3*
Specified locks have been successfully added.

# zypper ll

# | Name                      | Type    | Repository
--+---------------------------+---------+-----------
1 | kernel-default-5.3*       | package | (any)
2 | kernel-default-devel-5.3* | package | (any)
3 | kernel-devel-5.3*         | package | (any)
4 | kernel-source-5.3*        | package | (any)
5 | kernel-syms-5.3*          | package | (any)

# zypper update
<stuff>
The following 11 NEW packages are going to be installed:
  kernel-default-5.3.18-lp152.44.1 kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.3.18-lp152.44.1
  kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.3.18-lp152.44.1 kernel-devel-5.8.13-2.1.g08db7a3
  kernel-preempt-devel kernel-source-5.3.18-lp152.44.1 kernel-source-5.8.13-2.1.g08db7a3
  kernel-syms-5.3.18-lp152.44.1 kernel-syms-5.8.13-2.1.g08db7a3
<stuff>

So it looks like zypper is ignoring the explicit 5.3 package locks.

Next I started playing with repository locks. First attempt was to lock the normal updates repo:


# zypper al -r "openSUSE-Leap-15.2-Update" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel*
Specified locks have been successfully added.

# zypper ll

# | Name                  | Type    | Repository
--+-----------------------+---------+------------
1 | kernel-default*       | package | repo-update
2 | kernel-default-devel* | package | repo-update
3 | kernel-devel*         | package | repo-update
4 | kernel-macros*        | package | repo-update
5 | kernel-source*        | package | repo-update
6 | kernel-syms*          | package | repo-update

# zypper update
<stuff>
The following 11 NEW packages are going to be installed:
  kernel-default-5.3.18-lp152.19.2 kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.3.18-lp152.19.2
  kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.3.18-lp152.19.2 kernel-devel-5.8.13-2.1.g08db7a3
  kernel-preempt-devel kernel-source-5.3.18-lp152.19.2 kernel-source-5.8.13-2.1.g08db7a3
  kernel-syms-5.3.18-lp152.19.2 kernel-syms-5.8.13-2.1.g08db7a3
<stuff>

So no change. It’s still trying to pull in 5.3.18 from the 15.2 update repo (please ignore the proposed 5.8.13 updates…those coming from Kernel:stable and are expected).

(It’s not at all clear to me where that kernel-preempt-devel package is coming from as I don’t have “kernel-preempt” or “kernel-preempt-devel” installed presently. I can successfully prevent it from being installed via a global lock but zypper still wants to install the 5.3.18 stuff…)

Next, I deleted those locks and tried to lock Kernel:stable just to see what would happen:


# zypper al -r "Kernel:stable" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel*
Specified locks have been successfully added.

# zypper ll

# | Name                  | Type    | Repository
--+-----------------------+---------+--------------
1 | kernel-default*       | package | Kernel:stable
2 | kernel-default-devel* | package | Kernel:stable
3 | kernel-devel*         | package | Kernel:stable
4 | kernel-macros*        | package | Kernel:stable
5 | kernel-source*        | package | Kernel:stable
6 | kernel-syms*          | package | Kernel:stable

# zypper update
<stuff>
The following 6 NEW packages are going to be installed:
  kernel-default-5.3.18-lp152.44.1 kernel-default-devel-5.3.18-lp152.44.1 kernel-devel-5.3.18-lp152.44.1
  kernel-preempt-devel kernel-source-5.3.18-lp152.44.1 kernel-syms-5.3.18-lp152.44.1
<stuff>

Okay. No 5.8.13 kernel packages are listed so this does appear to lock new packages from Kernel:stable. So at least we know zypper honors repository locks. But it apparently does not honor locking the normal update repo? Strange.

One more test. I deleted those locks and tried locking “@System”


# zypper al -r "@System" kernel-default* kernel-default-devel* kernel-syms* kernel-source* kernel-macros* kernel-devel*
Specified locks have been successfully added.

# zypper ll

# | Name                  | Type    | Repository
--+-----------------------+---------+-----------
1 | kernel-default*       | package | (any)
2 | kernel-default-devel* | package | (any)
3 | kernel-devel*         | package | (any)
4 | kernel-macros*        | package | (any)
5 | kernel-source*        | package | (any)
6 | kernel-syms*          | package | (any)

# zypper update
<stuff>
The following 31 items are locked and will not be changed by any action:
 Available:
  kernel-default-base kernel-default-base-rebuild kernel-default-debuginfo kernel-default-debugsource
  kernel-default-devel-debuginfo kernel-default-livepatch-devel kernel-devel-rt kernel-source-rt
  kernel-source-vanilla kernel-syms-rt
<stuff>
The following 9 package updates will NOT be installed:
  kernel-default-5.8.13-2.1.g08db7a3 kernel-default-devel-5.8.13-2.1.g08db7a3 kernel-devel-5.8.13-2.1.g08db7a3
  kernel-macros kernel-source-5.8.13-2.1.g08db7a3 kernel-syms-5.8.13-2.1.g08db7a3 libseccomp-devel
  ...
<stuff>

Okay. So that seems to have locked all repositories from installing new kernels.

So I’m confused. zypper’s repository locks seem to work since I can prevent new kernels from Kernel:stable from being installed. And I can globally prevent all kernels from being installed. But I can’t seem to block just the 5.3.x kernels for some reason.

#4

Hi
Then use kernel-default-5.3.??* or permutations, else it might need the full version (sounds like a bug…).

#5

Smells like a bug to me. Try instead zypper al kernel-def* to lock all kernel-default versions. Then when you actually want a specific kernel-default upgraded, spell out the version: zypper in kernel-default-5.18.whateverversion. When it asks about what to do, answer to remove the lock. That will result in lock override for the current process, but won’t actually remove the lock, because it contains a wildcard.

#6

I’m (mostly) an idiot.

While the package locks for kernel-default-5.3* seem to be non-functional, my conclusions about the repository locks not working are incorrect. I failed to look closely at the version of the 5.3.18 kernel that zypper was trying to install. It’s not coming from the updates repo. It’s coming from the base repo.

When I add repository locks for kernel-default* for both the base and updates repos, zypper indeed does stop trying to install 5.3.18.

#7

I just did some experimenting.

When I have both the standard repos and the kernel:stable repo enabled, it only wants to install kernels from the standard repo. I can overide that, but by default that’s what it does.

I think that’s because I only have kernels from the standard repo. A few days ago, I did have a 5.8 kernel installed. And then “zypper up” wanted to install another kernel from the kernel:stable repo. So I think it has to do with vendor.

When I only have kernels with vendor=opensuse, it won’t install from kernel:stable repo. If I already have a kernel with the obs as vendor, then it will.

I don’t know if this would work. But I would try uninstalling all 5.3 kernels so that you only have kernels from kernel:stable. And I suspect it will then not install kernels from the standard repos unless you tell it to --allow-vendor-change.

You might want to test that idea.

Note that installing patches might override that. So use only “zypper up”. Don’t use Yast online update and don’t use the update app.

Again, I have only partly tested this, and my tests were not in the direction that you want.

#8

Hello,

I use TW with kernel:stable repo like @nrickert said.
I updated with vendor-change from kernel:stable repo and I had no problems with older kernels.

#9

If you have uninstalled all kernels from OSS and Update Repo, there will be none of them installed by update.
No lock is needed.

But there should also not installed any kmp from Repos for those kernels, such as broadcom,-wl or r8168 from Packman or virtualbox from OSS Repo.
I have installed them from my /home Repo, you could use this Repo for virtualbox:
https://download.opensuse.org/repositories/Kernel:/stable:/KMP/standard/