Why APT wants to upgrade already up to date package?

Question

Package version 1.14.2-2+deb10u1 is installed and 1.14.2-2+deb10u1 is the latest version in the repository at time of writing.

dpkg -l | grep nginx-extras ii  nginx-extras

1.14.2-2+deb10u1 amd64 nginx web/proxy server (extended version)

apt update

apt dist-upgrade --simulate

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  nginx-extras
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Inst nginx-extras [1.14.2-2+deb10u1] (1.14.2-2+deb10u1 Debian:10.3/stable, Debian-Security:10/stable [amd64])
Conf nginx-extras (1.14.2-2+deb10u1 Debian:10.3/stable, Debian-Security:10/stable [amd64])

Yet, APT wants to upgrade. Why? How can I let APT know that the system is already upgraded?

Why not just do the upgrade? I don't want to needlessly upgrade using APT. Because that would overwrite my local changes.

Background:

I manually downloaded (apt source nginx-extras), compiled, made local changes, installed the package[s] using dpkg and apt. The package source folder debian/changelog matches web repository repository changelog file.

Answer 1

This happens because your installed package doesn’t match the packages available from the repositories, even though they have the same versions. (As A.B figured out, this appears to be based on the installed size of the package: if the installed package’s version is identical to that available from the repositories, but its installed size is different, apt will want to replace the package with the version available from the repositories. The installed size is listed in Packages for remote packages, and /var/lib/dpkg/status for installed packages. All this of course is also subservient to package pin priorities.)

Whenever you build a package locally, especially if you make changes to it, it’s a good idea to update the changelog as if you were doing a non-maintainer upload:

dch -n "Summary of your changes"
dch -r ignored

That way apt won’t try to replace your package with the packages in the repositories, until the latter are updated.