Installing specific version debian package

Question

Installing packages with package managers such as npm (for javascript) or pip (for python) taught me to be very specific about packages versions to avoid weird behaviours or even unexpected bugs in the software I'm writing.

I know that the apt package manager is a very different animal, but I thought it wouldn't have hurt to be very precise. I was wrong!

It looks like until a few days ago the following command was working:

I created a script that installs in "steps", specific versions of apt packages. One example of a step is something like:

apt-get install git=1:2.20.1-2+deb10u1

But now I get:

Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Version '1:2.20.1-2+deb10u1' for 'git' was not found

And in order to go through with the installation I need to install the following version:

apt-get install git=1:2.20.1-2+deb10u3

There must be a way to install always the same software on different machine using the same script, correct? Maybe:

apt-get install git=1:2.20.1-2*

Please help to get this done in an correct way.

Thanks in advance.

Answer 1

There’s a fundamental difference in philosophy between the tools you mention, or rather, between the repositories they provide access to.

The repositories addressed by npm, pip etc. provide access to all published versions of the packages they distribute. It’s up to you, as developer of a project which relies on these packages, to choose the versions which are appropriate for your project — whether that’s a range, or specific versions, or “latest”, it’s up to you to decide and it’s up to you to bear the responsibility of that choice.

The repositories addressed by apt, as used in distributions such as Debian, only provide access to a small number (one, in most cases) of versions of the packages they distribute. The distributions’ developers make the choice of version for you, and they take on the responsibility of that choice. The choice comes with some promises, or at least intentions; specifically, when you use most release-based distributions, that installing a given package will always provide the same features throughout the lifetime of the distribution.

Thus, since you’re using Debian 10, the appropriate incantation is

apt install git

Throughout the lifetime of Debian 10, this will install a version of git with the same features. The only changes will address grave bugs and security issues (this is the case for git: the changes between the two versions you listed address two security issues).

Of course mistakes happen, but when they do, they are taken seriously by the distribution. If you file a bug describing a regression caused by a package upgrade within a given release of the distribution, I would expect it to be acted upon in short order. (And the fact that a given package was upgraded in a stable release means that there’s someone not asleep at the wheel.)

(If you really want to take on all the responsibility, you could use snapshot.debian.org to install specific versions of packages.)