MIME-Version: 1.0
References: <1c614505-92f2-42b4-ba46-b227777e0d5b@lodispoto.com>
In-Reply-To: <1c614505-92f2-42b4-ba46-b227777e0d5b@lodispoto.com>
Reply-To: noloader@gmail.com
From: Jeffrey Walton <noloader@gmail.com>
Date: Sun, 31 Mar 2024 20:08:00 -0400
Message-ID: <CAH8yC8=R7=9LvfJ55P230n-eSgZaje37q63KMGa9XRDzgeNr2g@mail.gmail.com>
Subject: Re: XZ force downgrade led to removal of many packages
To: Mike Lodispoto <mike@lodispoto.com>
Cc: ~alpine/users@lists.alpinelinux.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Sat, Mar 30, 2024 at 1:18=E2=80=AFAM Mike Lodispoto <mike@lodispoto.com>=
 wrote:
>
> Hello,
>
> I was attempting to downgrade XZ because of the SSH backdoor in it.
>
> I'm not the most familiar with Alpine, so this might have been user inexp=
erience that screwed me, but I did
>
>  apk add xz-libs=3D5.4.6 --force
>
> I had tried it without force before, but it had said something along the =
lines of xz-libs is required by world.
>
> This ended up with a bunch of essential packages removed.
>
> certbot-nginx-pyc certbot-nginx certbot-pyc certbot py3-configargparse-py=
c py3-configargparse py3-distro-pyc py3-distro py3-distutils-extra-pyc py3-=
distutils-extra py3-parsedatetime-pyc py3
> -parsedatetime py3-future-pyc py3-future py3-acme-pyc py3-acme py3-josepy=
-pyc py3-josepy py3-pyrfc3339-pyc py3-pyrfc3339 py3-tz-pyc py3-tz py3-opens=
sl-pyc py3-openssl py3-cryptography-pyc p
> y3-cryptography py3-cffi-pyc py3-cffi py3-cparser-pyc py3-cparser cloud-i=
nit-openrc cloud-init-doc cloud-init-pyc cloud-init cloud-utils-growpart pa=
rtx sfdisk py3-configobj-pyc py3-configob
> j py3-six-pyc py3-six py3-jinja2-doc py3-jinja2-pyc py3-jinja2 py3-markup=
safe-pyc py3-markupsafe py3-jsonpatch-pyc py3-jsonpatch py3-jsonpointer-pyc=
 py3-jsonpointer py3-jsonschema-pyc py3-j
> sonschema py3-jsonschema-specifications-pyc py3-jsonschema-specifications=
 py3-referencing-pyc py3-referencing py3-attrs-pyc py3-attrs py3-rpds-py-py=
c py3-rpds-py py3-requests-pyc py3-reques
> ts py3-certifi-pyc py3-certifi py3-charset-normalizer-pyc py3-charset-nor=
malizer py3-idna-pyc py3-idna py3-urllib3-pyc py3-urllib3 py3-yaml-pyc py3-=
yaml shadow-doc shadow tzdata-doc tzdata
> eudev-doc eudev-openrc eudev udev-init-scripts-openrc udev-init-scripts e=
udev-libs gdbm-doc grub-bios grub-doc grub ifupdown-ng-iproute2 iproute2-mi=
nimal iotop-pyc iotop-doc iotop json-c-do
> c kmod-doc libelf libfdisk libsmartcols libxml2-doc libzip-doc linux-pam-=
doc linux-virt mariadb-doc mariadb-openrc mkinitfs-doc mkinitfs kmod lddtre=
e mpdecimal-doc mysql mariadb php7-cgi ph
> p7-fpm php7-simplexml php7-soap php7-xmlreader php7-dom php7-xmlrpc php7-=
xml php7-zip php81-doc php81 php81-common py3-packaging-pyc py3-parsing-pyc=
 py3-pip-pyc py3-pip-doc py3-pip py3-setu
> ptools-pyc py3-setuptools py3-packaging py3-parsing python3-doc python3-p=
yc python3-pycache-pyc0 pyc yaml python3 kmod-libs libzip libxml2 xz-libs c=
ryptsetup-libs argon2-libs gdbm json-c li
> bpanelw linux-pam mpdecimal
>
> In my mind, force would have had it told me what packages were going to b=
e changed before applying them, so I could approve it like normal.
>
> Am I just completely screwed? I can do a clean install if needed, but I'd=
 like to salvage my system.