Log from build
Calculating upgrade... The following packages will be DOWNGRADED: libssl3 openssl 0 upgraded, 0 newly installed, 2 downgraded, 0 to remove and 0 not upgraded. E: Packages were downgraded and -y was used without --allow-downgrades. E: An unexpected failure occurred, exiting...
The issue is related to:
openssl:
Installed: 3.0.20-1~deb12u2
Candidate: 3.0.20-1~deb12u2
Version table:
* 3.0.20-1~deb12u2 500 <- debian bookworm + bookworm-security
* 3.0.20-1~deb12u2 600 <- packages.vyos.net rolling (same version string, higher pin)
* 3.0.17-1~deb12u2 500 <- bookworm-updatesThis results in APT seeing a version-string tie between Debian's build and the VyOS repo build of the same package and, because of the pin-priority swap, classifies switching to the VyOS repo copy as a "downgrade".
There are two solutions, change build-vyos-image to contain --apt-options "--yes --allow-downgrades" or Extend the OpenSSL version string as opposed by https://github.com/vyos/vyos-build/pull/1245/changes
--allow-downgrades may lead some other unexpected behavior in the future with other changes.
VyOS rebuilds OpenSSL with other option differs to Debian one, I think that it makes sense to append version string to determine debian ver or vyos ver.
And once upgrade to trixie, we could remove openssl build and install openssl with openssl-provider-fips.
@tjjh89017 yes - we removed --allow-downgrades during the 1.4 development cycle which was hard. There is no plan to reintroduce it. Infact your patch is a better solution and we will adjust/merge this. Also once we run trixie our plan is to ditch this workaround again.