Since T9489 we build pdns-recursor ourselves from Debian's bookworm packaging, with the upstream /etc/hosts fix added as a patch. The package keeps Debian's version, 4.8.81+deb12u1. So the VyOS repository and bookworm-security both carry a pdns-recursor 4.8.8-1+deb12u1, but they are different binaries.

On scutum arm64 the ISO build aborts in lb binary. live-build re-runs chroot_archives, which calls apt-get upgrade/dist-upgrade, and apt refuses:

The following packages will be DOWNGRADED:
pdns-recursor

Cause: dpkg's status file does not record where a package came from. apt works out which repository entry the installed package belongs to by comparing Installed-Size and the dependency fields. On arm64, our build and Debian's are identical in all of these fields, so apt links the installed package (ours) to Debian's entry. Our repository's entry then looks like a different version with a higher pin priority, and switching to it is treated as a downgrade.

amd64 (Installed-Size 7375 vs 7371) and rolling arm64 (Depends: libsnmp40 (>= 5.9.4+dfsg) vs >= 5.9.3+dfsg) only work because their metadata happens to differ from Debian's. The same thing can hit any architecture.

Give our rebuild its own, higher version (4.8.8-1+deb12u1+vyos0) with dch in the package's build recipe, as strongswan already does with +vyos0.