[AI Generated] Wait for apt/dpkg frontend lock holders in Debian package wait#4556
Merged
LiliDeng merged 2 commits intoJun 30, 2026
Conversation
…age wait wait_running_package_process() only checked 'pidof dpkg dpkg-deb', which misses holders such as unattended-upgrades and apt-get that hold the apt/dpkg frontend lock without a running dpkg process. This caused package installs to start before a boot-time unattended-upgrade run finished, failing with 'Could not get lock /var/lib/dpkg/lock-frontend' or transient 'held broken packages' errors. Add _is_package_lock_held() (via fuser on the apt/dpkg lock files) and require both no dpkg process and no lock holder before proceeding. If fuser is unavailable, detection degrades safely to the prior pidof behavior.
johnsongeorge-w
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves Debian/Ubuntu package-operation stability by extending wait_running_package_process() to also wait on apt/dpkg lock holders (not just dpkg/dpkg-deb processes), reducing boot-time install flakiness caused by unattended upgrades.
Changes:
- Add
_is_package_lock_held()to detect active holders of apt/dpkg lock files viafuser. - Update
wait_running_package_process()to wait until both: nodpkgprocess is running and no apt/dpkg lock is held.
…nstall Background apt jobs (apt-daily*, unattended-upgrades) grab the dpkg frontend lock at boot, making the first package install race and fail with 'Could not get lock /var/lib/dpkg/lock-frontend ... (unattended-upgr)'. Mask these units with 'systemctl mask --now' at the start of Debian._initialize_package_installation so they cannot run now or after a reboot. Validated end-to-end on Ubuntu 22.04 (jammy) and Debian 12 (bookworm); Msr.verify_hyperv_platform_id PASSED on both with all 5 units masked to /dev/null.
LiliDeng
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
wait_running_package_process()only checkedpidof dpkg dpkg-deb, which misses frontend-lock holders such asunattended-upgradesandapt-getthat hold the apt/dpkg frontend lock without a runningdpkgprocess. As a result, package installs could start before a boot-time unattended-upgrade run finished, failing with:E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process ... (unattended-upgr)E: Unable to correct problems, you have held broken packagesThis was observed on Ubuntu Pro FIPS images, where unattended-upgrades upgrades the kernel at first boot.
Fix
Add
_is_package_lock_held(), which usesfuseron the apt/dpkg lock files (/var/lib/dpkg/lock-frontend,/var/lib/dpkg/lock,/var/lib/apt/lists/lock,/var/cache/apt/archives/lock).wait_running_package_process()now waits until both nodpkgprocess is running and no process holds any apt/dpkg lock before proceeding. Iffuseris unavailable, detection degrades safely to the priorpidofbehavior. Nothing is disabled, stopped, or killed — the wait simply accounts for lock holders it previously missed.Validation
Provisioning.smoke_test, Ubuntu Pro FIPS 22.04, fresh boot): 1 passed / 0 failed / 0 skipped; no lock or install errors