With the simulation gate implemented, the safety model section is now
true, and says where the gate runs (inside convert, immediately before
the install) and what it writes. Plan mode is labelled advisory, because
that is what it is: it logs a simulation for a human to read and decides
nothing.
Removed four options the README documented that were never implemented:
--no-auto-fix, --overwrite-keyring, --recreate-keyring and
--no-purge-flavor. Documented --preserve-snap, which was implemented and
missing. Every flag now matches the parser in both directions.
Two troubleshooting sections described behaviour that does not exist.
Keyring recovery pointed at the two missing keyring flags; the real
mechanism is a check against the expected Mint key ID with --yes to
overwrite, which is worth stating since it is what makes the plain-HTTP
fallback safe. Flavor-package purging was never written, so the login
loop it referred to is now described as something to fix by hand.
Also removes --no-install-recommends from the usage text, which I added
in the previous commit believing it was a script flag. It is an apt
option inside apt_opts_common; the parser rejects it. That is the same
class of error this commit exists to fix, found by checking the flag
lists against the parser in both directions rather than trusting either.
The README's safety model claimed convert "runs an APT simulation and
aborts if APT wants to remove critical packages" or if "too many
removals are detected (default threshold 40)". Neither existed. There
was no --max-removals flag, no critical-package list, and convert ran
straight from `apt-get update` to `apt-get -y install` with nothing in
between. plan mode does simulate, but it only tees the output to a file
and checks the exit code -- it never reads the removals, and convert
never calls it.
That is the gap that matters here: mixing Mint and Ubuntu repositories
is exactly when APT resolves a conflict by proposing to remove a large
part of the system, and -y means nothing stops it.
simulate_and_gate now runs the same install as a simulation against the
live APT configuration -- sources and pinning are already written by
that point, so it reflects what the real install would do -- and parses
the Remv lines:
- any package in CRITICAL_PACKAGES aborts unconditionally. There is no
threshold at which removing sudo, systemd, libc6 or the kernel meta
package is acceptable.
- more than --max-removals (default 40) aborts, listing them.
- anything below that is listed as a warning and allowed.
- a simulation APT cannot resolve aborts rather than proceeding.
The package list moved into mint_stack_packages(), read by both the gate
and the installer, so the gate cannot end up vouching for a different
set of packages than the one that gets installed.
Also fixes usage(), which told users to run `convert --i-accept-theISK`.
jcoffey-dev