From 5a0b7478da5d34e43cc17d114c15ef7aea1ec961 Mon Sep 17 00:00:00 2001 From: Ismael Leon Date: Wed, 14 Oct 2026 20:05:29 -0600 Subject: [PATCH] Trust the deadsnakes PPA for Python 3.14 only An APT pin gives its python3.14 packages priority 500 and everything else it publishes -1, so it can never replace a system package. --- deploy/setup.sh | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/deploy/setup.sh b/deploy/setup.sh index 00d7da4..1ecb44b 100755 --- a/deploy/setup.sh +++ b/deploy/setup.sh @@ -38,6 +38,23 @@ if ! apt-cache show "$PYTHON" >/dev/null 2>&1; then | sudo tee /etc/apt/apt.conf.d/52loopify-deadsnakes >/dev/null fi +# The PPA is trusted for the interpreter and nothing else. Without this, a +# package it published under a system name (openssl, openssh-server) with a +# higher version would replace the system's, unattended and as root. Outside +# the block above so that re-running this on a host that already has the PPA +# writes it too. +if compgen -G "/etc/apt/sources.list.d/deadsnakes-*" >/dev/null; then + sudo tee /etc/apt/preferences.d/loopify-deadsnakes >/dev/null <<'PIN' +Package: python3.14 python3.14-* libpython3.14 libpython3.14-* +Pin: release o=LP-PPA-deadsnakes +Pin-Priority: 500 + +Package: * +Pin: release o=LP-PPA-deadsnakes +Pin-Priority: -1 +PIN +fi + sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \ ffmpeg "$PYTHON" "$PYTHON-venv" git unzip curl