dpkg: Fix and clarify behavior for packages marked to be on “hold”

A package marked to be on hold, denotes that the package should be kept
in its current version and should not be automatically installed, upgraded
or removed. The same applies to frontends. This behavior does not apply
when the user explicitly requested one of these actions, or the
--force-hold option is used.

It should never prevent dpkg from processing these for configuration (if
they were already in unpacked state) or from trigger processing, otherwise
we might get into trigger loops. Some of the code was already doing this,
but this was not consistently done. We update also the help output and
documentation to clarify the fixed behavior.

Closes: #926472

6 files changed, 18 insertions, 9 deletions

diff --git a/debian/changelog b/debian/changelog
index 88903136d..55e731cf8 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -31,6 +31,8 @@ dpkg (1.20.0) UNRELEASED; urgency=medium
   * dpkg-gencontrol: Take into account hardlinks when computing the
     Installed-Size substvar. Closes: #923475
     Patch co-authored with Sven Joachim <svenjoac@gmx.de>.
+  * dpkg: Fix and clarify behavior for packages marked to be on “hold”. These
+    need to be processed for configuration and triggers. Closes: #926472
   * Perl modules:
     - Dpkg::Source::Package: Verify original tarball signatures at build time.
     - Dpkg::BuildFlags: Add new unset() method.
diff --git a/dselect/helpmsgs.cc b/dselect/helpmsgs.cc
index d1641dd11..b101fc8bc 100644
--- a/dselect/helpmsgs.cc
+++ b/dselect/helpmsgs.cc
@@ -38,7 +38,7 @@ Motion keys: Next/Previous, Top/End, Up/Down, Backwards/Forwards:\n\
   ^b                    ^f                      pan display by 1 character\n\n\
 \
 Mark packages for later processing:\n\
- +, Insert  install or upgrade      =, H  hold in present state\n\
+ +, Insert  install or upgrade      =, H  hold in present version\n\
  -, Delete  remove                  :, G  unhold: upgrade or leave uninstalled\n\
  _          remove & purge config\n\
                                              Miscellaneous:\n\
@@ -140,7 +140,7 @@ four columns for its current status on the system and mark.  In terse mode (use\
  Mark: what is requested for this package:\n\
   '*': marked for installation or upgrade;\n\
   '-': marked for removal, but any configuration files will remain;\n\
-  '=': on hold: package will not be processed at all;\n\
+  '=': on hold: package will not be installed, upgraded or removed;\n\
   '_': marked for purge completely - even remove configuration;\n\
   'n': package is new and has yet to be marked for install/remove/&c.\n\n\
 \
diff --git a/man/dpkg.man b/man/dpkg.man
index 3987db5a3..659e87978 100644
--- a/man/dpkg.man
+++ b/man/dpkg.man
@@ -96,8 +96,10 @@ The package is correctly unpacked and configured.
 The package is selected for installation.
 .TP
 .B hold
-A package marked to be on \fBhold\fP is not handled by \fBdpkg\fP,
-unless forced to do that with option \fB\-\-force\-hold\fP.
+A package marked to be on \fBhold\fP is kept on the same version, that is,
+no automatic new installs, upgrades or removals will be performed on them,
+unless these actions are requested explicitly, or are permitted to be done
+automatically with the \fB\-\-force\-hold\fP option.
 .TP
 .B deinstall
 The package is selected for deinstallation (i.e. we want to remove all
@@ -555,7 +557,9 @@ Configure also any unpacked but unconfigured packages on which the current
 package depends.
 
 \fBhold\fP:
-Process packages even when marked “hold”.
+Allow automatic installs, upgrades or removals of packages even when marked
+to be on “hold”.
+Note: This does not prevent these actions when requested explicitly.
 
 \fBremove\-reinstreq\fP:
 Remove a package, even if it's broken and marked to require
diff --git a/src/force.c b/src/force.c
index 5fa19ee1c..07c1daa24 100644
--- a/src/force.c
+++ b/src/force.c
@@ -91,7 +91,7 @@ static const struct forceinfo {
 		"hold",
 		FORCE_HOLD,
 		FORCETYPE_DISABLED,
-		N_("Process incidental packages even when on hold"),
+		N_("Install or remove incidental packages even when on hold"),
 	}, {
 		"not-root",
 		FORCE_NON_ROOT,
diff --git a/src/packages.c b/src/packages.c
index bd8047ac9..932b88bf9 100644
--- a/src/packages.c
+++ b/src/packages.c
@@ -83,13 +83,15 @@ enqueue_pending(void)
             pkg->status == PKG_STAT_HALFCONFIGURED ||
             pkg->trigpend_head))
         continue;
-      if (pkg->want != PKG_WANT_INSTALL)
+      if (pkg->want != PKG_WANT_INSTALL &&
+          pkg->want != PKG_WANT_HOLD)
         continue;
       break;
     case act_triggers:
       if (!pkg->trigpend_head)
         continue;
-      if (pkg->want != PKG_WANT_INSTALL)
+      if (pkg->want != PKG_WANT_INSTALL &&
+          pkg->want != PKG_WANT_HOLD)
         continue;
       break;
     case act_remove:
diff --git a/src/trigproc.c b/src/trigproc.c
index 54b15bbe1..2ef8a5234 100644
--- a/src/trigproc.c
+++ b/src/trigproc.c
@@ -134,7 +134,8 @@ trigproc_populate_deferred(void)
 		    pkg->status != PKG_STAT_TRIGGERSPENDING)
 			continue;
 
-		if (pkg->want != PKG_WANT_INSTALL)
+		if (pkg->want != PKG_WANT_INSTALL &&
+		    pkg->want != PKG_WANT_HOLD)
 			continue;
 
 		trigproc_enqueue_deferred(pkg);