[Bug]: openvox 8.29.0 reports wrong version in package metadata

[bastelfreak]

Is this a critical security issue?

• This is not a security issue.

Describe the Bug

openvox 8.29.0 on Debian 13:

# apt info openvox-agent
Package: openvox-agent
Version: 8.29.0-1+debian13
Priority: optional
Section: admin
Maintainer: Vox Pupuli <openvox@voxpupuli.org>
Installed-Size: 86.6 MB
Provides: puppet-agent (= 8.29.0)
Depends: findutils, tar
Conflicts: puppet-agent
Breaks: puppet-agent (<< 9)
Replaces: puppet-agent (<< 9)
Homepage: https://voxpupuli.org
Download-Size: 26.7 MB
APT-Manual-Installed: yes
APT-Sources: https://apt.voxpupuli.org debian13/openvox8 amd64 Packages
Description: The OpenVox Agent package contains all of the elements needed to run the agent, including ruby and openfact.
 .
 Contains the following components:
 cleanup
 execution_wrapper
 module-puppetlabs-augeas_core v1.5.0
 module-puppetlabs-cron_core v1.3.0
 module-puppetlabs-host_core v1.3.0
 module-puppetlabs-mount_core v1.3.0
 module-puppetlabs-scheduled_task v3.2.0
 module-puppetlabs-selinux_core v1.4.0
 module-puppetlabs-sshkeys_core v2.5.0
 module-puppetlabs-yumrepo_core v2.1.0
 module-puppetlabs-zfs_core v1.6.1
 module-puppetlabs-zone_core v1.2.0
 openfact 5.6.0
 puppet 8.26.1
 puppet-resource_api 1.9.0
 puppet-runtime 2026.04.17.1
 shellpath 2023-02-15
 wrapper-script

Notice: There are 20 additional records. Please use the '-a' switch to see them.

note puppet 8.26.1.

openvox itself reports the correct version:

root@ ~ # puppet --version
8.29.0
root@ ~ #

Expected Behavior

apt should say 8.29.0

Steps to Reproduce

Install the deb and run apt info openvox-agent

Environment

Debian 13

Additional Context

I haven't tested the rpms yet

Relevant log output

[nmburgan]

I’ve seen this before. It seems like an apt issue. What version it shows there (and actually, I believe it’s showing the versions of all the other components for the, in this case, 8.26.1 package as well) depends on what other packages are in the cache or something. I think @Sharpie and I were seeing this when we were doing repo management stuff a few months ago. It’s odd, I never tracked down why it does that, but I think the package itself is fine. Not 100% sure, but I think that’s the case.

[nmburgan]

Unfortunately, I think our Slack conversation about it is just over 90 days old and gone now ☹️

[bastelfreak]

lol, indeed. I saw this on an existing box that had its openvox-agent upgraded. On a new box, after installing openvox-agent 8.29.0, apt reports 8.29.0. Is there some cache we need to purge? @bootc help? :D

[bootc]

That should come from the Description field in the package itself; which .deb is this exactly? I have occasionally seen dpkg not update its metadata correctly, but only when there's weird corruption...

[bootc]

I assumed https://apt.voxpupuli.org/pool/openvox8/o/openvox-agent/openvox-agent_8.29.0-1%2Bdebian13_amd64.deb, and:

$ dpkg-deb -I openvox-agent_8.29.0-1+debian13_amd64.deb
 new Debian package, version 2.0.
 size 26748110 bytes: control archive=218738 bytes.
     580 bytes,    12 lines      conffiles
    1035 bytes,    34 lines      control
  873164 bytes,  7854 lines      md5sums
    3413 bytes,    79 lines   *  postinst             #!/bin/bash
     561 bytes,    24 lines   *  postrm               #!/bin/bash
     881 bytes,    26 lines   *  preinst              #!/bin/bash
     586 bytes,    23 lines   *  prerm                #!/bin/bash
     221 bytes,     9 lines      shlibs
      99 bytes,     4 lines      triggers
 Package: openvox-agent
 Version: 8.29.0-1+debian13
 Architecture: amd64
 Maintainer: Vox Pupuli <openvox@voxpupuli.org>
 Installed-Size: 84583
 Depends: findutils, tar
 Conflicts: puppet-agent
 Breaks: puppet-agent (<< 9)
 Replaces: puppet-agent (<< 9)
 Provides: puppet-agent (= 8.29.0)
 Section: admin
 Priority: optional
 Homepage: https://voxpupuli.org
 Description: The OpenVox Agent package contains all of the elements needed to run the agent, including ruby and openfact.
  .
  Contains the following components:
  cleanup
  execution_wrapper
  module-puppetlabs-augeas_core v1.5.0
  module-puppetlabs-cron_core v1.3.0
  module-puppetlabs-host_core v1.3.0
  module-puppetlabs-mount_core v1.3.0
  module-puppetlabs-scheduled_task v3.2.0
  module-puppetlabs-selinux_core v1.4.0
  module-puppetlabs-sshkeys_core v2.5.0
  module-puppetlabs-yumrepo_core v2.1.0
  module-puppetlabs-zfs_core v1.6.1
  module-puppetlabs-zone_core v1.2.0
  openfact 5.6.1
  puppet 8.29.0
  puppet-resource_api 1.9.2
  puppet-runtime 2026.09.02.1
  shellpath 2023-02-15
  wrapper-script

It looks sensible in there...

Let me do a bit more digging.

[bastelfreak]

based on /var/log/apt/history.log:

Start-Date: 2026-09-05  12:05:34
Commandline: apt-get --quiet --yes upgrade
Upgrade: openvox-agent:amd64 (8.28.1-1+debian13, 8.29.0-1+debian13), linux-libc-dev:amd64 (6.12.105-1, 6.12.107-1)
Error: Sub-process /usr/bin/dpkg returned an error code (1)
End-Date: 2026-09-05  12:05:45

So apt tried an ugprade from 8.28.1 to 8.29.0, but still reports 8.26.1? maybe because dpkg aborted? I just don't know why it failed.

[bootc]

No, there's nothing wrong with dpkg in this case. This is all in how Apt works under the bonnet. Firstly, you can look at what you've actually got installed using dpkg -s openvox-agent. That should show all the correct fields.

The apt and apt-get commands work on what's available in the repos, not what's installed on your system. Unlike Debian repos, our repos include multiple versions of the same package, which is where the confusion happens.

You can see this for yourself: apt-cache show openvox-agent dumps the raw per-version stanzas straight from the Packages index, and each one's Description is correct for its own version. It's specifically the single-record output from apt show/apt info that's wrong — the Version, Depends, Provides etc. fields are correctly the candidate version's, but the long Description text gets swapped out for an older release's.

I was digging into this with Claude, and its best guess (based on its general knowledge of apt, not anything checked against apt's actual source) is that it's down to how apt pools/deduplicates description text internally when building its cache: every version of openvox-agent has the exact same short description (the first line, "The OpenVox Agent package contains all of the elements needed to run the agent..."), and only the long description (the "Contains the following components" block) changes between versions. If apt's internal pooling keys on that shared short description rather than on the version, the single-record "candidate" lookup path could end up reusing whichever long-description text got cached first, while the raw per-stanza dump isn't affected because it bypasses that pool. Take that bit with a pinch of salt until someone's actually checked it against the apt source — but the dpkg vs apt distinction above is solid.

In the meantime, apt-cache show and dpkg -s are the reliable sources for an accurate description.

[bootc]

Thinking about this, including this info in the Description field isn't how the field is really supposed to be used. I don't propose changing it now, given this is mostly harmless and everyone is used to it being there, but in Debian-land this kind of thing would normally belong in the changelog or similar - but then it's not immediately accessible using Apt: you either have to look inside the package or have the changelogs available to download somewhere.