Source: gnupg2 Version: 2.2.40-1.1 Severity: normal Various Arch: any packages in src:gnupg2 Recommends: gnupg (= ${binary:Version}). However, gnupg is an Arch: all package, so the relationship should use "(= ${source:Version})" to play nicely with binNMUs.
Currently, "apt upgrade" won't update the gnupg packages but "apt full-upgrade" will, because of this. $ sudo apt upgrade -o Debug::pkgDepCache::Marker=true Reading package lists... Done Building dependency tree... Done Reading state information... Done MarkInstall gpg:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 gpg:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkInstall gpg-wks-server:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 gpg-wks-server:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkInstall gpg-agent:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 gpg-agent:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkInstall gpgsm:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 gpgsm:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkInstall dirmngr:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 dirmngr:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkInstall gpg-wks-client:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 gpg-wks-client:amd64 Recommends on gnupg:amd64 < 2.2.40-1.1 @ii mK > (= 2.2.40-1.1+b1) can't be satisfied! (dep) MarkKeep gpg:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU IPb > FU=0 MarkKeep gpgconf:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU > FU=0 MarkKeep gpg-agent:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU Ib > FU=0 MarkKeep gpgsm:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU Ib > FU=0 MarkKeep dirmngr:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU Ib > FU=0 MarkKeep gpg-wks-client:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU Ib > FU=0 MarkKeep gpg-wks-server:amd64 < 2.2.40-1.1 -> 2.2.40-1.1+b1 @ii umU Ib > FU=0 Calculating upgrade... Done The following packages have been kept back: dirmngr gpg gpg-agent gpg-wks-client gpg-wks-server gpgconf gpgsm 0 upgraded, 0 newly installed, 0 to remove and 7 not upgraded. $ sudo apt -V full-upgrade Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done The following packages will be upgraded: dirmngr (2.2.40-1.1 => 2.2.40-1.1+b1) gpg (2.2.40-1.1 => 2.2.40-1.1+b1) gpg-agent (2.2.40-1.1 => 2.2.40-1.1+b1) gpg-wks-client (2.2.40-1.1 => 2.2.40-1.1+b1) gpg-wks-server (2.2.40-1.1 => 2.2.40-1.1+b1) gpgconf (2.2.40-1.1 => 2.2.40-1.1+b1) gpgsm (2.2.40-1.1 => 2.2.40-1.1+b1) 7 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. Need to get 4,748 kB of archives. After this operation, 31.7 kB of additional disk space will be used. Do you want to continue? [Y/n] n Abort. -- System Information: Debian Release: trixie/sid APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'unstable'), (500, 'testing'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 6.6.9-amd64 (SMP w/4 CPU threads; PREEMPT) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled