feat: pin package versions

tasks/install-repair-tools.yml

@@ -30,16 +30,24 @@
 - name: install repairtool (package dependencies are encoded in the package)
   apt:
     name: [
-      'libslub-lza-repair-perl=0.9.15*',
-      'checkit-tiff=1.0.0',
-      'fixit-tiff=0.1.3'
+      '{{ item.package_name }}={{ item.version }}',
     ]
     # CAUTION!!! Always use "state: present". Due to version constraints, we do
     #            not allow just any package version or automatic update
     #            mechanisms. Autoupdates will make the repair tool crash!
     state: present
+  loop: "{{ tool_versions }}"
   tags: [apt]
 
+- name: configure tool version pinning to avoid automatic nightly upgrades
+  template:
+    src: "etc/apt/preferences.d/pinning.j2"
+    dest: "/etc/apt/preferences.d/{{ item.package_name }}"
+    owner: "root"
+    group: "root"
+    mode: 0750
+  loop: "{{ tool_versions }}"
+
 # FHS 3.0 specifies the correct path for the config:
 # https://refspecs.linuxfoundation.org/FHS_3.0/fhs/ch04s09.html
 - name: install checkit_tiff config

templates/etc/apt/preferences.d/pinning.j2

+Package: {{ item.package_name }}
+Pin: version {{ item.version }}
+Pin-Priority: 999

vars/main.yml

 ---
-checkit_tiff_version: "v0.6.0"
+tool_versions:
+  - package_name: "checkit-tiff"
+    version: "1.0.0"
+  - package_name: "fixit-tiff"
+    version: "0.1.3"
+  - package_name: "libslub-lza-repair-perl"
+    version: "0.9.15*"