Clarify whether an explicit patch decline can be overridden by ring auto-approval

[ovizii]

I’m asking because I tried to prevent a specific Linux package from being installed: I declined docker-ce and selected “Clear all ring approvals.” Later, the device showed it as “Auto-approved by Production,” and the scheduled Server Policy job installed it successfully. The Production ring has “auto-approve unrated patches” enabled.

Is this expected? Should a ring’s automatic approval re-approve a patch after an explicit decline, or should the decline continue to block it? Also, does “Clear all ring approvals” remove existing approvals only, or should it prevent the patch from being automatically approved again?

If re-approval is intended, please clarify this in the UI so a decline isn’t mistaken for a lasting block.

I’m trying to find a reliable way to exclude specific Linux OS packages from automatic updates, since some packages—or some machines—need manual review or different handling.

[ToddHebebrand]

This is a bug, not intended behaviour. A decline stores rejected on the patch (apps/api/src/routes/patches/helpers.ts:156), but the scheduled-run resolver loads only approved rows (apps/api/src/services/patchEligibility.ts:281-302) and then evaluates the ring's auto-approve rules (apps/api/src/services/patchApprovalEvaluator.ts:554). With "auto-approve unrated" on, every Linux package qualifies, so the decline is never consulted, which is exactly what you saw. The docs say a declined patch is blocked (https://docs.breezermm.com/features/patch-management/, Approval States), so the code will be fixed to match: filed as #9369.

"Clear all ring approvals" marks the patch declined in every ring plus the partner-wide scope. It never deleted anything, and today it does not survive auto-approval either, for the same reason.

Per-package exclusion for Linux is not available yet. Ring Application rules (block and pin) only accept third-party and custom sources (packages/shared/src/validators/index.ts:616). Filed #9370 to extend them to OS packages, which is the durable answer to "some packages need manual handling".

Today: turn off "Also auto-approve unrated patches" on the Production ring (https://docs.breezermm.com/features/update-rings/). Linux packages then wait for manual approval, and your decline holds.

Status: bug #9369 filed; enhancement #9370 filed for Linux package rules.