- Shipped
- August 27, 2026 at 6:31 PM UTC
- Author
- Kamo
- Commit
- 23b8f52
Two separate reasons the "Code" update could not be installed. THE UPDATE COULD NOT BE DOWNLOADED. enp1s0 came up at MTU 1500 while every other workload on this cluster runs at 1420, and nothing tells the guest otherwise. TCP connects fine because the handshake is small, then anything needing full-size frames is silently blackholed. It hides well: it only bites where Path MTU Discovery cannot rescue it, so Ubuntu's mirrors were fine (they return ICMP "fragmentation needed") while packages.microsoft.com, behind Azure Front Door which filters that ICMP, hung forever on the TLS handshake. apt reported only "Could not wait for server fd - select (11: Resource temporarily unavailable)", which names nothing. Measured rather than guessed: at MTU 1500 the request never returns; at 1420 it is HTTP 200 in 0.13s. 1420 is the pod MTU, taken from a running pod rather than picked as a safe-looking smaller number, so the VM behaves like everything else here. Set in the netplan install-agent.sh writes, so it survives a rebuild. THE DESKTOP COULD NOT APPLY IT EITHER. PackageKit defaults to auth_admin / auth_admin_keep, and an xrdp session has NO SEAT — `loginctl show-session` shows Seat empty — so the admin authentication cannot be completed and Discover refuses to install anything, showing an update with no way to apply it and no explanation. There were no polkit rules on the machine at all. The new rule grants the kamodev group PackageKit's own action namespace and nothing else. It is not a privilege escalation: sudoers already gives that group NOPASSWD on apt, apt-get, aptitude, dpkg, snap, flatpak, add-apt-repository, apt-key and dpkg-reconfigure — dpkg alone is root. All this does is stop the graphical path being stricter than the terminal path that is already open. Verified on the VM: packagekit system-update / package-install / package-remove all authorise (exit 0), while systemd1.manage-units and login1.power-off still do not (exit 2). VS Code is now 1.135.0 and 0 packages remain upgradable.