Comment 17 for bug 1979244

No, it doesn't work. Is there a reason developers here are not actually launching new instances and confirming the statements themselves? Why do I have to keep proving this? Another fresh instance, AMI ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-20220609 (ami-0d70546e43a941d70), absolutely nothing tuned, touched, or otherwise:

ubuntu@ip-172-31-53-51:~$ dpkg -l | grep libssl
ii libssl3:amd64 3.0.2-0ubuntu1.2 amd64 Secure Sockets Layer toolkit - shared libraries

ubuntu@ip-172-31-53-51:~$ sudo apt install libssl-dev=3.0.2-0ubuntu1.4
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 libssl-dev : Depends: libssl3 (= 3.0.2-0ubuntu1.4) but 3.0.2-0ubuntu1.2 is to be installed

ubuntu@ip-172-31-53-51:~$ sudo aptitude why libssl3
i linux-headers-5.15.0-1011-aws Depends libssl3 (>= 3.0.0~~alpha1)

Now, if you do what I said earlier -- please note the package version name difference compared to what everyone keeps referring to:

ubuntu@ip-172-31-53-51:~$ sudo apt install libssl3=3.0.2-0ubuntu1.4
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following packages will be upgraded:
  libssl3
1 upgraded, 0 newly installed, 0 to remove and 7 not upgraded.
Need to get 1900 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 http://us-west-2.ec2.archive.ubuntu.com/ubuntu jammy-updates/main amd64 libssl3 amd64 3.0.2-0ubuntu1.4 [1900 kB]
Fetched 1900 kB in 0s (29.4 MB/s)
Preconfiguring packages ...
(Reading database ... 64038 files and directories currently installed.)
Preparing to unpack .../libssl3_3.0.2-0ubuntu1.4_amd64.deb ...
Unpacking libssl3:amd64 (3.0.2-0ubuntu1.4) over (3.0.2-0ubuntu1.2) ...
Setting up libssl3:amd64 (3.0.2-0ubuntu1.4) ...
Processing triggers for libc-bin (2.35-0ubuntu3) ...
{snipping for brevity}

ubuntu@ip-172-31-53-51:~$ dpkg -l | grep libssl
ii libssl3:amd64 3.0.2-0ubuntu1.4 amd64 Secure Sockets Layer toolkit - shared libraries

ubuntu@ip-172-31-53-51:~$ sudo apt-get install libmysqlclient-dev
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 libssl-dev : Depends: libssl3 (= 3.0.2-0ubuntu1.1) but 3.0.2-0ubuntu1.4 is to be installed
E: Unable to correct problems, you have held broken packages.

But now that libssl3 is using 3.0.2-0ubuntu1.4, let's see what happens if we try to get libssl-dev alongside the same version (per apt-cache show libssl-dev):

ubuntu@ip-172-31-53-51:~$ sudo apt-cache show libssl-dev | grep Depends
Depends: libssl3 (= 3.0.2-0ubuntu1.4)
Depends: libssl3 (= 3.0.2-0ubuntu1.1)
Depends: libssl3 (= 3.0.2-0ubuntu1)

ubuntu@ip-172-31-53-51:~$ sudo apt install libssl-dev=3.0.2-0ubuntu1.4
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Suggested packages:
  libssl-doc
The following NEW packages will be installed:
  libssl-dev
0 upgraded, 1 newly installed, 0 to remove and 7 not upgraded.
Need to get 2370 kB of archives.
After this operation, 12.4 MB of additional disk space will be used.
Get:1 http://us-west-2.ec2.archive.ubuntu.com/ubuntu jammy-updates/main amd64 libssl-dev amd64 3.0.2-0ubuntu1.4 [2370 kB]
Fetched 2370 kB in 0s (45.1 MB/s)
Selecting previously unselected package libssl-dev:amd64.
(Reading database ... 64038 files and directories currently installed.)
Preparing to unpack .../libssl-dev_3.0.2-0ubuntu1.4_amd64.deb ...
Unpacking libssl-dev:amd64 (3.0.2-0ubuntu1.4) ...
Setting up libssl-dev:amd64 (3.0.2-0ubuntu1.4) ...
{snipping for brevity}

ubuntu@ip-172-31-53-51:~$ dpkg -l | grep libssl
ii libssl-dev:amd64 3.0.2-0ubuntu1.4 amd64 Secure Sockets Layer toolkit - development files
ii libssl3:amd64 3.0.2-0ubuntu1.4 amd64 Secure Sockets Layer toolkit - shared libraries

ubuntu@ip-172-31-53-51:~$ sudo apt-get install libmysqlclient-dev
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
  fontconfig-config fonts-dejavu-core libc-dev-bin libc-devtools libc6-dev libcrypt-dev libdeflate0 libfontconfig1 libgd3 libjbig0 libjpeg-turbo8 libjpeg8 libmysqlclient21 libnsl-dev
  libtiff5 libtirpc-dev libwebp7 libxpm4 libzstd-dev linux-libc-dev manpages-dev mysql-common rpcsvc-proto zlib1g-dev
Suggested packages:
  glibc-doc libgd-tools
The following NEW packages will be installed:
  fontconfig-config fonts-dejavu-core libc-dev-bin libc-devtools libc6-dev libcrypt-dev libdeflate0 libfontconfig1 libgd3 libjbig0 libjpeg-turbo8 libjpeg8 libmysqlclient-dev
  libmysqlclient21 libnsl-dev libtiff5 libtirpc-dev libwebp7 libxpm4 libzstd-dev linux-libc-dev manpages-dev mysql-common rpcsvc-proto zlib1g-dev
0 upgraded, 25 newly installed, 0 to remove and 7 not upgraded.
Need to get 11.6 MB of archives.
After this operation, 50.2 MB of additional disk space will be used.
Do you want to continue? [Y/n] n

And now we're finally getting somewhere.

So, in other words: the version pinning has to be done against **two** packages independently, **and in this order**:

sudo apt install libssl3=3.0.2-0ubuntu1.4
sudo apt install libssl-dev=3.0.2-0ubuntu1.4

My point stands, however: if this is caused by phased updates, then this is literally hardcore breakage that is happening in the real world and wasting systems administrator + developer time. We should be able to rely on base Ubuntu images reliably and not find variance in packaging like this due to what is nothing more than a glorified A/B test.

I've opened https://bugs.launchpad.net/ubuntu/+source/linux-aws/+bug/1979325 to try and put an end to phased updates on AWS AMIs, since we need reliable behaviour. I am obviously not the only user who has run into this (this ticket is proof, as are comments going back to early 2021). I understand what the feature is for, but the way it manifests -- at least with regards to OpenSSL-related packages, considering how critical they are when tied to the base system (linux-headers) -- is not good.