If I run "apt-get install mysql-server" and get something other than MySQL, we now have a trust issue: The Debian repository cannot be trusted.
mysql-server package installs mariadb so that they can handle upgrades gracefully in a way that won't leave existing users in cold.
They would choose to do it the way you said but then the people who are upgrading their systems would be annoyed instead of you. Tough choice but either way it's a minor annoyance to be honest.
Addition:
Also it's not as if it isn't very clear what you're installing:
$ apt install mysql-server
....
The following NEW packages will be installed:
default-mysql-server galera-3 libdbd-mysql-perl libhtml-template-perl libterm-readkey-perl mariadb-client-10.1
mariadb-client-core-10.1 mariadb-common mariadb-server-10.1 mariadb-server-core-10.1 mysql-server
....
$ man mysql
MYSQL(1) MariaDB Database System MYSQL(1)
NAME
mysql - the MariaDB command-line tool
....
I certainly disagree that this qualifies as "very clear". The user asked to have mysql installed and the very first item on the list of stuff-to-be-installed is called "default-mysql-server". That certainly sounds like positive confirmation that you are indeed getting what you asked for.
Now, if you keep reading, you will see "mariadb-server-10.1" and stuff on that list, and if you also know two pieces of information (that mariadb is a fork of mysql, and that someone at Debian contemplated the idea of substituting one for the other), then you can see that you may have concluded the wrong thing and you can backtrack from there. Though really, at this point you still have conflicting information and it isn't conclusive.
So, I wouldn't say "very clear" is accurate. More like "possible to decipher if you have all the relevant context and are paying close attention".
As UIs go, this definitely violates the principle of least astonishment.
(though I don't buy this was an enough excuse for GP in this specific case because it becomes clear at the moment you run `mysql' command)
If Debian doesn't have a piece of software, it shouldn't update it. It should leave it alone.
(And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.)
And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL.
> And of course, the response to "man mysql" makes no sense, because MariaDB is not MySQL.
MariaDB was supposed to be a drop-in replacement. This is why Debian (and other distros like Fedora) chose to name it and help transition of existing users. Distributions tried their best to make it as painless as possible. Sorry it wasn't the case for you but I guess it still helped more people than it hurt.
> (And bear in mind, I was working from a script, so unless I sit there reading every line while it builds the VM, all of this unauthorized breakage of my machine is silent and without consulting me.)
It was documented in Release Notes [0]. You should've read it before upgrading your script. It is always a good idea to read it regardless of this specific issue.
Even if you didn't read release notes, banner text of `mysql' command makes it very clear it's MariaDB:
$ mysql
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 32
Server version: 10.1.26-MariaDB-0+deb9u1 Debian 9.1
"Supposed to" is a key point here, cause it's not: Explain works different if you need a certain thread info, AFAIK no JSON data type, GIS functions are different, lots of subtle differences that will bite you in the arse if you presume it's exactly the same engine. And as the time goes by the list of differences is just growing.
It was allowed to stay in unstable:
https://packages.debian.org/sid/mysql-server-5.5
However, the maintainers are uninterested in maintaining it there, since the release and security team have overrode them and forcibly removed it from stable.
Transitional packages are a source of confusion that are never fun, but this still sounds usually harrowing for dealing with the bumps of upgrading servers to a new OS major version. Just how rushed and close to the wire was your deployment?
Installing software that was not authorized on someone's machine is a serious security compromise.
Just learn from your mistakes and carry on.
This is a common mistake: you are conflating Linux and Debian. You don't have a Linux operating system, you have a Debian operating system and services & applications package (a "distribution") that happens to use the Linux kernel and other common parts associated (though in many cases not exclusively) with the Linux ecosystem.
MS wouldn't touch MySQL in an update because they never provided it for you. They might break it with changes that the upgrade makes and it isn't their responsibility not to (if you kept MySQL updated then you'd be fine as the maintainers would be aware of breaking changes in the OS and would have released updates to handle them ahead of time - but the onus here is on you to monitor that situation). They wouldn't change the operation of the DBMS they provide with the OS because there is no DBMS provided with the OS for them to break. A fairer comparison is MS updating IE with Windows upgrades, potentially breaking maintained web sites/apps that depend on non-standard and/or undefined behaviours in older versions of IE. Windows releases do often break other software, as do SQL Server release upgrades, as any major update of that sort does which is why thorough testing before releasing to production or otherwise mission-critical environments is essential.
> Installing software that was not authorized on someone's machine is a serious security compromise.
The release notes quite clearly state that it is going to happen. By installing the release you effectively authorised the process. And "serious security compromise" is hyperbole here IMO. A functionality compromise, yes, so effectively a DoS, but only for software more manually installed that is therefore not Debian's responsibility to keep compatibility with at all, and by installing the update without understanding it when the documentation was there to read you DoSed yourself.
While we are throwing around hyperbolic statements of blame: Not understanding the nature of the release update by at least reading through the release notes, and not testing an update in a pre-production environment, are both serious due diligence failures.
If the upgrade had left a (now unmaintained) mySQL install in-place with warnings in the documentation someone who didn't read that documentation wouldn't have seen the warnings any more than they would see the notes about the switch from mysql to mariadb so would have been left with a potentially insecure environment down the line as flaws are found by remain unpatched as Debian don't support mysql packages in that release.
If they had simply dropped the package your system would have been completely broken without manual intervention to install mariadb in its stead leaving your environment (more) broken.
The only way to keep everyone happy would be to keep maintaining both sets of packages, which, lo and behold, for all intents & purposes they do trough the LTS program: current old-stable is effectively supported until April 2020 so if you must keep mysql for compatibility purposes with software not provided as part of the distribution then you can keep using that for a while yet giving you nearly two more years to find a solution (waiting for that software made compatible with mariadb, finding an alternative to it, using mysql from another source (compiled locally or through a third party package repo, or moving to a Linux-based OS that does maintain mysql packages).
[1]: https://apps.fedoraproject.org/packages/community-mysql [2]: https://apps.fedoraproject.org/packages/mariadb
You could argue this was inevitable, but it was a product of the conditions at the time.
No, you installed their software on your machine without reading the release notes.
These situations are rare, but it's not without precedent.