Merge "Do not update packages in encrypted state" into nyc-dev