Pinning the metapackage `mongodb-org` to version 4.0.3 does not mean that the child packages are pinned in that version:
``` travis@271f6ca8bfb2:~$ dpkg -l | grep mongo ii mongodb-org 4.0.3 amd64 MongoDB open source document-oriented database system (metapackage) ii mongodb-org-mongos 4.0.5 amd64 MongoDB sharded cluster query router ii mongodb-org-server 4.0.5 amd64 MongoDB database server ii mongodb-org-shell 4.0.5 amd64 MongoDB shell client ii mongodb-org-tools 4.0.5 amd64 MongoDB tools ```
This ensures that the dependencies of the metapackage are installed on the version that we desire.
The result: ``` travis@f64e782f93ad:~$ dpkg -l | grep mongo ii mongodb-org-mongos 4.0.3 amd64 MongoDB sharded cluster query router ii mongodb-org-server 4.0.3 amd64 MongoDB database server ii mongodb-org-shell 4.0.3 amd64 MongoDB shell client ii mongodb-org-tools 4.0.3 amd64 MongoDB tools ```
The following files state that the packages are distributed under the AGPL license: /usr/share/doc/mongodb-org-mongos/copyright /usr/share/doc/mongodb-org-server/copyright /usr/share/doc/mongodb-org-shell/copyright /usr/share/doc/mongodb-org-tools/copyright