Day 09: Packages and updates

Written for apt. On RHEL-family systems the same five questions have dnf answers, noted at the end.

1. Refresh, then look before you leap

sudo apt-get update
apt list --upgradable

update refreshes the package lists and installs nothing — the most misunderstood command in the family. upgrade is what changes your system. Always run the first and read --upgradable before the second.

2. Install and inspect

sudo apt-get install -y tree
apt show tree | head -n 12
dpkg -L tree | head -n 10

apt show is the metadata: version, dependencies, description. dpkg -L lists every file the package placed on disk — the answer to "where did this actually install to".

3. Work backwards from a file

dpkg -S /usr/bin/tree
dpkg -S /etc/ssh/sshd_config

This is the one that earns its keep during an incident. You find an unfamiliar binary and need to know whether a package put it there or a person did. No output at all means no package owns it — which is worth a second look.

4. Pin a version you must not change

sudo apt-mark hold tree
apt-mark showhold
sudo apt-get install -y tree

The install becomes a no-op and says the package is held. This is how you stop an unattended upgrade from moving a version your application is pinned against. The matching mistake is holding something and forgetting — apt-mark showhold belongs in whatever you use to audit a machine.

sudo apt-mark unhold tree
apt-mark showhold

5. Remove, and understand the two kinds of removal

sudo apt-get remove -y tree
dpkg -l tree | tail -n 2
sudo apt-get purge -y tree
dpkg -l tree | tail -n 2
sudo apt-get autoremove -y

remove deletes the program but leaves configuration, so dpkg -l shows state rc — removed, config remaining. purge takes the config too. When a reinstall keeps inheriting settings you thought you deleted, remove is why.

autoremove drops dependencies nothing needs any more. Read what it proposes; it occasionally offers to remove a kernel you are running.

The RHEL-family equivalents

Where this goes next

Nine days of guided labs. Tomorrow has no steps: a service that will not start, and everything you need to diagnose it is in Days 06 to 09.