Is there a command-line command I can run to quickly determine the reason for a package update? Ideally, a command that dumps a set of URLs to all of the relevant information.

For example (it's a long example - sorry), today all of my systems updated these 5 packages:

Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  login openssh-client openssh-server openssh-sftp-server passwd
5 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,977 kB of archives.
After this operation, 24.6 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-updates/main login amd64 1: [301 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty-updates/main passwd amd64 1: [759 kB]
Get:3 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-sftp-server amd64 1:6.6p1-2ubuntu2.6 [34.2 kB]
Get:4 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-server amd64 1:6.6p1-2ubuntu2.6 [321 kB]
Get:5 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-client amd64 1:6.6p1-2ubuntu2.6 [562 kB] Preconfiguring packages ...
Fetched 1,977 kB in 3s (506 kB/s)
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../login_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking login (1: over (1: ...
Processing triggers for man-db ( ...
Setting up login (1: ...
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../passwd_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking passwd (1: over (1: ...

I'm not seeing anything obviously related on the Ubuntu Security Notices (USN) page, which is my usual go-to location. Updates of this nature (login, passwd, and OpenSSH) tend to be security related, but that doesn't, on the surface, appear to be the case here.

apt-cache show login

Shows a source of 'http://pkg-shadow.alioth.debian.org/', which says the parent 'shadow' package hasn't been updated since May 9, 2014. Okay. Not sure why there isn't a link to Launchpad.net baked into apt-cache show, but whatev's. Looking specifically at the 'shadow' package on Launchpad 'https://launchpad.net/ubuntu/+source/shadow' and looking for the package version '1:', I see a changelog:

18 hours ago


shadow (1: trusty; urgency=medium

  * debian/control, debian/rules: re-enable libaudit support. (LP: #1478087)

 -- Mathieu Trudel-Lapierre <email address hidden>  Fri, 22 Jan 2016 11:21:57 -0500

Which links to bug report #1478087. Which, in turn, has a discussion on 'libaudit', which is used to track login attempts and why the package update happened.

In short, after spending about a half hour, I can finally figure out why the update happened. It is security related as I originally suspected, but getting to that point of knowledge took too long. Which brings me back around to the original question I started with, which is: How to quickly get the reason for the update of a package from the command-line?

  • 3
    Run apt-get changelog pkgname. Feb 5, 2016 at 19:07
  • @mikewhatever - If you make that an answer, I'll upvote it. It works and I didn't know about it previously.
    – Joe
    Feb 12, 2016 at 9:37
  • @Joe Happy to oblige. :~) Feb 12, 2016 at 9:58

1 Answer 1


A simple way to check why a package has been updated is to check its changelog.

apt-get changelog pkgname

For example, here is the current changelog for openssh-client

$ apt-get changelog openssh-client

openssh (1:5.9p1-5ubuntu1.8) precise-security; urgency=medium

  * SECURITY UPDATE: information leak and overflow in roaming support
    - debian/patches/CVE-2016-077x.patch: completely disable roaming option
      in readconf.c.
    - CVE-2016-0777
    - CVE-2016-0778

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 13 Jan 2016 10:49:17 -0500

openssh (1:5.9p1-5ubuntu1.7) precise-security; urgency=medium

  • +1 as promised. For icing on the cake: Is there a way to do that before installing an update - to see if I really need it, etc. - like if I have a modified version and want to know if it's worth the trouble of reapplying the modification to a new version.
    – Joe
    Feb 13, 2016 at 4:57
  • That command will show changelog for the newest version available in the repositories, regardless of whether installed or not. Feb 13, 2016 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.