3

Is there a command-line command I can run to quickly determine the reason for a package update? Ideally, a command that dumps a set of URLs to all of the relevant information.

For example (it's a long example - sorry), today all of my systems updated these 5 packages:

Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  login openssh-client openssh-server openssh-sftp-server passwd
5 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,977 kB of archives.
After this operation, 24.6 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-updates/main login amd64 1:4.1.5.1-1ubuntu9.2 [301 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty-updates/main passwd amd64 1:4.1.5.1-1ubuntu9.2 [759 kB]
Get:3 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-sftp-server amd64 1:6.6p1-2ubuntu2.6 [34.2 kB]
Get:4 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-server amd64 1:6.6p1-2ubuntu2.6 [321 kB]
Get:5 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-client amd64 1:6.6p1-2ubuntu2.6 [562 kB] Preconfiguring packages ...
Fetched 1,977 kB in 3s (506 kB/s)
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../login_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking login (1:4.1.5.1-1ubuntu9.2) over (1:4.1.5.1-1ubuntu9.1) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Setting up login (1:4.1.5.1-1ubuntu9.2) ...
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../passwd_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking passwd (1:4.1.5.1-1ubuntu9.2) over (1:4.1.5.1-1ubuntu9.1) ...
...

I'm not seeing anything obviously related on the Ubuntu Security Notices (USN) page, which is my usual go-to location. Updates of this nature (login, passwd, and OpenSSH) tend to be security related, but that doesn't, on the surface, appear to be the case here.

apt-cache show login

Shows a source of 'http://pkg-shadow.alioth.debian.org/', which says the parent 'shadow' package hasn't been updated since May 9, 2014. Okay. Not sure why there isn't a link to Launchpad.net baked into apt-cache show, but whatev's. Looking specifically at the 'shadow' package on Launchpad 'https://launchpad.net/ubuntu/+source/shadow' and looking for the package version '1:4.1.5.1-1ubuntu9.2', I see a changelog:

18 hours ago

Changelog

shadow (1:4.1.5.1-1ubuntu9.2) trusty; urgency=medium

  * debian/control, debian/rules: re-enable libaudit support. (LP: #1478087)

 -- Mathieu Trudel-Lapierre <email address hidden>  Fri, 22 Jan 2016 11:21:57 -0500

Which links to bug report #1478087. Which, in turn, has a discussion on 'libaudit', which is used to track login attempts and why the package update happened.

In short, after spending about a half hour, I can finally figure out why the update happened. It is security related as I originally suspected, but getting to that point of knowledge took too long. Which brings me back around to the original question I started with, which is: How to quickly get the reason for the update of a package from the command-line?

3
  • 3
    Run apt-get changelog pkgname. – mikewhatever Feb 5 '16 at 19:07
  • @mikewhatever - If you make that an answer, I'll upvote it. It works and I didn't know about it previously. – Joe Feb 12 '16 at 9:37
  • @Joe Happy to oblige. :~) – mikewhatever Feb 12 '16 at 9:58
2

A simple way to check why a package has been updated is to check its changelog.

apt-get changelog pkgname

For example, here is the current changelog for openssh-client

$ apt-get changelog openssh-client

openssh (1:5.9p1-5ubuntu1.8) precise-security; urgency=medium

  * SECURITY UPDATE: information leak and overflow in roaming support
    - debian/patches/CVE-2016-077x.patch: completely disable roaming option
      in readconf.c.
    - CVE-2016-0777
    - CVE-2016-0778

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 13 Jan 2016 10:49:17 -0500

openssh (1:5.9p1-5ubuntu1.7) precise-security; urgency=medium

...
2
  • +1 as promised. For icing on the cake: Is there a way to do that before installing an update - to see if I really need it, etc. - like if I have a modified version and want to know if it's worth the trouble of reapplying the modification to a new version. – Joe Feb 13 '16 at 4:57
  • That command will show changelog for the newest version available in the repositories, regardless of whether installed or not. – mikewhatever Feb 13 '16 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.