How to quickly get the reason for the most recent update of a package from the command-line?

Question

Is there a command-line command I can run to quickly determine the reason for a package update? Ideally, a command that dumps a set of URLs to all of the relevant information.

For example (it's a long example - sorry), today all of my systems updated these 5 packages:

Reading package lists...
Building dependency tree...
Reading state information...
The following packages will be upgraded:
  login openssh-client openssh-server openssh-sftp-server passwd
5 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,977 kB of archives.
After this operation, 24.6 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-updates/main login amd64 1:4.1.5.1-1ubuntu9.2 [301 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty-updates/main passwd amd64 1:4.1.5.1-1ubuntu9.2 [759 kB]
Get:3 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-sftp-server amd64 1:6.6p1-2ubuntu2.6 [34.2 kB]
Get:4 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-server amd64 1:6.6p1-2ubuntu2.6 [321 kB]
Get:5 http://archive.ubuntu.com/ubuntu/ trusty-updates/main openssh-client amd64 1:6.6p1-2ubuntu2.6 [562 kB] Preconfiguring packages ...
Fetched 1,977 kB in 3s (506 kB/s)
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../login_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking login (1:4.1.5.1-1ubuntu9.2) over (1:4.1.5.1-1ubuntu9.1) ...
Processing triggers for man-db (2.6.7.1-1ubuntu1) ...
Setting up login (1:4.1.5.1-1ubuntu9.2) ...
(Reading database ... 88021 files and directories currently installed.) Preparing to unpack .../passwd_1%3a4.1.5.1-1ubuntu9.2_amd64.deb ...
Unpacking passwd (1:4.1.5.1-1ubuntu9.2) over (1:4.1.5.1-1ubuntu9.1) ...
...

I'm not seeing anything obviously related on the Ubuntu Security Notices (USN) page, which is my usual go-to location. Updates of this nature (login, passwd, and OpenSSH) tend to be security related, but that doesn't, on the surface, appear to be the case here.

apt-cache show login

Shows a source of 'http://pkg-shadow.alioth.debian.org/', which says the parent 'shadow' package hasn't been updated since May 9, 2014. Okay. Not sure why there isn't a link to Launchpad.net baked into apt-cache show, but whatev's. Looking specifically at the 'shadow' package on Launchpad 'https://launchpad.net/ubuntu/+source/shadow' and looking for the package version '1:4.1.5.1-1ubuntu9.2', I see a changelog:

18 hours ago

Changelog

shadow (1:4.1.5.1-1ubuntu9.2) trusty; urgency=medium

  * debian/control, debian/rules: re-enable libaudit support. (LP: #1478087)

 -- Mathieu Trudel-Lapierre <email address hidden>  Fri, 22 Jan 2016 11:21:57 -0500

Which links to bug report #1478087. Which, in turn, has a discussion on 'libaudit', which is used to track login attempts and why the package update happened.

In short, after spending about a half hour, I can finally figure out why the update happened. It is security related as I originally suspected, but getting to that point of knowledge took too long. Which brings me back around to the original question I started with, which is: How to quickly get the reason for the update of a package from the command-line?

Answer 1

A simple way to check why a package has been updated is to check its changelog.

apt-get changelog pkgname

For example, here is the current changelog for openssh-client

$ apt-get changelog openssh-client

openssh (1:5.9p1-5ubuntu1.8) precise-security; urgency=medium

  * SECURITY UPDATE: information leak and overflow in roaming support
    - debian/patches/CVE-2016-077x.patch: completely disable roaming option
      in readconf.c.
    - CVE-2016-0777
    - CVE-2016-0778

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 13 Jan 2016 10:49:17 -0500

openssh (1:5.9p1-5ubuntu1.7) precise-security; urgency=medium

...