Take the 2-minute tour ×

Does the Debian/Ubuntu package infrastructure has some way of marking packages so that they never get uninstalled, no matter the pinning of other packages?

My problem is that, sometimes, packages installed by Puppet (coming from non-standard repositories, of course) cause other packages to get uninstalled -- in particular, openssh-{server,client}.

The way this happens is that package A and B depend on different versions of package C. If A is installed and one asks to install B, then the version of C changes. The new version of C is incompatible with A, so A gets uninstalled.

The funny thing is that the process is then reversed, as, on the next run, Puppet notices that A is not installed and tries to install it.

So, basically, I want to make sure A never gets uninstalled, which would prevent B from getting installed. That would be reported as an error, making me aware of the issue.

If anyone cares, Puppet uses the following command to install packages:

share|improve this question
askubuntu.com/q/116180/46312 you have to hold the pinned application –  Ringtail May 21 '12 at 13:40

2 Answers 2

You need to "hold" the packages so that apt-get upgrade never removes them as part of upgrading to a newer version.

echo "package-name hold" | sudo dpkg --set-selections

However, note that explicitly doing an apt-get install package-name WILL override the hold, while an apt-get remove package-name WILL uninstall it.

If you pin it to a specific version with a priority of 1001 or greater, even apt-get install will NOT upgrade it, but it can still be removed.

share|improve this answer
Do I need to go through dpkg? Isn't there a configuration file for it? Also, would hold prevent them from being updated by unattended-upgrades? –  Daniel C. Sobral May 21 '12 at 15:09
It's highly recommended you NOT mess with the dpkg config files themselves. If you want GUI you can also go Synaptic and use right-click "lock this package", but I have seen some reports that the lock isn't obeyed. –  izx May 21 '12 at 15:11
Hold should prevent them from being upgraded. Only an explicit apt-get install held-package will override it. –  izx May 21 '12 at 17:54
Actually, I want text files updated through Puppet. GUI is the farthest thing from what I want. However, I saw that the packages that got inadvertently removed seemed to be in HOLD already, so I'm now suspicious of this method. Besides, I want them updated as usual, just not removed (particularly given their sensitivity to security issues). –  Daniel C. Sobral May 21 '12 at 19:00
You need to explain your update scenario and/or give more details. Packages are not removed unless they are being upgraded or there is a conflict; you have to apt-get autoremove them. –  izx May 23 '12 at 6:52

This can probably be solved by adding the this to apt.conf[.d]:

Aptitude::Always-Use-Safe-Resolver "true";

And to site.pp in puppet:

Package { provider => 'aptitude' }

Haven't tested that properly yet though.

share|improve this answer
Actually, just noticed the APT::Get::Remove option to apt-get, should solve it as well. Command line is --no-remove. –  user67212 May 30 '12 at 15:59
That's a general flag, isn't it? I want to mark specific packages. –  Daniel C. Sobral May 30 '12 at 17:42

Your Answer


