Is the any way off putting the command
you do into the change message.
Understanding how etckeeper works means you have to understand how version control systems work. With VCS systems you have the concept of your repository, basically a database of all the changes, the working directory where you are currently changing things.
Etckeeper can actually use one of several DVCS back-ends, it can support bzr, git and hg. Whatever back-end you use it all works about the same. I use git as the back-end since I am far more familiar with git.
With Etckeeper, your working directory is almost always
/etc, though you can use it for other directories. When everything about the current state of your working directory has been commited your working directory is considered to be clean. If you make a change to some file and would like your change to be committed to the repository you run the command
etckeeper commit "Your log message here". You can check to see if you repository is in a clean state by running a command like
etckeeper unclean && echo $.
With the background out of the way I can go into how etckeeper hooks into to help you keep track of what apt does. When etckeeper is installed a config file is added to the apt configuration at
/etc/apt/apt.conf.d/05etckeeper. This sets up some hooks so when apt is asked to install a package(s) it will run command before the installation is started, and it will run a command after the install is complete. To see exactly what the pre and post install command do take a look at the scripts in the
Basically the pre-install command will do a commit if your working directory is not clean. If you don't like this, you could simply remember to manually run a commit after you change anything. If you strongly object to the auto-commit you can adjust your
/etc/etckeeper/etckeeper.conf file and uncomment the
AVOID_COMMIT_BEFORE_INSTALL=1 line. Making this change will mean that you will be forced to manually commit before you can run apt. If you really don't like the auto-commit you may also want to disable the daily auto-commit, present in newer versions.
I want to be able to do enquiries on the bzr repository from an ordinary
That is a extremely bad idea in my opinion. There are many files in /etc that should not be readable to a end-user. If you want to make your life easier you could setup sudo to not prompt your account for a password when you use bzr or etckeeper.
Are there any gotchas in removing
files (such as /etc/shadow/ from
The right way to do this is to use the ignore feature for the DVCS backend you have chosen. If you where using git you would add the file to your
/etc/.gitignore, I believe there is a
/etc/.bzrignore that should do the same thing, but you may need to bzr expert to confirm that for you. Personally, I think I like to track the
/etc/shadow file since it allows me to know if someone evil has managed to modify a service account which is supposed to have a disabled password, to have a password which would allow it to be used for logins.