I wrote a CFEngine policy to manage the packages
debian-archive-keyring on Debian and Debian-based systems. For those packages, I would like to set the policy to
addupdate, that is: install the package if it's not installed, update it if a new version is available. This would allow us to avoid annoying warning messages when one or more keys in the keyrings expire and they are in use.
I am afraid that such policy could trigger other unwanted package upgrades/removals on certain systems, potentially leading to a broken system. The risk on pure Debian systems is small, as no package in, say, wheezy, can trigger an upgrade to a newer version of the distribution. However, the risk of unwanted package upgrades may grow if one is using non official repositories in addition (think of, say, percona, riak... whatever you are using that is not part of the official Debian repositories). And in the case of rolling distros like, e.g. Linux Mint Debian Edition (semi-rolling), the risk seems very high to me[*].
Am I just being paranoid and it's actually safe to keep those two packages at the very latest version? Or you would advise to avoid any automatic upgrade for these two?
[*] that actually happened to me with LMDE, where packages like, e.g., openssh-server and sudo where set to
addupdate. The upgrade request was honoured, at the price of removing many other packages including the desktop environment :-\
Thanks in advance