Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wrote a CFEngine policy to manage the packages debian-keyring and debian-archive-keyring on Debian and Debian-based systems. For those packages, I would like to set the policy to addupdate, that is: install the package if it's not installed, update it if a new version is available. This would allow us to avoid annoying warning messages when one or more keys in the keyrings expire and they are in use.

I am afraid that such policy could trigger other unwanted package upgrades/removals on certain systems, potentially leading to a broken system. The risk on pure Debian systems is small, as no package in, say, wheezy, can trigger an upgrade to a newer version of the distribution. However, the risk of unwanted package upgrades may grow if one is using non official repositories in addition (think of, say, percona, riak... whatever you are using that is not part of the official Debian repositories). And in the case of rolling distros like, e.g. Linux Mint Debian Edition (semi-rolling), the risk seems very high to me[*].

Am I just being paranoid and it's actually safe to keep those two packages at the very latest version? Or you would advise to avoid any automatic upgrade for these two?

[*] that actually happened to me with LMDE, where packages like, e.g., openssh-server and sudo where set to addupdate. The upgrade request was honoured, at the price of removing many other packages including the desktop environment :-\

Thanks in advance

-- bronto

share|improve this question
I doubt there is any foolproof way to handle this. Whenever something is set to automatically update you always have the risk of upstream releasing an update that results in your system being broken. As you said your use of many different distros makes this extremely complicated. –  Zoredache Jan 6 at 20:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.