← All rules
SOCLE-CLD-PKG-009// Packageslowinventory state

Install apt-listbugs (critical-bug warnings before APT)

apt-listbugs hooks into APT and queries the Debian bug tracker before every install or upgrade, listing the release-critical bugs (grave, serious, critical) that affect the packages about to be unpacked, and letting you abort or pin them. It protects the integrity of the upgrade itself, not the host's attack surface: no standard mandates it, and Pavois ships it as a Debian defence-in-depth practice.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0

What Pavois checks

Pavois asserts that apt-listbugs is present in the dpkg inventory. This is an inventory-state control: it proves the tool is installed, not that it is wired into APT or that anyone reads its output. The APT hook ships with the package (/etc/apt/apt.conf.d/10apt-listbugs), so installation is normally enough to activate it, but a hook disabled downstream, or an APT_LISTBUGS_FRONTEND=none in the environment, would still pass this check.

describe package('apt-listbugs') do
  it { should be_installed }
end

How to verify it is applied

Run dpkg -l apt-listbugs and confirm the state column reads ii:

ii  apt-listbugs   0.1.39  all  tool which lists critical bugs before each apt installation

To see it actually work, run a dry upgrade (apt-get -s upgrade does not trigger the hook, so use a real apt install <pkg> in a scratch VM): apt-listbugs prints the RC bugs found and prompts before unpacking.

Inspect & investigate

apt-listbugs is not a daemon and writes no log file. Its output appears inline in the APT transaction, on the terminal. Its persistent state is the bug list cached under /var/cache/apt-listbugs/ and, when you tell it to hold a buggy package, an APT pin written to /etc/apt/preferences.d/, which is the only durable trace of a decision it made.

Remediation

The Pavois harden plan installs the apt-listbugs package with the system package manager (package resource, action install). Nothing else is configured: the package's own APT hook makes it active on the next apt run.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
nameapt-listbugs
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Without it, you upgrade blind: a package with a known data-loss or boot-breaking RC bug is unpacked with no warning. The side effect is real and must be planned for: apt-listbugs is interactive and stops the APT transaction to ask what you want to do. On a host running unattended-upgrades, in CI, or in any non-TTY automation, that turns a silent security upgrade into a hung or aborted one, which delays patching. If the host patches itself unattended, either force the non-interactive frontend (APT_LISTBUGS_FRONTEND=none) for those runs, or accept that a human reviews the upgrades.

Sources & references