Install apt-listbugs (critical-bug warnings before APT)
apt-listbugs hooks into APT and queries the Debian bug tracker before every install or upgrade, listing the release-critical bugs (grave, serious, critical) that affect the packages about to be unpacked, and letting you abort or pin them. It protects the integrity of the upgrade itself, not the host's attack surface: no standard mandates it, and Pavois ships it as a Debian defence-in-depth practice.
Checked against what is installed or registered, packages present/absent, account databases.
What Pavois checks
Pavois asserts that apt-listbugs is present in the dpkg inventory. This is an inventory-state control: it proves the tool is installed, not that it is wired into APT or that anyone reads its output. The APT hook ships with the package (/etc/apt/apt.conf.d/10apt-listbugs), so installation is normally enough to activate it, but a hook disabled downstream, or an APT_LISTBUGS_FRONTEND=none in the environment, would still pass this check.
describe package('apt-listbugs') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -l apt-listbugs and confirm the state column reads ii:
ii apt-listbugs 0.1.39 all tool which lists critical bugs before each apt installation
To see it actually work, run a dry upgrade (apt-get -s upgrade does not trigger the hook, so use a real apt install <pkg> in a scratch VM): apt-listbugs prints the RC bugs found and prompts before unpacking.
Inspect & investigate
apt-listbugs is not a daemon and writes no log file. Its output appears inline in the APT transaction, on the terminal. Its persistent state is the bug list cached under /var/cache/apt-listbugs/ and, when you tell it to hold a buggy package, an APT pin written to /etc/apt/preferences.d/, which is the only durable trace of a decision it made.
Remediation
The Pavois harden plan installs the apt-listbugs package with the system package manager (package resource, action install). Nothing else is configured: the package's own APT hook makes it active on the next apt run.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | apt-listbugs |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without it, you upgrade blind: a package with a known data-loss or boot-breaking RC bug is unpacked with no warning. The side effect is real and must be planned for: apt-listbugs is interactive and stops the APT transaction to ask what you want to do. On a host running unattended-upgrades, in CI, or in any non-TTY automation, that turns a silent security upgrade into a hung or aborted one, which delays patching. If the host patches itself unattended, either force the non-interactive frontend (APT_LISTBUGS_FRONTEND=none) for those runs, or accept that a human reviews the upgrades.