Install apt-show-versions (patch-management inventory)
apt-show-versions reports, for every installed package, the version in use, the suite it came from (stable, oldstable, a third-party repo) and whether a newer version is available: apt-show-versions -u lists exactly what is upgradable. Be clear about what this buys you: it is an inventory and patch-management tool, not a protection. It makes patch drift measurable; it never fixes it. No standard mandates it, and Pavois carries it as a Debian defence-in-depth practice.
Checked against what is installed or registered, packages present/absent, account databases.
What Pavois checks
Pavois asserts that apt-show-versions is present in the dpkg inventory. This is an inventory-state control: it proves the binary is available on the host, not that anyone runs it, and certainly not that the host is up to date. A machine two years behind on patches passes this rule as long as the package is installed.
describe package('apt-show-versions') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -l apt-show-versions and confirm the state column reads ii:
ii apt-show-versions 0.22.13 all lists available package versions with distribution
Then exercise it: apt-show-versions -u prints one line per upgradable package (openssl/bookworm-security upgradeable from 3.0.11-1~deb12u2 to 3.0.15-1~deb12u1), and prints nothing when the host is current.
Inspect & investigate
No logs. apt-show-versions is an on-demand CLI with no daemon, no cron job and no log file; its only persistent artefact is a parsing cache under /var/cache/apt-show-versions/, rebuilt when the APT lists change. If you want a trace of patch drift over time, you have to capture the output of apt-show-versions -u yourself (a scheduled job feeding your monitoring).
Remediation
The Pavois harden plan installs the apt-show-versions package with the system package manager (package resource, action install). No configuration is applied, and none is needed: the tool is a read-only reporter.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | apt-show-versions |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without it you lose a fast, scriptable view of which packages are behind and which suite they come from, which is how you catch a package still pinned to an unsupported suite or pulled from a forgotten third-party repo. Honestly, apt list --upgradable covers most of that, so the marginal gain is modest, and the rule's real value is that it forces the question is anyone measuring patch drift here?. Side effects are negligible: the package is small, pulls only Perl libraries already present on Debian, changes no configuration and cannot break a service. The one cost is a cache rebuild that makes the first invocation after an apt update take a few seconds.