Hold packages back from updates without APT Pin?

Question

I know about pinning packages with Apt. That's not what I want to do. Other questions have been answered with either using pinning or by using pins temporarily. I don't want to do this.

What I want to do is keep packages back the same way the kernel has been:

# apt-get upgrade
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages have been kept back:
  linux-generic-pae linux-headers-generic-pae linux-image-generic-pae
The following packages will be upgraded:

I want to add tomcat-* and mysql-* and sun-* to this list. In the past, there was a configuration parameter to do this. I've always thought it was something like Apt::Get::HoldPkgs or Apt::HoldPkgs but I can't find it.

I want to have these packages held from updates until I specifically request them with an apt-get install.

I found the apt-get configuration Apt::NeverAutoRemove. Will this do what I want?

Added Question: I notice that Apt::NeverAutoRemove and Apt::Never-MarkAuto-Sections (among others) are not documented so far as I can see. They're not in the manpages. Neither is aptitude::Keep-Unused-Pattern and aptitude::Get-Root-Command.

Is there any comprehensive and complete documentation for apt.conf?

The kernel example depends on the difference between upgrade and dist-upgrade and cannot be configured on a per-package basis. — enzotib, Jun 29 '11 at 14:50
Blast! (sorry...) I'm still convinced that it used to be configurable; wouldn't surprise me that it's obsolete by now. — Mei, Jun 29 '11 at 14:51
I didn't say cannot be done, I said the kernel example is not appropriate, because the fact that "packages have been kept back" do not depends on any configuration, but from the semantic of upgrade command of apt-get. — enzotib, Jun 29 '11 at 14:53
This answer http://askubuntu.com/questions/18654/how-to-prevent-updating-of-a-specific-package seems to not use pinnig. — enzotib, Jun 29 '11 at 15:07
I saw those; I was hoping for a apt.conf parameter - a futile hope, it now appears. I'm leaning toward the use of dpkg --set-selections. I found a question that suggested the use of dpkg and the use of aptitude were not equivalent (i.e., dpkg did not honor the aptitude setting). — Mei, Jun 29 '11 at 16:46
Using echo foobar hold | dpkg --set-selections doesn't seem to have any effect on installed packages. — Mei, Jun 30 '11 at 13:34
After using echo "foobar hold" | sudo dpkg --set-selections (I hope you used sudo), you will not see any immadiate effect. But when for foobar package there will be an upgrade available in the repos, nor apt-get, nor aptitude, nor update-manager will upgrade the package. Only synaptic will upgrade if explicitily instructed. — enzotib, Jun 30 '11 at 15:15

score 15 · Accepted Answer · edited Jan 12 '14 at 14:51

The answer is to use dpkg --set-selections. If you run the command dpkg --get-selections you can see what is set already:

$ dpkg --get-selections | head
acct                                            install
adduser                                         install
apparmor                                        install
apparmor-utils                                  install
apt                                             install
apt-transport-https                             install
apt-utils                                       install
aptitude                                        install
at                                              install
auditd                                          install

Consider, in this case, the package dnsutils:

$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  bind9-host dnsutils libbind9-60 libdns64 libisc60 libisccc60 libisccfg60 liblwres60
8 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 1,257kB of archives.
After this operation, 0B of additional disk space will be used.
Do you want to continue [Y/n]? n
Abort.

Now let's change it - put the package on hold:

$ echo dnsutils hold | sudo dpkg --set-selections

Check the results:

$ dpkg --get-selections | grep dnsutils
dnsutils                                        hold

Try the update again:

$ sudo apt-get upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages have been kept back:
  bind9-host dnsutils libbind9-60 libdns64 libisc60 libisccfg60 liblwres60
The following packages will be upgraded:
  libisccc60
1 upgraded, 0 newly installed, 0 to remove and 7 not upgraded.
Need to get 29.9kB of archives.
After this operation, 0B of additional disk space will be used.
Do you want to continue [Y/n]? n
Abort.

Now, dnsutils - and its related packages - are being held back, just as we wished.

Logging in as root is certainly easier; however, using sudo in appropriate places is better practice. In the examples, the commands apt-get upgrade and dpkg --set-selections would require root access - thus, sudo should be used for these commands. Others should be alright as is. — Mei, Jul 12 '11 at 19:03

score -1 · Answer 2 · answered May 08 '16 at 11:24

Man page from APT-MARK

APT-MARK(8)                                                            APT                                                            APT-MARK(8)

NAME
       apt-mark - show, set and unset various settings for a package

SYNOPSIS
       apt-mark {-f=filename | {auto | manual} pkg...  | {showauto | showmanual} [pkg...] } | {-v | --version} | {-h | --help}

       apt-mark {hold | unhold | install | remove | purge} pkg...  | {showhold | showinstall | showremove | showpurge} [pkg...]

DESCRIPTION
       apt-mark can be used as a unified front-end to set various settings for a package, such as marking a package as being
       automatically/manually installed or changing dpkg selections such as hold, install, deinstall and purge which are respected e.g. by
       apt-get dselect-upgrade or aptitude.

AUTOMATICALLY AND MANUALLY INSTALLED PACKAGES
       When you request that a package is installed, and as a result other packages are installed to satisfy its dependencies, the dependencies
       are marked as being automatically installed, while the package you installed explicitly is marked as manually installed. Once an
       automatically installed package is no longer depended on by any manually installed package it is considered no longer needed and e.g.
       apt-get or aptitude will at least suggest removing them.

       auto
           auto is used to mark a package as being automatically installed, which will cause the package to be removed when no more manually
           installed packages depend on this package.

       manual
           manual is used to mark a package as being manually installed, which will prevent the package from being automatically removed if no
           other packages depend on it.

       showauto
           showauto is used to print a list of automatically installed packages with each package on a new line. All automatically installed
           packages will be listed if no package is given. If packages are given only those which are automatically installed will be shown.

       showmanual
           showmanual can be used in the same way as showauto except that it will print a list of manually installed packages instead.

   Options
       -f=filename, --file=filename
           Read/Write package stats from the filename given with the parameter filename instead of from the default location, which is
           extended_status in the directory defined by the Configuration Item: Dir::State.

PREVENT CHANGES FOR A PACKAGE
       hold
           hold is used to mark a package as held back, which will prevent the package from being automatically installed, upgraded or removed.

       unhold
           unhold is used to cancel a previously set hold on a package to allow all actions again.

       showhold
           showhold is used to print a list of packages on hold in the same way as for the other show commands.

SCHEDULE PACKAGES FOR INSTALL, REMOVE AND PURGE
       Some front-ends like apt-get dselect-upgrade can be used to apply previously scheduled changes to the install state of packages. Such
       changes can be scheduled with the install, remove (also known as deinstall) and purge commands. Packages with a specific selection can be
       displayed with showinstall, showremove and showpurge respectively. More information about these so called dpkg selections can be found in
       dpkg(1).

OPTIONS
       -h, --help
           Show a short usage summary.

       -v, --version
           Show the program version.

       -c, --config-file
           Configuration File; Specify a configuration file to use. The program will read the default configuration file and then this
           configuration file. If configuration settings need to be set before the default configuration files are parsed specify a file with the
           APT_CONFIG environment variable. See apt.conf(5) for syntax information.

       -o, --option
           Set a Configuration Option; This will set an arbitrary configuration option. The syntax is -o Foo::Bar=bar.  -o and --option can be
           used multiple times to set different options.

FILES
       /var/lib/apt/extended_states
           Status list of auto-installed packages. Configuration Item: Dir::State::extended_states.

SEE ALSO
       apt-get(8),aptitude(8),apt.conf(5)

DIAGNOSTICS
       apt-mark returns zero on normal operation, non-zero on error.

BUGS
       APT bug page[1]. If you wish to report a bug in APT, please see /usr/share/doc/debian/bug-reporting.txt or the reportbug(1) command.

AUTHORS
       Mike O'Connor

       APT team

NOTES
        1. APT bug page
           http://bugs.debian.org/src:apt

APT 1.2.10                                                      25 September 2015                                                     APT-MARK(8)

Hold packages back from updates without APT Pin?

2 Answers2

Linked