Module apt 

apt-family package management actions (Ubuntu / Debian).

The eight actions that run apt-get or apt-mark as root (AptUpdate, AptUpgrade, AptInstall, AptRemove, AptPurge, AptAutoremove, AptHold, AptUnhold) run sudo /usr/lib/sysknife/action-steps apt <subcommand> [<package>]. The helper builds the apt-get or apt-mark argv from an allowlist and sets DEBIAN_FRONTEND=noninteractive and NEEDRESTART_MODE=a itself, so the commands never block waiting for a TUI prompt. A direct sudoers grant on apt-get or apt-mark admitted apt’s own options (-o APT::Update::Pre-Invoke::=<cmd> runs <cmd> as root), and sudoers cannot forbid the options that follow a wildcard, so neither has a grant.

The package operand is validated here by validated_install_package and validated_unmodified_package (character set, and no trailing -, + or ^), and again in the helper. A name containing . or + can still be a regular expression to apt, so the helper also passes -o APT::Cmd::Pattern-Only=1 and refuses an operand that does not name exactly one existing package, which only the host’s package database can say.

Lock contention

Concurrent apt runs are prevented by the dispatcher’s exclusion gate, not by a pre-flight probe: every action whose argv names an apt/dpkg tool maps to ExclusiveResource::Dpkg, and a second one submitted while the first holds that lock gets a ConflictResponse.

An earlier version of this doc claimed the executor ran fuser /var/lib/dpkg/lock before each mutating command. It never did — there is no such probe anywhere in the daemon. The gate above covers contention between SysKnife actions, which is what SysKnife can actually control; it does not detect a dpkg lock held by something outside SysKnife (an operator’s own apt session, or unattended-upgrades). In that case apt itself reports the lock and the action fails with apt’s own message.

Environment variables

DEBIAN_FRONTEND=noninteractive suppresses all debconf prompts. NEEDRESTART_MODE=a tells the needrestart post-install hook to automatically restart services instead of prompting the operator. Both are required for daemon-driven apt invocations; omitting them causes apt to hang waiting for terminal input that never arrives. The apt verb of packaging/sysknife-action-steps provides both.

Functions

apt_autoremove

Remove automatically-installed packages no longer needed (action-steps apt autoremove, which runs apt-get autoremove -y).

apt_history_list

Show recent apt transaction history from /var/log/apt/history.log.

apt_hold

Pin a package at its current version (action-steps apt hold <package>, which runs apt-mark -o APT::Cmd::Pattern-Only=1 hold -- <package>).

apt_install

Install a single package (action-steps apt install <package>, which runs apt-get -o APT::Cmd::Pattern-Only=1 install -y -- <package>).

apt_list_installed

List all installed packages (dpkg -l).

apt_list_upgradable

List packages that have upgrades available (apt list --upgradable).

apt_purge

Remove a package AND its configuration files (action-steps apt purge <package>, which runs apt-get -o APT::Cmd::Pattern-Only=1 purge -y -- <package>). Validated like apt_remove.

apt_remove

Remove a package but keep its configuration files (action-steps apt remove <package>, which runs apt-get -o APT::Cmd::Pattern-Only=1 remove -y -- <package>).

apt_search

Search apt repositories for packages matching a term (apt-cache search <term>).

apt_show

Show detailed information about a package (apt-cache show <package>).

apt_unhold

Remove the hold on a package, allowing upgrades again (action-steps apt unhold <package>; see apt_hold).

apt_update

Refresh the apt package index (action-steps apt update, which runs apt-get update).

apt_upgrade

Upgrade all installed packages (action-steps apt dist-upgrade, which runs apt-get dist-upgrade -y).

configure_unattended_upgrades

Enable or disable Ubuntu automatic (unattended) security updates.

parse_autoremove_removals

The set of packages apt-get -s autoremove would remove, parsed from its simulate (-s) output.

specs

Return one representative ActionSpec per action name so the consistency test can verify policy + preview + executor coverage.