Find out what software is installed, understand the difference between a query and a transaction, and prepare evidence for a controlled package change.

Series: Previous: networking · Part 6 of 6 · Introduction
Applies to: Debian/Ubuntu APT, Fedora/RHEL-family DNF or legacy YUM, and Arch Linux pacman. Commands differ by installed release; choose your host’s native package manager. Example versions are illustrative.

The subsystem: package databases and repositories

A distribution package manager tracks software files, versions, dependencies and transactions using a local package database. Repository metadata describes available packages; signed packages and repository trust configuration help establish provenance. These tools sit above lower-level formats such as Debian packages and RPMs.

An enterprise patch changes more than a version string. It may restart services, update configuration, introduce dependencies or require a reboot. Start with an inventory and change plan. Refreshing metadata is also a state-changing network operation, even when it does not install packages.

A query can succeed with stale metadata. Installed software may also include containers, language-package environments or manually copied binaries that the OS package database does not track. An inventory is evidence about a defined scope, not a complete vulnerability assessment.

apt: interactive Debian/Ubuntu package work

apt show bash
apt list --installed bash

These inspect cached package information and the installed version. An installed row might resemble bash/stable,now 5.x amd64 followed by an installed-status marker; actual release names and versions vary. APT is designed for interactive use, so scripts should use interfaces such as dpkg-query, apt-cache and apt-get as appropriate.

On an approved lab machine, a controlled installation might be:

sudo apt update
apt-get --simulate install tree
sudo apt install tree

update refreshes package indexes; it does not upgrade installed packages. The simulation previews a dependency plan, while the final command changes the machine. Review the proposed versions, removals and service implications before confirming. A preview may become stale when repositories change, so it is not an immutable deployment plan.

dnf and yum: RPM-family package work

dnf --cacheonly info bash
dnf --cacheonly list --installed bash

These use available cached metadata and can fail if the required cache is absent. Current Fedora/RHEL-family environments may provide different DNF generations. yum can be a compatibility entry point on newer systems or the older package manager on legacy systems; do not assume the implementation from its name alone.

For an authorized lab transaction:

sudo dnf install tree

On a legacy host whose supported tool is YUM, the corresponding command is sudo yum install tree. Review the transaction rather than adding unconditional confirmation flags to a runbook. DNF’s check-update can return status 100 to indicate available updates, so scripts must not treat every nonzero result as a broken repository.

An enterprise can also use approved repository snapshots, version policies and staged rollouts. Package history is useful evidence, but a package rollback does not necessarily restore application data or reverse every scriptlet effect.

pacman: Arch Linux package work

pacman -Qi bash
pacman -Q bash

-Qi reports information for an installed package; -Q lists its name and version. A query might return bash 5.x-y. pacman -Si bash inspects repository metadata already available locally.

For an authorized Arch lab system, the usual fully synchronized upgrade/install operation is:

sudo pacman -Syu tree

This can update the whole system as well as install the requested package. Review that broader scope carefully. Do not refresh databases with pacman -Sy and then selectively install packages while leaving the rest of the system behind; Arch does not support partial upgrades. This behavior makes pacman commands especially important to interpret before copying them into a maintenance ticket.

Plan the change before applying it

Record the native distribution/release, installed version, approved repository, proposed target version, dependency impact, application checks and recovery procedure. Confirm whether a service restart or reboot is required within the maintenance process. Test against a representative non-production host.

Package signing matters, but do not disable verification to bypass a repository problem. Resolve trust or repository configuration with its owner. Avoid mixing unreviewed third-party repositories into a production host just to obtain a single utility.

Practical script: a local package inventory for a change ticket

A team needs the installed package inventory before reviewing a patch. This script makes no repository requests and runs no install, remove, update or upgrade operation. It supports the native package databases behind the commands above and creates a new private TSV report.

Save as package-inventory.sh; run bash package-inventory.sh. The report contains package names and versions, which can disclose internal software choices; review it before sharing.

#!/usr/bin/env bash
set -euo pipefail
export LC_ALL=C
umask 077
report=$(mktemp)
if command -v dpkg-query >/dev/null && [[ -f /var/lib/dpkg/status ]]; then
  printf 'Manager family: Debian/Ubuntu\n'
  dpkg-query -W -f='${db:Status-Status}\t${binary:Package}\t${Version}\n' |
    awk -F '\t' '$1 == "installed" {print $2 "\t" $3}' > "$report"
elif command -v rpm >/dev/null && command -v dnf >/dev/null; then
  printf 'Manager family: RPM/DNF\n'
  rpm -qa --qf '%{NAME}\t%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' > "$report"
elif command -v rpm >/dev/null && command -v yum >/dev/null; then
  printf 'Manager family: RPM/YUM\n'
  rpm -qa --qf '%{NAME}\t%{EPOCHNUM}:%{VERSION}-%{RELEASE}.%{ARCH}\n' > "$report"
elif command -v pacman >/dev/null && [[ -d /var/lib/pacman/local ]]; then
  printf 'Manager family: Arch/pacman\n'
  pacman -Q | awk '{print $1 "\t" $2}' > "$report"
else
  printf 'No supported native package database detected; report is incomplete.\n' >&2
  exit 2
fi
printf 'Installed package records: '
wc -l < "$report"
printf 'Inventory retained at: %s\n' "$report"

The script uses lower-level database query tools where that avoids a changing interactive interface. It assumes a conventional single-distribution host; a mixed package-manager workstation needs a reviewed selection rule. It does not claim that an old version is vulnerable: distribution backports and security advisories need separate assessment. Likewise, it does not prove that every installed package is still supported.

Finishing the series

You can now navigate files, inspect text, understand access, collect process evidence, investigate a network path and record a software inventory. A useful next exercise is a lab incident: a local web service has the wrong configuration path. Use observations from all six parts to explain the failure, propose one narrow change and verify the outcome. Keep the evidence and change proposal separate so another engineer can review the reasoning.

References

Debian apt manual, dpkg-query manual, DNF command reference, RPM query documentation, pacman manual, Arch guidance on partial upgrades.

FILED UNDER