The Debian policy
dictates that package upgrades must take care of preserving user changes to configuration files. This article will explain you how most packages ensure this. This is important knowledge for anyone who has to manage upgrades: knowing how it works lets you easily automate most of it and deal correctly with the fallout.
How dpkg manages configuration files
Most packages rely on dpkg to properly install configuration files. Dpkg keeps a checksum of the last installed version of configuration file. When it must install a new version, it calculates the checksum of the currently installed file and if it doesn t match anymore, it knows that the user has edited the file. In that case, instead of overwriting the configuration file, it asks the user what to do. You probably already have seen those questions, they look like this:
Configuration file /etc/bash.bashrc'
==> Modified (by you or by a script) since installation.
==> Package distributor has shipped an updated version.
What would you like to do about it ? Your options are:
Y or I : install the package maintainer's version
N or O : keep your currently-installed version
D : show the differences between the versions
Z : start a shell to examine the situation
The default action is to keep your current version.
*** bash.bashrc (Y/I/N/O/D/Z) [default=N] ?
In this specific example, if you answer Y or I (for yes or install ), dpkg will install the new version of
/etc/bash.bashrc but it will also backup the current version in
/etc/bash.bashrc.dpkg-old. If you answer N or O (for no or old ), dpkg will install the new version in
/etc/bash.bashrc.dpkg-dist and
/etc/bash.bashrc is left untouched. The two other answers allow you to examine the differences before taking a decision. Note that if you choose to start a shell, the new version is currently available as
/etc/bash.bashrc.dpkg-new (and since Squeeze there are convenient environment variables $DPKG_CONFFILE_OLD and $DPKG_CONFFILE_NEW in case you want to create a custom review script).
All configurations files managed by dpkg are called conffiles because that s the name of the field where they are recorded in the dpkg database. You can display the list of conffiles for any package:
$ dpkg --status bash
[...]
Conffiles:
/etc/skel/.profile ecb6d3479ac3823f1da7f314d871989b
/etc/skel/.bashrc 2afdd6c53990f2387a7ef9989af0bc07
/etc/skel/.bash_logout 22bfb8c1dd94b5f3813a2b25da67463f
/etc/bash.bashrc 5b3c3bc73d236e4e1b6f9b6c1ed5964e
[...]
The command
dpkg-query --showformat='$ Conffiles \n' --show bash can give you the same information if you need to retrieve only that field. The 32 characters after the filename are the MD5 checksum of the original configuration file provided by the package.
Avoiding the conffile prompt
Every time that dpkg must install a new conffile that you have modified (and a removed file is only a particular case of a modified file in dpkg s eyes), it will stop the upgrade and wait your answer. This can be particularly annoying for major upgrades. That s why you can give predefined answers to dpkg with the help of multiple
--force-conf* options:
--force-confold: do not modify the current configuration file, the new version is installed with a .dpkg-dist suffix. With this option alone, even configuration files that you have not modified are left untouched. You need to combine it with --force-confdef to let dpkg overwrite configuration files that you have not modified.--force-confnew: always install the new version of the configuration file, the current version is kept in a file with the .dpkg-old suffix.--force-confdef: ask dpkg to decide alone when it can and prompt otherwise. This is the default behavior of dpkg and this option is mainly useful in combination with --force-confold.--force-confmiss: ask dpkg to install the configuration file if it s currently missing (for example because you have removed the file by mistake).
If you use Apt, you can pass options to dpkg with a command-line like this:
$ apt-get -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" dist-upgrade
You can also make those options permanent by creating
/etc/apt/apt.conf.d/local:
Dpkg::Options
"--force-confdef";
"--force-confold";
Bringing up the conffile prompt at any time
The conffile prompt is only displayed when dpkg detects that the package provides an new version of the conffile. Thus reinstalling the same package will not bring up the prompt. But you can instruct dpkg to ask nevertheless with the
--force-confask option. This is a new feature in Debian Squeeze. It will only ask for files that are locally modified.
If you want to read more articles like this one, click here to subscribe to my free newsletter. You can also follow me on Identi.ca, Twitter and Facebook.
4 comments Support my work
Brian announced it on r-help and r-sig-finance
and I have since updated the
R/Finance website and
Call for Papers page.
And as David Smith already outblogged me about it,
without further ado our Call for Paper for next spring's R/Finance conference:
As I'm currently attending the EUgridPMA meeting in Zagreb I thought I'd share a bit of this project I've been working on for the past year: the TCS eScience project.
In the scientific world lots of calculations are performed on distributed computing platforms known as grid. Because users of other institutions will be using your hardware, authentication is needed and this problem has been solved with x.509 personal certificates. The problem however, is that these certificates of course have to be issued by some CA. Currently in Europe alone there are over 40 active CA's, even multiple per country, dedicated to this job. They are accredited through the 
My comment form on my blog contains the following, right above the
<textarea> element where the text can be entered:
Some weeks ago, I've started to change documentation structure of Gammu to move from separate documents here and there into one comprehensive documentation which would cover it all. As a tool to do this I've chosen 
This morning, my laptop was stolen from my parked car while I was jogging. I do not want to make a big deal out of it.
Still, even though I am sure it was not targetted at my data (three other people at least were reporting similar facts in the same area), and the laptop's disk will probably just be reformatted, I am trying to limit the possible impact of my cryptographic identification being in somebody else's hands.
GPG makes it easy: I had on that machine just my old 1024D key, so it is just matter of generating a revocation certificate. I have done that, and uploaded it to the SKS keyservers - Anyway, here is my revocation certificate:
From the 17th to the 19th of September in Perugia, Italy, it took place the 5th edition of the Italian Debian Community Conference, which has been attended by many contributors and users.
For the first time, the event has been organized in collaboration with the Italian Ubuntu community, as to create a new joint conference in order to foster shared contributions and emphasizing the large common ground of our projects. This new experimental kind of mini-conference was then labeled DUCC-IT, to reflect both the local profile and the mutual collaboration.
After the initial social night, spent discussing of several ongoing free software efforts and having dinner all together, the conference official opening started on Saturday, temporarily housed at University of Perugia, with a series of talks and hands-on session aimed at recruiting new contributors to work on development, translations, documentation writing and marketing. It has been a good opportunity to celebrate the 
Finally, six months after releasing 0.9.9, and about three months after when I would have preferred to have released it, I've 
I m putting together a list of email server features that you should look for. I m thinking:
Another one, just not to forget it, since I'm just starting to
play with grsecurity. When building package under
pbuilder/cowbuilder and using
a 
After 20 days of final polishing and maturing since