Saturday, April 28, 2007

Good Advice, Bad Advice

Earlier this month Debian 4.0 (codename 'Etch') was released; many web pages now sport instructions for upgrading, but not all of these are wholly correct and some aren't even safe. Naturally the best source for all things Debian is the official Debian website, where one may find comprehensive upgrade notes, but quick and easy tends to be the order of the day.
Debian Admin, for example, recommends the following command:

aptitude -f --with-recommends dist-upgrade

Any sysadmin should know that aptitude is a package management tool and dist-upgrade tells it to upgrade all packages and install new ones as required, and those other options sound fairly innocuous, no? Even if one has the wisdom to check the man page prior to running this command one sees what appear to be useful options:

Try hard to fix the dependencies of broken packages, even if it means ignoring the actions requested on the command line.
-r, --with-recommends
Treat recommendations as dependencies when installing new packages (this overrides settings in /etc/apt/apt.conf and ~/.aptitude/config).

Despite the probable good intentions of the poster, --with-recommends turns out to be a rather bad idea in many circumstances. Suppose Harry would like to upgrade his Debian mail server and unwisely runs the above command; not surprisingly, Debian offers a choice of mail daemons and Harry has selected Postfix rather than Debian's default package: Exim. Unfortunately Harry is in for a surprise when --with-recommends causes aptitude to remove Postfix and install Exim in its place.

The full explanation for this behavior is a bit involved (one could even argue that this is a bug) but in all cases one should never run any command without knowing what it does, and always check information with official sources or knowledgeable colleagues.