Is dpkg-query -W sufficient for the manifest? about sec-cvescan

[mssalvatore]

@setharnold No, it's not. See #56 and #53

[techalchemy]

@setharnold @mssalvatore as a work-around until 3.0, do you see any issues with using the following to remove previously uninstalled items from the manifest?

$ grep -v -f <(dpkg --get-selections | awk '$2 ~ /deinstall/ {print $1}') <(dpkg-query -W)

[philroche]

If it helps, the cloud image manifests published to http://cloud-images.ubuntu.com/releases/focal/release/ are generated using

dpkg-query --show --admindir="/var/lib/dpkg"

See https://git.launchpad.net/ubuntu/+source/livecd-rootfs/tree/live-build/functions?h=ubuntu/focal-updates#n46 for more details.

[techalchemy]

@philroche that still turns up previously installed packages for me -- for example, zfs-zed is no longer installed locally and ideally won't show up in a manifest:

$ dpkg -l | grep '^rc' | tail -1       Wed 16 Dec 2020 09:28:15 PM UTC
rc  zfs-zed                                       0.7.12-1ubuntu5                             amd64        OpenZFS Event Daemon

but it does show up in standard queries:

$ dpkg-query --show --admindir="/var/lib/dpkg" | grep 'zfs-zed'
zfs-zed	0.7.12-1ubuntu5

[philroche]

@techalchemy Interesting. I'll check to see if any cloud-images are affected by this. I'll also update https://github.com/CanonicalLtd/ubuntu-package-manifest too

@philroche that still turns up previously installed packages for me -- for example, zfs-zed is no longer installed locally and ideally won't show up in a manifest:

$ dpkg -l | grep '^rc' | tail -1       Wed 16 Dec 2020 09:28:15 PM UTC
rc  zfs-zed                                       0.7.12-1ubuntu5                             amd64        OpenZFS Event Daemon

but it does show up in standard queries:

$ dpkg-query --show --admindir="/var/lib/dpkg" | grep 'zfs-zed'
zfs-zed	0.7.12-1ubuntu5

[philroche]

I have confirmed that Ubuntu cloud image manifests are not affected as any package removal that I can find uses apt-get remove --purge which means it will not show up in the manifest.

I have tested this locally now too.