Package Holds and Locks

Package Holds and Locks refer to mechanisms within Linux package management systems that prevent specific software packages from being automatically upgraded, removed, or altered during system updates or dependency resolution. These features allow system administrators to maintain stable and consistent software environments by controlling when and how package changes occur, preventing unintended disruptions caused by automatic package modifications.

Purpose and Importance of Package Holds and Locks

Package holds and locks are essential tools for managing software packages in complex or production environments where stability is critical. By applying holds or locks, administrators can:

• Prevent upgrades of packages that might introduce incompatibilities or bugs.
• Avoid accidental removal of crucial packages during dependency cleanups.
• Control the timing of package updates to coordinate with testing or deployment schedules.
• Maintain older versions of software when newer versions are incompatible with existing applications.

These controls reduce the risk of system instability and ensure predictable package behavior over time.

Mechanisms to Implement Holds and Locks

Different Linux package managers provide distinct commands and file configurations to implement holds and locks. The most common package managers supporting these features include:

APT (Debian, Ubuntu)

APT uses the concept of "holds" to freeze packages at their current version.

• To place a hold on a package:

sudo apt-mark hold <package-name>

• To remove a hold:

sudo apt-mark unhold <package-name>

• To verify held packages:

apt-mark showhold

Held packages will not be upgraded during apt upgrade or apt dist-upgrade operations.

APT also respects pinning policies configured in /etc/apt/preferences and /etc/apt/preferences.d/, allowing fine-grained control over package versions and sources, effectively locking versions or prioritizing specific repositories.

DPKG (Debian Package System)

DPKG itself can mark packages as held using the dpkg database.

• Mark package as held:

echo "<package-name> hold" | sudo dpkg --set-selections

• Remove hold:

echo "<package-name> install" | sudo dpkg --set-selections

• List held packages:

dpkg --get-selections | grep hold

This method is lower-level compared to apt-mark.

RPM (Red Hat, CentOS, Fedora)

RPM-based systems do not have a direct "hold" command but use the yum or dnf package managers which provide locking features.

• To lock a package version with yum:

sudo yum versionlock <package-name>

• To install the versionlock plugin if missing:

sudo yum install yum-plugin-versionlock

• To list locked packages:

yum versionlock list

• To remove a lock:

sudo yum versionlock delete <package-name>

In dnf (successor to yum), the syntax is similar:

sudo dnf versionlock add <package-name>
sudo dnf versionlock list
sudo dnf versionlock delete <package-name>

This prevents packages from being updated or removed unintentionally.

Zypper (openSUSE)

Zypper provides a locking mechanism:

• Lock a package:

sudo zypper addlock <package-name>

• Remove a lock:

sudo zypper removelock <package-name>

• List locked packages:

zypper locks

Locked packages will not be updated or removed.

Use Cases and Best Practices

Use Cases

• Freezing critical system components such as the kernel or libc to avoid breakage.
• Holding back specific software versions for compatibility with proprietary or legacy applications.
• Managing staged upgrades where packages are updated in phases.
• Preventing automatic upgrades of packages with known regressions or bugs.

Best Practices

• Regularly review held or locked packages to ensure they remain relevant.
• Document the reasons for holding packages to maintain clarity across teams.
• Combine holds with package pinning or repository prioritization for comprehensive version control.
• Use holds sparingly to avoid creating outdated or insecure systems.
• Test package upgrades in a staging environment before releasing them to production.

Technical Details and Effects on Package Management Operations

When a package is held or locked:

• Upgrade commands will skip the package, even if a newer version is available.
• Dependency resolution respects the hold, potentially preventing upgrades of dependent packages.
• Some package managers will alert the user if held packages cause dependency conflicts.
• Removal or downgrade operations may also be blocked or require explicit override.
• In some cases, holding a package can create "broken" dependencies if other packages require newer versions.

Administrators must monitor package states to avoid dependency issues arising from holds.

Summary of Common Commands

Interaction with Package Pinning and Preferences

Package holds and locks can be complemented by pinning mechanisms, which adjust package priorities and repository preferences.

• Pinning allows specifying particular package versions or origins to prefer or avoid.
• Holds stop package changes outright; pinning influences version selection during upgrades.
• Both mechanisms together provide granular control over package versions and update policies.

For example, in Debian-based systems, /etc/apt/preferences files can pin packages to specific versions or repositories, while apt-mark hold prevents their upgrade regardless of pinning.

Summary

Package holds and locks are fundamental tools in Linux package management used to prevent specific packages from being upgraded, removed, or altered unintentionally. They provide system administrators with control over software versions, ensuring system stability, compatibility, and predictable behavior. These mechanisms vary across package managers but share the goal of preserving package states according to administrative policies. Proper use of holds and locks, combined with version pinning and repository management, forms a robust strategy for managing software lifecycle in Linux environments.