~ubuntu-security/ubuntu-security-tools/trunk

#!/bin/bash

# Copyright (C) 2008-2010, Canonical, Ltd.

# Author: Kees Cook <kees@ubuntu.com>

#

# This will attempt to downgrade any non-standard package versions on the

# system.  Use carefully!

set -e

export LANG=C

rm_lsb=

[ -w /etc/passwd ] || { echo "Must be root" >&2; exit 1; }

if [ ! -x /usr/bin/lsb_release ]; then

    apt-get -y install lsb-release

    rm_lsb=y

fi

RELEASE=$(lsb_release -cs)

# Save pre-existing preferences

saved=$(mktemp -t prefs-XXXXXX)

if [ -f /etc/apt/preferences ]; then

    cat /etc/apt/preferences > $saved

fi

# Prefer versions from standard release

cat > /etc/apt/preferences <<EOM

Package: *

Pin: release a=$RELEASE

Pin-Priority: 1001

EOM

# Prefer versions from standard desired pockets

for pocket in updates security ; do

grep -v ^# /etc/apt/sources.list | grep -q $RELEASE-$pocket && cat >> /etc/apt/preferences <<EOM

Package: *

Pin: release a=$RELEASE-$pocket

Pin-Priority: 1001

EOM

done

# Prompt for downgrades, if any

apt-get dist-upgrade "$@" || true

# Restore old preferences

if [ -s $saved ]; then

    cat $saved > /etc/apt/preferences

else

    rm -f /etc/apt/preferences

fi

rm -f $saved

if [ -n "$rm_lsb" ]; then

    apt-get purge -y lsb-release

fi

# Remove everything not found in the archive, but prompt for it.

UNKNOWN=$(apt-get install --dry-run --reinstall --print-uris \

            $(dpkg -l '*' | grep '^.i' | awk '{print $2}') \

            | grep 'cannot be downloaded' | awk '{print $3}')

if [ -n "$UNKNOWN" ] ; then

    apt-get purge $UNKNOWN

fi

# Toss everything else that was left hanging.

apt-get autoremove --purge -y