Ubuntu Server包管理与软件仓库管理深度实践

# 安装本地软件包
sudo dpkg -i package.deb

# 列出系统上安装的所有软件包
dpkg -l

# 查看特定软件包信息
dpkg -s package_name

# 列出软件包安装的文件
dpkg -L package_name

# 查找哪个包提供了某个文件
dpkg -S /path/to/file

# 移除软件包(保留配置文件)
sudo dpkg -r package_name

# 完全清除软件包(包括配置文件)
sudo dpkg -P package_name

# 查找snap包
snap find search_term

# 安装snap包
sudo snap install package_name

# 列出已安装的snap包
snap list

# 更新snap包
sudo snap refresh package_name

# 或者更新所有snap包
sudo snap refresh

# 移除snap包
sudo snap remove package_name

# 禁用特定snap的自动更新
sudo snap refresh --hold package_name

# 重新启用自动更新
sudo snap refresh --unhold package_name

# 设置系统在特定时间更新
sudo snap set system refresh.timer=04:00-06:00

# 从特定频道安装
sudo snap install --channel=latest/edge package_name

# 切换到其他频道
sudo snap refresh --channel=latest/candidate package_name

# 查看可用频道
snap info package_name

# 搜索包含关键字的软件包
apt-cache search search_term

# 显示软件包的详细信息
apt-cache show package_name

# 查看软件包的依赖关系
apt-cache depends package_name

# 查看哪些包依赖于此包
apt-cache rdepends package_name

# 显示软件包版本信息
apt-cache policy package_name

# 列出所有已安装的包
dpkg -l

# 使用模式匹配查找包
dpkg -l '*pattern*'

# 检查软件包状态
dpkg -s package_name

# 列出包安装的文件
dpkg -L package_name

# 确定文件属于哪个包
dpkg -S /path/to/file

# 列出deb文件内容
dpkg -c package.deb

# 查看deb包信息
dpkg -I package.deb

# 提取deb包内容而不安装
dpkg -x package.deb extraction_dir/

# 列出所有可用软件包
apt list --all-versions

# 列出已安装的软件包
apt list --installed

# 列出可升级的软件包
apt list --upgradable

# 使用模式匹配过滤
apt list '*pattern*'

deb [options] uri distribution [components]

deb http://archive.ubuntu.com/ubuntu/ jammy main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu/ jammy-updates main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu/ jammy-backports main restricted universe multiverse
deb http://security.ubuntu.com/ubuntu jammy-security main restricted universe multiverse

sudo sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list

deb https://mirrors.aliyun.com/ubuntu/ jammy main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ jammy-updates main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ jammy-security main restricted universe multiverse
deb https://mirrors.aliyun.com/ubuntu/ jammy-backports main restricted universe multiverse

sudo nano /etc/apt/preferences.d/99-my-priority

Package: *
Pin: origin internal.repo.example.com
Pin-Priority: 700

Package: nginx
Pin: version 1.18.*
Pin-Priority: 1001

Package: *
Pin: release o=Ubuntu,a=jammy
Pin-Priority: 900

Package: *
Pin: release o=Ubuntu,a=jammy-updates
Pin-Priority: 900

Package: *
Pin: release o=Ubuntu,a=jammy-security
Pin-Priority: 1000

apt-cache policy package_name

# 安装所需软件
sudo apt-get install apache2 apt-mirror

# 创建镜像存储目录
sudo mkdir /linoxide

# 配置APT-mirror
sudo nano /etc/apt/mirror.list

############# config ##################
#
set base_path    /linoxide
#
# set mirror_path  $base_path/mirror
# set skel_path    $base_path/skel
# set var_path     $base_path/var
# set cleanscript $var_path/clean.sh
# set defaultarch  <running host architecture>
# set postmirror_script $var_path/postmirror.sh
# set run_postmirror 0
set nthreads     20
set _tilde 0
#
############# end config ##############

deb http://archive.ubuntu.com/ubuntu jammy main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu jammy-security main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu jammy-updates main restricted universe multiverse
#deb http://archive.ubuntu.com/ubuntu jammy-proposed main restricted universe multiverse
#deb http://archive.ubuntu.com/ubuntu jammy-backports main restricted universe multiverse

deb-src http://archive.ubuntu.com/ubuntu jammy main restricted universe multiverse
deb-src http://archive.ubuntu.com/ubuntu jammy-security main restricted universe multiverse
deb-src http://archive.ubuntu.com/ubuntu jammy-updates main restricted universe multiverse

sudo apt-mirror

# 创建符号链接到Web根目录
sudo ln -s /linoxide /var/www/ubuntu

# 重启Apache
sudo systemctl restart apache2

deb http://192.168.0.100/ubuntu/ jammy main restricted universe

# 每天凌晨3点同步
0 3 * * * /usr/bin/apt-mirror > /var/spool/apt-mirror/var/cron.log

# 手动清理
/linoxide/var/clean.sh

# 下载密钥
wget -O - https://example.com/repo/keys.gpg | sudo apt-key add -

# 列出已信任密钥
apt-key list

# 删除密钥
sudo apt-key del key_id

# 下载密钥
wget -O /tmp/example.key https://example.com/repo/keys.gpg

# 转换为deb格式并放入指定位置
cat /tmp/example.key | gpg --dearmor | sudo tee /usr/share/keyrings/example.gpg > /dev/null

# 在源文件中引用
echo "deb [signed-by=/usr/share/keyrings/example.gpg] https://example.com/repo/ stable main" | sudo tee /etc/apt/sources.list.d/example.list

deb [arch=amd64 signed-by=/usr/share/keyrings/example.gpg] https://apt.example.com/repo jammy main

# 检查未验证的源
grep -r "trusted=yes" /etc/apt/sources.list /etc/apt/sources.list.d/

# 检查未知密钥
find /usr/share/keyrings/ -name "*.gpg" -exec gpg --list-keys --keyid-format long {} \;

deb [arch=amd64 signed-by=/usr/share/keyrings/example.gpg fingerprints=ABC123] https://apt.example.com/repo jammy main

# 查看包依赖关系
apt-cache depends package_name

# 查看反向依赖(哪些包依赖此包)
apt-cache rdepends package_name

# 显示包详细信息包括依赖
apt-cache show package_name

# 检查未满足的依赖
apt-check -d

# 尝试自动修复
sudo apt --fix-broken install

# 或者使用
sudo apt -f install

# 重新配置未正确配置的包
sudo dpkg --configure -a

# 模拟安装并显示依赖关系
apt -s install package_name

# 有时需要移除冲突的包
sudo apt remove conflicting-package

# 或者尝试特定版本
sudo apt install package_name=version

# 安装aptitude
sudo apt install aptitude

# 使用aptitude解决复杂依赖
sudo aptitude install problem-package

# 移除不再需要的依赖包
sudo apt autoremove

# 清理已下载的包文件
sudo apt clean

# 或者部分清理
sudo apt autoclean

# 检查系统中的冗余包
deborphan | xargs sudo apt-get remove -y

# 只下载不安装
apt download package_name

# 下载所有依赖
apt-get download $(apt-cache depends --recurse --no-recommends --no-suggests --no-conflicts --no-breaks --no-replaces --no-enhances package_name | grep "^\w" | sort -u)

# 手动安装下载的包
sudo dpkg -i *.deb

# 安装apt-tree工具
sudo apt install apt-utils

# 显示依赖树
apt-cache dotty package_name | dot -Tpng > dependency.png

# 只安装安全更新
sudo apt upgrade --only-upgrade-security

# 或者通过优先级配置只自动安装安全更新

# 安装无人值守更新包
sudo apt install unattended-upgrades

# 配置自动更新
sudo dpkg-reconfigure --priority=low unattended-upgrades

#!/bin/bash
# 系统更新脚本
set -e

LOG_FILE="/var/log/system-update-$(date +%Y%m%d).log"

{
    echo "Starting system update: $(date)"
    
    # 更新包列表
    apt-get update
    
    # 检查可更新包
    UPDATES=$(apt list --upgradable 2>/dev/null | wc -l)
    echo "Available updates: $((UPDATES-1))"
    
    if [ $UPDATES -gt 1 ]; then
        # 下载但不安装更新
        apt-get upgrade -d -y
        
        # 创建快照（如果使用LVM或ZFS）
        echo "Creating snapshot..."
        
        # 应用安全更新
        apt-get install -y --only-upgrade $(apt-get upgrade -s | grep ^Inst | grep security | awk '{print $2}')
        
        # 记录更新包
        apt-get upgrade -s | grep ^Inst > /var/log/updates-list-$(date +%Y%m%d).log
        
        # 如果需要，手动安排重启
        if [ -f /var/run/reboot-required ]; then
            echo "Reboot required after updates" >> /var/run/reboot-required.pkgs
        fi
    else
        echo "No updates available"
    fi
    
    echo "System update completed: $(date)"
} | tee -a $LOG_FILE

# 查看已安装内核
dpkg -l | grep linux-image

# 移除旧内核（保留当前和上一个版本）
sudo apt autoremove --purge

# 防止特定内核包被自动移除
sudo apt-mark hold linux-image-extra-version

# 使用apt-dater分布式更新管理
# 或使用Ansible等配置管理工具

# 示例Ansible playbook用于分阶段更新
- hosts: staging_servers
  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        
    - name: Upgrade system
      apt:
        upgrade: safe
        autoremove: yes
        
    - name: Check if reboot required
      stat:
        path: /var/run/reboot-required
      register: reboot_required
      
    - name: Reboot if required
      reboot:
        msg: "Reboot initiated by Ansible for security updates"
        connect_timeout: 5
        reboot_timeout: 300
        pre_reboot_delay: 0
        post_reboot_delay: 30
      when: reboot_required.stat.exists

# 启用源码仓库
sudo sed -i 's/# deb-src/deb-src/' /etc/apt/sources.list

# 更新包列表
sudo apt update

# 下载特定包的源码
apt source package_name

# 安装构建依赖
sudo apt build-dep package_name

# 解压并进入源码目录
cd package-version

# 进行修改
# ...

# 更新版本号以避免与官方包冲突
dch -i -l "custom" "Custom build"

# 重建包
debuild -us -uc

# 或者使用dpkg-buildpackage
dpkg-buildpackage -us -uc -b

# 安装新构建的包
sudo dpkg -i ../package_version_arch.deb

# 解决可能缺失的依赖
sudo apt -f install

# 安装pbuilder
sudo apt install pbuilder

# 创建基础环境
sudo pbuilder create

# 使用pbuilder构建包
sudo pbuilder build package.dsc

# 更新pbuilder环境
sudo pbuilder update

# 安装必要的工具
sudo apt install dh-make

# 创建包结构
mkdir mypackage-1.0
cd mypackage-1.0

# 创建示例程序
mkdir -p src
echo '#!/bin/bash
echo "Hello from custom package!"' > src/myscript
chmod +x src/myscript

# 创建Debian包配置文件
dh_make --native -s

# 编辑控制文件
nano debian/control

# 修改规则文件指定安装位置
nano debian/rules

# 构建包
dpkg-buildpackage -us -uc

# 安装仓库工具
sudo apt install reprepro

# 创建仓库配置
mkdir -p /path/to/repo/conf
cat > /path/to/repo/conf/distributions << EOF
Codename: jammy
Components: main
Architectures: amd64 i386 source
SignWith: yes
EOF

# 添加包到仓库
reprepro -b /path/to/repo includedeb jammy /path/to/*.deb

# 生成仓库索引
reprepro -b /path/to/repo export jammy

#!/bin/bash
# 自动安全更新脚本
set -o errexit
set -o nounset
set -o pipefail

LOG_FILE="/var/log/auto-security-updates.log"
EMAIL_ADMIN="admin@example.com"
HOSTNAME=$(hostname)

{
    echo "=== Security update started at $(date) ==="
    
    # 更新包列表
    if ! apt-get update; then
        echo "ERROR: apt-get update failed"
        exit 1
    fi
    
    # 获取可用的安全更新
    SECURITY_UPDATES=$(apt-get upgrade -s | grep -i security | grep ^Inst | awk '{print $2}')
    
    if [ -z "$SECURITY_UPDATES" ]; then
        echo "No security updates available"
        exit 0
    fi
    
    echo "Security updates to install: $SECURITY_UPDATES"
    
    # 下载并安装安全更新
    if ! apt-get install --only-upgrade $SECURITY_UPDATES; then
        echo "ERROR: Failed to install security updates"
        exit 1
    fi
    
    # 检查是否需要重启
    if [ -f /var/run/reboot-required ]; then
        echo "Reboot required"
        # 在实际环境中，可能需要安排重启而不是立即重启
        # shutdown -r +5 "System will reboot for security updates"
    fi
    
    echo "=== Security update completed at $(date) ==="
} | tee -a $LOG_FILE | mail -s "Security update report for $HOSTNAME" $EMAIL_ADMIN

# 每天凌晨检查安全更新
0 2 * * * /usr/local/bin/security-updates.sh

# 每周清理一次旧包
0 3 * * 0 /usr/local/bin/cleanup-packages.sh

#!/bin/bash
# 检查系统包状态

echo "Package management status report"
echo "Generated: $(date)"
echo "========================================"

# 检查更新可用性
echo "1. Available updates:"
apt list --upgradable 2>/dev/null | sed 1d

echo ""
echo "2. Hold packages:"
apt-mark showhold

echo ""
echo "3. Orphaned packages:"
deborphan

echo ""
echo "4. Large installed packages (top 10):"
dpkg-query -W -f='${Installed-Size;8}\t${Package}\n' | sort -nr | head -10

echo ""
echo "5. Recently installed packages (last 7 days):"
grep " status installed" /var/log/dpkg.log* | grep -E "$(date -d "7 days ago" "+%Y-%m-%d")" | \
awk '{print $4}' | cut -d: -f1 | sort | uniq

echo ""
echo "6. Package repository status:"
apt-cache policy | grep -A1 http | grep -v http | grep -v master | sort | uniq -c

---
- name: Update and maintain Ubuntu servers
  hosts: ubuntu_servers
  serial: 3  # 分批更新，每次3台
  tasks:
    - name: Update apt cache
      apt:
        update_cache: yes
        cache_valid_time: 3600
        
    - name: Check for security updates
      apt:
        upgrade: safe
        autoremove: yes
        autoclean: yes
      register: apt_result
      
    - name: Report changes
      debug:
        msg: "{{ apt_result.changed }}"
        
    - name: Check if reboot required
      stat:
        path: /var/run/reboot-required
      register: reboot_required
      
    - name: Reboot if required
      reboot:
        msg: "Reboot after security updates"
      when: reboot_required.stat.exists

# 发送包状态到监控系统
#!/bin/bash
UPDATES=$(apt list --upgradable 2>/dev/null | wc -l)
let UPDATE_COUNT=$UPDATES-1

# 发送到监控系统
echo "PUTVAL ${HOSTNAME}/apt/updates interval=3600 N:${UPDATE_COUNT}"

# 或者使用Node Exporter文本收集器
mkdir -p /var/lib/node_exporter/textfile_collector
echo "apt_updates ${UPDATE_COUNT}" > /var/lib/node_exporter/textfile_collector/apt.prom

# 22.04中apt命令的输出更简洁易读
# 18.04中需要更多使用apt-get而不是apt

# 22.04支持更多交互式选项
apt --help # 查看新选项

# 22.04改进了包缓存管理

# 22.04中查找Snap包更简单
snap find package_name

# 18.04中Snap支持已存在但集成度较低

# 22.04中可用的内核变体
linux-generic # 标准服务器内核
linux-oem-22.04 # 针对新硬件优化的内核
linux-aws # AWS环境优化内核

# 18.04内核选择较少

# 22.04中更严格的权限控制
# 软件包安装时可能默认有更多限制

# 检查安全状态
ubuntu-security-status

# 18.04中安全工具较少

# 1. 全面备份系统
sudo tar -cvpzf /backup/ubuntu-1804-backup-$(date +%Y%m%d).tar.gz --exclude=/backup --exclude=/proc --exclude=/tmp --exclude=/mnt --exclude=/dev --exclude=/sys --exclude=/run /

# 2. 更新当前系统
sudo apt update
sudo apt upgrade
sudo apt dist-upgrade

# 3. 清理不必要的包
sudo apt autoremove --purge

# 4. 检查第三方源兼容性
grep -r "bionic" /etc/apt/sources.list.d/

# 5. 禁用不兼容的第三方源
sudo mv /etc/apt/sources.list.d/incompatible.list /etc/apt/sources.list.d/incompatible.list.disabled

# 6. 验证系统状态
ubuntu-support-status

# 安装升级工具
sudo apt install update-manager-core

# 检查升级可用性
sudo do-release-upgrade -c

# 开始升级(首先升级到20.04)
sudo do-release-upgrade

# 升级完成后重启
sudo reboot

# 确认升级到20.04成功
lsb_release -a

# 准备从20.04到22.04的升级
sudo apt update
sudo apt upgrade
sudo do-release-upgrade -c
sudo do-release-upgrade

# 升级过程中出现冲突时
sudo apt-get install -f
sudo dpkg --configure -a

# 如果特定包导致问题
sudo apt remove problem-package

# 查看配置文件差异
sudo dpkg --configure -a

# 对于重要服务，选择保留现有配置
# 但之后需要手动合并重要变更

# 检查服务状态
systemctl --failed

# 验证网络功能
ip a
ping -c 3 google.com

# 测试关键应用程序
systemctl status apache2 mysql nginx

# 检查磁盘空间
df -h

# 查看日志中的错误
journalctl -p 3 -xb

# 在中心服务器安装apt-cacher-ng
sudo apt install apt-cacher-ng

# 配置客户端使用代理
echo 'Acquire::http::Proxy "http://apt-cache-server:3142";' | sudo tee /etc/apt/apt.conf.d/01proxy

# 配置apt-mirror包含多个版本
deb http://archive.ubuntu.com/ubuntu bionic main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-security main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu bionic-updates main restricted universe multiverse

deb http://archive.ubuntu.com/ubuntu jammy main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu jammy-security main restricted universe multiverse
deb http://archive.ubuntu.com/ubuntu jammy-updates main restricted universe multiverse

# Ansible playbook示例处理多版本
- name: Configure APT sources
  hosts: all
  tasks:
    - name: Configure Ubuntu sources
      apt_repository:
        repo: "deb http://internal-mirror/ubuntu {{ ansible_distribution_release }} main restricted universe multiverse"
        state: present
      when: ansible_distribution == "Ubuntu"
      
    - name: Install common packages
      apt:
        name: "{{ item }}"
        state: present
      loop: "{{ common_packages }}"
      
    - name: Install version-specific packages
      apt:
        name: "{{ item }}"
        state: present
      loop: "{{ version_specific_packages[ansible_distribution_release] }}"
      when: version_specific_packages[ansible_distribution_release] is defined

# 检查未更新系统
#!/bin/bash
for host in $(cat host-list); do
    echo "Checking $host"
    ssh $host "lsb_release -a; echo 'Security updates:'; apt list --upgradable 2>/dev/null | grep -i security | wc -l"
done

# 检查End-of-Life系统
echo "Ubuntu 18.04 ELS: 2023-04-30"
echo "Ubuntu 22.04 ELS: 2027-04-30"

#!/bin/bash
# 升级准备检查脚本

CHECK_HOST=$1

echo "=== Pre-upgrade check for $CHECK_HOST ==="

# 检查磁盘空间
ssh $CHECK_HOST "df -h /"

# 检查第三方源
ssh $CHECK_HOST "grep -r 'bionic' /etc/apt/sources.list.d/"

# 检查保持的包
ssh $CHECK_HOST "apt-mark showhold"

# 检查自定义内核模块
ssh $CHECK_HOST "ls /lib/modules/"

# 检查服务状态
ssh $CHECK_HOST "systemctl --failed"

# 检查备份状态
echo "Backup status: [需根据实际备份系统实现]"

echo "=== Pre-upgrade check completed ==="

# 安装和配置reprepro创建内部仓库
sudo apt install reprepro

# 创建仓库目录结构
mkdir -p /srv/apt/ubuntu/{conf,dists,pool}

# 配置distributions文件
cat > /srv/apt/ubuntu/conf/distributions << EOF
Origin: Internal Ubuntu Repository
Label: Internal Ubuntu
Codename: jammy
Architectures: amd64 i386 source
Components: main restricted universe multiverse
Description: Internal repository for approved Ubuntu packages
SignWith: yes
EOF

# 添加包到仓库
reprepro -b /srv/apt/ubuntu includedeb jammy /path/to/package.deb

开发仓库 → 测试仓库 → 生产仓库

# 使用ClamAV扫描上传的包
sudo apt install clamav
freshclam  # 更新病毒数据库
clamscan -r /path/to/new/packages/

# 使用lynis进行安全审计
sudo apt install lynis
sudo lynis audit system

# 检查软件包完整性
debsums -c  # 检查已安装包的文件完整性

# 设置仓库目录权限
sudo chown -R root:www-data /srv/apt/ubuntu
sudo chmod -R 750 /srv/apt/ubuntu

# 配置审计日志
sudo apt install auditd
sudo auditctl -w /srv/apt/ubuntu -p wa -k package_changes

# 定期审查访问日志

# 修复损坏的依赖关系
sudo apt --fix-broken install
sudo apt -f install

# 清除并重建包缓存
sudo apt clean
sudo apt update

# 手动解决复杂依赖
sudo aptitude install problem-package

# 检查源列表语法
sudo apt update 2>&1 | grep -i "failed\|error"

# 禁用有问题的源
sudo mv /etc/apt/sources.list.d/problematic.list /etc/apt/sources.list.d/problematic.list.disabled

# 检查GPG密钥
sudo apt-key list
sudo apt update | grep "NO_PUBKEY"  # 获取缺失的密钥ID
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys KEY_ID

# 清理旧内核和缓存
sudo apt autoremove --purge
sudo apt clean

# 清理日志文件
sudo journalctl --vacuum-size=100M

# 查找大文件
sudo du -h /var/lib/dpkg/ | sort -rh | head -10

# 找出冲突的包
sudo dpkg --audit

# 暂时移除冲突包
sudo apt remove conflicting-package

# 安装所需包后再重新安装
sudo apt install desired-package
sudo apt install conflicting-package

# 使用equivs创建虚拟包解决依赖
sudo apt install equivs
equivs-control virtual-package
# 编辑virtual-package文件后构建
equivs-build virtual-package
sudo dpkg -i virtual-package.deb

# 使用更快的镜像源
sudo sed -i 's/archive.ubuntu.com/mirrors.aliyun.com/g' /etc/apt/sources.list

# 配置APT连接参数
echo 'Acquire::http::Timeout "10";' | sudo tee /etc/apt/apt.conf.d/10-timeout
echo 'Acquire::http::Max-Age "300";' | sudo tee /etc/apt/apt.conf.d/10-max-age
echo 'Acquire::https::Timeout "10";' | sudo tee /etc/apt/apt.conf.d/10-ssl-timeout

# 使用APT缓存代理
echo 'Acquire::http::Proxy "http://proxy.example.com:3142";' | sudo tee /etc/apt/apt.conf.d/02proxy

# 创建监控脚本检查更新和安全性
#!/bin/bash
# monitor-apt.sh

HOSTNAME=$(hostname)
UPDATES=$(apt list --upgradable 2>/dev/null | wc -l)
let UPDATE_COUNT=$UPDATES-1
SECURITY_UPDATES=$(apt upgrade -s | grep -i security | grep ^Inst | wc -l)

echo "apt_updates{host=\"$HOSTNAME\"} $UPDATE_COUNT"
echo "apt_security_updates{host=\"$HOSTNAME\"} $SECURITY_UPDATES"

# 检查是否需要重启
if [ -f /var/run/reboot-required ]; then
    echo "apt_reboot_required{host=\"$HOSTNAME\"} 1"
else
    echo "apt_reboot_required{host=\"$HOSTNAME\"} 0"
fi

# 使用Node Exporter文本收集器
mkdir -p /var/lib/node_exporter/textfile_collector
./monitor-apt.sh > /var/lib/node_exporter/textfile_collector/apt.prom
chown prometheus:prometheus /var/lib/node_exporter/textfile_collector/apt.prom

# 每周审计脚本
#!/bin/bash
# apt-audit-weekly.sh

LOG_FILE="/var/log/apt-audit-$(date +%Y%m%d).log"

{
    echo "=== APT Weekly Audit $(date) ==="
    
    # 检查未验证的包
    echo "1. Unauthenticated packages:"
    apt list --installed | grep unauthenticated
    
    # 检查保持的包
    echo "2. Held packages:"
    apt-mark showhold
    
    # 检查孤儿包
    echo "3. Orphaned packages:"
    deborphan
    
    # 检查大包
    echo "4. Largest packages:"
    dpkg-query -W -f='${Installed-Size;8}\t${Package}\n' | sort -nr | head -10
    
    # 检查仓库状态
    echo "5. Repository status:"
    apt-cache policy | grep http | sort | uniq -c
    
    echo "=== Audit completed ==="
} | tee -a $LOG_FILE

# 每日维护任务
0 3 * * * /usr/local/bin/apt-daily-maintenance

# 每周审计任务
0 4 * * 6 /usr/local/bin/apt-weekly-audit

# 月度清理任务
0 5 1 * * /usr/local/bin/apt-monthly-cleanup