# apt safe-upgrade module **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu\ **Created:** [September 26, 2014, 9:57am UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357 "2014-09-26T09:57:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Benjamin\_Copeland1](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@Benjamin\_Copeland1](https://forum.ansible.com/u/Benjamin_Copeland1)\ **Post date:** [September 26, 2014, 9:57am UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/1 "2014-09-26T09:57:26Z")
- name: hold openssh-client only if OS is 12.04 shell: echo “openssh-client hold” | sudo dpkg --set-selections when: ansible\_distribution == ‘Ubuntu’ and ansible\_distribution\_release == ‘precise’ - name: hold openssh-server only if OS is 12.04 shell: echo “openssh-server hold” | sudo dpkg --set-selections when: ansible\_distribution == ‘Ubuntu’ and ansible\_distribution\_release == ‘precise’ - name: update and upgrade a server apt: upgrade=safe update\_cache=yes sudo: yes The package is “held” it dpkg. openssh-client hold openssh-server hold The state of apt before ansible: The following packages have been kept back: linux-headers-generic linux-headers-virtual linux-image-virtual linux-virtual openssh-client openssh-server After deploy: The following packages have been kept back: linux-headers-generic linux-headers-virtual linux-image-virtual linux-virtual I would have thought, using the safe-upgrade should have stopped openssh being upgraded. Is this a bug, or am I missing something? Thanks Ben ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 26, 2014, 12:33pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/2 "2014-09-26T12:33:08Z")
Where are you seeing the output of what is “held back” and so on? That’s usually what you see during an update, so it seems some steps are not being executed by Ansible, and that’s confusing me a little. Can you show the commands executed? Thanks! ---
**Author:** ![Benjamin\_Copeland1](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@Benjamin\_Copeland1](https://forum.ansible.com/u/Benjamin_Copeland1)\ **Post date:** [September 26, 2014, 2:04pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/3 "2014-09-26T14:04:09Z")
Hello Michael, I am using dpkg, so dpkg --get-selections | grep “openssh-\*”. apt-get upgrade, by default won’t upgrade held packages. There is a option in apt-get manual: –ignore-hold Ignore package Holds; This causes apt-get to ignore a hold placed on a package. This may be useful in conjunction with dist-upgrade to override a large number of undesired holds. Configuration Item: APT::Ignore-Hold. Which, I assume then will overwrite the default behavior. Thanks Ben ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 27, 2014, 1:37pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/4 "2014-09-27T13:37:52Z")
Curious how the holds got placed? ---
**Author:** ![Benjamin\_Copeland1](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@Benjamin\_Copeland1](https://forum.ansible.com/u/Benjamin_Copeland1)\ **Post date:** [September 29, 2014, 8:52am UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/5 "2014-09-29T08:52:18Z")
[https://help.ubuntu.com/community/PinningHowto#Apt](https://help.ubuntu.com/community/PinningHowto#Apt) Like that. Ben ---
**Author:** ![Igor\_Homyakov](https://avatars.discourse-cdn.com/v4/letter/i/f4b2a3/32.png) [@Igor\_Homyakov](https://forum.ansible.com/u/Igor_Homyakov)\ **Post date:** [September 29, 2014, 10:07am UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/6 "2014-09-29T10:07:31Z")
All holds are in /var/lib/dpkg/status file as well as other statuses of available packages. ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 29, 2014, 1:43pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/7 "2014-09-29T13:43:17Z")
Yep, familiar with apt pinning. I think I’d be open to a parameter to ignore the pinning, but it probably should not happen by default. ---
**Author:** ![Benjamin\_Copeland1](https://avatars.discourse-cdn.com/v4/letter/b/5f8ce5/32.png) [@Benjamin\_Copeland1](https://forum.ansible.com/u/Benjamin_Copeland1)\ **Post date:** [September 29, 2014, 3:11pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/8 "2014-09-29T15:11:49Z")
Currently, its holding me back from updating a number of our servers. As, soon as the held package gets updated, the server breaks. Is there anything I can do? ---
**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\ **Post date:** [September 30, 2014, 7:15pm UTC](https://forum.ansible.com/t/apt-safe-upgrade-module/16357/9 "2014-09-30T19:15:34Z")
For now you could modify the module or make a "shell: " command call instead, using the numerous flags and env variables required to make apt do a direct update. Please make sure there’s a ticket or pull request filed for this one if not already.