check_apt_updates

#!/usr/bin/python


#nice apt-get -s -o Debug::NoLocking=true upgrade | grep ^Inst

import apt_pkg
import os
import sys
from optparse import OptionParser
import gettext
import subprocess

SYNAPTIC_PINFILE = "/var/lib/synaptic/preferences"
DISTRO = subprocess.Popen(["lsb_release","-c","-s"],
                          stdout=subprocess.PIPE).communicate()[0].strip()

class OpNullProgress(object):
    def update(self, percent=None):
        pass
    def done(self):
        pass

def _(msg):
    return gettext.dgettext("update-notifier", msg)

def _handleException(type, value, tb):
    sys.stderr.write("E: "+ _("Unknown Error: '%s' (%s)") % (type,value))
    sys.exit(-1)

def clean(cache,depcache):
    " unmark (clean) all changes from the given depcache "
    # mvo: looping is too inefficient with the new auto-mark code
    #for pkg in cache.Packages:
    #    depcache.MarkKeep(pkg)
    depcache.init()

def saveDistUpgrade(cache,depcache):
    """ this functions mimics a upgrade but will never remove anything """
    depcache.upgrade(True)
    if depcache.del_count > 0:
        clean(cache,depcache)
    depcache.upgrade()

def isSecurityUpgrade(ver):
    " check if the given version is a security update (or masks one) "
    security_pockets = [("Ubuntu", "%s-security" % DISTRO),
                        ("gNewSense", "%s-security" % DISTRO),
                        ("Debian", "%s-updates" % DISTRO)]

    for (file, index) in ver.file_list:
        for origin, archive in security_pockets:
            if (file.archive == archive and file.origin == origin):
                return True
    return False

def write_package_names(outstream, cache, depcache):
    " write out package names that change to outstream "
    pkgs = filter(lambda pkg:
                  depcache.marked_install(pkg) or depcache.marked_upgrade(pkg),
                  cache.packages)
    outstream.write("\n".join(map(lambda p: p.name, pkgs)))

def write_human_readable_summary(outstream, upgrades, security_updates):
    " write out human summary summary to outstream "
    outstream.write(gettext.dngettext("update-notifier",
                            "%i package can be updated.",
                            "%i packages can be updated.",
                            upgrades) % upgrades)
    outstream.write("\n")
    outstream.write(gettext.dngettext("update-notifier",
                            "%i update is a security update.",
                            "%i updates are security updates.",
                            security_updates)  % security_updates)
    outstream.write("\n")

def write_nagios_output(total_updates,crit_updates,crit_updates_list,soft_updates,soft_updates_list,critonly):
    " write out nagios formatted output to outstream "
    if crit_updates > 0:
        nagios_status = "CRITICAL"
        nagios_exitcode = 2
    elif total_updates > 0 and not critonly:
        nagios_status = "WARNING"
        nagios_exitcode = 1
    else:
        nagios_status = "OK"
        nagios_exitcode = 0

    if crit_updates_list.endswith(", "): crit_updates_list = crit_updates_list[:-2]
    if soft_updates_list.endswith(", "): soft_updates_list = soft_updates_list[:-2]

    sys.stdout.write("%s: %s Total upgradable pagckages" % (nagios_status,total_updates))
    if total_updates > 0:
        sys.stdout.write(" || %s critical" % (crit_updates))
        if crit_updates > 0 and options and not options.hide_package_names:
            sys.stdout.write(" (%s)" % (crit_updates_list))
        if not critonly:
            sys.stdout.write(" || %s non-critical" % (soft_updates))
            if soft_updates > 0 and options and not options.hide_package_names:
                sys.stdout.write(" (%s)" % (soft_updates_list))
    sys.stdout.write("\n")
    sys.exit(nagios_exitcode)

def init():
    " init the system, be nice "
    # FIXME: do a ionice here too?
    os.nice(19)
    apt_pkg.init()
    # force apt to build its caches in memory for now to make sure
    # that there is no race when the pkgcache file gets re-generated
    apt_pkg.config.set("Dir::Cache::pkgcache","")

def run(options=None):

    # we are run in "are security updates installed automatically?"
    # question mode
#    if options.security_updates_unattended:
#        res = apt_pkg.config.find_i("APT::Periodic::Unattended-Upgrade", 0)
#        #print res
#        sys.exit(res)

    # get caches
    try:
        cache = apt_pkg.Cache(OpNullProgress())
    except SystemError, e:
        sys.stderr.write("E: "+ _("Error: Opening the cache (%s)") % e)
        sys.exit(-1)
    depcache = apt_pkg.DepCache(cache)

    # read the pin files
    depcache.read_pinfile()
    # read the synaptic pins too
    if os.path.exists(SYNAPTIC_PINFILE):
        depcache.read_pinfile(SYNAPTIC_PINFILE)

    # init the depcache
    depcache.init()

    if depcache.broken_count > 0:
        sys.stderr.write("E: "+ _("Error: BrokenCount > 0"))
        sys.exit(-1)

    # do the upgrade (not dist-upgrade!)
    try:
        saveDistUpgrade(cache,depcache)
    except SystemError, e:
        sys.stderr.write("E: "+ _("Error: Marking the upgrade (%s)") % e)
        sys.exit(-1)

    # analyze the ugprade
    updates = 0
    security_updates = 0
    non_security_updates = 0
    updates_list = ""
    security_updates_list = ""
    non_security_updates_list = ""
    for pkg in cache.packages:
        # skip packages that are not marked upgraded/installed
        if not (depcache.marked_install(pkg) or depcache.marked_upgrade(pkg)):
            continue
        # check if this is really a upgrade or a false positive
        # (workaround for ubuntu #7907)
        inst_ver = pkg.current_ver
        cand_ver = depcache.get_candidate_ver(pkg)
        if cand_ver == inst_ver:
            continue
	# ignore packages not previously installed (these are dependencies, not upgrades, and would otherwise raise false criticals at new packages)
        if inst_ver is None:
            continue

        # check for security updates
        updates = updates + 1
        updates_list += ("%s; " % pkg.name)
        if not isSecurityUpgrade(cand_ver):
            non_security_updates_list += ("%s, " % pkg.name)
            non_security_updates += 1
        else:
            security_updates_list += ("%s, " % pkg.name)
            security_updates += 1
            continue

        # now check for security updates that are masked by a
        # canidate version from another repo (-proposed or -updates)
        for ver in pkg.version_list:
            if (inst_ver and apt_pkg.version_compare(ver.ver_str, inst_ver.ver_str) <= 0):
                #print "skipping '%s' " % ver.VerStr
                continue
            if isSecurityUpgrade(ver):
                security_updates_list += ("%s; " % pkg.name)
                security_updates += 1
                break

    if options and options.nagios_mode:
        write_nagios_output(updates,security_updates,security_updates_list,non_security_updates,non_security_updates_list,options.critical_only)
        # nagios_mode will always do sys.exit so it will never pass this point

    # print the number of updates
    if options and options.show_package_names:
        write_package_names(sys.stderr, cache, depcache)
    elif options and options.readable_output:
        write_human_readable_summary(sys.stdout, updates, security_updates)
    else:
        # print the number of regular updates and the number of
        # security updates
        sys.stderr.write("%s;%s" % (updates,security_updates))

    # return the number of updates (if its used as a module)
    return(updates,security_updates)


if __name__ == "__main__":
    # setup a exception handler to make sure that uncaught stuff goes
    # to the notifier
    sys.excepthook = _handleException

    # gettext
    APP="update-notifier"
    DIR="/usr/share/locale"
    gettext.bindtextdomain(APP, DIR)
    gettext.textdomain(APP)

    # check arguments
    parser = OptionParser()
#    parser.add_option("-p",
#                      "--package-names",
#                      action="store_true",
#                      dest="show_package_names",
#                      help=_("Show the packages that are going to be installed/upgraded"))
#    parser.add_option("",
#                      "--human-readable",
#                      action="store_true",
#                      dest="readable_output",
#                      help=_("Show human readable output on stdout"))
#    parser.add_option("",
#                      "--security-updates-unattended",
#                      action="store_true",
#                      help=_("Return the time in days when security updates "
#                             "are installed unattended (0 means disabled)"))
    parser.add_option("-c","--crit-only",
                      action="store_true",
                      dest="critical_only",
                      help=_("Warn only about critical updates"))
    parser.add_option("-q",
                      "--quiet",
                      action="store_true",
                      dest="hide_package_names",
                      help=_("Quiet output: hide the names of packages that are pending upgrades"))
    (options, args) = parser.parse_args()

    options.nagios_mode = "forcing nagios mode is fun"

    # run it
    init()
    run(options)