Sanitizing Debian

#debian #ubuntu #debsums #vscode

(this is my first post on dev.to, testing the waters, be gentle)

Today I wanted to check whether any file on my system was not exactly the file that was shipped in its debian package. So after some research, I settled on the debsums command:

$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)
debsums: changed file /usr/share/applications/gedit.desktop (from gedit package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/__init__.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/config.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/cupshelpers.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/installdriver.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/openprinting.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/ppds.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/xmldriverprefs.cpython-35.pyc (from python3-cupshelpers package)

Moved on to re-installing the affected packages:

$ sudo debsums -s 2>&1 | \
  grep -oE "from .* package" | \
  sort | uniq | \
  while read PKG; do
    echo "$PKG" | cut -d ' ' -f 2;
  done;
code
gedit
python3-cupshelpers
$ sudo aptitude reinstall code gedit python3-cupshelpers
...

And checked (again):

$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)

Uh. There's something at work that I don't fully understand (yet). Since I cannot justify the time spent chasing this down, I find out who to contact:

$ apt-cache show code | grep -E "Maintainer" | uniq -c
     50 Maintainer: Microsoft Corporation <vscode-linux@microsoft.com>

Then I drop them a mail:

From: Le Stephane
To: vscode-linux@microsoft.com
Subject: /usr/share/applications/code(-url-handler).desktop files always show up as modified in debsums

Dear VS Code maintainers, 

I get debsums errors on files belonging to your .deb package, even after re-installing it. Can you advise?

$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)

$ dpkg -l code
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                  Version                 Architecture            Description
+++-=====================================-=======================-=======================-===============================================================================
ii  code                                  1.29.1-1542309157       amd64                   Code editing. Redefined.

Best

Takeaways (so far)

Posting on dev.to is fun, I will do it again
There's a debsums command which is pretty cool
debsums + aptitude reinstall makes my system fresh again...
...except for a few files, for an unknown reason
I don't need to find that reason just yet. But I can find out where to ask for help
Similarly, I don't need to finish my article. Maybe someone in the audience will know why I'm experiencing this behaviour. If not, in time, the maintainer will probably point me to the reason. I can then amend the article.
This article is my first, and just a start. I should also check which files currently present in my OS system directories does not belong to a package, if I'm serious about security.