Sanitizing Debian
Tags: debian, ubuntu, debsums, vscode
Published: 2018-12-12 15:47:24

---
title: Sanitizing Debian
published: true
description: How I cleaned up my OS using debsums (and got stumped by vscode)
tags: #debian #ubuntu #debsums #vscode
---
_(this is my first post on dev.to, testing the waters, be gentle)_

Today I wanted to check whether any file on my system was not exactly the file that was shipped in its debian package. So after some research, I settled on the _debsums_ command: 

```bash
$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)
debsums: changed file /usr/share/applications/gedit.desktop (from gedit package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/__init__.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/config.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/cupshelpers.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/installdriver.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/openprinting.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/ppds.cpython-35.pyc (from python3-cupshelpers package)
debsums: changed file /usr/lib/python3/dist-packages/cupshelpers/__pycache__/xmldriverprefs.cpython-35.pyc (from python3-cupshelpers package)
```

Moved on to re-installing the affected packages:

```bash
$ sudo debsums -s 2>&1 | \
  grep -oE "from .* package" | \
  sort | uniq | \
  while read PKG; do
    echo "$PKG" | cut -d ' ' -f 2;
  done;
code
gedit
python3-cupshelpers
$ sudo aptitude reinstall code gedit python3-cupshelpers
...
```

And checked (again):

```bash
$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)
```

Uh. There's something at work that I don't fully understand (yet). Since I cannot justify the time spent chasing this down, I find out who to contact:

```bash
$ apt-cache show code | grep -E "Maintainer" | uniq -c
     50 Maintainer: Microsoft Corporation <vscode-linux@microsoft.com>
```

Then I drop them a mail:

```text
From: Le Stephane
To: vscode-linux@microsoft.com
Subject: /usr/share/applications/code(-url-handler).desktop files always show up as modified in debsums

Dear VS Code maintainers, 

I get debsums errors on files belonging to your .deb package, even after re-installing it. Can you advise?

$ sudo debsums -s
debsums: changed file /usr/share/applications/code-url-handler.desktop (from code package)
debsums: changed file /usr/share/applications/code.desktop (from code package)

$ dpkg -l code
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                                  Version                 Architecture            Description
+++-=====================================-=======================-=======================-===============================================================================
ii  code                                  1.29.1-1542309157       amd64                   Code editing. Redefined.

Best
```

# Takeaways (so far) 

- Posting on dev.to is fun, I will do it again
- There's a _debsums_ command which is pretty cool
- _debsums_ + _aptitude reinstall_ makes my system fresh again... 
- ...except for a few files, for an unknown reason
- I don't need to find that reason just yet. But I can find out where to ask for help
- Similarly, I don't need to finish my article. Maybe someone in the audience will know why I'm experiencing this behaviour. If not, in time, the maintainer will probably point me to the reason. I can then amend the article.
- This article is my first, and just a start. I should also check which files currently present in my OS system directories does not belong to a package, if I'm serious about security.