From 72f5dc70f8a433d3fc2c3764b6fb2ca46e6dc756 Mon Sep 17 00:00:00 2001
From: Jeremy Lecour <jlecour@evolix.fr>
Date: Tue, 4 Feb 2020 18:14:57 +0100
Subject: [PATCH] apt: hold packages only if package is installed

---
 CHANGELOG.md                | 1 +
 apt/tasks/hold_packages.yml | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 65206345..0d2c8671 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,7 @@ The **patch** part changes incrementally at each release.
 ### Changed
 * removed some deprecations for Ansible 2.7
 * apache: improve permissions in save_apache_status script
+* apt: hold packages only if package is installed
 * elasticsearch: listen on local interface only by default
 * evocheck: upstream version 19.11.2
 * evocheck: cron jobs execute in verbose
diff --git a/apt/tasks/hold_packages.yml b/apt/tasks/hold_packages.yml
index 36aebfb0..3b065f13 100644
--- a/apt/tasks/hold_packages.yml
+++ b/apt/tasks/hold_packages.yml
@@ -1,7 +1,7 @@
 ---
 
 - name: "hold packages (apt)"
-  shell: "(apt-mark showhold | grep --quiet {{ item }}) || apt-mark hold {{ item }}"
+  shell: "(dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) || apt-mark hold {{ item }})"
   register: apt_mark
   changed_when: "'{{ item }} set on hold.' in apt_mark.stdout"
   with_items: "{{ apt_hold_packages }}"
@@ -13,6 +13,8 @@
     dest: /etc/evolinux
     mode: "0700"
     state: directory
+  tags:
+    - apt
 
 - name: "hold packages (config)"
   lineinfile:
@@ -25,7 +27,7 @@
     - apt
 
 - name: "unhold packages (apt)"
-  shell: "(apt-mark showhold | grep --quiet {{ item }}) && apt-mark unhold {{ item }}"
+  shell: "(dpkg -l {{ item }} 2>/dev/null | grep -q -E '^(i|h)i') && ((apt-mark showhold | grep --quiet {{ item }}) && apt-mark unhold {{ item }})"
   register: apt_mark
   changed_when: "'Canceled hold on {{ item }}.' in apt_mark.stdout"
   with_items: "{{ apt_unhold_packages }}"
@@ -67,6 +69,8 @@
   changed_when: false
   failed_when: false
   check_mode: no
+  tags:
+    - apt
 
 - name: Check for held packages (script)
   cron: