Identify Debian packages that are not installed by Puppet

check-puppet-packages.sh

#!/bin/bash


# These were copied from /usr/local/bin/kvmCreate_squeeze.sh. Some or
# all probably shouldn't be listed here.
extra_packages="locales netbase net-tools ifupdown iptables linux-image-2.6-amd64"

# This is what debootstrap installs for 'minbase'
base_packages="apt $(aptitude -F %p search '?priority(required)')"

puppet_packages_file="$(mktemp)"
ruby >"$puppet_packages_file" <<'RUBY'
require 'puppet'
x = YAML.load(File.read("/var/lib/puppet/client_yaml/catalog/#{`hostname --fqdn`.strip}.yaml"))
puts x.edges.
  select {|e| e.target.type == 'Package' }.
  map {|e| e.target.to_hash }.
  select {|h| h[:provider] != 'gem' }.
  map {|h| h[:name] }.
  sort.
  uniq
RUBY

known_packages=($base_packages $extra_packages `cat "$puppet_packages_file"`)
printf -v known_filter ' -e %s' ${known_packages[@]}

real_known_packages="$(dpkg-query -W -f='${Package}\n' | grep -x -F $known_filter | sort | uniq)"
#echo $real_known_packages

check_depends() {
   p="$1"
   shift
   why="$(aptitude why $* "$p")"
   result="$?"
   if [ "$result" -eq 0 ]; then
      if ! echo "$why" | grep -v '^ ' | grep -q -v -F -e Depends -e Provides; then
         # okay, we found a strict dependency on this package (or on
         # something this package provides)
         return 0
      else
         return 1
      fi
   else
      return 1
   fi
}

packages_to_check="$*"
if [ -z "$packages_to_check" ]; then
   packages_to_check="$(dpkg-query -W -f='${Package}\n' | grep -x -F -v $known_filter | sort)"
fi

packages_without_explanation=
for pkg in $packages_to_check; do
   if ! check_depends $pkg $real_known_packages; then
      packages_without_explanation="$packages_without_explanation$pkg
"
   fi
done

root_bad_packages=
non_root_bads=
for pkg in $packages_without_explanation; do
   if check_depends $pkg; then
      non_root_bads="$non_root_bads$pkg
"
   else
      root_bad_packages="$root_bad_packages$pkg
"
   fi
done

more_bad_packages=
excusable_packages=
for pkg in $non_root_bads; do
   if check_depends $pkg $real_known_packages $root_bad_packages; then
      excusable_packages="$excusable_packages$pkg
"
   else
      more_bad_packages="$more_bad_packages$pkg
"
   fi
done


bad_packages=($(echo -n "$root_bad_packages$more_bad_packages" | sort))
not_so_bad_packages=($(echo -n $excusable_packages | sort))

if [ "${#bad_packages[*]}" -gt 0 ]; then
   echo
   echo "Unexplained packages"
   echo "====================="
   printf '  %s\n' "${bad_packages[@]}"
   if [ "${#not_so_bad_packages[*]}" -gt 0 ]; then
      echo
      echo "Dependencies"
      echo "============="
      printf '  %s\n' "${not_so_bad_packages[@]}"
   fi
   echo
fi