Command Line – deborphan

Debian is distinguished by its utilities for package management. Every package manager has command options, but Debian also has at least 87 utility packages for everything from creating a package to managing installed packages. Some of these utilities, such as apt-cache, have been added to apt (the stripped down version of apt-get), while Nala uses fetch to find the fastest mirror like netselect-apt does. While many of the other available utilities remain hidden in the Debian repositories, they are worth seeking out. A prime example is deborphan [1], which identifies unneeded packages. This ability is useful for freeing up space on a system and, equally importantly, for knowing exactly what is installed, which is a prerequisite for security.

The deborphan utility takes its name from Debian's name for packages that are not dependent on any other packages. These orphans are the remnants of packages that have been deleted and left behind because Debian's package management commands do not remove dependencies, regardless of whether a package is removed or purged. Orphans can be formerly required packages, recommended packages that add enhancements most users would want, and suggested packages that add enhancements that some users may want. If you are constantly exploring and deleting packages, orphans can quickly multiply, especially because recommended and suggested packages can sometimes outnumber the required dependencies. Wrappers (i.e., packages such as apt that provide a common interface for related packages) are especially likely to have numerous dependencies. Left unchecked, orphans can waste memory and greatly increase potential security vulnerabilities. By default, deborphan detects orphans by searching /libs and /oldlibs to detect unused libraries (Figure 1), although its search can be expanded. It records the status of available packages in /var/lib/dpkg/status and packages to keep in no particular order in /var/lib/deborphan/keep.

Using deborphan

Unusually well structured, the deborphan man page divides options into four sections. The topmost section lists options for the command, with the usual --help (-h) and --version (-v). The Options section also includes --stat-file=FILE (-f) for those who do not want to use /var/lib/dpkg/status for any reason.

[...]