Prove a Package Candidate Is From Security

A package is upgradable and you need to confirm whether the candidate version comes from the security pocket.

Command

apt-cache policy openssl | sed -n '/Installed:/p;/Candidate:/p;/security/p'

Before you run this

Risk: safe. Do not use it to install the package; this is only metadata inspection.

Expected output

Installed and candidate versions plus a security repository line for the candidate.

System impact

Nothing changes. apt-cache reads local apt metadata and sed extracts the version and security-origin lines.

Recovery / rollback: no state is changed.

When to use it

Use when documenting why a specific package is being patched or when comparing update and security pockets.

When not to use it

Do not use it to install the package; this is only metadata inspection.

Watch this command run

Example output from a temporary Linux lab

This example uses disposable sample files and sanitized output so you can inspect the shape of the result before touching a real system.

demo@lab:~$

$ apt-cache policy openssl

openssl:
  Installed: 3.0.13-0ubuntu3.5
  Candidate: 3.0.13-0ubuntu3.6
  Version table:
     3.0.13-0ubuntu3.6 500
        500 http://example.com/ubuntu noble-security/main amd64 Packages
 *** 3.0.13-0ubuntu3.5 100
        100 /var/lib/dpkg/status

$ apt-cache policy openssl | sed -n '/Installed:/p;/Candidate:/p;/security/p'

  Installed: 3.0.13-0ubuntu3.5
  Candidate: 3.0.13-0ubuntu3.6
        500 http://example.com/ubuntu noble-security/main amd64 Packages

View reproducible demo details

This page shows the sanitized shell transcript and the setup steps needed to reproduce the example.