Debian - check which versions of a package were previously installed

Question

Let's take NGINX as an example. I've installed NGINX and after a year it has received several security updates (through unattended-upgrades) and another system operator ran apt-get upgrade a couple of times (and maybe a dist-upgrade has been performed). The log files have been "logrotated" since then so I can't use them. Now assume that it has been found out that version X.XX has had several security issues - is there any way to trace back if this version has ever been installed on my server except the log files? If I check the repository to see when and what was released it's not a fact if it has ever been on my system.

Is there any way to check on a Debian system which versions of a Debian package have ever been previously installed?

Answer 1

The only history of package versions is the various logs that trace package installations and upgrades; that includes apt’s logs in /var/log/apt (/var/log/apt/history* in particular), but also dpkg’s logs in /var/log/dpkg.log*. The latter are more comprehensive since they cover all dpkg operations, whereas apt’s logs only cover apt-based tools.

If those logs are lost through rotation, there is no way of determining which versions of a given package were installed, in general.

Some packages store their own traces of upgrades, but that’s rather unusual and can’t be relied upon in general.