feat(dms updater): add support for ignoring specific packages during system updates

- Added UI component & popout settings to manage ignored packages
- Added CLI support available in danklinux docs

Fixes: #2827
Closes: #2344, #1741
Port 1.5

core/internal/server/sysupdate/backend_apt.go

@@ -2,6 +2,7 @@ package sysupdate
 
 import (
 	"context"
+	"fmt"
 	"os/exec"
 	"regexp"
 	"strings"
@@ -31,7 +32,36 @@ func (aptBackend) CheckUpdates(ctx context.Context) ([]Package, error) {
 	if err != nil {
 		return nil, err
 	}
-	return parseAptUpgradable(string(out)), nil
+	return filterAptHeld(parseAptUpgradable(string(out)), aptHeldPackages(ctx)), nil
+}
+
+// aptHeldPackages returns held packages, which apt-get upgrade never applies.
+func aptHeldPackages(ctx context.Context) map[string]bool {
+	out, err := exec.CommandContext(ctx, "apt-mark", "showhold").Output()
+	if err != nil {
+		return nil
+	}
+	held := make(map[string]bool)
+	for line := range strings.SplitSeq(string(out), "\n") {
+		if name := strings.TrimSpace(line); name != "" {
+			held[name] = true
+		}
+	}
+	return held
+}
+
+func filterAptHeld(pkgs []Package, held map[string]bool) []Package {
+	if len(held) == 0 {
+		return pkgs
+	}
+	out := pkgs[:0]
+	for _, p := range pkgs {
+		if held[p.Name] {
+			continue
+		}
+		out = append(out, p)
+	}
+	return out
 }
 
 func (aptBackend) Upgrade(ctx context.Context, opts UpgradeOptions, onLine func(string)) error {
@@ -52,7 +82,22 @@ func (aptBackend) Upgrade(ctx context.Context, opts UpgradeOptions, onLine func(
 }
 
 func aptUpgradeArgv(bin string, opts UpgradeOptions) []string {
-	return privilegedArgv(opts, "env", "DEBIAN_FRONTEND=noninteractive", "LC_ALL=C", bin, "upgrade", "-y")
+	ignored := shellSafeNames(opts.Ignored)
+	if len(ignored) == 0 {
+		return privilegedArgv(opts, "env", "DEBIAN_FRONTEND=noninteractive", "LC_ALL=C", bin, "upgrade", "-y")
+	}
+	return privilegedArgv(opts, "env", "DEBIAN_FRONTEND=noninteractive", "LC_ALL=C", "sh", "-c", aptHoldScript(bin, ignored))
+}
+
+// aptHoldScript holds ignored packages only for the upgrade, leaving pre-existing user holds untouched.
+func aptHoldScript(bin string, ignored []string) string {
+	names := strings.Join(ignored, " ")
+	return fmt.Sprintf(
+		`new=""; for p in %s; do apt-mark showhold | grep -qx "$p" || new="$new $p"; done; `+
+			`[ -n "$new" ] && apt-mark hold $new; `+
+			`%s upgrade -y; rc=$?; `+
+			`[ -n "$new" ] && apt-mark unhold $new; exit $rc`,
+		names, bin)
 }
 
 func parseAptUpgradable(text string) []Package {