Ensuring safe rollback after Kali Linux apt schema change

Direct answer

Kali Linux inherits Debian apt, which has no built-in atomic rollback for schema changes. The only reliable way to return a system to its pre-upgrade state—including /etc and /var/lib/dpkg—is to restore a filesystem snapshot taken before the upgrade. apt pinning can delay or block specific package versions, but it cannot make a schema migration transactional. An empty /var/lib/dpkg/updates/ directory only means no package is mid-unpack right now; it does not prove that a previous change can be reversed.

Confirmed facts and assumptions

• apt and dpkg apply package changes one package at a time; maintainer scripts can rewrite /etc/sources.list and dpkg has no undo log for those scripts.
• dpkg --audit and dpkg --verify detect broken packages after an upgrade but cannot undo schema migrations.
• etckeeper can roll back files in /etc, but not the dpkg database state.
• /var/lib/dpkg/updates/ holds temporary .new files during unpacking and removes them when the step finishes.

Assumption: this guidance treats Kali as a rolling Debian derivative and makes no claim about a specific Kali version. If your root filesystem does not support snapshots, the manual fallback below is non-atomic and should be tested in a VM first.

Steps for this case

1. Before upgrading, create a read-only snapshot of the root filesystem using LVM, Btrfs, or ZFS. Snapshot /boot separately if it is not part of the root volume, because kernel and initramfs must stay matched after rollback.
2. Run apt full-upgrade.
3. If packages break or sources.list changes unexpectedly, roll back the snapshot. This restores /etc, /var/lib/dpkg, and installed package state together.
4. If snapshots are unavailable, back up /var/lib/dpkg/status and /etc/apt/sources.list manually, and use etckeeper for /etc. Treat this as a last-resort fallback, not atomic rollback.

apt pinning to limit schema changes

Create /etc/apt/preferences.d/kali-schema-hold:

Package: kali-archive-keyring
Pin: release o=Kali
Pin-Priority: 1001

Then run apt-mark hold kali-archive-keyring. This prevents keyring-driven sources.list changes but may also block repository updates. Because priority 1001 overrides security updates, review Kali advisories manually and plan an unhold window.

Verifying /var/lib/dpkg/updates/

Run:

ls -la /var/lib/dpkg/updates/

An empty directory means no unpack is in progress. It is not a rollback ledger. To see whether recent packages touched sources.list or the keyring, inspect the log:

grep -i "sources.list\|base-files\|kali-archive-keyring" /var/log/dpkg.log

Missing diagnostic detail

Does your root filesystem support snapshots (LVM, Btrfs, or ZFS)? This determines whether snapshot rollback is the primary path or whether you need the manual dpkg status and /etc backup procedure.

Verification commands

• apt update && apt list --upgradable — lists packages that may modify sources.list.
• apt-cache policy kali-archive-keyring — confirms whether the pin is active.
• dpkg --get-selections | grep hold — confirms held packages persist across reboots.
• dpkg --audit — checks for partially installed or broken packages.