purge insecure packages

[chris-rock]

This PR makes sure that insecure packages are not just removed but completely purged. Otherwise the packages may still be on the system.

[chris-rock]

If I read the travis report correctly, the errors are not related to this PR

[nodiscc]

Otherwise the packages may still be on the system.

Not exactly, only their configuration files will remain https://docs.ansible.com/ansible/latest/modules/apt_module.html, https://manpages.debian.org/buster/apt/apt.8.en.html. Still it doesn't hurt to remove/purge them also.

this leads me to the question: since you usually want to purge (instead of simply remove) packages when using a config management system, is there a way to make ansible default to purge: yes globally/at the playbook level?

[rndmh3ro]

Thank you Chris for this addition!

@nodiscc

this leads me to the question: since you usually want to purge (instead of simply remove) packages when using a config management system, is there a way to make ansible default to purge: yes globally/at the playbook level?

You could probably use module defaults for this:
https://docs.ansible.com/ansible/latest/user_guide/playbooks_module_defaults.html