This Python script can be used to add or remove packages from the 'hold' state in the Advanced Package Tool on Debian-based systems.
For example, it could be assigned to a different Puppet/Ansible class level in order to keep track of packages that should not be updated.
class { "pkgkeeper":
keep_packages => ['nginx','openssl']
}