is there a way to list or install security upgrades only using apt?

if I list upgrades with:

apt list --upgradable

can I also see without knowing packages and libraries which upgrades are relevant security upgrades.

and furthermore is there an option to only apply those by skipping any others, so the non-security-relevant upgrades would be prompted again next time I run apt upgrade?

  • 1
    so you have two questions, 1.print security updates, 2.update only selected packages, well I know that there are 6 links in sources.list and two of them are security related repo links, you can see which upgradable packages would be downloaded from each link by following command: sudo apt upgrade --no-upgrade --assume-no --print-uris – Brian SP2 Sep 26 '17 at 6:57
  • 1
    but about second question, apparently you can choose a single package to be upgraded by the following command sudo apt upgrade --upgrade-only <package name> but this doesn't work for me, sorry – Brian SP2 Sep 26 '17 at 6:58

apt can’t (yet) provide the information you’re after. aptitude can though, albeit somewhat confusingly:

aptitude search '~U ~ODebian' -F "%p %O"|awk '/Debian-Security/ {print $1}'

This searches all upgradable (~U) packages from official Debian repositories (~ODebian), and displays their package name (%p) and “origin” (%O). The latter actually displays the repository label, which is “Debian-Security:9/stable” for the Debian 9 security repositories. You end up with a list of upgradable package names from the security repositories.

There are a variety of ways to install only security upgrades, none of them ideal though.

  • aptitude’s text interface allows only security upgrades to be applied, simply by scrolling to the “Security Updates” header (which should be the first one) and hitting +.

  • You can feed the list of packages extracted above to apt to install the upgrades:

    aptitude search '~U ~ODebian' -F "%p %O" |
    awk '/Debian-Security/ {print $1}' |
    xargs apt-get install --only-upgrade

    This has the unfortunate side-effect of clearing the “automatically installed” marker on upgraded packages.

  • You can use unattended-upgrades, whose default action is to only apply security upgrades:

    unattended-upgrades -v

    If you don’t want upgrades to be installed automatically, you’ll need to disable unattended-upgrades’s daily cron job.

  • Aptitude's TUI doesn't seem to present security updates separately any more - as of a year ago or so on 16.04, and currently on 18.04. Anybody else seen that? – Greg Bell Oct 14 '19 at 3:14
  • @Greg it still does for me (on Debian 10), and I don’t see any change in Ubuntu which would affect that. Perhaps the security updates are applied automatically before you can see them in aptitude, e.g. by unattended-upgrades... – Stephen Kitt Oct 14 '19 at 4:22
  • Nope, my unattended-upgrades is limited to just thunderbird, sshd, and firefox. What's weird is that aptitude search '~U' finds plenty. I can see it still working on aptitude 0.7.4 ; aptitude 0.8.10 is what Ubuntu 18.04 ships with. What version do you have? – Greg Bell Oct 15 '19 at 7:17
  • @Greg I have 0.8.11, and it shows security updates in their own section. The display is configurable, which might be the problem here — when you press G, what package grouping mechanism is shown? The default is task,status,section(subdirs,passthrough),section(topdir). – Stephen Kitt Oct 15 '19 at 7:21
  • Same grouping mechanism here. And I've mv'd ~/.aptitude to make sure it wasn't something goofy I'd set. – Greg Bell Oct 16 '19 at 10:58

To display the security update you can use:

apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++'

To apply only the security updates for 1 package:

apt-get install --only-upgrade pckg_name

To apply only the security updates from list:

list=$(apt-get --just-print upgrade | grep -i security | awk '{print $2}' | awk '!seen[$0]++')
apt-get install --only-upgrade $list

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.