Debian agnostic, version agnostic way to configure update preferences in unattended-upgrades

Question

I understand the the configuration files for unattended-upgrades in which you determine if you want only security upgrades or other upgrades as well, are located in a bit "dynamic" locations that could change between specific debian distros and their versions.

Is there a general command structure to control these in a uniformal, Debian agnostic, version agnostic way? Some command I could learn?

I'm not sure that the following is what I need:

sudo dpkg-reconfigure --priority=low unattended-upgrades

I might miss the association between priority and allowed origins, as in:

Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};

Update for Stephen

Dear Stephen, if I understood your answer correctly what I should do, due to the hierarchy you describe is to edit /etc/apt/apt.conf and add in the end of that file:

Unattended-Upgrade::Allowed-Origins {
      "${distro_id}:${distro_codename}";
      "${distro_id}:${distro_codename}-security";
      "${distro_id}:${distro_codename}-updates";
      "${distro_id}:${distro_codename}-proposed";
      "${distro_id}:${distro_codename}-backports";
};

This would be the most minimal way to make the change of allowing upgrading of all types of software, given there isn't a command for that.

Answer 1

APT configuration files are read in the following order:

1. the file specified by APT_CONFIG if any;
2. files in /etc/apt/apt.conf.d;
3. /etc/apt/apt.conf.

Later files override earlier ones, so in practice the best place to put settings is /etc/apt/apt.conf; that will override any setting defined in a file in /etc/apt/apt.conf.d. An alternative which should work well is to use a file named /etc/apt/apt.conf.d/99local, but /etc/apt/apt.conf has worked fine for me for this kind of purpose for many years. You can think of this setup as allowing packages to provide default configuration in files in /etc/apt/apt.conf.d, and /etc/apt/apt.conf containing the local system administrator’s desired configuration.

In your case, you should edit /etc/apt/apt.conf and add the following snippet to it:

Unattended-Upgrade::Allowed-Origins {
      "${distro_id}:${distro_codename}";
      "${distro_id}:${distro_codename}-security";
      "${distro_id}:${distro_codename}-updates";
};

You don’t want -proposed (which contains packages waiting for approval); you might want -backports (which contains packages backported from the current release of Debian), if you use backported packages. -updates contains upgrades which aren’t important for security; so you can enable it to get upgrades as they are made available, or disable it to batch upgrades at point releases.

The priority specified in the dpkg-reconfigure command doesn’t have any association with allowed origins, it simply determines which configuration questions are displayed (and should be unnecessary since low is the default for dpkg-reconfigure).