unattended-upgrades ignores priorities

Question

I seems that unattended-upgrades do not follow the priorities sett up in /etc/apt/preferences.

I am maintaining a Debian file server where unattended-upgrades are set up. The version of rclone from testing is currently installed. When updating with apt the rclone is updated from testing. However, when running unattended-upgrades the update in the testing repository is ignored.

Is this behavior expected from unattended upgrades? I would like rclone to follow the update the updates in the testing repository. Details of the output and the system set-up are summarized below.

The output from running unattended-upgrade --dry-run --debug is:

Enabled logging to syslog via daemon facility
Initial blacklisted packages: 
Initial whitelisted packages: 
Starting unattended upgrades script
Allowed origins are: ['origin=Debian,codename=stretch,archive=stable',
  'origin=Debian,codename=stretch,archive=testing',
  'origin=Debian,codename=stretch,label=Debian-Security',
  'origin=Debian Backports,codename=stretch-backports,label=Debian Backports',
  'origin=Syncthing,archive=syncthing,codename=debian,label=Syncthing,component=stable',
  'origin=www.geogebra.net,codename=stable,component=main']
ignoring ver 'rclone=1.45-2+b21' with priority < 0
adjusting candidate version: 'rclone=1.35-1+b3'
pkgs that look like they should be upgraded: 
Fetched 0 B in 0s (0 B/s)                                                       
fetch.run() result: 0
blacklist: []
whitelist: []
No packages found that can be upgraded unattended and no pending auto-removals

The preference files /etc/apt/preferences is:

Package: *
Pin: release l=Debian-Security
Pin-Priority: 1000

Package: rclone
Pin: release a=testing
Pin-Priority: 950

Package: *
Pin: release a=stable
Pin-Priority: 900

Package: *
Pin: release a=stretch-backports
Pin-Priority: 800

Package: *
Pin: release a=testing
Pin-Priority: -1

The /etc/apt/sources.list file is:

deb http://ftp.uk.debian.org/debian/ stretch main non-free contrib
deb-src http://ftp.uk.debian.org/debian/ stretch main non-free contrib

deb http://security.debian.org/debian-security stretch/updates main contrib non-free
deb-src http://security.debian.org/debian-security stretch/updates main contrib non-free

# stretch-updates, previously known as 'volatile'
deb http://ftp.uk.debian.org/debian/ stretch-updates main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ stretch-updates main contrib non-free

# stretch-backports, previously on backports.debian.org
deb http://ftp.uk.debian.org/debian/ stretch-backports main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ stretch-backports main contrib non-free

# testing 
deb http://ftp.uk.debian.org/debian/ testing main contrib non-free
deb-src http://ftp.uk.debian.org/debian/ testing main contrib non-free

The origins in /etc/apt/apt.conf.d/50unattended-upgrades are configured as follows:

Unattended-Upgrade::Origins-Pattern {
  "origin=${distro_id},codename=${distro_codename},archive=stable";
  "origin=${distro_id},codename=${distro_codename},archive=testing";
  "origin=${distro_id},codename=${distro_codename},label=Debian-Security";
  "origin=${distro_id} Backports,codename=${distro_codename}-backports,label=Debian Backports";
  "origin=Syncthing,archive=syncthing,codename=debian,label=Syncthing,component=stable";
  "origin=www.geogebra.net,codename=stable,component=main";
};

Answer 1

You need to set the appropriate codename for testing:

Unattended-Upgrade::Origins-Pattern {
    "origin=${distro_id},codename=${distro_codename},archive=stable";
    "origin=${distro_id},codename=buster,archive=testing";
    "origin=${distro_id},codename=${distro_codename},label=Debian-Security";
    "origin=${distro_id} Backports,codename=${distro_codename}-backports,label=Debian Backports";
    "origin=Syncthing,archive=syncthing,codename=debian,label=Syncthing,component=stable";
    "origin=www.geogebra.net,codename=stable,component=main";

};