I'm running a raspberry pi (Raspbian 10 -- buster) with unattended-upgrades installed and configured. Today I got a mail report with the following content:

Unattended upgrade result: All upgrades installed

Packages with upgradable origin but kept back:

Goal: To configure unattended-upgrades so that it does not send me notifcations (daily) because of held back packages. It could either install them by itself or refrain from sending a mail-report. Setting Unattended-Upgrade::MailOnlyOnError to true is not an option for me because I want to be notified about successful upgrades.

My config is as follows:

Unattended-Upgrade::Origins-Pattern {

Unattended-Upgrade::Package-Blacklist {


Unattended-Upgrade::Mail "MYMAILADDRESS";
Unattended-Upgrade::Sender "SENDERADDRESS";

Unattended-Upgrade::Remove-Unused-Dependencies "true";

Unattended-Upgrade::Automatic-Reboot "true";

Edit: Output of apt-cache policy linux-libc-dev

  Installed: 4.18.20-2+rpi1
  Candidate: 1:1.20210430-2
  Version table:
     1:1.20210430-2 500
        500 http://archive.raspberrypi.org/debian buster/main armhf Packages
     5.10.28-1+rpi1 -1
         -1 http://raspbian.raspberrypi.org/raspbian bullseye/main armhf Packages
 *** 4.18.20-2+rpi1 500
        500 http://raspbian.raspberrypi.org/raspbian buster/main armhf Packages
        100 /var/lib/dpkg/status

Output of apt-get -d install linux-libc-dev

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be upgraded:
1 upgraded, 0 newly installed, 0 to remove and 23 not upgraded.
Need to get 1.011 kB of archives.
After this operation, 54,3 kB disk space will be freed.
Get:1 http://archive.raspberrypi.org/debian buster/main armhf linux-libc-dev armhf 1:1.20210430-2 [1.011 kB]
Fetched 1.011 kB in 0s (3.006 kB/s)      
Download complete and in download only mode

So far I only found articles explaining how you can prevent packages from being updated by putting them into the Package-Blacklist field. That, however, is empty in my config. So why is the package linux-libc-dev held back from being upgraded? Is there another configuration that I'm not aware of and which might cause this? Does it relate to the Origins-Pattern that I've configured?

Thanks for any advice in advance!

  • You could learn more about it by trying to install the kept package (eg apt-get -d install linux-libc-dev), or maybe just checking available versions apt-cache policy linux-libc-dev (are you using backports?)
    – A.B
    May 14, 2021 at 20:53
  • I ran the commands and added the output to the question. I noticed that when I run apt list --upgradable that it says that an upgrade for linux-libc-dev is available from Debian Testing (linux-libc-dev/testing 1:1.20210430-2 armhf [upgradable from: 4.18.20-2+rpi1] ). Also, as far as I know, I don't use any backports.
    – lipflip
    May 15, 2021 at 9:00
  • 1
    I changed the Debian tag into Raspbian tag, because that's really what it is and is the cause of the problem (nowadays there probably should be an alias raspberrypios but there isn't)
    – A.B
    May 15, 2021 at 12:02

1 Answer 1


I guess the automatic upgrade doesn't work properly because the Release files http://archive.raspberrypi.org/debian/dists/buster/InRelease and http://raspbian.raspberrypi.org/raspbian/dists/buster/InRelease don't have an Origin that equals Debian or Debian-security. So these repositories don't match the settings in Unattended-Upgrade::Origins-Pattern and are not selected for automatic upgrade source candidates. Their relevant block of information is respectively:

Origin: Raspberry Pi Foundation
Label: Raspberry Pi Foundation
Suite: testing
Codename: buster
Date: Fri, 14 May 2021 23:17:18 UTC
Architectures: armhf arm64 i386 amd64
Components: main ui untested

which is really strange: testing instead of stable , likewise stretch is marked as stable instead of oldstable. I guess it's a trick related to the fact that (according to this forum) archive.raspberrypi.org is intended to add newer software than available from Debian stable equivalent as provided in raspbian.rasberrypi.org, so buster's status is "upgraded" to testing there. It's only a supposition, and doesn't affect the answer.


Origin: Raspbian
Label: Raspbian
Suite: stable
Codename: buster
Date: Sat, 15 May 2021 04:52:10 UTC
Architectures: armhf
Components: main contrib non-free rpi firmware

You should edit your /etc/apt/apt.conf.d/50unattended-upgrades so that the entries match the values specific to the Raspberry repositories. This should work:

Unattended-Upgrade::Origins-Pattern {
        "origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation";

Check there aren't any other hidden around that should also be changed.

I removed the Debian repositories because it's really not recommended to have Debian repositories configured, especially not for automatic upgrade.

  • Thanks for the detailed answer and the time you took to research!
    – lipflip
    May 20, 2021 at 10:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.