What does it mean when unattended-upgrades reports [package on hold]?

Question

I'm running a raspberry pi (Raspbian 10 -- buster) with unattended-upgrades installed and configured. Today I got a mail report with the following content:

Unattended upgrade result: All upgrades installed

Packages with upgradable origin but kept back:
 linux-libc-dev

Goal: To configure unattended-upgrades so that it does not send me notifcations (daily) because of held back packages. It could either install them by itself or refrain from sending a mail-report. Setting Unattended-Upgrade::MailOnlyOnError to true is not an option for me because I want to be notified about successful upgrades.

My config is as follows:

/etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Origins-Pattern {
        "origin=Debian,codename=${distro_codename},label=Debian";
        "origin=Debian,codename=${distro_codename},label=Debian-Security";
};

Unattended-Upgrade::Package-Blacklist {

};


Unattended-Upgrade::Mail "MYMAILADDRESS";
Unattended-Upgrade::Sender "SENDERADDRESS";

Unattended-Upgrade::Remove-Unused-Dependencies "true";

Unattended-Upgrade::Automatic-Reboot "true";

Edit: Output of apt-cache policy linux-libc-dev

linux-libc-dev:
  Installed: 4.18.20-2+rpi1
  Candidate: 1:1.20210430-2
  Version table:
     1:1.20210430-2 500
        500 http://archive.raspberrypi.org/debian buster/main armhf Packages
     5.10.28-1+rpi1 -1
         -1 http://raspbian.raspberrypi.org/raspbian bullseye/main armhf Packages
 *** 4.18.20-2+rpi1 500
        500 http://raspbian.raspberrypi.org/raspbian buster/main armhf Packages
        100 /var/lib/dpkg/status

Output of apt-get -d install linux-libc-dev

Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following packages will be upgraded:
  linux-libc-dev
1 upgraded, 0 newly installed, 0 to remove and 23 not upgraded.
Need to get 1.011 kB of archives.
After this operation, 54,3 kB disk space will be freed.
Get:1 http://archive.raspberrypi.org/debian buster/main armhf linux-libc-dev armhf 1:1.20210430-2 [1.011 kB]
Fetched 1.011 kB in 0s (3.006 kB/s)      
Download complete and in download only mode

So far I only found articles explaining how you can prevent packages from being updated by putting them into the Package-Blacklist field. That, however, is empty in my config. So why is the package linux-libc-dev held back from being upgraded? Is there another configuration that I'm not aware of and which might cause this? Does it relate to the Origins-Pattern that I've configured?

Thanks for any advice in advance!

Answer 1

I guess the automatic upgrade doesn't work properly because the Release files http://archive.raspberrypi.org/debian/dists/buster/InRelease and http://raspbian.raspberrypi.org/raspbian/dists/buster/InRelease don't have an Origin that equals Debian or Debian-security. So these repositories don't match the settings in Unattended-Upgrade::Origins-Pattern and are not selected for automatic upgrade source candidates. Their relevant block of information is respectively:

Origin: Raspberry Pi Foundation
Label: Raspberry Pi Foundation
Suite: testing
Codename: buster
Date: Fri, 14 May 2021 23:17:18 UTC
Architectures: armhf arm64 i386 amd64
Components: main ui untested

which is really strange: testing instead of stable , likewise stretch is marked as stable instead of oldstable. I guess it's a trick related to the fact that (according to this forum) archive.raspberrypi.org is intended to add newer software than available from Debian stable equivalent as provided in raspbian.rasberrypi.org, so buster's status is "upgraded" to testing there. It's only a supposition, and doesn't affect the answer.

and:

Origin: Raspbian
Label: Raspbian
Suite: stable
Codename: buster
Date: Sat, 15 May 2021 04:52:10 UTC
Architectures: armhf
Components: main contrib non-free rpi firmware

You should edit your /etc/apt/apt.conf.d/50unattended-upgrades so that the entries match the values specific to the Raspberry repositories. This should work:

Unattended-Upgrade::Origins-Pattern {
        "origin=Raspbian,codename=${distro_codename},label=Raspbian";
        "origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation";
};

Check there aren't any other hidden around that should also be changed.

I removed the Debian repositories because it's really not recommended to have Debian repositories configured, especially not for automatic upgrade.