2

All seems to be correctly set up on my Debian 11 but I don't know why the unattended upgrade doesn't work any more since my upgrade to Debian 11.

While I perform an apt update, I found packages that needs to be upgraded:

7 packages can be upgraded. Run 'apt list --upgradable' to see them.

Here is my sources.list :

# #deb cdrom:[Debian GNU/Linux 10.2.0 _Buster_ - Official amd64 DVD Binary-1 20191116-09:57]/ buster contrib main

#deb cdrom:[Debian GNU/Linux 10.2.0 _Buster_ - Official amd64 DVD Binary-1 20191116-09:57]/ buster contrib main

#deb http://security.debian.org/debian-security buster/updates main contrib
#deb-src http://security.debian.org/debian-security buster/updates main contrib
#deb http://ftp.de.debian.org/debian/ stable main

deb http://ftp.de.debian.org/debian/ stable main

deb http://deb.debian.org/debian bullseye main
deb-src http://deb.debian.org/debian bullseye main

deb http://deb.debian.org/debian-security/ bullseye-security main contrib
deb-src http://deb.debian.org/debian-security/ bullseye-security main contrib

deb http://deb.debian.org/debian bullseye-updates main
deb-src http://deb.debian.org/debian bullseye-updates main

deb http://deb.debian.org/debian bullseye-backports main
deb-src http://deb.debian.org/debian bullseye-backports main

# buster-updates, previously known as 'volatile'
# A network mirror was not selected during install.  The following entries
# are provided as examples, but you should amend them as appropriate
# for your mirror of choice.
#
# deb http://deb.debian.org/debian/ buster-updates main contrib
# deb-src http://deb.debian.org/debian/ buster-updates main contrib

Output of my unattended upgrades in debug mode:

sudo unattended-upgrades --debug --dry-run
Starting unattended upgrades script
Allowed origins are: origin=Debian,codename=bullseye-updates, origin=Debian,codename=bullseye-proposed-updates, origin=Debian,codename=bullseye,label=Debian, origin=Debian,codename=bullseye,label=Debian-Security
Initial blacklist:
Initial whitelist (not strict):
Marking not allowed <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.nodesource.com_node%5f16.x_dists_bullseye_main_binary-amd64_Packages'  a=,c=main,v=,o=Node Source,l=Node Source arch='amd64' site='deb.nodesource.com' IndexType='Debian Package Index' Size=1209 ID:14> with -32768 pin
Marking not allowed <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian_dists_bullseye-backports_main_i18n_Translation-en'  a=bullseye-backports,c=main,v=,o=Debian Backports,l=Debian Backports arch='' site='deb.debian.org' IndexType='Debian Translation Index' Size=377020 ID:13> with -32768 pin
Marking not allowed <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian_dists_bullseye-backports_main_binary-amd64_Packages'  a=bullseye-backports,c=main,v=,o=Debian Backports,l=Debian Backports arch='amd64' site='deb.debian.org' IndexType='Debian Package Index' Size=656568 ID:12> with -32768 pin
Marking not allowed <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en'  a=stable-security,c=main,v=11,o=Debian,l=Debian-Security arch='' site='deb.debian.org' IndexType='Debian Translation Index' Size=187892 ID:9> with -32768 pin
Marking not allowed <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages'  a=stable-security,c=main,v=11,o=Debian,l=Debian-Security arch='amd64' site='deb.debian.org' IndexType='Debian Package Index' Size=266792 ID:8> with -32768 pin
Applying pinning: PkgFilePin(id=14, priority=-32768)
Applying pin -32768 to package_file: <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.nodesource.com_node%5f16.x_dists_bullseye_main_binary-amd64_Packages'  a=,c=main,v=,o=Node Source,l=Node Source arch='amd64' site='deb.nodesource.com' IndexType='Debian Package Index' Size=1209 ID:14>
Applying pinning: PkgFilePin(id=13, priority=-32768)
Applying pin -32768 to package_file: <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian_dists_bullseye-backports_main_i18n_Translation-en'  a=bullseye-backports,c=main,v=,o=Debian Backports,l=Debian Backports arch='' site='deb.debian.org' IndexType='Debian Translation Index' Size=377020 ID:13>
Applying pinning: PkgFilePin(id=12, priority=-32768)
Applying pin -32768 to package_file: <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian_dists_bullseye-backports_main_binary-amd64_Packages'  a=bullseye-backports,c=main,v=,o=Debian Backports,l=Debian Backports arch='amd64' site='deb.debian.org' IndexType='Debian Package Index' Size=656568 ID:12>
Applying pinning: PkgFilePin(id=9, priority=-32768)
Applying pin -32768 to package_file: <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian-security_dists_bullseye-security_main_i18n_Translation-en'  a=stable-security,c=main,v=11,o=Debian,l=Debian-Security arch='' site='deb.debian.org' IndexType='Debian Translation Index' Size=187892 ID:9>
Applying pinning: PkgFilePin(id=8, priority=-32768)
Applying pin -32768 to package_file: <apt_pkg.PackageFile object: filename:'/var/lib/apt/lists/deb.debian.org_debian-security_dists_bullseye-security_main_binary-amd64_Packages'  a=stable-security,c=main,v=11,o=Debian,l=Debian-Security arch='amd64' site='deb.debian.org' IndexType='Debian Package Index' Size=266792 ID:8>
Using (^linux-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^kfreebsd-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^gnumach-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^.*-modules-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^.*-kernel-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^linux-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^kfreebsd-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^gnumach-.*-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^.*-modules-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$|^.*-kernel-[1-9][0-9]*\.[0-9]+\.[0-9]+-[0-9]+(-.+)?$) regexp to find kernel packages
Using (^linux-.*-5\.10\.0\-8\-amd64$|^linux-.*-5\.10\.0\-8$|^kfreebsd-.*-5\.10\.0\-8\-amd64$|^kfreebsd-.*-5\.10\.0\-8$|^gnumach-.*-5\.10\.0\-8\-amd64$|^gnumach-.*-5\.10\.0\-8$|^.*-modules-5\.10\.0\-8\-amd64$|^.*-modules-5\.10\.0\-8$|^.*-kernel-5\.10\.0\-8\-amd64$|^.*-kernel-5\.10\.0\-8$|^linux-.*-5\.10\.0\-8\-amd64$|^linux-.*-5\.10\.0\-8$|^kfreebsd-.*-5\.10\.0\-8\-amd64$|^kfreebsd-.*-5\.10\.0\-8$|^gnumach-.*-5\.10\.0\-8\-amd64$|^gnumach-.*-5\.10\.0\-8$|^.*-modules-5\.10\.0\-8\-amd64$|^.*-modules-5\.10\.0\-8$|^.*-kernel-5\.10\.0\-8\-amd64$|^.*-kernel-5\.10\.0\-8$) regexp to find running kernel packages
Checking: gir1.2-javascriptcoregtk-4.0 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: gir1.2-javascriptcoregtk-4.0=2.32.3-1
Checking: gir1.2-webkit2-4.0 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: gir1.2-webkit2-4.0=2.32.3-1
Checking: libjavascriptcoregtk-4.0-18 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: libjavascriptcoregtk-4.0-18=2.32.3-1
Checking: libwebkit2gtk-4.0-37 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: libwebkit2gtk-4.0-37=2.32.3-1
Checking: linux-image-5.10.0-8-amd64 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: linux-image-5.10.0-8-amd64=5.10.46-4
Checking: linux-image-amd64 ([<Origin component:'main' archive:'stable-security' origin:'Debian' label:'Debian-Security' site:'deb.debian.org' isTrusted:True>])
adjusting candidate version: linux-image-amd64=5.10.46-4
Checking: nodejs ([<Origin component:'main' archive:'' origin:'Node Source' label:'Node Source' site:'deb.nodesource.com' isTrusted:True>])
adjusting candidate version: nodejs=16.9.1-deb-1nodesource1
pkgs that look like they should be upgraded:
Fetched 0 B in 0s (0 B/s)
fetch.run() result: 0
Packages blacklist due to conffile prompts: []
No packages found that can be upgraded unattended and no pending auto-removals
The list of kept packages can't be calculated in dry-run mode.

My config file for unattended upgrades:

// Unattended-Upgrade::Origins-Pattern controls which packages are
// upgraded.
//
// Lines below have the format format is "keyword=value,...".  A
// package will be upgraded only if the values in its metadata match
// all the supplied keywords in a line.  (In other words, omitted
// keywords are wild cards.) The keywords originate from the Release
// file, but several aliases are accepted.  The accepted keywords are:
//   a,archive,suite (eg, "stable")
//   c,component     (eg, "main", "contrib", "non-free")
//   l,label         (eg, "Debian", "Debian-Security")
//   o,origin        (eg, "Debian", "Unofficial Multimedia Packages")
//   n,codename      (eg, "jessie", "jessie-updates")
//     site          (eg, "http.debian.net")
// The available values on the system are printed by the command
// "apt-cache policy", and can be debugged by running
// "unattended-upgrades -d" and looking at the log file.
//
// Within lines unattended-upgrades allows 2 macros whose values are
// derived from /etc/debian_version:
//   ${distro_id}            Installed origin.
//   ${distro_codename}      Installed codename (eg, "buster")
Unattended-Upgrade::Origins-Pattern {
        // Codename based matching:
        // This will follow the migration of a release through different
        // archives (e.g. from testing to stable and later oldstable).
        // Software will be the latest available for the named release,
        // but the Debian release itself will not be automatically upgraded.
        "origin=Debian,codename=${distro_codename}-updates";
        "origin=Debian,codename=${distro_codename}-proposed-updates";
        "origin=Debian,codename=${distro_codename},label=Debian";
        "origin=Debian,codename=${distro_codename},label=Debian-Security";

        // Archive or Suite based matching:
        // Note that this will silently match a different release after
        // migration to the specified archive (e.g. testing becomes the
        // new stable).
//     "o=Debian,a=stable";
//     "o=Debian,a=stable-updates";
//     "o=Debian,a=proposed-updates";
//     "o=Debian Backports,a=${distro_codename}-backports,l=Debian Backports";
};

// Python regular expressions, matching packages to exclude from upgrading
Unattended-Upgrade::Package-Blacklist {
    // The following matches all packages starting with linux-
//  "linux-";

    // Use $ to explicitely define the end of a package name. Without
    // the $, "libc6" would match all of them.
//  "libc6$";
//  "libc6-dev$";
//  "libc6-i686$";

    // Special characters need escaping
//  "libstdc\+\+6$";

    // The following matches packages like xen-system-amd64, xen-utils-4.1,
    // xenstore-utils and libxenstore3.0
//  "(lib)?xen(store)?";

    // For more information about Python regular expressions, see
    // https://docs.python.org/3/howto/regex.html
};

// This option allows you to control if on a unclean dpkg exit
// unattended-upgrades will automatically run 
//   dpkg --force-confold --configure -a
// The default is true, to ensure updates keep getting installed
//Unattended-Upgrade::AutoFixInterruptedDpkg "true";

// Split the upgrade into the smallest possible chunks so that
// they can be interrupted with SIGTERM. This makes the upgrade
// a bit slower but it has the benefit that shutdown while a upgrade
// is running is possible (with a small delay)
//Unattended-Upgrade::MinimalSteps "true";

// Install all updates when the machine is shutting down
// instead of doing it in the background while the machine is running.
// This will (obviously) make shutdown slower.
// Unattended-upgrades increases logind's InhibitDelayMaxSec to 30s.
// This allows more time for unattended-upgrades to shut down gracefully
// or even install a few packages in InstallOnShutdown mode, but is still a
// big step back from the 30 minutes allowed for InstallOnShutdown previously.
// Users enabling InstallOnShutdown mode are advised to increase
// InhibitDelayMaxSec even further, possibly to 30 minutes.
//Unattended-Upgrade::InstallOnShutdown "false";

// Send email to this address for problems or packages upgrades
// If empty or unset then no email is sent, make sure that you
// have a working mail setup on your system. A package that provides
// 'mailx' must be installed. E.g. "user@example.com"
Unattended-Upgrade::Mail "myemail@myemail.com";

// Set this value to "true" to get emails only on errors. Default
// is to always send a mail if Unattended-Upgrade::Mail is set
Unattended-Upgrade::MailOnlyOnError "false";

// Remove unused automatically installed kernel-related packages
// (kernel images, kernel headers and kernel version locked tools).
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

// Do automatic removal of newly unused dependencies after the upgrade
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";

// Do automatic removal of unused packages after the upgrade
// (equivalent to apt-get autoremove)
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Automatically reboot *WITHOUT CONFIRMATION* if
//  the file /var/run/reboot-required is found after the upgrade
Unattended-Upgrade::Automatic-Reboot "true";

// Automatically reboot even if there are users currently logged in
// when Unattended-Upgrade::Automatic-Reboot is set to true
Unattended-Upgrade::Automatic-Reboot-WithUsers "false";

// If automatic reboot is enabled and needed, reboot at the specific
// time instead of immediately
//  Default: "now"
Unattended-Upgrade::Automatic-Reboot-Time "02:00";

// Use apt bandwidth limit feature, this example limits the download
// speed to 70kb/sec
//Acquire::http::Dl-Limit "70";

// Enable logging to syslog. Default is False
// Unattended-Upgrade::SyslogEnable "false";

// Specify syslog facility. Default is daemon
// Unattended-Upgrade::SyslogFacility "daemon";

// Download and install upgrades only on AC power
// (i.e. skip or gracefully stop updates on battery)
// Unattended-Upgrade::OnlyOnACPower "true";

// Download and install upgrades only on non-metered connection
// (i.e. skip or gracefully stop updates on a metered connection)
// Unattended-Upgrade::Skip-Updates-On-Metered-Connections "true";

// Verbose logging
Unattended-Upgrade::Verbose "true";

// Print debugging information both in unattended-upgrades and
// in unattended-upgrade-shutdown
Unattended-Upgrade::Debug "true";

The 20auto-upgrades is as well correctly customized:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

The service works correctly from what I see:

    sudo systemctl status unattended-upgrades.service
    ●  unattended-upgrades.service - Unattended Upgrades Shutdown
     Loaded: loaded (/lib/systemd/system/unattended-upgrades.service; enabled; vendor preset: enabled)
     Active: active (running) since Mon 2021-10-04 13:12:12 CEST; 27s ago
       Docs: man:unattended-upgrade(8)
   Main PID: 561 (unattended-upgr)
      Tasks: 2 (limit: 19156)
     Memory: 20.8M
        CPU: 213ms
     CGroup: /system.slice/unattended-upgrades.service
             └─561 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal

Oct 04 13:12:12 WIPMagentoLocal systemd[1]: Started Unattended Upgrades Shutdown.

Could you please help me to make it work again? Thanks!

2 Answers 2

4

For security updates in Debian 11, you need to change the “Debian-Security” line in /etc/apt/apt.conf.d/50unattended-upgrades to

"origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

(note the addition of -security).

0
0

Debian won't upgrade packages from external (added) repos. Check: https://linux-audit.com/upgrading-external-packages-with-unattended-upgrade/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.