feauture: automatic apt updates via `unattended-upgrades` #22515

mchlwbr · 2025-10-16T13:18:40Z

This is currently based on cockpit version 337 as we (Team LinOTP) develop/run on bookworm-backports and resolves #15269.

I will happily rebase on a branch of your choice to get the feature to bookworm-backports.

#18595 seems to be stale and instead of parsing the config files on our own, we rely on apt-config dump doing the heavy lifting.

tomasmatus · 2025-10-22T07:49:19Z

Hey @mchlwbr ! Thanks for the PR, we'll have a look once you think it's ready and help you with tests if necessary.

Just a quick heads up - translations are done through Fedora Weblate and are periodically synced to here. Please don't directly edit translation files here.

mchlwbr · 2025-10-22T07:55:54Z

Thanks, will do!

Please don't directly edit translation files here.

I will drop the commit. I added it because of the documented translation process:

Translations can also be done using any other tool or platform and be submitted via pull requests that update the po/XX.po files.

tomasmatus · 2025-10-22T08:22:56Z

Ah, my bad then, sorry! Though it may get annoying to deal with rebases every week when we sync translations.

mchlwbr · 2025-10-22T12:12:33Z

The feature itself is ready for review.

I have rebased the PR on main and extended the tests in the WIP commit - albeit they are shot in the dark, as I don't get them to run locally. Is the test coverage enough? Do I need to extend testWithAvailableUpdates?

Though it may get annoying to deal with rebases every week when we sync translations.

I agree^^

jelly

Thank you very much for picking this up, this has been a long awaited feature from the community. Sorry for the long delay for an initial review.

jelly · 2025-11-06T09:34:40Z

pkg/packagekit/autoupdates.jsx

+            } else {
+                if (timerOutput.indexOf("InactiveSec=1d\n") >= 0)
+                    this.day = this.time = "";
+                else if (this.installed)


This should be unreachable, we return directly if it is not installed. (same issue is in the dnf5 implementation)

jelly · 2025-11-06T09:36:31Z

pkg/packagekit/autoupdates.jsx

+            }
+
+            // Get unattended-upgrades configuration
+            const aptConfigOutput = await cockpit.script('apt-config dump | grep "Unattended-Upgrade"', [], { superuser: "require", err: "message" });


For me, verify that this is always installed on Debian.

apt-config (part of apt) and grep should always be available as they both have required as priority and grep is marked as essential:

$ apt-cache show apt | grep -E "(Essential|Priority):" Priority: required

$ apt-cache show grep | grep -E "(Essential|Priority):" Essential: yes Priority: required

Yes, that's correct!

I'll leave it to you to resolve threads once you're satisfied, ok?

jelly · 2025-11-06T09:56:47Z

pkg/packagekit/autoupdates.jsx

+                script += '        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";\n';
+            } else {
+                // All updates (security + regular)
+                script += '        "origin=Debian,codename=${distro_codename},label=Debian";\n';


Is this correct? Reading the periodic updates wiki, it says the default is only security updates and that is:

Unattended-Upgrade::Origins-Pattern { // Codename based matching: // This will follow the migration of a release through different // archives (e.g. from testing to stable and later oldstable). // Software will be the latest available for the named release, // but the Debian release itself will not be automatically upgraded. // "origin=Debian,codename=${distro_codename}-updates"; // "origin=Debian,codename=${distro_codename}-proposed-updates"; "origin=Debian,codename=${distro_codename},label=Debian"; "origin=Debian,codename=${distro_codename},label=Debian-Security"; "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"; // "o=Debian Backports,n=${distro_codename}-backports,l=Debian Backports"; // Archive or Suite based matching: // Note that this will silently match a different release after // migration to the specified archive (e.g. testing becomes the // new stable). // "o=Debian,a=stable"; // "o=Debian,a=stable-updates"; // "o=Debian,a=proposed-updates"; // "o=Debian Backports,a=stable-backports,l=Debian Backports"; };

So I think if you want "all updates" you also have to enable:

"origin=Debian,codename=${distro_codename}-updates";

And we also have to handle if a user has enabled backports I suppose and enable those updates.

You are correct.

We propose to set it to "origin=*"; when the user selects all. This way, all defined apt sources get used.

For security it'll be set to the quoted default:

"origin=Debian,codename=${distro_codename},label=Debian"; "origin=Debian,codename=${distro_codename},label=Debian-Security"; "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

jelly · 2025-11-06T09:57:25Z

pkg/packagekit/autoupdates.jsx

+            // Determine upgrades type based on Origins-Pattern
+            const regularUpgrades = aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename},label=Debian"');
+            const securityUpgrades = aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename},label=Debian-Security"') ||
+                                   aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"');


These are very long lines and not to readable, I have some questions about the difference between all / security updates below. Hopefully we can simplify things after that is cleared up.

I've suggested to set origins=* for all updates below.

I will think about how the parsing of a given config can be refactored.

pkg/packagekit/autoupdates.jsx

jelly · 2025-11-06T10:02:18Z

pkg/packagekit/autoupdates.jsx

+                script += "systemctl enable --now apt-daily.timer; ";
+            } else {
+                script += "systemctl disable --now apt-daily-upgrade.timer; ";
+                script += "systemctl disable --now apt-daily.timer; ";


Two timers unfortunately but not both are overridden, when I configured them to update every Friday at 6:00.

Thu 2025-11-06 20:09:51 UTC 10h Fri 2025-10-31 13:36:59 UTC - apt-daily.timer apt-daily.service Fri 2025-11-07 06:13:11 UTC 20h Thu 2025-11-06 10:00:39 UTC 47s ago apt-daily-upgrade.timer apt-daily-upgrade.service

root@debian-trixie-127-0-0-2-2201:~# systemctl cat apt-daily-upgrade.timer # /usr/lib/systemd/system/apt-daily-upgrade.timer [Unit] Description=Daily apt upgrade and clean activities After=apt-daily.timer [Timer] OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m Persistent=true [Install] WantedBy=timers.target # /etc/systemd/system/apt-daily-upgrade.timer.d/time.conf [Timer] OnCalendar= OnCalendar=fri 06:00 root@debian-trixie-127-0-0-2-2201:~# systemctl cat apt-daily.timer # /usr/lib/systemd/system/apt-daily.timer [Unit] Description=Daily apt download activities [Timer] OnCalendar=*-*-* 6,18:00 RandomizedDelaySec=12h Persistent=true [Install] WantedBy=timers.target

Or is this expected? And does apt-daily just download updates so this wouldn't be an issue.

apt-daily perfoms apt update as far as I understood it: https://salsa.debian.org/apt-team/apt/-/blob/main/debian/apt-daily.service

For consistency, they should likely both be set to the defined value.

pkg/packagekit/autoupdates.jsx

mchlwbr

Thanks for your review and sorry about the delay - I was on vacation :)

I will implement your suggestions.

Can you give me the OK for setting "origin=*"; when the user selects all updates?

mchlwbr · 2025-11-17T14:12:49Z

pkg/packagekit/autoupdates.jsx

+                script += '        "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";\n';
+            } else {
+                // All updates (security + regular)
+                script += '        "origin=Debian,codename=${distro_codename},label=Debian";\n';


You are correct.

We propose to set it to "origin=*"; when the user selects all. This way, all defined apt sources get used.

For security it'll be set to the quoted default:

"origin=Debian,codename=${distro_codename},label=Debian"; "origin=Debian,codename=${distro_codename},label=Debian-Security"; "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";

mchlwbr · 2025-11-17T14:25:37Z

pkg/packagekit/autoupdates.jsx

+            }
+
+            // Get unattended-upgrades configuration
+            const aptConfigOutput = await cockpit.script('apt-config dump | grep "Unattended-Upgrade"', [], { superuser: "require", err: "message" });


apt-config (part of apt) and grep should always be available as they both have required as priority and grep is marked as essential:

$ apt-cache show apt | grep -E "(Essential|Priority):" Priority: required

$ apt-cache show grep | grep -E "(Essential|Priority):" Essential: yes Priority: required

mchlwbr · 2025-11-17T14:40:44Z

pkg/packagekit/autoupdates.jsx

+                script += "systemctl enable --now apt-daily.timer; ";
+            } else {
+                script += "systemctl disable --now apt-daily-upgrade.timer; ";
+                script += "systemctl disable --now apt-daily.timer; ";


apt-daily perfoms apt update as far as I understood it: https://salsa.debian.org/apt-team/apt/-/blob/main/debian/apt-daily.service

For consistency, they should likely both be set to the defined value.

pkg/packagekit/autoupdates.jsx

mchlwbr · 2025-11-17T14:47:22Z

pkg/packagekit/autoupdates.jsx

+            // Determine upgrades type based on Origins-Pattern
+            const regularUpgrades = aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename},label=Debian"');
+            const securityUpgrades = aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename},label=Debian-Security"') ||
+                                   aptConfigOutput.includes('Unattended-Upgrade::Origins-Pattern:: "origin=Debian,codename=${distro_codename}-security,label=Debian-Security"');


I've suggested to set origins=* for all updates below.

I will think about how the parsing of a given config can be refactored.

jelly

Thanks for the fixes!

test/verify/check-packagekit

cockpituous

There are more than 10 code coverage comments, see the full report here.

mchlwbr · 2025-11-26T08:02:31Z

Hi @jelly
Thanks to the tests, I just noticed that the current implementation does not support ubuntu.

I'll get onto that and also extend the tests.

jelly · 2025-11-26T08:49:09Z

test/verify/check-packagekit

@@ -1460,14 +1466,16 @@ class TestAutoUpdates(NoSubManCase):

    def setUp(self):
        super().setUp()
-        # not implemented for apt yet, only dnf
-        self.supported_backend = "dnf" in self.backend
+        self.supported_backend = "dnf" in self.backend or self.backend == "apt"


One missing converted test is testWithAvailableUpdates it now fails with NotImplementedError.

jelly · 2025-11-26T09:23:13Z

Hi @jelly Thanks to the tests, I just noticed that the current implementation does not support ubuntu.

I'll get onto that and also extend the tests.

Thanks! Feel free to ask for help

cockpituous

There are more than 10 code coverage comments, see the full report here.

cockpituous · 2025-11-26T10:10:27Z

pkg/packagekit/autoupdates.jsx

+        if (time !== null || day !== null) {
+            if (day === "" && time === "") {


These 2 added lines are not executed by any test. Details

cockpituous · 2025-11-26T10:10:27Z

pkg/packagekit/autoupdates.jsx

+        if (time !== null || day !== null) {
+            if (day === "" && time === "") {
+                // restore defaults
+                script += `rm -f ${configFile}; `;


This added line is not executed by any test. Details

cockpituous · 2025-11-26T10:10:27Z

pkg/packagekit/autoupdates.jsx

+                if (day == null) day = this.day;
+                if (time == null) time = this.time;


These 2 added lines are not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

-            }
-        }
+        // Configure timer
+        script += this.generateTimerConfigScript(timerConf, day, time);


This added line is not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

    }
 }

+class AptImpl extends ImplBase {


This added line is not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

+    originsPatterns = {
+        all: '"origin=*";',
+        stable: '"origin=Debian,codename=${distro_codename},label=Debian";',
+        security: '"origin=Debian,codename=${distro_codename}-security,label=Debian-Security";',
+        securityAlt: '"origin=Debian,codename=${distro_codename},label=Debian-Security";'


These 5 added lines are not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

+    async getConfig() {
+        this.packageName = "unattended-upgrades";


These 2 added lines are not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

+        try {
+            await cockpit.spawn(["dpkg", "-l", this.packageName], { err: "ignore" });
+            this.installed = true;
+        } catch (ex) {
+            this.installed = false;
+            debug("apt getConfig: not installed:", ex);
+            return;


These 7 added lines are not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

+            return;
+        }
+
+        try {


This added line is not executed by any test. Details

cockpituous · 2025-11-26T10:10:28Z

pkg/packagekit/autoupdates.jsx

+            const timerOutput = await cockpit.script(
+                "set -eu; " +


These 2 added lines are not executed by any test. Details

mchlwbr · 2025-12-04T11:04:13Z

Hi @jelly

I have added a WIP commit for ubuntu support based on unattended-upgrades config on ubuntu:

$ cat /etc/apt/apt.conf.d/50unattended-upgrades
// Automatically upgrade packages from these (origin:archive) pairs
//
// Note that in Ubuntu security updates may pull in new dependencies
// from non-security sources (e.g. chromium). By allowing the release
// pocket these get automatically pulled in.
Unattended-Upgrade::Allowed-Origins {
        "${distro_id}:${distro_codename}";
        "${distro_id}:${distro_codename}-security";
        // Extended Security Maintenance; doesn't necessarily exist for
        // every release and this system may not have it installed, but if
        // available, the policy for updates is such that unattended-upgrades
        // should also install from here by default.
        "${distro_id}ESMApps:${distro_codename}-apps-security";
        "${distro_id}ESM:${distro_codename}-infra-security";
//      "${distro_id}:${distro_codename}-updates";
//      "${distro_id}:${distro_codename}-proposed";
//      "${distro_id}:${distro_codename}-backports";
};

...

For security updates i have opted to require all patterns.

Could you please test it on ubuntu, @jelly ?
For me, a manual run of unattended-upgrade works with the configs set by cockpit.
But I currently have a weird network issue regarding the timer/service on my VM... The service and apt think the VM is offline, hence the service does not start due to ExecStartPre=-/usr/lib/apt/apt-helper wait-online. But even with that removed, it wont apply the upgrades :/
I will still try to get it to work on my VM, but it would be great if you can confirm that it's working on ubuntu.

Once that's sorted, I'll continue updating/fixing the test suite.

Edit 1: I got the timer to work as expected (I had to remove /var/lib/apt/periodic/upgrade-stamp manually though, otherwise the executed /usr/lib/apt/apt.systemd.daily install will skip the upgrades)

mchlwbr · 2025-12-04T14:41:50Z

I pushed the updated tests - could you please run the test-suite again, @jelly ? I dont find the test report with the failing tests anymore :/

FYI: I'll rebase and merge both WIP commits with the others once it's running.

mchlwbr force-pushed the feature/unattended-updates-LVA-156 branch from 83b983c to 5430d60 Compare October 22, 2025 05:10

mchlwbr force-pushed the feature/unattended-updates-LVA-156 branch from 5430d60 to 745c9be Compare October 22, 2025 07:57

mchlwbr changed the title ~~Draft: feauture: automatic apt updates via unattended-upgrades~~ feauture: automatic apt updates via unattended-upgrades Oct 22, 2025

mchlwbr force-pushed the feature/unattended-updates-LVA-156 branch 2 times, most recently from 8466912 to 3d3635e Compare October 22, 2025 12:01

jelly requested changes Nov 6, 2025

View reviewed changes

mchlwbr commented Nov 17, 2025

View reviewed changes

mchlwbr added 2 commits November 19, 2025 13:41

feature: automatic apt updates via unattended-upgrades

a14745c

refactor: extract timer configuration logic into shared method

bc97398

mchlwbr force-pushed the feature/unattended-updates-LVA-156 branch from 19a3e67 to 04682ea Compare November 19, 2025 12:51

test: tests for apt autoupdates

acb2e3f

mchlwbr force-pushed the feature/unattended-updates-LVA-156 branch from 04682ea to acb2e3f Compare November 24, 2025 10:02

jelly reviewed Nov 25, 2025

View reviewed changes

test/verify/check-packagekit Show resolved Hide resolved

cockpituous reviewed Nov 25, 2025

View reviewed changes

jelly reviewed Nov 26, 2025

View reviewed changes

cockpituous reviewed Nov 26, 2025

View reviewed changes

WIP: feature: ubuntu support

bb130fa

WIP: test: add testWithAvailableUpdates and ubuntu

8587557

		if (time !== null \|\| day !== null) {
		if (day === "" && time === "") {

		if (day == null) day = this.day;
		if (time == null) time = this.time;

		async getConfig() {
		this.packageName = "unattended-upgrades";

+                          return;
+                      }
+                      try {

feauture: automatic apt updates via unattended-upgrades #22515

Are you sure you want to change the base?

feauture: automatic apt updates via unattended-upgrades #22515

Uh oh!

Conversation

mchlwbr commented Oct 16, 2025

Uh oh!

tomasmatus commented Oct 22, 2025

Uh oh!

mchlwbr commented Oct 22, 2025

Uh oh!

tomasmatus commented Oct 22, 2025

Uh oh!

mchlwbr commented Oct 22, 2025

Uh oh!

jelly left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mchlwbr left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jelly left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cockpituous left a comment

Choose a reason for hiding this comment

Uh oh!

mchlwbr commented Nov 26, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jelly commented Nov 26, 2025

Uh oh!

cockpituous left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

feauture: automatic apt updates via `unattended-upgrades` #22515

feauture: automatic apt updates via `unattended-upgrades` #22515

mchlwbr commented Dec 4, 2025 •

edited

Loading