application-cookbook-attributes.rb

override['unattended-upgrades']['allowed_origins']['add-this-one'] = true

application2-cookbook-attributes.rb

override['unattended-upgrades']['allowed_origins']['security'] = false # Turn off the default value

library-cookbook-attributes.rb

default['unattended-upgrades']['allowed_origins'] = {
  'security'  => true,
  'updates'   => false,
  'proposed'  => false,
  'backports' => false
}

Example of the pattern of using a hash, instead of an array to specify a list of values. The cookbook implementation needs to check the truthy value each item in the hash points to, and either remove or ignore the falsy values. e.g. https://github.com/jeremyolliver/cookbook-unattended-upgrades/blob/master/attributes/default.rb#L11-L16

This makes deep merging and attribute precedence easier to deal with because changing the defaults can now point to only the value they wish to addd or subtract, without having to specify the entire list (which may have already been overridden).

The alternate solution of using the array ['security', 'updates', 'proposed', 'backports'] is harder to change, because depending on the precedence level where you try to change the defaults, either the array might be replaced (meaning you would need to know the entire value, making your changes not composable), or the two arrays might be merged together, which only works for adding in new values, subtracting is a nightmare.

lol fuck this

I typically would alter the defaults as shown above with an override statement either in an attribute or recipe file of an 'application' cookbook.The same should also work, altering the defaults via a role or environment too.

this is why we can't have nice things