WARNING: these commands can be very disruptive. review each of the files in this gist and on the filesystem which they will replace before executing the commands below.
when you run apt update, this script will be executed automatically. for each vulnerable package in testing which has been fixed in unstable, it will create a priority 990 pin for the unstable package.
It is a good idea to install security updates from unstable since they take extra time to reach testing and the security team only releases updates to unstable. If you have unstable in your apt sources but pinned lower than testing, you can automatically add temporary pinning for packages with security issues fixed in unstable using the output of debsecan.
these scripts assume that you are running debian testing and have enabled the unstable repositories but pinned at a lower priority by default.
this can usually be achieved by running the command below. USE WITH CAUTION and check that the output of
apt update && apt full-upgrade --autoremove --purge looks reasonable before proceeding.
curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/configure-sources.sh | sh apt update && apt full-upgrade --autoremove --purge
the command below will change your sources.list to debian testing, enable the unstable repositories pinned at a lower priority and configure debsecan to run with each
execute the following commands as root to install/enable:
curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/enable-unstable-updates.sh | sh apt update && apt full-upgrade --autoremove --purge
you can view the list of packages which will be installed from unstable in
i recommend always running chromium and firefox from unstable.
this can be achieved with the following command:
curl -o /etc/apt/preferences.d/unstable-packages https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/unstable-packages apt update && apt install -y chromium firefox
note: uninstalling will not downgrade packages to their testing versions. you will need to do this yourself or wait for the packages to catch up on their own (which should typically happen within a few weeks).
curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/disable-unstable-updates.sh | sh
@martin-braun -- this is needed because there is still a delay (sometimes as long as weeks) between fixes entering testing-security from the unstable repo.