debian testing with automatic security updates from unstable

00default-release

APT::Default-Release "testing";

99debsecan

APT::Update::Post-Invoke { "/usr/sbin/debsecan-apt-priority"; };

README.md

overview

WARNING: these commands can be very disruptive. review each of the files in this gist and on the filesystem which they will replace before executing the commands below.

when you run apt update, this script will be executed automatically. for each vulnerable package in testing which has been fixed in unstable, it will create a priority 990 pin for the unstable package.

background

from https://wiki.debian.org/DebianTesting:

It is a good idea to install security updates from unstable since they take extra time to reach testing and the security team only releases updates to unstable. If you have unstable in your apt sources but pinned lower than testing, you can automatically add temporary pinning for packages with security issues fixed in unstable using the output of debsecan.

prerequisites

these scripts assume that you are running debian testing and have enabled the unstable repositories but pinned at a lower priority by default.

this can usually be achieved by running the command below. USE WITH CAUTION and check that the output of apt update && apt full-upgrade --autoremove --purge looks reasonable before proceeding.

curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/configure-sources.sh | sh

apt update && apt full-upgrade --autoremove --purge

installation

the command below will change your sources.list to debian testing, enable the unstable repositories pinned at a lower priority and configure debsecan to run with each apt update.

execute the following commands as root to install/enable:

curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/enable-unstable-updates.sh | sh

apt update && apt full-upgrade --autoremove --purge

you can view the list of packages which will be installed from unstable in /var/lib/debsecan/apt_preferences

special cases

i recommend always running chromium and firefox from unstable.

this can be achieved with the following command:

curl -o /etc/apt/preferences.d/unstable-packages https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/unstable-packages

apt update && apt install -y chromium firefox

uninstallation

note: uninstalling will not downgrade packages to their testing versions. you will need to do this yourself or wait for the packages to catch up on their own (which should typically happen within a few weeks).

curl https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/0ddac34c0b7904113af9b1a3d81eae6c5fcd0c32/disable-unstable-updates.sh | sh

configure-sources.sh

#!/bin/sh

set -ex

curl -o /etc/apt/apt.conf.d/00default-release https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/a5ac6edf206c440b489fd14e9bc0d61c0c146716/00default-release
curl -o /etc/apt/preferences.d/default-priority https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/a5ac6edf206c440b489fd14e9bc0d61c0c146716/default-priority
curl -o /etc/apt/sources.list https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/a5ac6edf206c440b489fd14e9bc0d61c0c146716/sources.list

debsecan-apt-priority

#!/bin/sh

# this program will add APT pinning for packages that are fixed in
# unstable and not testing
#
# see https://bugs.debian.org/725934

set -e

echo "running debsecan check for issues fixed in unstable..." >&2

rm -f /var/lib/debsecan/apt_preferences.disabled
cat > /var/lib/debsecan/apt_preferences.disabled <<EOF
# pin packages with security issues fixed in unstable
# generated automatically on $(date) by $0

EOF

for pkg in $(debsecan --suite=sid --only-fixed | cut -d\  -f2 | sort -u) ; do
    suite=unstable
    case "$pkg" in
        *-dbgsym)
            suite=unstable-debug
            ;;
    esac
    echo "adding pin to suite $suite for package $pkg" >&2
    cat <<EOF >> /var/lib/debsecan/apt_preferences.disabled
Package: $pkg
Pin: release a=$suite
Pin-Priority: 990

EOF
done
chmod 644 /var/lib/debsecan/apt_preferences.disabled
mv --force /var/lib/debsecan/apt_preferences.disabled /var/lib/debsecan/apt_preferences

default-priority

Package: *
Pin: release a=unstable
Pin-Priority: 50

disable-unstable-updates.sh

#!/bin/bash

set -ex

rm -f /etc/apt/preferences.d/unstable-security-packages
rm -f /etc/apt/apt.conf.d/99debsecan

apt update

enable-unstable-updates.sh

#!/bin/bash

set -ex

apt install -y debsecan

curl -o /usr/sbin/debsecan-apt-priority https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/a5ac6edf206c440b489fd14e9bc0d61c0c146716/debsecan-apt-priority
curl -o /etc/apt/apt.conf.d/99debsecan https://gist.githubusercontent.com/khimaros/21db936fa7885360f7bfe7f116b78daf/raw/a5ac6edf206c440b489fd14e9bc0d61c0c146716/99debsecan
chmod 755 /usr/sbin/debsecan-apt-priority
ln -sf /var/lib/debsecan/apt_preferences /etc/apt/preferences.d/unstable-security-packages

sources.list

deb http://deb.debian.org/debian/ testing main non-free contrib
deb-src http://deb.debian.org/debian/ testing main non-free contrib

deb http://security.debian.org/debian-security testing-security main contrib non-free
deb-src http://security.debian.org/debian-security testing-security main contrib non-free

deb http://deb.debian.org/debian/ unstable main non-free contrib
deb-src http://deb.debian.org/debian/ unstable main non-free contrib

unstable-packages

Package: chromium chromium-sandbox chromium-common
Pin: release a=unstable
Pin-Priority: 990

Package: firefox libnss3 libnss3:i386 libnss3-dev
Pin: release a=unstable
Pin-Priority: 990

@martin-braun -- this is needed because there is still a delay (sometimes as long as weeks) between fixes entering testing-security from the unstable repo.

@khimaros Thanks for the quick response, I already removed my comment, because I realized this by myself. However one more thing: https://gist.github.com/khimaros/21db936fa7885360f7bfe7f116b78daf#file-debsecan-apt-priority-L27

This looks wrong to me, shouldn't the first EOF stay behind like at https://gist.github.com/khimaros/21db936fa7885360f7bfe7f116b78daf#file-debsecan-apt-priority-L13 ?

In any case, I will try this on a clean Debian in combination with additional Sparky repositories, will see how it goes. Thanks for your work.

@martin-braun -- either syntax works. actually, i should mention that this file actually came from another repository https://gitlab.com/anarcat/puppet/-/raw/b6bc3e3dc982abcc4100143abb6594404b1241ac/site-modules/profile/files/debsecan-apt-priority which was originally started collaboratively on this bug: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=725934

@khimaros Great, thanks a lot! :) I'm using your solution and I hope it will work out in the long run. Thanks sharing!

@khimaros

Thank you for the instructions and scripts here. There were extremely enlightening.

However I believe there is one small error in the instructions in README.md.

I believe the following line:

ln -sf /var/lib/debsecan/apt_priorities /etc/apt/preferences.d/unstable-security-packages

should actually read:

ln -sf /var/lib/debsecan/apt_preferences /etc/apt/preferences.d/unstable-security-packages

Otherwise the symbolic link points to a non-existent file. apt outputs the following error:

N: Ignoring `unstable-security-packages` in directory '/etc/apt/preferences.d/ as it is not a regular file

and the packages pinned by debsecan do not get upgraded.

I have tested using ln -sf /var/lib/debsecan/apt_preferences /etc/apt/preferences.d/unstable-security-packages instead and everything seems to work.

Thanks again for the instructions :)

@jmzumg thank you, updated!

I think that for bookworm+ that you need to add non-free-firmware to the sources.list file.

https://wiki.debian.org/Firmware

Thanks for maintaining this!

A suggestion
I would change the content of /etc/apt/apt/conf.d./99debscan to

APT::Update::Post-Invoke { "/usr/sbin/debsecan-apt-priority"; };

just to make sure we have the latest Info before doing any pinning'.

I ran into the issue that it did pin some package which wasn't available anymore because the system wasn't running for a few days and so a second apt-get update was needed to "fix" that 🙈

@crpb thanks for the suggestion, done!

The link to enable-unstable-updates.sh used in the installation section points to a version of 99debsecan that still says Pre-Invoke rather than Post-Invoke.

The link to enable-unstable-updates.sh used in the installation section points to a version of 99debsecan that still says Pre-Invoke rather than Post-Invoke.

Still true today...
sed -i 's/Pre-/Post-/' /etc/apt/apt.conf.d/99debsecan

Thank you khimaros!