up vote 18 down vote favorite
5
share [g+] share [fb]

sudo apt-get upgrade installs all updates, not just security updates. I know that I can use Update Manager to select only important security updates, but is there a way to do this from the command line?

link|improve this question
80% accept rate
I assume you meant to refer to apt-get (dist-)upgrade? – andol Jul 28 '10 at 22:52
I don't think so. dist-upgrade takes the entire system to a new release. I'm talking about day-to-day updates, like the ones you see in Update Manager. – mac9416 Jul 28 '10 at 22:59
Oh, I see what you're saying now. Heh, I run apt-get update so often, I type it without thinking. Thanks for the heads-up! – mac9416 Jul 28 '10 at 23:02
You want "apt-get dist-upgrade", not "apt-get upgrade". "dist-upgrade" isn't for new releases (that's "do-release-upgrade" a separate command). Using "dist-upgrade" means it will handle changing dependencies of the new packages. This can be important. – Kees Cook Sep 21 '10 at 18:37
I don't think @KeesCook is correct. According to apt docs you want to use apt-get upgrade unless you are moving between distributions. Only under rare conditions should a dist-upgrade be necessary v. and upgrade when running a released (e.g. not currently beta/rc) ubuntu. – Jay _silly_evarlast_ Wren Apr 13 at 13:44
feedback

4 Answers

up vote 11 down vote accepted

There is a package unattended-upgrades, which provides functionality to install security updates automatically.

You could use this, but not configure the automatic part and call it manually instead, so the following should do it:

sudo unattended-upgrade

(assuming the package is installed by default, which is probably is)

See also /usr/share/doc/unattended-upgrades/README.

link|improve this answer
That seems to do the job. Thanks! – mac9416 Jul 30 '10 at 1:47
feedback
up vote 6 down vote

replace /etc/apt/preferences with the following:

Package: *
Pin: release a=lucid-security
Pin-Priority: 500

Package: *
Pin: release o=Ubuntu
Pin-Priority: 50

now a simple apt-get upgrade will upgrade all security updates only.

Why (and how) this works: The preferences file will pin all packages from ubuntu distribution to priority 50, which will make them less desirable than already installed packages. Files originating from security repository are given the default (500) priority so they are considered for installation. This means that only packages that are considered more desirable than currently installed ones are security updates. More information about pinning in the apt_preferences manpage.

You can temporarily promote a certain distribution for updates with the --target-release option that works with apt-get and aptitude (at least) which will allow you pin certain releases so that they are eligible for upgrade.

If you wish to use this for scripts only and not make it default for the system, you can place the rules in to some other location and use this instead:

 apt-get -o Dir::Etc::Preferences=/path/to/preferences_file upgrade

This will make apt look for the preferences file from a non-default location.

The preferences file given as an example doesn't apply to third party repositories, if you wish to pin those too you can use apt-cache policy to easily determine the required keys for pinning.

link|improve this answer
Thanks for taking time for a thorough answer. I think I understand how it works. But when I create the /etc/apt/preferences file and run apt-get upgrade, it wants to upgrade all packages, not just security updates. The list upgrade before and after are exactly the same, except with /etc/apt/preferences it doesn't want to upgrade Leafpad, which I built from source and installed "by hand" with dpkg. It's very strange to me, but may mean something to you. – mac9416 Jul 29 '10 at 13:14
You can see what is going on with apt-cache policy command. Pick one of the packages that isn't getting a security fix and run apt-cache policy packagename. This will list the priorities for various versions. You should see various lines and different priorities. If there are no lines with the priority 50, the pinning isn't affecting the packages in question for some reason. – Ressu Jul 29 '10 at 16:24
feedback
up vote 0 down vote

I can't find an option in either apt-get or aptitude, however someone had the same question on SuperUser. The only response is:

Check and adjust /etc/apt/apt.conf.d/50unattended-upgrade . Did you replace 'karmic' with the code name of your Ubuntu?

No reply as to whether that worked however.

link|improve this answer
It appears that the method described in that wiki page depends on setting aptitude's --target-release argument to <release>-security. Like the OP of that question, that method installs all upgrades, not just security upgrades. Reading the apt-get and aptitude man pages, I don't think the --target-release argument is even intended to limit upgrades to just security, though I'm not sure just what it is for. – mac9416 Jul 28 '10 at 23:38
feedback
up vote 0 down vote

Although its pretty ugly, you could disable all the repositories apart from the security repository and then do:

sudo apt-get update && sudo apt-get upgrade

I haven't tested it, but in theory it would only find updates in the security repo and apply them...

link|improve this answer
Yeah, that's a possibility. I'll look into it. I'm no good at BASH, but I may try to make a script to do it. – mac9416 Jul 29 '10 at 0:07
OK, I disabled all but the Ubuntu security repos and ran a sudo apt-get update && sudo apt-get upgrade (cancelling before any upgrades were done). Then I re-enabled all my repos, ran sudo apt-get updatee, and opened Update Manager. The packages marked as security updates were not exactly what apt-get upgrade found, but they were very close -- close enough for me. I still wish I knew exactly how Update Manager does it and how to do the same from the command-line, but this will do. Thanks! – mac9416 Jul 29 '10 at 0:39
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.