I've created and published a mirror of the Ubuntu repositories for Xenial using aptly. This includes
xenial-updates downloaded from my country specific Ubuntu mirror. I've taken
http://security.ubuntu.com. I can use all
apt-get update and upgrade commands normally with this mirror to manually upgrade systems.
My issue is that
unattended-upgrades with security only updates configured will not register any packages as available to upgrade. Likewise after using
apt update, the motd message on login will say something like:
261 packages can be updated. 0 updates are security updates.
If I switch back to the default repositories and run the same command, motd changes to:
261 packages can be updated. 176 updates are security updates.
unattended-upgrade --dry-run -d has similar results, plenty of security updates if I use the default mirrors, but none from my local mirror.
Evidently I'm losing whatever marks the packages as security updates in my mirroring process.
How does apt determine that a package update is a security update once the package list has been updated? What do I have to do to accurately mirror this?