1

I'm using a shell script to keep one of my servers updated with the latest packages, The script is ran every 3 hours by cron job and then emails the result to me.
Here's the script:

#!/bin/sh
export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
DATE=`date +%F_%H:%M`
DOY=`date +%j`
FILENAME=$DATE"_Upgrade_results.log"
FILENAME=${FILENAME// /_}
FILEPATH="/Custom/logs/upgrade/$FILENAME"
apt-key update
apt-get update 
apt-get dist-upgrade -y  >"$FILEPATH"
#Mailing section removed to prevent exposing api keys. (I'm using mailgun)

Sometimes I get this in my email:

Reading package lists...
Building dependency tree...
Reading state information...
The following package was automatically installed and is no longer required:
  python-support
Use 'apt-get autoremove' to remove it.
The following packages will be REMOVED:
  mysql-client-5.5 mysql-server-5.5 mysql-server-core-5.5 The following NEW packages will be installed:
  libseccomp2 mysql-client-5.6 mysql-client-core-5.6 mysql-server-5.6
  mysql-server-core-5.6 python-funcsigs python-pbr The following packages have been kept back:
  rsyslog
The following packages will be upgraded:
  e2fslibs e2fsprogs ifupdown libsystemd0 libudev1 manpages mysql-common
  mysql-server python-mock python-ndg-httpsclient python-requests python-six
  python-urllib3 systemd systemd-sysv udev
16 upgraded, 7 newly installed, 3 to remove and 1 not upgraded.
Need to get 26.9 MB/27.1 MB of archives.
After this operation, 59.2 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
  e2fslibs e2fsprogs mysql-server mysql-client-core-5.6 mysql-common
  mysql-client-5.6 mysql-server-core-5.6 mysql-server-5.6 libseccomp2
  libsystemd0 libudev1 udev systemd ifupdown systemd-sysv manpages
  python-funcsigs python-ndg-httpsclient python-six python-pbr python-urllib3
  python-requests python-mock

Next time the script runs, the output is clean:

Reading package lists...
Building dependency tree...
Reading state information...
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

The problem is that I get this part again and again and again on different days:

The following packages will be upgraded:
  e2fslibs e2fsprogs ifupdown libsystemd0 libudev1 manpages mysql-common
  mysql-server python-mock python-ndg-httpsclient python-requests python-six
  python-urllib3 systemd systemd-sysv udev
16 upgraded, 7 newly installed, 3 to remove and 1 not upgraded.
Need to get 26.9 MB/27.1 MB of archives.
After this operation, 59.2 MB of additional disk space will be used.
WARNING: The following packages cannot be authenticated!
  e2fslibs e2fsprogs mysql-server mysql-client-core-5.6 mysql-common
  mysql-client-5.6 mysql-server-core-5.6 mysql-server-5.6 libseccomp2
  libsystemd0 libudev1 udev systemd ifupdown systemd-sysv manpages
  python-funcsigs python-ndg-httpsclient python-six python-pbr python-urllib3
  python-requests python-mock

It looks like these packages did not get upgraded, BUT when I run apt-get update && apt-get dist-upgrade manually through the console, I get 0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded. .
I would be thankful if any one could explain why this is happening?
P.S: My question is different from this one

1

You were using apt-get's -y option there. In apt-get manual page, this has been written about -y option

-y, --yes, --assume-yes
           Automatic yes to prompts; assume "yes" as answer to all prompts and run non-interactively. If an undesirable situation, such as changing
           a held package, trying to install a unauthenticated package or removing an essential package occurs then apt-get will abort.
           Configuration Item: APT::Get::Assume-Yes.

From your output, it's clear that some packages are unauthenticated and thus apt-get aborting the operation. Since it's aborting, you're getting the same output again and again.

To force apt-get to install unauthenticated package silently, you need to use --allow-unauthenticated option with existing -y option. From manual page, it is

--allow-unauthenticated
       Ignore if packages can't be authenticated and don't prompt about it. This can be useful while working with local repositories, but is a
       huge security risk if data authenticity isn't ensured in another way by the user itself. The usage of the Trusted option for
       sources.list(5) entries should usually be preferred over this global override. Configuration Item: APT::Get::AllowUnauthenticated.
  • WOW! You were quick to notice that! Thanks for your answer. But why are those packages unauthenticated? I'm doing an apt-key update before attempting to do an upgrade, and I'm using official repos for these packages plus some nginx repos for debian. – Sam Oct 11 '16 at 7:44
  • I'm not sure. Check if you have all of those repos' keys are in your apt-key db. Also check if apt-get update worked successfully. – Anwar Oct 11 '16 at 7:46
  • @Sam Let me know if this answer works – Anwar Oct 11 '16 at 13:07
  • I had a repo entry for debian backports, after deleting it from sources.lst, the script is working all OK with no error. I waited a few days to get some package updates, it seems all OK now. – Sam Oct 21 '16 at 20:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.