I read here how to enable silent automatic updates for Google Chrome. However, I have other repositories like spotify, docky and others for which I would like to enable silent updates.

I am trying to do this in my Ubuntu 10.04 system. But this question applies to all Ubuntu versions. I have the unattended-upgrades package installed.

How can I do this?

  • Do you want silent security updates. or ALL updates installed without intervention? Why?
    – david6
    Dec 14, 2011 at 23:11
  • 1
    Pretty much all updates including the user repositories as well.
    – nik90
    Dec 14, 2011 at 23:20

4 Answers 4


First, install gksu:

sudo apt-get install gksu

The easiest way of enabling unattended updates for your system is to edit the file 50unattended-upgrades inside /etc/apt/apt.conf.d/ with your favourite text editor, for example:

gksu gedit /etc/apt/apt.conf.d/50unattended-upgrades

In it you need to comment out the commented sections of the Allowed Origins block.


Unattended-Upgrade::Allowed-Origins {
        "${distro_id} ${distro_codename}-security";
//      "${distro_id} ${distro_codename}-updates";
//      "${distro_id} ${distro_codename}-proposed";
//      "${distro_id} ${distro_codename}-backports";


Unattended-Upgrade::Allowed-Origins {
        "${distro_id} ${distro_codename}-security";
        "${distro_id} ${distro_codename}-updates";
//      "${distro_id} ${distro_codename}-proposed";
//      "${distro_id} ${distro_codename}-backports";

For software that is not on the Ubuntu repos that you would like to update, you need to add an origin and archive to the file. To find what those are for your PPAs, open the folder /var/lib/apt/lists/, that is the storage area for state information for each package resource. What you are looking for is the files that end with Release in the name.

Open one with your text editor, e.g. for Google Chrome:

gedit /var/lib/apt/lists/dl.google.com_linux_chrome_deb_dists_stable_Release

Inside you will see something like the following:

Origin: Google, Inc.
Label: Google
Suite: stable
Codename: stable
Version: 1.0
Date: Thu, 17 Nov 2011 19:09:01 +0000
Architectures: i386 amd64
Components: main
Description: Google chrome-linux repository.

The origin is obvious (Origin: Google, Inc.) and the archive will be whatever is under the line Suite (Suite: stable).

If either Origin or Suite is missing, then they will be the empty string. But note that if both are missing, then probably it will not be possible to use that source with unattended upgrades without including other sources with the same issue.

After you noted those 2 lines, you need to edit the 50unattended-upgrades file and add the lines using this format "<origin>:<archive>"; of for this example's sake "Google\, Inc.:stable";.

Google Chrome's origin is kinda tricky, because it has a space, an end pointn and a comma in it, but most Release files will be easy to read.

As another example, Node JS source specifies an origin (Node Source) but not an archive; so you can match it with "Node Source:";.

Allowed Origins is matched using shell-style wildcards (more specifically, with Python's fnmatch()). If you're careful enough to not include conflicting sources, it's possible to write things like "Node *:*";.

Do not forget to make a backup of your 50unattended-upgrades file before editing it. Do that with:

sudo cp /etc/apt/apt.conf.d/50unattended-upgrades /etc/apt/apt.conf.d/50unattended-upgrades.bak

To test the changes done on the file, you can use sudo unattended-upgrades with the parameters --dry-run and --debug.

  • --dry-run will run an unattended upgrades cycle, except it will not really install the upgrades, only check and verify that everything is ok.

  • --debug will enable verbose mode.

You can always check the logs for unattended-upgrades at /var/log/unattended-upgrades/unattended-upgrades.log.

You can change the configuration of the unattended upgrades by editing the file /etc/apt/apt.conf.d/10periodic. Options for the configuration are in the /etc/cron.daily/apt script header. Read them to configure the frequency of the unattended upgrades.

  • 3
    Thanks...Very detailed! may i ask why you put a \ after Google?
    – nik90
    Dec 14, 2011 at 23:20
  • Because of the special characters in the origin, its an escape character for the comma. Most origins you find will not have that. Dec 14, 2011 at 23:25
  • 1
    @jos No, that is the way it works, --dry-run will check if on the updated lists there is any updates available and output them to you, the lists updates via whatever is your configuration in /etc/cron.daily/apt, running it manually does not update the lists I think. Aug 11, 2012 at 10:10
  • 1
    What should I put as the archive name when the corresponding Release file doesn't list a Suite?
    – hsivonen
    Dec 19, 2013 at 7:46
  • 2
    Please also check the automated approach here: askubuntu.com/a/792621/417607 Jun 29, 2016 at 14:40

Automated approach for @Bruno Pereira's answer: (Please consider starring the github repo if you find the answer useful.)

Code Link: https://github.com/abhigenie92/unattended_upgrades_repos

  • Check repositories to add:

    $ python automatic_upgrade.py 
    Add repos:
    Skipping files due to not present origin or suite. Or origin being a url.:
  • Now edit /etc/apt/apt.conf.d/50unattended-upgrades to include them:

    // Automatically upgrade packages from these (origin:archive) pairs
    Unattended-Upgrade::Allowed-Origins {
  • Check to see if they are included:

    $ sudo unattended-upgrade --dry-run --debug
    Initial blacklisted packages: 
    Initial whitelisted packages: 
    Starting unattended upgrades script
    Allowed origins are: ['o=Ubuntu,a=xenial-security', 'o=Ubuntu,a=xenial-updates', 'o=Ubuntu,a=xenial-proposed', 'o=Ubuntu,a=xenial-backports', 'o=Ubuntu,a=xenial', 'o=LP-PPA-kubuntu-ppa-backports,a=xenial', 'o=LP-PPA-tuxonice,a=xenial', 'o=LP-PPA-webupd8team-sublime-text-3,a=xenial']
    pkgs that look like they should be upgraded: 
    Fetched 0 B in 0s (0 B/s)                                                                                  
    fetch.run() result: 0
    blacklist: []
    whitelist: []
    No packages found that can be upgraded unattended and no pending auto-removals
  • @andy.holmes welcome, please consider starring the github repository if possible. Link- github.com/abhigenie92/unattended_upgrades_repos Nov 2, 2017 at 2:55
  • You may also wish to modify how dpkg treats packages that attempt to modify configuration files: unix.stackexchange.com/questions/138751/…
    – deoren
    Dec 18, 2017 at 15:25
  • This python script is excellent, however I had to modify what README.md suggested for 50unattended-upgrades for my Raspberry Pi running stretch. Specifying the allowed origin as, e.g., "Raspberry:stable"; didn't work. Instead I used, e.g., "o=Raspberry, a=stable";
    – cfogelberg
    Jun 9, 2019 at 17:27

Editing /etc/apt/apt.conf.d/50unattended-upgrades, add the following:

Unattended-Upgrade::Origins-Pattern {

This will allow unattended upgrades for all packages.

  • 1
    Yes, thanks for the clear and concise answer. But there are packages which have origin:'', for example datadog-agent from site:'apt.datadoghq.com'. In that case it would also be needed to add "origin="; to not skip packages with empty origin. But then it's better to just use "site=*"; instead of "origin=*";. May 9, 2018 at 7:35
  • I have added my own repository into a file in /etc/apt/sources.list.d/my_repo.list, but it don't upgrade the package. Manually it works with sudo apt update. Any clue how?
    – Sander
    Oct 23, 2018 at 13:47
  • Does this use the same sources as a manual update, i.e. does it ignore disabled sources? Oct 17, 2019 at 21:19

There are instructions for forcing a rerun to make cron start the automatic update at the following link. The procedure to stop cron is this

sudo service anacron stop
sudo service cron stop
sudo rm -rf /var/run/unattend* /var/run/cron* /var/run/anacron*
sudo rm -rf /var/lib/apt/periodic/*

and to restart cron to make the automatic update happen now (or at least within a few miutes) is

sudo service cron start
sudo anacron -fn

How it works

Several things will trigger it to run.

  • It is fired off from the running of /etc/cron.daily by cron, specifically /etc/cron.daily/apt. Cron runs /etc/cron.daily at 6.25 am (see /etc/crontab)

  • Anacron runs from upstart? and it will fire off /etc/cron.daily after 5 minutes of uptime (see /etc/anacrontab)

    Note APT::Periodic::RandomSleep can be set in /etc/apt/apt.conf.d/10periodic, but defaults to 1800s (30 mins) so no updates may happen till 30 mins after /etc/cron.daily/apt runs.


If it works things should get logged in this folder, /var/log/unattended-upgrades.

  • This was especially useful to me as my virtual hosting provider thought it would be a good idea to remove /etc/cron.daily/apt from the default Ubuntu 12.04 installation - so automatic APT updates were not taking place :-(. The ServerFault answer serverfault.com/a/568329/95570 provided details on getting that file re-created.
    – Alex Dupuy
    Sep 29, 2014 at 15:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .