do-one-update.sh

#!/usr/bin/bash -e

# Pick the first updatable package that isn't held, and list what was
# updated.


trap "rm /tmp/*.$$" EXIT
cp /var/log/dpkg.log /tmp/dpkg.log.$$
apt-mark showhold | awk -F: '{print $1}' |sort -u > /tmp/held.$$
apt list --upgradable 2>/dev/null | awk -F/ 'NR>1 {print $1}' | sort -u > \
    /tmp/upgradable.$$
package="$(comm -23 /tmp/upgradable.$$ /tmp/held.$$)"
if [ ! "$package" ]; then
    echo "There are no unheld packages to update." 1>&2
    exit 1
fi
apt-get install $package
echo
diff /tmp/dpkg.log.$$ /var/log/dpkg | grep ' upgrade '