debian testing with automatic security updates from unstable

README.md

THIS GIST HAS MOVED TO https://github.com/khimaros/debian-hybrid

PLEASE READ THE UPDATED INSTRUCTIONS CAREFULLY.

@khimaros

Thank you for the instructions and scripts here. There were extremely enlightening.

However I believe there is one small error in the instructions in README.md.

I believe the following line:

ln -sf /var/lib/debsecan/apt_priorities /etc/apt/preferences.d/unstable-security-packages

should actually read:

ln -sf /var/lib/debsecan/apt_preferences /etc/apt/preferences.d/unstable-security-packages

Otherwise the symbolic link points to a non-existent file. apt outputs the following error:

N: Ignoring `unstable-security-packages` in directory '/etc/apt/preferences.d/ as it is not a regular file

and the packages pinned by debsecan do not get upgraded.

I have tested using ln -sf /var/lib/debsecan/apt_preferences /etc/apt/preferences.d/unstable-security-packages instead and everything seems to work.

Thanks again for the instructions :)

@jmzumg thank you, updated!

I think that for bookworm+ that you need to add non-free-firmware to the sources.list file.

https://wiki.debian.org/Firmware

Thanks for maintaining this!

A suggestion
I would change the content of /etc/apt/apt/conf.d./99debscan to

APT::Update::Post-Invoke { "/usr/sbin/debsecan-apt-priority"; };

just to make sure we have the latest Info before doing any pinning'.

I ran into the issue that it did pin some package which wasn't available anymore because the system wasn't running for a few days and so a second apt-get update was needed to "fix" that 🙈

@crpb thanks for the suggestion, done!

The link to enable-unstable-updates.sh used in the installation section points to a version of 99debsecan that still says Pre-Invoke rather than Post-Invoke.

The link to enable-unstable-updates.sh used in the installation section points to a version of 99debsecan that still says Pre-Invoke rather than Post-Invoke.

Still true today...
sed -i 's/Pre-/Post-/' /etc/apt/apt.conf.d/99debsecan

Thank you khimaros!

Thanks for this! Very useful.

very useful indeed. more people should know about this. best of the both worlds: relatively fresh packages yet quite stable.

Hej @khimaros,

thanks a lot for your work! I just "installed" and so far it works fine. 👍

I myself use debian without root user, so always sudo it is. Therefore a had a lot of line by line copying, which is fine, but maybe it is worth thinking to have the sudo way instead of the root way.

Again: Thanks for your work! <3
Simon

@quiteBold

so always sudo it is

why not just use sudo -i and be root for the moment?

maintaining the hashes for all of these files has become onerous.

i've moved development to https://github.com/khimaros/debian-hybrid

please see the updated instructions there for how to use.