claudiomaradonna/castrum
1
0
Fork 0
Code Pull requests Activity

unattended-upgrades: install the package, then check it actually does anything #2

Merged
claudiomaradonna merged 1 commit from unattended-upgrades-blacklist into main 2026-08-28 18:29:09 +02:00
Conversation 0 Commits 1 Files changed 4 +101
claudiomaradonna commented 2026-08-28 18:28:52 +02:00
Owner
Copy link

The role installed unattended-upgrades and stopped. Whether unattended
upgrades then happened was left to the distribution: on Debian the periodic
runs depend on APT::Periodic, which the package does not necessarily set. So a
host in autopatched carried a claim nobody had verified - the same shape as
fail2ban-basic starting a service and never noticing it exited a second
later.

It now writes /etc/apt/apt.conf.d/52-castrum-unattended-upgrades, and then
reads apt-config dump back and asserts APT parsed it. An apt.conf file with a
syntax error is ignored silently, which is precisely the failure the file
exists to prevent, so writing it is not evidence that it works.

unattended_upgrades_package_blacklist is what prompted this. A host whose
storage is a DKMS module cannot take unattended kernel upgrades: the ODROID
vendor kernels keep one release string across every point release, so
/lib/modules// is reused, DKMS reports "installed", skips the rebuild,
and leaves a module compiled against a kernel that no longer exists. Where root
is a normal filesystem that does not stop the boot - the host returns looking
healthy with its pool unimported and its data absent. Measured: a zfs.ko dated
September 2025 sitting under a kernel built in July 2026, with matching
vermagic, which DKMS reported as installed.

The regex in the verification is single-backslash on purpose. In a YAML folded
scalar \\s reaches the regex as a literal backslash and matches nothing;
\s is what works. Proven both ways against known-good and known-bad
apt-config output before this landed.

Claude-Session: https://claude.ai/code/session_01W5FkkabPcwgqKTQv4LD7DP

The role installed `unattended-upgrades` and stopped. Whether unattended upgrades then happened was left to the distribution: on Debian the periodic runs depend on APT::Periodic, which the package does not necessarily set. So a host in `autopatched` carried a claim nobody had verified - the same shape as `fail2ban-basic` starting a service and never noticing it exited a second later. It now writes /etc/apt/apt.conf.d/52-castrum-unattended-upgrades, and then reads `apt-config dump` back and asserts APT parsed it. An apt.conf file with a syntax error is ignored silently, which is precisely the failure the file exists to prevent, so writing it is not evidence that it works. `unattended_upgrades_package_blacklist` is what prompted this. A host whose storage is a DKMS module cannot take unattended kernel upgrades: the ODROID vendor kernels keep one release string across every point release, so /lib/modules/<release>/ is reused, DKMS reports "installed", skips the rebuild, and leaves a module compiled against a kernel that no longer exists. Where root is a normal filesystem that does not stop the boot - the host returns looking healthy with its pool unimported and its data absent. Measured: a zfs.ko dated September 2025 sitting under a kernel built in July 2026, with matching vermagic, which DKMS reported as installed. The regex in the verification is single-backslash on purpose. In a YAML folded scalar `\\s` reaches the regex as a literal backslash and matches nothing; `\s` is what works. Proven both ways against known-good and known-bad apt-config output before this landed. Claude-Session: https://claude.ai/code/session_01W5FkkabPcwgqKTQv4LD7DP
The role installed `unattended-upgrades` and stopped. Whether unattended
upgrades then happened was left to the distribution: on Debian the periodic
runs depend on APT::Periodic, which the package does not necessarily set. So a
host in `autopatched` carried a claim nobody had verified - the same shape as
`fail2ban-basic` starting a service and never noticing it exited a second
later.

It now writes /etc/apt/apt.conf.d/52-castrum-unattended-upgrades, and then
reads `apt-config dump` back and asserts APT parsed it. An apt.conf file with a
syntax error is ignored silently, which is precisely the failure the file
exists to prevent, so writing it is not evidence that it works.

`unattended_upgrades_package_blacklist` is what prompted this. A host whose
storage is a DKMS module cannot take unattended kernel upgrades: the ODROID
vendor kernels keep one release string across every point release, so
/lib/modules/<release>/ is reused, DKMS reports "installed", skips the rebuild,
and leaves a module compiled against a kernel that no longer exists. Where root
is a normal filesystem that does not stop the boot - the host returns looking
healthy with its pool unimported and its data absent. Measured: a zfs.ko dated
September 2025 sitting under a kernel built in July 2026, with matching
vermagic, which DKMS reported as installed.

The regex in the verification is single-backslash on purpose. In a YAML folded
scalar `\\s` reaches the regex as a literal backslash and matches nothing;
`\s` is what works. Proven both ways against known-good and known-bad
apt-config output before this landed.

Claude-Session: https://claude.ai/code/session_01W5FkkabPcwgqKTQv4LD7DP
claudiomaradonna deleted branch unattended-upgrades-blacklist 2026-08-28 18:29:11 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
claudiomaradonna/castrum!2
No description provided.