Apt-upgrade

The apt-upgrade script is a custom tool that can be used to know which suite/channel/repo have pending package upgrades and also to perform the actual upgrade.

This script was developed as part of our workflow for package upgrades.

Usage options are:

% apt-upgrade [-un] [-f exclude_file] [-x regex] upgrade <suite> [-yh]
% apt-upgrade [-un] [-f exclude_file] [-x regex] report [<suite>] [-h]
% apt-upgrade [-un] [-f exclude_file] [-x regex] list [-h]

The -u switch is to control whether or not to update the apt cache. The -n switch control whether the node name should be printed in each line.

The -f/--exclude-file switch allows to load a file with a regex per file for package exclusion. This can be combined with -x/--exclude, which allows to specify exclusion regex as arguments (can be specified multiple times).

upgrade: upgrade all pending upgradeable packages from a given suite. Use the -y to avoid a confirmation prompt.
report: report all upgradeable packages in the system. Optionally, only from a given archive.
list: report all archives from which there are pending upgradeable packages.

Root permission is always required to run it. Please note that DEBIAN_FRONTEND=nonintereactive is used internally to avoid debconf prompts.

Listing archives which contains upgradeable packages, with and without node name:

user@machine01:~$ sudo apt-upgrade -u list
machine01: jessie-backports, jessie-wikimedia, oldstable-updatesuser
user@machine01:~$ sudo apt-upgrade -un list
jessie-backports, jessie-wikimedia, oldstable-updates

Report details of package upgrades, with and without node name:

user@machine01:~$ sudo apt-upgrade -u report
machine01: jessie-backports: linux-image-4.9.0-0.bpo.4-amd64 4.9.51-1~bpo8+1 --> 4.9.65-3+deb9u1~bpo8+1 
machine01: jessie-wikimedia: linux-meta 1.16 --> 1.17 
machine01: jessie-wikimedia: linux-meta-4.9 1.16 --> 1.17 
machine01: jessie-wikimedia: linux-image-4.9.0-0.bpo.6-amd64 [absent] --> 4.9.82-1~wmf1 
machine01: oldstable-updates: linux-image-3.16.0-4-amd64 3.16.43-2+deb8u5 --> 3.16.51-3 
user@machine01:~$ sudo apt-upgrade -un report
jessie-backports: linux-image-4.9.0-0.bpo.4-amd64 4.9.51-1~bpo8+1 --> 4.9.65-3+deb9u1~bpo8+1 
jessie-wikimedia: linux-meta 1.16 --> 1.17 
jessie-wikimedia: linux-meta-4.9 1.16 --> 1.17 
jessie-wikimedia: linux-image-4.9.0-0.bpo.6-amd64 [absent] --> 4.9.82-1~wmf1 
oldstable-updates: linux-image-3.16.0-4-amd64 3.16.43-2+deb8u5 --> 3.16.51-3

Excluding some packages by using a file with a regexp per line:

user@machine01:~$ cat exclude_file.txt 
linux-meta.*
user@machine01:~$ sudo apt-upgrade -un -f exclude_file.txt report
jessie-wikimedia: linux-meta 1.16 --> 1.17 [excluded]
jessie-wikimedia: linux-meta-4.9 1.16 --> 1.17 [excluded]
jessie-backports: linux-image-4.9.0-0.bpo.4-amd64 4.9.51-1~bpo8+1 --> 4.9.65-3+deb9u1~bpo8+1 
jessie-wikimedia: linux-image-4.9.0-0.bpo.6-amd64 [absent] --> 4.9.82-1~wmf1 
oldstable-updates: linux-image-3.16.0-4-amd64 3.16.43-2+deb8u5 --> 3.16.51-3

Performing an upgrade, a report is printed and a confirmation prompt will appear:

user@machine01:~$ sudo apt-upgrade -un -f exclude_file.txt upgrade jessie-wikimedia
jessie-wikimedia: linux-meta 1.16 --> 1.17 [excluded]
jessie-wikimedia: linux-meta-4.9 1.16 --> 1.17 [excluded]
jessie-wikimedia: linux-image-4.9.0-0.bpo.6-amd64 [absent] --> 4.9.82-1~wmf1 
commit changes? [y/N]:

To avoid the confirmation prompt use -y in the command line:

user@machine01:~$ sudo apt-upgrade -un -f exclude_file.txt upgrade jessie-wikimedia -y
jessie-wikimedia: linux-meta 1.16 --> 1.17 [excluded]
jessie-wikimedia: linux-meta-4.9 1.16 --> 1.17 [excluded]
jessie-wikimedia: linux-image-4.9.0-0.bpo.6-amd64 [absent] --> 4.9.82-1~wmf1 
Selecting previously unselected package linux-image-4.9.0-0.bpo.6-amd64.
(Reading database ... 67435 files and directories currently installed.)
Preparing to unpack .../linux-image-4.9.0-0.bpo.6-amd64_4.9.82-1~wmf1_amd64.deb ...
Unpacking linux-image-4.9.0-0.bpo.6-amd64 (4.9.82-1~wmf1) ...
Setting up linux-image-4.9.0-0.bpo.6-amd64 (4.9.82-1~wmf1) ...
[...]

Since all machines should have this wrapper, you should be able to use clush:

user@machine01:~$ clush -w @all 'sudo apt-upgrade -u upgrade stretch-updates -y'

To avoid upgrades of certain key important packages, it is recommended that you:

create an apt pinning for it
put the package on hold
exclude it by means of -f exclude_file.txt or -x regex.

FAQ

Does the `apt-upgrade` script works with any repository?

Yes, since in reads the source repo of candidate upgrades. If no candidates are found, nothing will happen.

Does the `apt-upgrade` script produce logs?

Yes, in /var/log/apt/history.log as per usual.

Could the `apt-upgrade` script destroy the system?

It's similar to running `aptitude install pkg1 pkg2 pkg3 ...`. The dependency resolver could do estrange things as per usual. Obtain a report before to see what will happen.

Is it safe to obtain reports using the `apt-upgrade` script?

yes, it should produce 0 modification to any given system. However, it has been observed that running it may trigger dpkg/apt to continue with previous aborted updates.

I want to see a package debconf prompt, does apt-upgrade allows that?

no, the code uses interanlly DEBIAN_FRONTEND=noninteractive