Re: Debian unattended-upgrades

[Chuck Lever <chuck.lever@oracle.com>]

On 4/9/25 3:54 PM, Chuck Lever wrote:
> Hi -
> 
> While testing with Debian 12 on AWS, I ran into this:
> 
> ---
> - name: Check if unattended-upgrades is installed
>   command: dpkg-query -W -f='${Status}' unattended-upgrades
>   register: unattended_upgrade_status
>   ignore_errors: true
>   changed_when: false
> 
> - name: Set fact if unattended-upgrades is installed
>   set_fact:
>     unattended_upgrades_installed: "{{ 'install ok installed' in
> unattended_upgrade_status.stdout }}"
> 
> - name: Verify unattended-upgrades is not installed
>   fail:
>     msg: |
>       The unattended-upgrades package is installed on the base image, this
>       can cause tons of issues with CIs. Fix this by running the following
>       commands:
> 
>       make cleancache
>       make bringup
>   when:
>     - unattended_upgrades_installed|bool
> 
> The Debian 12 image on AWS has the unattended-upgrades package
> installed. I haven't checked Debian 11 or Debian on other cloud
> providers.
> 
> - I did a "dpkg --purge unattended-upgrades" on each of the
>   instances, and this failure went away
> 
> - "make cleancache" might be appropriate for a libvirt installation,
>   but it definitely won't do anything for cloud; a fresh OS image
>   will always have that package (unless we make a custom image)
> 
> - Even so, if the libvirt OS image provider installs that package,
>   "make cleancache" won't eliminate the failure
> 
> Noting that later steps in
> playbooks/roles/devconfig/tasks/install-deps/debian/main.yml disable and
> uninstall unattended-upgrades anyway, what
> is the purpose for the above logic? Can it be removed?
> 

This is a possible solution I found on StackOverflow:

https://stackoverflow.com/questions/45269225/ansible-playbook-fails-to-lock-apt/51919678#51919678

I see that bringup_guestfs.sh already attempts to uninstall
unattended-upgrades on new images. We'll want something that works
for cloud instances too.


-- 
Chuck Lever