Debian 12提取安全源列表并用于dist-upgrade的正确方法

Debian 12（Bookworm）改用了deb822格式的源配置文件，替代了传统的单行deb格式，这是导致原有脚本失效的核心原因。以下是适配Debian 12的正确处理方法：

一、理解Debian 12的安全源结构 #

Debian 12默认不再在/etc/apt/sources.list中写入安全源，而是通过/etc/apt/sources.list.d/debian.sources（deb822格式）配置，其中会指向/etc/apt/mirrors/debian-security.list——但这个文件仅存储镜像URL，缺少apt识别源所需的类型、发行版分支、组件等关键字段，直接使用会触发格式错误。

二、正确提取安全源配置 #

方法1：解析deb822格式的源文件 #

直接读取/etc/apt/sources.list.d/debian.sources，筛选出包含debian-security的完整源段落，保存为新的安全源文件：

• 示例debian.sources中的安全源段落格式：

  Types: deb
  URIs: https://cdn-aws.deb.debian.org/debian-security
  Suites: bookworm-security
  Components: main contrib non-free non-free-firmware
  Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
  

• 提取后直接将该段落写入/home/user/security.list，apt原生支持deb822格式的源文件。

方法2：转换为传统单行deb格式 #

如果偏好传统格式，可以将deb822字段拼接成标准的deb行：

deb https://cdn-aws.deb.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware

可通过命令行快速提取并生成：

grep -A4 "URIs:.*debian-security" /etc/apt/sources.list.d/debian.sources | awk '
/Types:/ {type=$2}
/URIs:/ {uri=$2}
/Suites:/ {suite=$2}
/Components:/ {comp=$0; sub("Components: ", "", comp)}
END {print type, uri, suite, comp}' > /home/user/security.list

三、适配后的Python脚本示例 #

以下脚本兼容Debian 11、Ubuntu和Debian 12：

import os
import re
import subprocess

def extract_security_sources():
    security_list_path = "/home/user/security.list"
    # 优先处理Debian 12的deb822格式源
    debian_sources_path = "/etc/apt/sources.list.d/debian.sources"
    if os.path.exists(debian_sources_path):
        with open(debian_sources_path, 'r') as f:
            content = f.read()
        # 匹配包含debian-security的完整源段落
        security_sections = re.findall(
            r'(Types: deb\nURIs: .*debian-security.*?\nSigned-By: .*?\n)',
            content,
            re.DOTALL
        )
        if security_sections:
            with open(security_list_path, 'w') as f:
                f.write('\n'.join(security_sections))
            return
    
    # 兼容Debian 11/Ubuntu的传统sources.list
    with open("/etc/apt/sources.list", 'r') as f:
        security_lines = [
            line.strip() for line in f.readlines()
            if 'security' in line.lower() and not line.startswith('#')
        ]
    with open(security_list_path, 'w') as f:
        f.write('\n'.join(security_lines))

def fetch_security_upgrades():
    extract_security_sources()
    # 执行模拟升级命令
    cmd = 'apt-get dist-upgrade -o Dir::Etc::sourcelist=/home/user/security.list -s'
    result = subprocess.run(
        cmd,
        shell=True,
        capture_output=True,
        text=True,
        check=False
    )
    
    if result.returncode == 0:
        # 解析输出，提取包名和版本
        for line in result.stdout.split('\n'):
            if line.startswith('Inst '):
                parts = line.split()
                pkg_name = parts[1]
                pkg_version = parts[2].strip('()')
                print(f"{pkg_name}: {pkg_version}")
    else:
        print(f"命令执行失败: {result.stderr.strip()}")

if __name__ == "__main__":
    fetch_security_upgrades()

四、注意事项 #

• 脚本需要以root权限运行（可通过sudo执行），否则apt命令会因权限不足报错。
• Debian 12的安全源分支为bookworm-security，不要与Debian 11的bullseye-security混淆。
• 若使用deb822格式的源文件，无需修改apt-get命令参数，apt会自动识别格式。

内容的提问来源于stack exchange，提问作者Sathish M