Debian 11下如何配置Unattended-upgrades自动升级Teleport？

问题描述 #

在Debian 11系统中配置Unattended-upgrades自动升级Teleport，已完成：

• 添加Teleport官方源及验证密钥到apt源列表
• 创建专属配置文件/etc/apt/apt.conf.d/50unattended-upgrades-teleport，内容如下：

Unattended-Upgrade::Origins-Pattern {
"site=apt.releases.teleport.dev";
};

运行调试命令unattended-upgrades -d时，日志明确识别到Teleport有可用新版本（12.4.6），但始终不执行升级操作，关键日志片段：

Checking if system is running on battery is skipped. Please install powermgmt-base package to check power status and skip installing updates when 
the system is running on battery.                                                                                                                
Starting unattended upgrades script                                                                                                               
Allowed origins are: origin=Debian,codename=bullseye,label=Debian, origin=Debian,codename=bullseye,label=Debian-Security, origin=Debian,codename=b
ullseye-security,label=Debian-Security, site=apt.releases.teleport.dev
...
Checking: teleport ([<Origin component:'main' archive:'' origin:'teleport' label:'teleport' site:'deb.releases.teleport.dev' isTrusted:True>])
adjusting candidate version: teleport=12.4.6
pkgs that look like they should be upgraded: 
Fetched 0 B in 0s (0 B/s)                                                                                                                        
fetch.run() result: 0
Packages blacklist due to conffile prompts: []
No packages found that can be upgraded unattended and no pending auto-removals
Package teleport has a higher version available, checking if it is from an allowed origin and is not pinned down.
Extracting content from /var/log/unattended-upgrades/unattended-upgrades-dpkg.log since 2023-06-08 18:32:02

查看/var/log/unattended-upgrades/unattended-upgrades-dpkg.log，无Teleport相关升级记录：

Log started: 2023-06-06  15:52:25
(Reading database ... 136395 files and directories currently installed.)
Removing linux-image-5.10.0-20-amd64 (5.10.158-2) ...
/etc/kernel/postrm.d/initramfs-tools:
update-initramfs: Deleting /boot/initrd.img-5.10.0-20-amd64
/etc/kernel/postrm.d/zz-update-grub:
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-5.10.0-23-amd64
Found initrd image: /boot/initrd.img-5.10.0-23-amd64
Found linux image: /boot/vmlinuz-5.10.0-21-amd64
Found initrd image: /boot/initrd.img-5.10.0-21-amd64
Warning: os-prober will be executed to detect other bootable partitions.
Its output will be used to detect bootable binaries on them and create new boot entries.
done
Log ended: 2023-06-06  15:52:29

解决步骤 #

1. 修正源匹配规则 #

从调试日志中可见，Teleport包的实际源站点是deb.releases.teleport.dev，但配置文件中写的是apt.releases.teleport.dev，两者不匹配导致Unattended-upgrades拒绝升级。

编辑配置文件：

nano /etc/apt/apt.conf.d/50unattended-upgrades-teleport

修改为：

Unattended-Upgrade::Origins-Pattern {
"site=deb.releases.teleport.dev";
};

2. 增加匹配精度（可选） #

为了避免源信息变更导致的匹配失败，可同时指定origin和label，进一步缩小匹配范围：

Unattended-Upgrade::Origins-Pattern {
"origin=teleport,label=teleport";
"site=deb.releases.teleport.dev";
};

3. 检查版本固定规则 #

执行命令检查Teleport是否被apt固定版本：

apt-cache policy teleport

如果输出中存在优先级高于500的pin规则，需要删除/etc/apt/preferences.d/目录下对应的固定文件。

4. 重新验证配置 #

运行调试命令确认升级逻辑正常：

unattended-upgrades -d

如果日志中出现Upgrading packages及Teleport的升级记录，说明配置生效。

内容的提问来源于stack exchange，提问作者mondragonfx