mjhjmtu

is there a way to list or install security upgrades only using apt?

if I list upgrades with:

apt list --upgradable

can I also see without knowing packages and libraries which upgrades are relevant security upgrades.

and furthermore is there an option to only apply those by skipping any others, so the non-security-relevant upgrades would be prompted again next time I run apt upgrade?

apt can’t (yet) provide the information you’re after. aptitude can though, albeit somewhat confusingly:

aptitude search '~U ~ODebian' -F "%p %O"|awk '/Debian-Security/ print $1'

This searches all upgradable (~U) packages from official Debian repositories (~ODebian), and displays their package name (%p) and “origin” (%O). The latter actually displays the repository label, which is “Debian-Security:9/stable” for the Debian 9 security repositories. You end up with a list of upgradable package names from the security repositories.

There are a variety of ways to install only security upgrades, none of them ideal though.

• aptitude’s text interface allows only security upgrades to be applied, simply by scrolling to the “Security Updates” header (which should be the first one) and hitting +.



• 
  

  You can feed the list of packages extracted above to apt to install the upgrades:

  
  
  

  aptitude search '~U ~ODebian' -F "%p %O" |
  awk '/Debian-Security/ print $1' |
  xargs apt-get install --only-upgrade
  

  
  
  

  This has the unfortunate side-effect of clearing the “automatically installed” marker on upgraded packages.

  
  


• 
  

  You can use unattended-upgrades, whose default action is to only apply security upgrades:

  
  
  

  unattended-upgrades -v
  

  
  
  

  If you don’t want upgrades to be installed automatically, you’ll need to disable unattended-upgrades’s daily cron job.

  
  

To display the security update you can use:

apt-get --just-print upgrade | grep -i security | awk 'print $2' | awk '!seen[$0]++'

To apply only the security updates for 1 package:

apt-get install --only-upgrade pckg_name

To apply only the security updates from list:

list=$(apt-get --just-print upgrade | grep -i security | awk 'print $2' | awk '!seen[$0]++')
apt-get install --only-upgrade $list