[Post-Install] Phased Updates

[Anomalous]

How can I permanently disable the phased updates from Apt so that I get all of the upgraded packages I want?


I am asking because today was the fourth time that the unattended-upgrade tool has removed my nvidia-drivers only to then run into the updated drivers being held back, leaving me with no display drivers on my next boot.

[skyfishgoo]

i would recommend unchecking the box for "offline update" and setting the update policy to manual so you can wait for the blue dot on the discovery icon in the system tray and then open discover to see what will be updated.

if you see a kernal, firmware, or driver update pending you know that

a) you should take a snapshot first

b) you will need to reboot after the update

c) you should be prepared to face some level of maintenance busy work, just in case anything goes sideways (at the very least be able to restore your snapshot).

there is no way to force apt to install packages that are being held back short of compiling them yourself.

[oldgeek]

I've found that some, if not all, phased updates will upgrade if you use Discover to update.

[skyfishgoo]

i always found a 1:1 relationship between packages available for updates in apt vs discover.

phased packages don't even show up in discover until they are released, and they they show up in both.

[oldgeek]

Awhile back, I received a notication of mostly Nvidia updates (for 24.04) which were marked as held back on the terminal, but were available for download on Discover. I downloaded them, and lost my Nvidia driver and could only get a low resolution. I returned to my previous configuration (using btrfs) to fix it. I still see these 'upgrades' on the held back list for Apt updating, but they are ready to go on Discover. So in my case, I never use Discover to update, just the terminal.

[Snowhog]

How can I permanently disable the phased updates from Apt so that I get all of the upgraded packages I want?

How do I turn off phased updates?
If you’re sure that you want to disable phased updates, reverting to the old behavior, you can change apt’s configuration by creating a file in /etc/apt/apt.conf.d called 99-Phased-Updates (if /etc/apt/apt.conf.d/99-Phased-Updates doesn’t already exist). In the file, simply add the following lines:

Update-Manager::Always-Include-Phased-Updates true;
APT::Get::Always-Include-Phased-Updates true;

[suplero]

unattended updates is the first thing i rip out of every install.

here are my issues with unattended updates:

1) it never asks for a password. apt needs sudo right? how does this command have sudo access? is the password stored somewhere? is this a root level command already? either way, this seems to me to be a huge vector for attacks at some point, especially now that ai is doing so many vulnerability checks

2) nobody knows when it runs. twice - and that's all it took - tried to install something and apt said it was busy. i refuse to have my computer interrupt my workflow.

3) it never shows when it is running. #2 would be a little more acceptable if there was something that said unattended updates was running, but nope, not a thing

4) no indication of what it is doing or how long it will take. what did it do? or, if it is doing something, what is it doing now and for how long?

unattended updates seem like a good idea on paper, but the implementation is not well thought out at all.

as much as i despise windows, here is what windows does well for their background updates - 1) users can still install programs and user operations take precedence over background processes - user downloads happen, running programs get more cpu cycles, etc. 2) going to windows update page can show what is being installed (in general terms) and how long it takes, 3) even during background updates a shutdown can happen and the update will figure out how to resume later, no fear of breaking anything.

what windows failed bigly on was the automatic reboot option. if windows would have kept the reboot up to the user, then windows update wouldn't have near the hate it has now.

but when an unattended update interferes with the user's workflow or experience - like by removing drivers by itself - it's time to rethink the whole idea. the security risk buried in the command itself is way worse to me than any security risk to a "user" system (servers and other setups may vary) with unupdated packages.

[Snowhog]

Google AI answer

The unattended upgrades process doesn't actually bypass sudo. Instead, it runs natively as the root user through a background system service.

How It Works Behind the Scenes

• Systemd Service: The process is triggered by a background timer (systemd) or an automated script (cron), which is owned by the operating system itself.
• Native Root Privileges: Because the operating system spawns the process directly, it already has the highest level of administrative privileges (root).
• No User Needed: sudo (Superuser Do) is a tool specifically designed for human users to temporarily elevate their privileges. Since a background system process is already running as root, it has no need to ask a human for a password or use sudo.

Is This Secure?

Yes. It is safe because:

• It reads configurations from protected system folders (/etc/apt/apt.conf.d/) that only root can modify.
• It only installs packages from trusted, cryptographically signed official repositories (like Ubuntu/Kubuntu security repositories).