mcpField
A
auto-updates

auto-updates

github.com/mikr13Security647 installsUpdated 2w ago
Repository

About auto-updates

auto-updates is a skill for inspecting or configuring periodic package upgrades with unattended-upgrades on APT systems. It emphasizes reviewing existing policies, previewing changes, preserving rollback state, and verifying timers and logs.

Key features

  1. 01Inspects APT configuration and upgrade logs
  2. 02Checks distribution-specific allowed origins
  3. 03Previews proposed settings with a dry run
  4. 04Applies managed settings with rollback support
  5. 05Verifies timers, schedules, and logs
  6. 06Avoids altering reboot and cleanup policies

Use cases

  1. 01Auditing automatic upgrade configuration
  2. 02Setting up periodic APT upgrades
  3. 03Reviewing repository origins before updates
  4. 04Diagnosing timer activation or package locks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/mikr13/secure-server-setup-skills --skill auto-updates

After installing, type/auto-updatesin Claude Code to confirm it loaded.

Bundled filesreferences/apt-config.mdscripts/setup-auto-updates.sh

Details

From the project README

Automatic updates

Use this skill to inspect or configure periodic upgrades. Keep the requested maintenance policy: enabling a schedule does not authorize an immediate full upgrade, automatic reboot, or removal of dependencies.

Inspect first

  • Identify the distribution/release and installed unattended-upgrades version. Inspect apt-config dump, /etc/apt/apt.conf.d/, held packages, timers, and recent upgrade logs.
  • Confirm allowed origins against this distribution's installed configuration. Ubuntu security, Debian security, third-party repositories, and Ubuntu Pro/ESM have different origin requirements. Do not copy an Ubuntu origin list onto Debian.
  • Record existing automatic reboot, package cleanup, notification and scheduling choices. If the request is an audit, report findings without changing them.

Configure

For operational details and lock troubleshooting, read references/apt-config.md.

  1. If missing, install unattended-upgrades using the target's package manager within the authorized setup scope. This helper does not install packages.

  2. Preview scripts/setup-auto-updates.sh:

    sudo bash scripts/setup-auto-updates.sh --dry-run

  3. Review the proposed daily periodic settings and existing origin/reboot policy. Once configuration and timer activation are authorized:

    sudo bash scripts/setup-auto-updates.sh --apply --activate

The helper writes its own managed drop-in, preserves the exact previous version for rollback, validates effective APT settings, and runs an unattended-upgrade dry run. It changes no allowed origins, reboot settings, dependency cleanup, or existing notification configuration. Without --activate, timer states remain unchanged.

Verify and recover

  • Check apt-config dump, the dry-run output and allowed origins, both APT timers, their installed schedules, and recent logs. Timer presence or an active service alone is insufficient evidence of upgrades.
  • Plan required kernel/service restarts within the maintenance policy. Do not unhold packages without understanding why they were held.
  • On failed validation or timer activation, the helper restores its prior drop-in and timer states it changed. The printed rollback directory contains the saved managed file. Restore it, or remove the new managed file if none existed, when reverting later.
  • For APT contention, identify the lock holder and wait or diagnose it. Never delete lock files to bypass an active package manager.

Report configured origins, scheduling evidence, reboot policy, changes, and checks still pending on the target.

Comments

Markdown supported