Unattended Upgrades (Raspberry Pi OS)

Overview

Mainsail OS runs on Raspberry Pi OS. Unattended-upgrades handles automatic installation of security updates. This page covers enabling it and verifying it is working.

Enable Unattended Upgrades

Install packages

sudo apt update
sudo apt install unattended-upgrades apt-listchanges -y

Run interactive configuration

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select Yes when prompted to automatically download and install stable updates.

Verify auto-upgrades config

cat /etc/apt/apt.conf.d/20auto-upgrades

Expected output:

APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";

If the file is missing or incorrect, create/edit it:

sudo nano /etc/apt/apt.conf.d/20auto-upgrades

Paste the two lines above. Save with Ctrl+O, Enter, then exit with Ctrl+X.

Add Raspbian origins

The default 50unattended-upgrades template only whitelists Debian origins. Raspbian and Raspberry Pi Foundation packages require explicit entries.

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Locate the Unattended-Upgrade::Origins-Pattern block and confirm these two lines are present inside it. Add them if not:

"origin=Raspbian,codename=${distro_codename},label=Raspbian";
"origin=Raspberry Pi Foundation,codename=${distro_codename},label=Raspberry Pi Foundation";

Save and exit.

Verify Unattended Upgrades Is Working

Dry run

sudo unattended-upgrade --dry-run --debug

Review output for errors. It should scan packages against the configured origins without reporting "no origin matched."

Check systemd timer

systemctl status apt-daily-upgrade.timer

The timer should show as active and enabled. If not:

sudo systemctl enable --now apt-daily-upgrade.timer

Check git status of Klipper repo

Mainsail OS can leave the Klipper checkout in a dirty state (local modifications uncommitted). Verify before any Klipper update or MCU reflash.

cd ~/klipper
git status

• If only build artifacts are modified (e.g., klippy/chelper/c_helper.so, .pyc files), discard them:

git checkout -- .
git clean -fd

• If actual source files (.py, .c) are modified with unrecognized changes, do not discard. Investigate before proceeding.

Confirm clean state:

git status

Expected output: nothing to commit, working tree clean