Replace cron-apt with unattended-upgrades on Focal #5684

emkll · 2021-01-05T15:22:03Z

Status

Ready for Review

See freedomofpress/securedrop-docs#146 for documentation changes

Description of Changes

Fixes #5295 , fixes #3376

A couple of comments for the reviewer:

While it would be more straightforward to also update the Suite field, this will have an impact on running instances : apt will show an interactive warning to the user requiring them to approve the change of Suite from '' to focal
It may make sense to provide the configuration via apt (perhaps forking the securedrop-config package for focal and populate 50unattended-upgrades and 20auto-upgrades via deb package. This will ensure we will not require admin intervention to make updates to the unattended upgrades config. However, we will need to configure the reboot time somehow instead of relying on a jinja template via Ansible. Happy to append a commit to this PR.

Testing

Deployment

Changes will be applied to new Focal installs via Ansible, and behavior for Xenial should remain unchanged

Checklist

If you made changes to the server application code:

Linting (make lint) and tests (make test) pass in the development container

If you made changes to the system configuration:

Configuration tests pass

If you made non-trivial code changes:

I have written a test plan and validated it for this PR

Choose one of the following:

I have opened a PR in the docs repo for these changes, or will do so later (TBD)

codecov-io · 2021-01-07T00:40:28Z

Codecov Report

Merging #5684 (0a8334c) into develop (8897a79) will increase coverage by 0.07%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop    #5684      +/-   ##
===========================================
+ Coverage    81.41%   81.48%   +0.07%     
===========================================
  Files           53       53              
  Lines         3965     3965              
  Branches       496      496              
===========================================
+ Hits          3228     3231       +3     
+ Misses         632      630       -2     
+ Partials       105      104       -1

Impacted Files	Coverage Δ
securedrop/source_app/main.py	`93.29% <0.00%> (+1.54%)`	⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 8897a79...0a8334c. Read the comment docs.

conorsch

Took a first pass through, visual review only, did not run through the test plan. At a high level, I like the changes, although I'm now increasingly convinced that forking the securedrop-config metapackage is going to free us up. During prior discussions, @emkll, I'd feared the complexity of maintaining multiple packages there, but given that a similar implementation was required for #5691, I'm pleased to say it wasn't all that daunting. If you agree, we can wait until that PR is merged and then easily add a Focal-only metapackage for "config".

While it would be more straightforward to also update the Suite field, this will have an impact on running instances

Only for Focal, though! And there aren't any Focal instances in prod yet, so it sounds like we should make this change now, no? We can make it for Focal only but not for Xenial, by modifying only the Focal component in https://github.com/freedomofpress/securedrop-dev-packages-lfs/blob/75073cfd59dd98c76757a27ec1f3bd516ec70217/repo/conf/distributions#L9-L10

perhaps forking the securedrop-config package for focal and populate 50unattended-upgrades and 20auto-upgrades via deb package [...] we will need to configure the reboot time somehow instead of relying on a jinja template via Ansible

As mentioned above, yes, I do think that forking the package is a good idea. As for the template-vs-deb-pkg issue, my understanding of the conf.d logic is that we could set the Unattended-Upgrade::Automatic-Reboot-Time option in a separate via, e.g. /etc/apt/apt.conf.d/80securedrop, and manage the 50unattendedupgrades file in the deb package. More testing required, of course, to confirm that behavior.

Given the complexity of these changes, plus the fact I'm requesting further changes, I suggest we defer merge until after feature freeze for 1.7.0, currently scheduled for 2021-01-12.

conorsch · 2021-01-07T23:36:22Z

molecule/upgrade/templates/distributions.j2

@@ -1,3 +1,4 @@
+Origin: {{ rep_origin }}


This is an important change! It mirrors what's also provided by our reprepro setup, e.g.

$ curl -s https://apt.freedom.press/dists/xenial/Release | grep ^Origin Origin: SecureDrop

Although the repo config is managed outside of this repository, we should add tests (for apt-test & apt) that verify that Origin line: if the apt server config ever changes, then unattended-upgrade will stop working.

conorsch · 2021-01-07T23:37:14Z

install_files/ansible-base/roles/common/vars/Ubuntu_focal.yml

+securedrop_common_packages:
+  - apt-transport-https
+  - aptitude
+  - unattended-upgrades


conorsch · 2021-01-07T23:46:19Z

install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml

+  cron:
+    name: Indicate that a reboot is required at the scheduled time.
+    job: "touch /var/run/reboot-required"
+    hour: "*/12"


Creative! By ensuring that /var/run/reboot-required always exists, unattended-upgrades will always reboot after it runs. That's similar to what we're doing manually with cron-apt by appending && to the job.

In this case, it'd give us more control to handle the cron job in /etc/ and configure it via the securedrop-config package. We'd have to fork the package for Focal specifically, but I'm leaning toward that as a simpler option for maintenance anyway.

conorsch · 2021-01-07T23:48:01Z

install_files/ansible-base/roles/common/templates/50unattended-upgrades.j2

+
+// Automatically reboot *WITHOUT CONFIRMATION*
+//  if the file /var/run/reboot-required is found after the upgrade
+Unattended-Upgrade::Automatic-Reboot "true";


Might be worth appending

// Automatically reboot even if there are users currently logged in // when Unattended-Upgrade::Automatic-Reboot is set to true Unattended-Upgrade::Automatic-Reboot-WithUsers "true";

since we use tmux, and dangling session isn't impossible.

conorsch · 2021-01-07T23:49:06Z

install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml

+    hour: "*/12"
+  tags:
+    - cron
+    - unatted-upgrades


Nit: typo in tag name.

conorsch · 2021-01-07T23:51:04Z

install_files/ansible-base/roles/common/templates/sources.list.j2

+
+### Security fixes for distribution packages
+deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security main
+deb http://security.ubuntu.com/ubuntu {{ ansible_distribution_release }}-security universe


Good, clean restrictions here. Essentially, we're removing use of "multiverse" and "restricted", and allowing everything else. Confirmed that e.g. intel-microcode will be caught by these rules:

sdadmin@sd-staging-app:~$ apt-cache policy intel-microcode intel-microcode: Installed: 3.20201110.0ubuntu0.20.04.2 Candidate: 3.20201110.0ubuntu0.20.04.2 Version table: *** 3.20201110.0ubuntu0.20.04.2 500 500 http://us.archive.ubuntu.com/ubuntu focal-updates/main amd64 Packages 500 http://us.archive.ubuntu.com/ubuntu focal-security/main amd64 Packages 100 /var/lib/dpkg/status 3.20191115.1ubuntu3 500 500 http://us.archive.ubuntu.com/ubuntu focal/main amd64 Packages

emkll · 2021-01-22T21:10:26Z

Thanks @conorsch for the review. I have implemented all your suggestions, and this is now ready for re-review. In my local testing I have confirmed this will also resolve the longstanding #3376 as well, updated the test plan and PR to that effect.

I think this is ready for another review, and @conorsch you can return for a final pass after a functional review.

emkll · 2021-01-25T17:21:16Z

This will need to be updated once #5684 is merged.

conorsch · 2021-01-26T01:02:46Z

Took a quick look visually again, and looks great. As has been said above, let's revisit this post-release of 1.7.0, since some of the string changes will need to be updated as part of recent close-out. Still haven't tested functionally, but pleased with the approach presented.

kushaldas

Testing

Code wise this looks good.

I could managed to get the last parts working and that made me to look at a few more points.

I can not see securedrop-config package is building for me with the latest securedrop_app_code_version

I tried, 1.8.0 first and 1.8.1 and 1.8.2, the build directory looks like:

❯ ls build/focal/
ossec-agent-3.6.0-amd64.deb                        securedrop-keyring-0.1.4+1.6.0~rc1-amd64.deb                              
ossec-server-3.6.0-amd64.deb                       securedrop-keyring-0.1.4+1.7.0~rc1-amd64.deb                              
securedrop-app-code_1.6.0~rc1+focal.tar.gz         securedrop-keyring-0.1.4+1.8.0-amd64.deb                                  
securedrop-app-code_1.6.0~rc1+focal_amd64.deb      securedrop-keyring-0.1.4+1.8.0~rc1-amd64.deb                              
securedrop-app-code_1.7.0~rc1+focal.tar.gz         securedrop-keyring-0.1.4+1.8.1-amd64.deb                                  
securedrop-app-code_1.7.0~rc1+focal_amd64.deb      securedrop-keyring-0.1.4+1.8.2-amd64.deb                                  
securedrop-app-code_1.8.0+focal.tar.gz             securedrop-ossec-agent-3.6.0+1.6.0~rc1-amd64.deb                          
securedrop-app-code_1.8.0+focal_amd64.deb          securedrop-ossec-agent-3.6.0+1.7.0~rc1-amd64.deb                          
securedrop-app-code_1.8.0~rc1+focal.tar.gz         securedrop-ossec-agent-3.6.0+1.8.0-amd64.deb                              
securedrop-app-code_1.8.0~rc1+focal_amd64.deb      securedrop-ossec-agent-3.6.0+1.8.0~rc1-amd64.deb                          
securedrop-app-code_1.8.1+focal.tar.gz             securedrop-ossec-agent-3.6.0+1.8.1-amd64.deb                              
securedrop-app-code_1.8.1+focal_amd64.deb          securedrop-ossec-agent-3.6.0+1.8.2-amd64.deb                              
securedrop-app-code_1.8.2+focal.tar.gz             securedrop-ossec-server-3.6.0+1.6.0~rc1-amd64.deb                         
securedrop-app-code_1.8.2+focal_amd64.deb          securedrop-ossec-server-3.6.0+1.7.0~rc1-amd64.deb                         
securedrop-config-0.1.3+1.6.0~rc1-amd64.deb        securedrop-ossec-server-3.6.0+1.8.0-amd64.deb                             
securedrop-config-0.1.3+1.7.0~rc1+focal-amd64.deb  securedrop-ossec-server-3.6.0+1.8.0~rc1-amd64.deb                         
securedrop-config-0.1.3+1.7.0~rc1-amd64.deb        securedrop-ossec-server-3.6.0+1.8.1-amd64.deb                             
securedrop-config-0.1.3+1.8.0~rc1-amd64.deb        securedrop-ossec-server-3.6.0+1.8.2-amd64.deb                             
securedrop-grsec-4.14.188+focal-amd64.deb          tor-geoipdb_0.4.4.5-1~focal+1_all.deb                                     
securedrop-grsec-4.14.188-amd64.deb                tor_0.4.4.5-1~focal+1_amd64.deb

Also, all the reference i found online about unattended-upgrades, they suggest to enable apt-daily and apt-daily-upgrade timers to be used. But, I could not figure how that part is happening in the current implementation in Focal in this PR. I changed the time a few times, and that did not reboot the box or updated any packages.

kushaldas · 2021-01-29T05:13:55Z

molecule/testinfra/common/test_automatic_updates.py

+        c = host.run('sudo unattended-upgrades -d')
+        assert c.rc == 0
+        expected_origins = (
+            "Allowed origins are: origin=Ubuntu,archive=focal, origin=Ubuntu,archive=focal-security"


This is nice.

kushaldas · 2021-01-29T05:18:07Z

devops/apt-local.yml

@@ -29,6 +29,7 @@
    rep_dist: "focal"
    molecule_dir: "../molecule/upgrade"
    dpkg_dir: /var/repos/debs
+    rep_origin: SecureDrop


https://wiki.debian.org/DebianRepository/Format#Origin has the definition (for the person who is looking at this in future).

emkll · 2021-01-29T22:48:59Z

Also, all the reference i found online about unattended-upgrades, they suggest to enable apt-daily and apt-daily-upgrade timers to be used. But, I could not figure how that part is happening in the current implementation in Focal in this PR. I changed the time a few times, and that did not reboot the box or updated any packages.

@kushaldas you can find the times for the two daily tasks in /lib/systemd/system/apt-daily.timer and /lib/systemd/system/apt-daily-upgrade.timer. You can adjust the OnCalendar and RandomizedDelaySec values there. They are currently populated with the default values provided by unattended-upgrades.

emkll · 2021-02-01T23:03:57Z

@kushaldas thanks for the feedback you've provided out of band. I've resolved the two issues you've identified:

Rebased on latest develop, and updated update_version.sh to ensure the correct config package is used for the staging scenario
Unmasked the apt-daily and apt-daily-upgrade services. From my local testing, the service only runs when triggered by the daily/scheduled cron (ie only when running the apt update or apt upgrade, otherwise it's inactive)

This should unblock you for further testing, thanks for your continued attention on this PR.

kushaldas

This still did not start the timers.

vagrant@app-staging:~$ sudo systemctl list-timers
NEXT                        LEFT          LAST                        PASSED               UNIT                         ACTIVATES                     
Tue 2021-02-02 14:48:41 UTC 4h 13min left Tue 2021-02-02 09:18:57 UTC 1h 16min ago         motd-news.timer              motd-news.service             
Tue 2021-02-02 19:13:07 UTC 8h left       Sun 2020-08-16 03:36:36 UTC 5 months 18 days ago fwupd-refresh.timer          fwupd-refresh.service         
Wed 2021-02-03 00:00:00 UTC 13h left      Tue 2021-02-02 09:12:11 UTC 1h 23min ago         logrotate.timer              logrotate.service             
Wed 2021-02-03 00:00:00 UTC 13h left      Tue 2021-02-02 09:12:11 UTC 1h 23min ago         man-db.timer                 man-db.service                
Wed 2021-02-03 09:40:11 UTC 23h left      Tue 2021-02-02 09:40:11 UTC 55min ago            systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Sun 2021-02-07 03:10:29 UTC 4 days left   Tue 2021-02-02 09:12:53 UTC 1h 22min ago         e2scrub_all.timer            e2scrub_all.service           
Mon 2021-02-08 00:00:00 UTC 5 days left   Tue 2021-02-02 09:12:11 UTC 1h 23min ago         fstrim.timer                 fstrim.service                

7 timers listed.
Pass --all to see loaded but inactive timers, too.

vagrant@app-staging:~$ sudo systemctl status apt-daily-upgrade.timer
● apt-daily-upgrade.timer - Daily apt upgrade and clean activities
     Loaded: loaded (/lib/systemd/system/apt-daily-upgrade.timer; disabled; vendor preset: enabled)
     Active: inactive (dead)
    Trigger: n/a
   Triggers: ● apt-daily-upgrade.service

When we have the timers running, we will see something similar with the details below (after starting both the services).

vagrant@app-staging:~$ sudo systemctl start apt-daily-upgrade.timer
vagrant@app-staging:~$ sudo systemctl status apt-daily-upgrade.timer
● apt-daily-upgrade.timer - Daily apt upgrade and clean activities
     Loaded: loaded (/lib/systemd/system/apt-daily-upgrade.timer; disabled; vendor preset: enabled)
     Active: active (waiting) since Tue 2021-02-02 10:38:17 UTC; 1s ago
    Trigger: Wed 2021-02-03 06:59:27 UTC; 20h left
   Triggers: ● apt-daily-upgrade.service

Feb 02 10:38:17 app-staging systemd[1]: Started Daily apt upgrade and clean activities.

vagrant@app-staging:~$ sudo systemctl list-timers
NEXT                        LEFT          LAST                        PASSED               UNIT                         ACTIVATES                     
Tue 2021-02-02 14:02:29 UTC 2h 53min left Sun 2020-08-16 03:36:36 UTC 5 months 18 days ago apt-daily.timer              apt-daily.service             
Tue 2021-02-02 14:48:41 UTC 3h 39min left Tue 2021-02-02 09:18:57 UTC 1h 49min ago         motd-news.timer              motd-news.service             
Tue 2021-02-02 19:13:07 UTC 8h left       Sun 2020-08-16 03:36:36 UTC 5 months 18 days ago fwupd-refresh.timer          fwupd-refresh.service         
Wed 2021-02-03 00:00:00 UTC 12h left      Tue 2021-02-02 09:12:11 UTC 1h 56min ago         logrotate.timer              logrotate.service             
Wed 2021-02-03 00:00:00 UTC 12h left      Tue 2021-02-02 09:12:11 UTC 1h 56min ago         man-db.timer                 man-db.service                
Wed 2021-02-03 06:59:27 UTC 19h left      Tue 2021-02-02 10:38:17 UTC 30min ago            apt-daily-upgrade.timer      apt-daily-upgrade.service     
Wed 2021-02-03 09:40:11 UTC 22h left      Tue 2021-02-02 09:40:11 UTC 1h 28min ago         systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Sun 2021-02-07 03:10:29 UTC 4 days left   Tue 2021-02-02 09:12:53 UTC 1h 56min ago         e2scrub_all.timer            e2scrub_all.service           
Mon 2021-02-08 00:00:00 UTC 5 days left   Tue 2021-02-02 09:12:11 UTC 1h 56min ago         fstrim.timer                 fstrim.service

Now, the following patch adds this to our ansible role.

diff --git a/install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml b/install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml                                                                                                   
index 29e1b876e..eee592cb2 100644
--- a/install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml
+++ b/install_files/ansible-base/roles/common/tasks/unattended_upgrades.yml
@@ -25,3 +25,15 @@
   tags:
     - apt
     - unattended-upgrades
+
+- name: Ensure apt-daily and apt-daily-upgrade timers are started, and enabled.
+  systemd:
+    name: "{{ item }}"
+    state: started
+    enabled: yes
+  with_items:
+    - 'apt-daily.timer'
+    - 'apt-daily-upgrade.timer'
+  tags:
+    - apt
+    - unattended-upgrades

But, still does not solve the timer issues, as you can notice, the apt-daily and apt-daily-upgrade are running on strange time automatically. @emkll please let me know what do you think.

Also, the config is missing the -focal from ./update_version.sh.

securedrop-config-0.1.3+1.8.0~rc1+focal-amd64.deb
securedrop-config-0.1.3+1.9.0-amd64.deb

Universe channel is required for `ntp` and `aptitude`

The current configuration of SecureDrop apt servers does not contain the `Suite` field which, with `Origin`, is the default combination used by unattended-upgrades to allow certain package lists to be updated. In order to avoid using a wildcard (e.g. SecureDrop:*, which would allow any (configured in apt sources) Suite for the SecureDrop Origin to be updated through unatteded upgrades, we use the newer Allowed-Origins syntax to specify the `Codename` field in lieu of the `Suite` field for SecureDrop.

This is inline with the configuration provided by apt(-test).freedom.press.

Unattended upgrades will reboot the system if and only if the dependency that is being updated requires a reboot. However, SecureDrop relies on cron-apt's reboot to ensure the memory is regularly cleared from the system. In order to reboot on a daily basis, we drop the updates-required flag in /var/run to tell unattended-upgrades that the system should be rebooted at the scheduled time. The absence of update-notifier-common package will make daily reboots silently fail, so adding explicitly to the apt package install step to ensure it's installed as it's not pulled in the Depends field of unattended-upgrades.

securedrop-config package will provide the configuration for focal only

@kushaldas

Based on feedback from @kushaldas, in some conditions the apt-daily and apt-daily upgrade would be masked and stopped after install. This should ensure the services and timers are properly enabled after install. They are automatically started by cron when the upgrade processes are invoked.

kushaldas

Did one more round of testing today: now everything looks good to me. I will wait till tomorrow to check for reboot, but everything else is working as planned.

Changes to the apt config in distribution.j2 matches the configuration of both apt.freedom.press and apt-test.freedom.press
Run molecule converge libvirt-staging-focal , the unattended-upgrades configuration is as expected
[ ] Optionally, add a package in Required of a control file, to observe dependencies also also downloaded by unattended-upgrades
Bump SecureDrop version locally: securedrop/bin/dev-shell ../update_version.sh 1.7.0 and build focal packages: make build-debs-focal
Deploy a local apt server vagrant up apt-local
Update or add an apt source to point to local server (dev[arch=amd64] http://10.0.1.7 focal main
If using staging, you will need to un-hold packages:
- app : sudo aptitude unhold securedrop-app-code securedrop-config securedrop-grsec securedrop-keyring securedrop-ossec-agent and mon, un
- mon : sudo aptitude unhold securedrop-config securedrop-grsec securedrop-keyring securedrop-ossec-server
sudo unattended-upgrades --dry-run makes sense, sudo unattended-upgrade d will apply the upgrades
Bump SecureDrop version once again: securedrop/bin/dev-shell ../update_version.sh 1.7.1 and build focal packages: make build-debs-focal
Redeploy a local apt server vagrant destroy apt-local && vagrant up apt-local (maybe vagrant provision apt-local will work here as well, untested.
Observe the package being updated automatically

conorsch · 2021-02-05T01:09:42Z

Looks great! Thanks for changes, @emkll. Test plan checks out, made sure to observe upgrades to unheld staging packages via apt-local. The only behavior I haven't verified manually was the cron logic, but we'll be observing that regularly post merge as part of QA. Let's get it in!

emkll force-pushed the 5295-unattended-upgrades branch 4 times, most recently from a8240b6 to 0a8334c Compare January 6, 2021 23:06

emkll requested a review from conorsch January 6, 2021 23:07

emkll marked this pull request as ready for review January 6, 2021 23:08

emkll requested a review from kushaldas as a code owner January 6, 2021 23:08

conorsch suggested changes Jan 8, 2021

View reviewed changes

emkll force-pushed the 5295-unattended-upgrades branch 2 times, most recently from 8628255 to 6d1d194 Compare January 21, 2021 23:20

emkll added the blocked label Jan 25, 2021

kushaldas suggested changes Jan 29, 2021

View reviewed changes

emkll force-pushed the 5295-unattended-upgrades branch 2 times, most recently from dc72c7d to 4b62bc2 Compare February 1, 2021 22:59

emkll removed the blocked label Feb 1, 2021

kushaldas suggested changes Feb 2, 2021

View reviewed changes

Updates apt sources for Focal

5a0c16b

Universe channel is required for `ntp` and `aptitude`

emkll added 5 commits February 2, 2021 16:04

Rename test file

331d01d

Use unattended-upgrades instead of cron-apt under Ubuntu Focal

475cf14

Add SecureDrop to Origin field in apt-local's reprepro config

50b9365

This is inline with the configuration provided by apt(-test).freedom.press.

emkll force-pushed the 5295-unattended-upgrades branch from 4b62bc2 to cd445c1 Compare February 3, 2021 14:23

Provide unattended-upgrades configuration via apt package

bddc184

securedrop-config package will provide the configuration for focal only

emkll force-pushed the 5295-unattended-upgrades branch 2 times, most recently from 44b1ae6 to 19ea23f Compare February 3, 2021 16:58

emkll force-pushed the 5295-unattended-upgrades branch from 19ea23f to 733bd11 Compare February 3, 2021 20:08

emkll mentioned this pull request Feb 3, 2021

Update docs to include instructions for unattended-upgrades under Ubuntu Focal freedomofpress/securedrop-docs#146

Merged

3 tasks

eloquence added the release blocker label Feb 4, 2021

eloquence added this to the 1.8.0 milestone Feb 4, 2021

kushaldas approved these changes Feb 4, 2021

View reviewed changes

conorsch approved these changes Feb 5, 2021

View reviewed changes

conorsch merged commit 5395bbc into develop Feb 5, 2021

emkll mentioned this pull request Feb 8, 2021

Bump securedrop-grsec-focal metapackage to 5.4.88 #5772

Merged

7 tasks

emkll deleted the 5295-unattended-upgrades branch February 8, 2021 21:19

emkll mentioned this pull request Feb 8, 2021

Adds securedrop-config 0.1.4 package for focal freedomofpress/securedrop-apt-test#90

Merged

conorsch mentioned this pull request Feb 11, 2021

Add dependency to ubuntu-release-upgrader-core #5781

Closed

emkll mentioned this pull request Feb 23, 2021

[Focal] reboot flag daily cron syntax is incorrect #5812

Closed

kushaldas mentioned this pull request Feb 26, 2021

Release SecureDrop 1.8.0 #5794

Closed

27 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace cron-apt with unattended-upgrades on Focal #5684

Replace cron-apt with unattended-upgrades on Focal #5684

emkll commented Jan 5, 2021 •

edited

Loading

codecov-io commented Jan 7, 2021

conorsch left a comment

conorsch Jan 7, 2021

conorsch Jan 7, 2021

conorsch Jan 7, 2021

conorsch Jan 7, 2021

conorsch Jan 7, 2021

conorsch Jan 7, 2021

emkll commented Jan 22, 2021

emkll commented Jan 25, 2021

conorsch commented Jan 26, 2021

kushaldas left a comment

kushaldas Jan 29, 2021

kushaldas Jan 29, 2021

emkll commented Jan 29, 2021

emkll commented Feb 1, 2021

kushaldas left a comment •

edited

Loading

kushaldas left a comment

conorsch commented Feb 5, 2021

Replace cron-apt with unattended-upgrades on Focal #5684

Replace cron-apt with unattended-upgrades on Focal #5684

Conversation

emkll commented Jan 5, 2021 • edited Loading

Status

Description of Changes

Testing

Deployment

Checklist

If you made changes to the server application code:

If you made changes to the system configuration:

If you made non-trivial code changes:

codecov-io commented Jan 7, 2021

Codecov Report

conorsch left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

emkll commented Jan 22, 2021

emkll commented Jan 25, 2021

conorsch commented Jan 26, 2021

kushaldas left a comment

Choose a reason for hiding this comment

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

emkll commented Jan 29, 2021

emkll commented Feb 1, 2021

kushaldas left a comment • edited Loading

Choose a reason for hiding this comment

kushaldas left a comment

Choose a reason for hiding this comment

conorsch commented Feb 5, 2021

emkll commented Jan 5, 2021 •

edited

Loading

kushaldas left a comment •

edited

Loading