SxUpdate (StackX Update)
SxUpdate is a GPL-licensed Bash script designed to reliably automate Debian system updates, as run on the StackX servers at ScalarX.
SxUpdate handles non-interactive execution, preservation of configuration files, logging, detection of a required reboot, and resilience to third-party repositories (Sury, NodeSource, MariaDB, Webmin, etc.) by automatically repairing APT signature/key problems.
Main features
– Checks root privileges.
– Uses a lockfile to prevent concurrent runs.
– Prefetches packages before upgrading (-d full-upgrade).
– Optional cleanup at the end of a run (–clean).
– Preserves configuration files through –force-confdef and –force-confold.
– Supports ucf through environment variables (preserving configurations).
– Disables common prompts (needrestart, apt-listchanges).
– Detects signature/key errors (NO_PUBKEY, EXPKEYSIG, etc.).
– Repairs existing sources without destructive changes by adding/correcting signed-by without overwriting options/mirrors.
– Supports /etc/apt/sources.list + *.list + *.sources (deb822) formats.
– As a last resort, automatically imports missing key IDs through a sequence of keyservers.
– Logs each run in /var/log/sxupdate/
– Reports at the end of the script whether a reboot is required (/var/run/reboot-required).
Usage
After downloading the script:
cp sxupdate.sh /usr/local/bin/sxupdate
chmod +x /usr/local/bin/sxupdate
Standard run:
sxupdate
Run with automatic cleanup at the end:
sxupdate --clean
Maintenance mode (force repair routines to run before apt-get update):
sxupdate --force-repair
Note: the script must be run with root privileges (using sudo or directly as root).
Design notes
The script is designed to work in “dual mode”: scheduled execution (cron) across a fleet of servers, without human intervention, but also manual execution when needed.
APT repository repairs are non-destructive: the script avoids overwriting an existing configuration (internal mirror, specific APT options) and only corrects what is needed for it to work properly (key/signature).
Todo list
– Add a –dry-run mode to simulate the steps.
– Proactively detect failing repositories (with optional quarantine of a third-party repository that breaks apt update).
– Detect broken packages and suggest a fix.
Resources
Script: sxupdate.sh
—
Christophe Casalegno (find all my social networks at: all.bo)