Skip to main content

max / makenotwork

Ship a one-package ca-certificates refresh timer for prod prod-1's Unattended-Upgrade::Allowed-Origins covers noble, noble-security and the two ESM security pockets, and leaves noble-updates out: a dry run showed adding it would upgrade 40 packages including cloud-init, netplan and apparmor, which is a real way to lose the single production host. But ca-certificates ships to noble-updates, and has reached noble-security only by Ubuntu's publishing habit rather than by any rule. This closes that one gap on a mechanism. Blast radius is exactly ca-certificates plus openssl. Package-Whitelist cannot do the job -- it filters within the allowed origins and never adds one -- and strict mode silently ends security patching for everything not whitelisted. Policy and what would have to be true to revisit it: wiki prod-patching-policy.
Author: Max Johnson <me@maxj.phd> · 2026-08-28 18:06 UTC
Signed with PGP, not checked
Commit: be39295e21b5f6ea3814775e0eeb237a5eaec3a7
Parent: 046fa6e
3 files changed, +61 insertions, -0 deletions
@@ -1,0 +1,18 @@
1 + [Unit]
2 + # Policy and what was ruled out: wiki note prod-patching-policy, and
3 + # setup-ca-certificates-refresh.sh beside this file.
4 + Description=Refresh ca-certificates
5 +
6 + [Service]
7 + Type=oneshot
8 + Environment=DEBIAN_FRONTEND=noninteractive
9 + # Two commands, one package. Unattended-upgrades on this host does not read
10 + # noble-updates (see the wiki note), and ca-certificates has historically
11 + # reached noble-security only by Ubuntu's habit rather than by any guarantee.
12 + # This closes that one gap without broadening what else may install itself
13 + # unattended on the single production host.
14 + ExecStart=/usr/bin/apt-get -q update
15 + ExecStart=/usr/bin/apt-get -q -y --only-upgrade install ca-certificates
16 +
17 + [Install]
18 + WantedBy=multi-user.target
@@ -1,0 +1,10 @@
1 + [Unit]
2 + Description=Daily ca-certificates refresh
3 +
4 + [Timer]
5 + OnCalendar=daily
6 + RandomizedDelaySec=1h
7 + Persistent=true
8 +
9 + [Install]
10 + WantedBy=timers.target
@@ -1,0 +1,33 @@
1 + #!/bin/bash
2 + # Install the one-package ca-certificates refresh timer on the Makenotwork
3 + # production host. Idempotent: safe to re-run.
4 + #
5 + # Why this exists at all: prod's Unattended-Upgrade::Allowed-Origins covers
6 + # noble, noble-security and the two ESM security pockets, and deliberately
7 + # leaves noble-updates out. ca-certificates is published to noble-updates and
8 + # has reached noble-security too, but by Ubuntu's publishing habit rather than
9 + # by any rule. This timer closes that one gap on a mechanism instead of a
10 + # habit, and its blast radius is exactly ca-certificates plus openssl.
11 + #
12 + # What was ruled out, so it is not re-derived: Unattended-Upgrade::Package-
13 + # Whitelist filters *within* the allowed origins and never adds one, confirmed
14 + # by dry-run on this host. Strict mode is worse -- it pins every allowed origin
15 + # to -1 and lifts only whitelisted names, silently ending security patching for
16 + # everything else.
17 + #
18 + # Full policy, including what would have to be true to revisit it: wiki note
19 + # `prod-patching-policy`.
20 +
21 + set -euo pipefail
22 +
23 + if [ "$(id -u)" -ne 0 ]; then
24 + echo "run as root on the production host" >&2
25 + exit 1
26 + fi
27 +
28 + cd "$(dirname "$0")"
29 + install -m 0644 ca-certificates-refresh.service /etc/systemd/system/
30 + install -m 0644 ca-certificates-refresh.timer /etc/systemd/system/
31 + systemctl daemon-reload
32 + systemctl enable --now ca-certificates-refresh.timer
33 + systemctl list-timers ca-certificates-refresh.timer --no-pager