| 1 |
[Unit] |
| 2 |
# Policy and what was ruled out: wiki note prod-patching-policy, and |
| 3 |
# setup-ca-certificates-refresh.sh beside this file. |
| 4 |
Description=Refresh ca-certificates |
| 5 |
|
| 6 |
[Service] |
| 7 |
Type=oneshot |
| 8 |
Environment=DEBIAN_FRONTEND=noninteractive |
| 9 |
# Two commands, one package. Unattended-upgrades on this host does not read |
| 10 |
# noble-updates (see the wiki note), and ca-certificates has historically |
| 11 |
# reached noble-security only by Ubuntu's habit rather than by any guarantee. |
| 12 |
# This closes that one gap without broadening what else may install itself |
| 13 |
# unattended on the single production host. |
| 14 |
ExecStart=/usr/bin/apt-get -q update |
| 15 |
ExecStart=/usr/bin/apt-get -q -y --only-upgrade install ca-certificates |
| 16 |
|
| 17 |
[Install] |
| 18 |
WantedBy=multi-user.target |
| 19 |
|