apt-get update silently fails fetching security updates

[Roman Fiedler]

On Ubuntu Xenial, apt-get fails silently when security update server cannot be reached. This state could be detected by scanning the apt-get output afterwards. But manually adding workarounds to each apt-get invocation in production automation is prone to error, thus leaving machines without security updates.

Expected behaviour (e.g.):
* 0 - all OK
* 1 - temporary failure (e.g. network)
* 2 - permanent failure

Test:
* Change your update server IP in /etc/hosts to something unreachable
* Run apt-get update (might take a while)
* Check exit status

$ lsb_release -r -d
Description: Ubuntu 16.04.3 LTS
Release: 16.04
rfiedler@n3ahit1403:~$

ii apt 1.2.24 amd64 commandline package manager

[Julian Andres Klode (juliank)]

Really? It should print that it could not reach the server. Transient errors like that are ignored success-state wise so you don't end up with tons of error messages when you are offline or your connection is broken. I want to rework this eventually to give more control on what constitutes an error, but that's a long way off.

[Roman Fiedler (roman-fiedler-deactivatedaccount)]

Here the output:

# apt-get update
....
Err:3 http://mirror.[domain]/ubuntu xenial-security InRelease
  Unable to connect to mirror.[domain]:80:
Reading package lists... Done
...
W: Failed to fetch http://mirror.[domain]/ubuntu/dists/xenial-security/InRelease Unable to connect to mirror.[domain]:80:
W: Some index files failed to download. They have been ignored, or old ones used instead.
# echo $?
0

[Roman Fiedler (roman-fiedler-deactivatedaccount)]

See also
https://unix.stackexchange.com/questions/175146/apt-get-update-exit-status

[Julian Andres Klode (juliank)]

So, that's not a bug then. I eventually want to add a feature where you can switch between a one-source-must-update and a all-sources-must-update mode, but as mentioned before, that's way off - it probably requires quite a few changes.