if (pkg.is_upgradable or candidate_version_changed(pkg) and is_pkgname_in_whitelist(pkg.name, cache.whitelist)):
is evaluated as "pkg.is_upgradable or (candidate_version_changed(pkg) and is_pkgname_in_whitelist(...))". Every upgradable package satisfies the first operand, so the whitelist is never consulted.
It was introduced upstream in commit 4d0c9cd, first released in 1.16 (October 2019), which is why 1.11.2 in Debian 10 is the last version where the whitelist works: bullseye, bookworm and trixie are all affected, as is the current upstream 2.13.
Fix and regression test proposed upstream: https://github.com/mvo5/unattended-upgrades/pull/412
--- a/unattended-upgrade +++ b/unattended-upgrade@@ -2079,8 +2079,8 @@ def calculate_upgradable_pkgs(cache, # type: UnattendedUpgradesCache
getattr(pkg, "candidate", pkg.name), getattr(pkg.candidate, "origins", []))) - if (pkg.is_upgradable or candidate_version_changed(pkg) - and is_pkgname_in_whitelist(pkg.name, cache.whitelist)): + if ((pkg.is_upgradable or candidate_version_changed(pkg)) + and is_pkgname_in_whitelist(pkg.name, cache.whitelist)): try: ver_in_allowed_origin(pkg, cache.allowed_origins) except NoAllowedOriginError:
OpenPGP_signature.asc
Description: OpenPGP digital signature
