From 4ba57d251180469a58e6b59c3788d807260b02ea Mon Sep 17 00:00:00 2001
From: nkinkade <kinkade@measurementlab.net>
Date: Mon, 15 Jul 2024 16:44:54 -0400
Subject: [PATCH] Unconditionally add updates and security apt repos (#265)

By testing on my local machine, I verified that debootstrap only install the
main release repository. We also want <release>-updates and <release>-security
repositories, especially the latter. Without the latter unattended upgrades for
security updates will not work.
---
 setup_stage3_ubuntu.sh | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/setup_stage3_ubuntu.sh b/setup_stage3_ubuntu.sh
index 9f9b08e..9f606b5 100755
--- a/setup_stage3_ubuntu.sh
+++ b/setup_stage3_ubuntu.sh
@@ -98,11 +98,12 @@ fi
 trap "umount_proc_and_sys $BOOTSTRAP" EXIT
 
 mount_proc_and_sys $BOOTSTRAP
-    # Add extra apt sources to install latest kernel image and headers.
-    LINE='deb http://archive.ubuntu.com/ubuntu/ jammy-updates main universe multiverse'
-    if ! grep -q "$LINE" $BOOTSTRAP/etc/apt/sources.list ; then
-        chroot $BOOTSTRAP bash -c "echo '$LINE' >> /etc/apt/sources.list"
-    fi
+    # Add updates and security repositories to apt
+    UPDATES_REPO='deb http://archive.ubuntu.com/ubuntu/ jammy-updates main universe multiverse'
+    chroot $BOOTSTRAP bash -c "echo '$UPDATES_REPO' >> /etc/apt/sources.list"
+    SECURITY_REPO='deb http://archive.ubuntu.com/ubuntu/ jammy-security main universe multiverse'
+    chroot $BOOTSTRAP bash -c "echo '$SECURITY_REPO' >> /etc/apt/sources.list"
+
     # Update the apt repositories.
     chroot $BOOTSTRAP apt-get update --fix-missing