[trashfindhunter]

Another possibility for managing this would be to use a puppet agent / master setup, and use puppet directives to pin sensitive packages (i.e. the ones that comprise your application) to specific versions while allowing the rest of the system to update accordingly (assuming the pinned packages don't cause dependency issues - which should be tested before pushing).

So the process might look like this:

1. Manually update a test system and take note of the packages comprising your application and their new versions ('grep -E "<PATTERN>" --color=always' could be helpful here). 2. Run automated tests against the test build to ensure that new packages have not caused issues. 3. If any breaking changes are discovered, pin the offending packages to their unbroken versions. Rinse and repeat. 4. Once a stable build is found, update your puppet manifests to reflect any pinned packages and run it on a single test system (I use an isolated puppet master test server for this). 5. If all goes well on the test system, update the main puppet master server and wait for the agents to call home (don't forget to update the runinterval directive in puppet.conf so the agents don't call home every 30 minutes - even idempotent processes consume resources).

Further reading:

https://forge.puppet.com/puppetlabs/apt https://wiki.debian.org/AptConfiguration https://help.ubuntu.com/community/PinningHowto