This is a confusing comment because Debian/Ubuntu/etc (you referenced apt) have separate security repositories that exist for this purpose. They have only security fixes and don't try to unnecessarily fix "other" stuff. I have not heard of the security repos pushing out a breaking update before.

`unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.

Especially in environments where manglement mandate something like Qualys, leading to demands that systems must be patched to address the critical vulnerabilities that it's reported despite said vulnerabilities being unexploitable.

One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.

Wire the script to a pressure sensor in your seat, save-all/update/reboot every time you get out of your chair.

Bonus points for relaunching programs open during initial execution of script.

There are pro/enterprise features that can upgrade the linux kernel without downtime, like livepatch or kpatch. (The non-proprietary klp-build is still missing tooling for most distros I think.)

Debian based systems can be queried if they need a reboot because of dpkg. But this was the same then 20 years ago....

Is anyone at Debian paid to keep up with this spigot of CVEs?

"Shit why is everything dead"

Isn't biggest attack surface in drivers? I expect distros to split less popular kernel modules into many separate opt-in packages at cost of default hardware support, and kernel developers to purge everything without active development team. The good old "lets leave it in tree, someone might find it useful" was nice idea but that is the part that is definitely not sustainable.

GenodeOS :: SculptOS might get more attention for just this reason.