On Mon, Mar 18, 2013 at 01:32:09AM -0700, Raphaël Pinson wrote:
> > @@ -0,0 +1,5 @@
> > +// file managed by puppet
> > +Unattended-Upgrade::Allowed-Origins {
> > +  "Debian testing";
> 
> Our machines don't usually (and shouldn't) have `testing` sources.list.

Actually they do, and this is definitely needed. For the record, this
discussion has been started one year ago. Meaning that we have had wheezy
machines running since that time at least. I'm pretty sure this will be no
different post-wheezy release.

As we want to avoid referring to a moving target such as "stable" or
"testing", I'd suggest to filter on the distro codename instead:

    Unattended-Upgrade::Origins-Pattern {
      "o=Debian,n=wheezy";
    }