- only possible upgrade path for packages installed from Makefile.extras
- leave it disabled as we don't want third-party APT sources in the default setup
- the GPG signing key is not trusted by default and must be manually trusted by the administrator
- auto-upgrade packages from buster-updates, proposed-updates, security, backports
- split the upgrade into minimal steps (so that shutodwns during upgrades are possible)
- enable logging to syslog
- daily, automatic update of package lists, download and installation of upgrades