When setting up Raspbian Lite and installing unattended-upgrades, the origins list defaults to this:
"o=Debian,codename=${distro_codename},label=Debian-Security";
Is it safe (or wise) to use this, or should Debian be changed to Raspbian? There are posts around from people that seem to have had Raspbian in there by default, so I'm not sure whether it's new/recommended behaviour to use Debian or whether the default has somehow become bad since.
If your goal is to only get security updates unattended, without updating all the packages, you need to point to Debian, as Raspian does not maintain a separate security distribution. If you point to Raspian you'll update everything which is more likely to break something.
As to the question of how safe it is to have truly unattended security-only updates from Debian onto Raspbian stretch, as in how (un)likely are they to break something, I hope someone else can answer that. I'm facing the same question. I speculate that the contributors for Debian are good at deciding which updates can percolate unattended, but I lack the depth of knowledge to consider how likely those updates are to break something unique to Raspian. I can say that Ubuntu, which is another derivation of Debian, has a distro-specific security update repo, because my Ubuntu 50automatic-upgrades configuration file points to it, but I don't know what Ubuntu does to serve that repo. Do they test the Debian upgrades themselves before populating their distro repo (implying that Raspian not doing the same thing introduces risk), or do they just point to the Debian updgrades (which would imply the Raspbian behavior is safe)?
While assumptions and speculation are generally bad form for answers in a forum like this, nobody else has answered this question. I hope someone else with more knowledge can provide a better answer.
This is a rather YMMV.
Personally, I would not allow any auto (even a security) update on a working device (in a production line) unless I already have a full backup. The reason is simply something may just cause an auto update to crash and that will probably cause the device to dangle.
If you had another Rpi Lite running with the same configuration in a different (private) LAN as a test bed, perhaps you can manually perform an update (no auto nor unattended update). If the update works flawlessly, then perhaps you can swap out the devices and let it run to see if the update will cause any problem. If you find no problem with the update, then I believe it is safe for you fully update the device and swap it back.
