Look at unattended-upgrades

[geofft]

It's possible we should be using Ubuntu's unattended-upgrades package (possibly with some site config) instead of our own auto-update, for all the standard reasons that upstream software is good -- the most important one here being that mistakes cause people besides us to get in trouble too. :-)

We should see if unattended-upgrades is reasonable for our use case, or see if at the least there are design decisions that Ubuntu made for it that would be worth adapting.