os_patch_audit.sh

#!/usr/bin/env bash

set -euo pipefail

# os_patch_audit.sh
# Reports pending package updates and security update indicators.

if command -v apt-get >/dev/null 2>&1; then
  echo "Detected apt-based system"
  echo "Updating package index..."
  sudo apt-get update -y >/dev/null
  echo
  echo "Upgradable packages:"
  apt list --upgradable 2>/dev/null | tail -n +2 || true

  if command -v unattended-upgrade >/dev/null 2>&1; then
    echo
    echo "Unattended upgrades dry-run summary:"
    sudo unattended-upgrade --dry-run --debug | grep -E 'Packages that will be upgraded|No packages found' || true
  fi

elif command -v dnf >/dev/null 2>&1; then
  echo "Detected dnf-based system"
  echo "Available updates:"
  sudo dnf check-update || true
  echo
  echo "Security updates:"
  sudo dnf updateinfo list security || true

elif command -v yum >/dev/null 2>&1; then
  echo "Detected yum-based system"
  echo "Available updates:"
  sudo yum check-update || true
  echo
  echo "Security updates:"
  sudo yum updateinfo list security all || true

else
  echo "Unsupported package manager (apt/dnf/yum not found)."
  exit 1
fi