Hi, A further consequence of this bug: Ubuntu's release upgrader uses aptsources.sourceslist.SourceEntry to migrate one-line .list sources to deb822 .sources. Because [signed-by=...] lines parse as invalid, it cannot convert them. It writes them, commented out, to foo.list.disabled and removes them from foo.list (deleting the file, or leaving only its comment lines). apt then has no source for those packages. The upgrader logs this only at DEBUG level, and apt update and apt upgrade report nothing.
signed-by is the recommended way to configure third-party repositories, so it is the correctly configured ones that get disabled. Seen on this machine during two release upgrades (to 26.04 and then 26.10). Excerpt from the upgrader's log (/var/log/dist-upgrade/main.log) for the 26.10 upgrade, timestamps removed: DEBUG Could not migrate deb [signed-by=/usr/share/keyrings/cloud.google.gpg] https://packages.cloud.google.com/apt cloud-sdk main from /etc/apt/sources.list.d/google-cloud-sdk.list, disabling instead. DEBUG Could not migrate deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/ubuntu resolute main from /etc/apt/sources.list.d/tailscale.list, disabling instead. The earlier upgrade to 26.04 disabled a third repository the same way (its .list.disabled file has the same header). Before that upgrade, dpkg.log shows its package being upgraded every few days. The last upgrade was the day before the release upgrade, and the next was 11 weeks later, after I restored the source by hand. Reproducer, on Ubuntu 26.10 with python3-apt 3.1.0ubuntu2: $ /usr/bin/python3 -c ' from aptsources.sourceslist import SourceEntry print(SourceEntry("deb [signed-by=/usr/share/keyrings/x.gpg] https://example.com/apt stable main").invalid) print(SourceEntry("deb [arch=amd64] https://example.com/apt stable main").invalid) print(SourceEntry("deb https://example.com/apt stable main").invalid) ' True False False [arch=] parses, but [signed-by=] does not. The upgrader acknowledges the cause in a comment in DistUpgrade/DistUpgradeController.py, migrateToDeb822Sources(), in ubuntu-release-upgrader 1:26.10.11: # It's possible that the source is considered invalid because python-apt # does not support [signed-by=] or something. For anything that we # cannot migrate, move it instead to <filename>.disabled. These will not # be cleaned up at the end of the upgrade. Fixing signed-by parsing in SourceEntry, along the lines of the patch already attached to this report, should let these entries migrate normally. The upgrader's handling of entries it cannot parse (removing them from the original file, logging only at DEBUG) is a separate Ubuntu issue. Versions (current, after the 26.10 upgrade): Ubuntu 26.10 (stonking) python3-apt 3.1.0ubuntu2 ubuntu-release-upgrader-core 1:26.10.11 apt 3.3.3 The 26.04 upgrade ran release-upgrader 26.04.22. Thanks, Ove Brynestad -- *CONFIDENTIALITY NOTICE* -- This email is intended only for the person(s) named in the message header. Unless otherwise indicated, it contains information that is confidential, privileged and/or exempt from disclosure without written approval by Ascenium Inc.
