[Touch-packages] [Bug 1918930] Re: Unexpected file size of one package interrupts update process for all packages and leaves system vulnerable

2021-04-12 Thread Julian Andres Klode
** Changed in: apt (Ubuntu)
   Status: New => Triaged

** Changed in: apt (Ubuntu)
   Importance: Undecided => Low

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1918930

Title:
  Unexpected file size of one package interrupts update process for all
  packages and leaves system vulnerable

Status in apt package in Ubuntu:
  Triaged

Bug description:
  An unexpected file size error of *one* package interrupts the whole
  update process for *all* packages and this can leave the system in a
  vulnerable state - this is not a constructed situation, but very real
  right now, look at the following console output - sublime has some
  problems with its package size, but then important ssh updates are not
  executed. Bad.

  The following packages will be upgraded:
brave-browser git git-man libpython2.7-minimal libpython2.7-stdlib 
linux-firmware openssh-client openssh-server openssh-sftp-server python2.7 
python2.7-minimal python3-pil sublime-merge
  13 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
  Need to get 4.548 kB/199 MB of archives.
  After this operation, 1.744 kB of additional disk space will be used.
  Do you want to continue? [Y/n]
  Get:1 https://download.sublimetext.com apt/stable/ sublime-merge 2049 [4.548 
kB]
  Err:1 https://download.sublimetext.com apt/stable/ sublime-merge 2049
File has unexpected size (4542548 != 4548032). Mirror sync in progress? 
[IP: 104.236.0.104 443]
Hashes of expected file:
 - 
SHA512:f65ce3ca80ff0877da48826a0151036cd8e0bdf28b03d225a03f202262ca1278accdac8e7eb46a22904203750ccf06e3abe496a44f7a4b0c3363076501f72369
 - SHA256:e71fcf37e9d934a60b5112a7b79c819f03f55d331371ec0e9b02378c6234478c
 - SHA1:7fe54a9f7ea5383dbdfc0aae39310e2902c6d7f5 [weak]
 - MD5Sum:fd78a3b986bd7da8b2ebd1f659f5938c [weak]
 - Filesize:4548032 [weak]
  E: Failed to fetch 
https://download.sublimetext.com/files/sublime-merge_build-2049_amd64.deb  File 
has unexpected size (4542548 != 4548032). Mirror sync in progress? [IP: 
104.236.0.104 443]
 Hashes of expected file:
  - 
SHA512:f65ce3ca80ff0877da48826a0151036cd8e0bdf28b03d225a03f202262ca1278accdac8e7eb46a22904203750ccf06e3abe496a44f7a4b0c3363076501f72369
  - SHA256:e71fcf37e9d934a60b5112a7b79c819f03f55d331371ec0e9b02378c6234478c
  - SHA1:7fe54a9f7ea5383dbdfc0aae39310e2902c6d7f5 [weak]
  - MD5Sum:fd78a3b986bd7da8b2ebd1f659f5938c [weak]
  - Filesize:4548032 [weak]
  E: Unable to fetch some archives, maybe run apt-get update or try with 
--fix-missing?

  Note: This issue is not about the package size error in a third party
  repo - I do not blame Ubuntu for problems with that. This is about
  breaking the whole process of updating the system because one single
  sub-task fails.

  Why not make the basic tools really robust and reliable?

  BTW - here are s many free pixels on this screen - why not add two
  or three small sentences about text formatting syntax available in
  this extremely primitive text input box? Is there any text formatting
  at all? Why not put just a little bit of love to the user perspective
  and experience? Just two little senteces about formatting would make
  it so much more user friendly to type here. It feels so quick-and-
  dirty, it hurts. Very sad.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1918930/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp


[Touch-packages] [Bug 1918930] Re: Unexpected file size of one package interrupts update process for all packages and leaves system vulnerable

2021-03-12 Thread David Kalnischkies
APT can't know how "critical" the other packages are compared to the
packages which failed to download (which really shouldn't happen to
begin with). I mean, if you don't (normally) use an SSH server, but
hard-depend on a sublime text-editor experience…

Have you tried the --fix-missing option the error message points to? It
will make it so that apt still shows the errors, but it will continue on
and install all packages it could successfully acquire. That is still a
failure for the whole process though (if that would be silent it would
be too easy for an attacker to fail these downloads and make you believe
you are up-to-date while nothing was installed – especially in
unattended processes).

Perhaps we should make that an interactive question in "apt" to have it
more easily discoverable for an interactive user?

(not commenting on the LP things, you may want to talk to them directly
about this rather than venting in an unrelated bugreport)

-- 
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1918930

Title:
  Unexpected file size of one package interrupts update process for all
  packages and leaves system vulnerable

Status in apt package in Ubuntu:
  New

Bug description:
  An unexpected file size error of *one* package interrupts the whole
  update process for *all* packages and this can leave the system in a
  vulnerable state - this is not a constructed situation, but very real
  right now, look at the following console output - sublime has some
  problems with its package size, but then important ssh updates are not
  executed. Bad.

  The following packages will be upgraded:
brave-browser git git-man libpython2.7-minimal libpython2.7-stdlib 
linux-firmware openssh-client openssh-server openssh-sftp-server python2.7 
python2.7-minimal python3-pil sublime-merge
  13 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
  Need to get 4.548 kB/199 MB of archives.
  After this operation, 1.744 kB of additional disk space will be used.
  Do you want to continue? [Y/n]
  Get:1 https://download.sublimetext.com apt/stable/ sublime-merge 2049 [4.548 
kB]
  Err:1 https://download.sublimetext.com apt/stable/ sublime-merge 2049
File has unexpected size (4542548 != 4548032). Mirror sync in progress? 
[IP: 104.236.0.104 443]
Hashes of expected file:
 - 
SHA512:f65ce3ca80ff0877da48826a0151036cd8e0bdf28b03d225a03f202262ca1278accdac8e7eb46a22904203750ccf06e3abe496a44f7a4b0c3363076501f72369
 - SHA256:e71fcf37e9d934a60b5112a7b79c819f03f55d331371ec0e9b02378c6234478c
 - SHA1:7fe54a9f7ea5383dbdfc0aae39310e2902c6d7f5 [weak]
 - MD5Sum:fd78a3b986bd7da8b2ebd1f659f5938c [weak]
 - Filesize:4548032 [weak]
  E: Failed to fetch 
https://download.sublimetext.com/files/sublime-merge_build-2049_amd64.deb  File 
has unexpected size (4542548 != 4548032). Mirror sync in progress? [IP: 
104.236.0.104 443]
 Hashes of expected file:
  - 
SHA512:f65ce3ca80ff0877da48826a0151036cd8e0bdf28b03d225a03f202262ca1278accdac8e7eb46a22904203750ccf06e3abe496a44f7a4b0c3363076501f72369
  - SHA256:e71fcf37e9d934a60b5112a7b79c819f03f55d331371ec0e9b02378c6234478c
  - SHA1:7fe54a9f7ea5383dbdfc0aae39310e2902c6d7f5 [weak]
  - MD5Sum:fd78a3b986bd7da8b2ebd1f659f5938c [weak]
  - Filesize:4548032 [weak]
  E: Unable to fetch some archives, maybe run apt-get update or try with 
--fix-missing?

  Note: This issue is not about the package size error in a third party
  repo - I do not blame Ubuntu for problems with that. This is about
  breaking the whole process of updating the system because one single
  sub-task fails.

  Why not make the basic tools really robust and reliable?

  BTW - here are s many free pixels on this screen - why not add two
  or three small sentences about text formatting syntax available in
  this extremely primitive text input box? Is there any text formatting
  at all? Why not put just a little bit of love to the user perspective
  and experience? Just two little senteces about formatting would make
  it so much more user friendly to type here. It feels so quick-and-
  dirty, it hurts. Very sad.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1918930/+subscriptions

-- 
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help   : https://help.launchpad.net/ListHelp