Hi, My understanding is that the Ubuntu Technical Board has a long-standing policy against enabling PPAs without a formal exception. For background, a request to enable a Unity 8 PPA for 16.04 LTS users was denied. See LP: #1585362
Software Boutique ----------------------- Ubuntu MATE for several releases has shipped a Software Boutique app (source package is ubuntu-mate-welcome). While it respects the letter of the policy (Ubuntu MATE does not enable PPAs by default), the UI at least bends the interpretation of the policy. It's fairly easy to try out even without installing Ubuntu MATE. Just grab the 17.10 iso (the 18.04 version of the app hasn't been fully updated for available sources) and run System> Administration> Software Boutique. (The Boutique app is also promoted as part of the Welcome app experience after install). There is a large amount of software available for install, some of it comes directly from Ubuntu. Others are not part of Ubuntu at all. A user could easily install the Brave web browser and be unaware that they have enabled a third-party software source and unaware of the consequences of doing that. The prominent "Retrieve the latest software listings" link (once "Apply Changes" is clicked) enables the Ubuntu Mate Welcome PPA. Consequences ------------------- It's a lot of third-party sources that are not vetted or monitored by anyone except for the Ubuntu MATE developers. My understanding is that all third-party sources are disabled on upgrade by ubuntu-release-upgrader and not re-enabled afterwards. This is a serious problem. For instance, a user could install Brave in 17.10 and a few months later, upgrade to 18.04 and then not receive any security updates for Brave any more. Also, the Ubuntu upgrader does not run ppa-purge which could cause issues on upgrade. I don't know if it affects any of the Boutique apps, but it is a problem for some types of repos. I think many Ubuntu developers and contributors would consider a system with a significant number of third-party repositories like that to be in an unsupported state. (??) Informed Consent ---------------------- During install of those apps, the app does not directly explain to users what they are doing and where the software is coming from. There is a details button next to the Install button that does mention the source. Other Background ----------------------- I had assumed that the Tech Board was aware of the Software Boutique and had generally approved it. I do feel a bit uncomfortable with bringing up a topic that could take away one of Ubuntu MATE's popular features, and I didn't really feel doing so was my responsibility. I believe Iwas mistaken on some of those points, but it explains why I hadn't written this list sooner. I (very) briefly discussed this app and the possible TB concerns with Martin Wimpress a long while ago. Conclusion -------------- Therefore, I propose this topic for the next Technical Board meeting, which I believe is scheduled for February 27. I might not attend (I've said quite a bit in this email already!) Thanks, Jeremy Bicha -- technical-board mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/technical-board
