Public bug reported:
Related: #2130273 (Fix Released 26.04.5), #2086506, python-apt #2070432
(Won't Fix)
Impact
After 24.04 -> 26.04, every repository added with the documented "deb
[signed-by=...]" syntax ends up with no .sources file and no enabled source. On
this machine, that included a browser, Signal and OpenVPN3. They received no
updates since release upgrade while apt, update-notifier and
unattended-upgrades all reported the system as current. A browser going
unpatched with no warning is a security issue.
Cause
#2130273 fixed the upgrader *deleting* these files; they are now kept as
*.list.disabled. But they are still never migrated: python-apt's legacy parser
rejects signed-by= (#2070432, closed Won't Fix because "deb822 migration will
handle it") and the migration gives up on anything python-apt marks invalid.
The two decisions together leave the syntax every vendor documents unsupported.
Reproduce
1. On 24.04: deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg]
https://pkgs.tailscale.com/stable/ubuntu noble main
2. do-release-upgrade to 26.04.
Expected: tailscale.sources with Signed-By: (Enabled: no is fine, it is
visible).
Actual: tailscale.list.disabled, no .sources file, apt-cache policy shows no
candidate.
/var/log/dist-upgrade/main.log:
DEBUG Could not migrate deb
[signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg]
https://pkgs.tailscale.com/stable/ubuntu noble main from
/etc/apt/sources.list.d/tailscale.list, disabling instead.
Suggested fix
In migrateToDeb822Sources, before giving up on an invalid entry, extract the
[options] with a regex; signed-by= maps directly to Signed-By:, which the deb822
writer already emits. python-apt's legacy parser stays untouched.
ubuntu-release-upgrader 26.04.22 (upgrade run), python3-apt
3.1.0ubuntu1.1
** Affects: ubuntu-release-upgrader (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2167655
Title:
Third-party repos using [signed-by=] are left as .list.disabled after
upgrade; packages silently stop receiving security updates
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/2167655/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
