USC/APTURL allows a package installation to invisibly uninstall vital packages

[Ryan Finnie]

Update:
Bug #793318 has been made an alias of this bug without notifying here that it relates to APTURL and modifying this header.
A similar horror story happened invisibly after clicking an APTURL link in a Web page. In that example, it removed the communication manager to make restoring difficult.
The problem is doing the operations blindly, without showing what's happening. Removing Synaptic Packet Manager is also a similar problem.
Please add "Affects apturl (Ubuntu)" like in that page.

Original:
software-center 5.4.1.3, Ubuntu 12.10

I downloaded steam_latest.deb from steampowered.com, saved it, double clicked on it, and Software Center launched. It brought up the deb information page, I clicked Install, and Software Center proceeded to remove literally about half of the installed pacakges on my system (about 400), including things like unity, ubuntu-desktop, and, ironically, software-center itself. It eventually errored out (see attached log).

Using /var/log/apt/history.log, I was able to restore the system's packages to their previous state, but Software Center shouldn't have allowed this to happen (whether or not the third-party .deb was actually at fault).

NB: To correct the apt error, I did "apt-get -f install". Then, after I apt-get installed the packages which were removed, steam was still installed, so it wasn't a dependency error which caused the packages to be removed. I have no idea why it actually happened.

<https://wiki.ubuntu.com/SoftwareCenter#installing>: "4. If installing the software would involve removing ubuntu-desktop, the package should be treated as uninstallable (just as it is with software updates). 5. If the relevant package cannot be installed, for that reason or any other, an error alert should appear..."

[Ryan Finnie (fo0bar)]

I now know at least what the trigger was: I had upgraded cairo packages from raring on this quantal machine (see Bug #1073372), and steam ultimately depended on libcairo*:i386, and different versions of the same package cannot live on the same multiarch install. Still, software-center should have prevented the package from being installed, or at least warned that packages were about to be removed.

[Matthew Paul Thomas (mpt)]

"Removing ubuntu-desktop ..."

This at least should have caused USC to cancel the installation before it even began. I have a design for this situation in Software Updater <https://wiki.ubuntu.com/SoftwareUpdates#uninstallable>, but it hadn't occurred to me that the same thing could happen with USC.

If you don't mind, I'll focus this bug report on the issue of installing anything that would remove vital components. Problems with the Steam package in particular are outside the control of Ubuntu developers.

[Matthew Paul Thomas (mpt)]

Specification updated. <https://wiki.ubuntu.com/SoftwareCenter?action=diff&rev2=688&rev1=687>

[André Pirard (a.pirard)]

See bug #793318 for a similar horror story.
The issue is not only preventing the system to crash but hiding from the user all the information that Synaptic Packet Manager shows.
One of the reasons I abandoned Windows is that setup.exe is (was?) a black box most often without warning of what it's going to do, like replacing a component of the system with a more recent one but in the wrong language.
With the removal of Synaptic Packet Manager and exclusivity of blind USC, Ubuntu has become like Windows.
I suggest making USC controls as wonderful as SPM on demand.
Fortunately, the oder system killing bug affected only one person and was low priority but this one affects two and is of high priority ;-)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.