Store sending out notices for ESM-only CVEs (for `base: core20`, too)

[Michał Sawicz]

I got notice of a handful of outdated packages in some of my snaps, e.g. mir-kiosk-kodi:

```
A scan of this snap shows that it was built with packages from the Ubuntu
archive that have since received security updates. The following lists new
USNs for affected binary packages in each snap revision:

Revision r459 (amd64; channels: stable, candidate, beta)
 * libsmbclient: 5822-2
 * libwbclient0: 5822-2
 * python3-samba: 5822-2
 * samba-common: 5822-2
 * samba-common-bin: 5822-2
 * samba-libs: 5822-2

Revision r460 (arm64; channels: stable, candidate, beta)
 * libmysofa1: 5184-1
 * libpython2.7: 5342-2
 * libpython2.7-minimal: 5342-2
 * libpython2.7-stdlib: 5342-2
 * libsmbclient: 5822-2
 * libwbclient0: 5822-2
 * libzmq5: 4920-1
 * python-pil: 5777-2
 * python2.7: 5342-2
 * python2.7-minimal: 5342-2
 * python3-samba: 5822-2
 * samba-common: 5822-2
 * samba-common-bin: 5822-2
 * samba-libs: 5822-2

# ...
```

Most of these CVEs are only fixed in ESM:

 * https://ubuntu.com/security/notices/USN-4920-1/
 * https://ubuntu.com/security/notices/USN-5184-1/
 * https://ubuntu.com/security/notices/USN-5342-2/
 * https://ubuntu.com/security/notices/USN-5777-2/
 * https://ubuntu.com/security/notices/USN-5822-2/

Is there even a story for building snaps with ESM? Shouldn't this be opt-in per snap?

[Daniel Manrique (roadmr)]

The store does nothing in the notification-sending process; we just generate a dump of stage-packages for other tools to analyze and email about.

[Emilia Torino (emitorino)]

Daniel, what about this part:

"Is there even a story for building snaps with ESM? Shouldn't this be opt-in per snap?"

[Daniel Manrique (roadmr)]

Hi, that sounds like a feature request, and we are aware it'd be nice for the store to have this kind of control and take a more active role in notification generation, but that's still in the pre-planning phase :(

[Colin Watson (cjwatson)]

Is there any reason we shouldn't just enable ESM for core18 and core20 builds in Launchpad, as we did for core a while back (see https://ubuntu.com/blog/how-does-ubuntu-16-04-entering-extended-security-maintenance-esm-affect-snap-publishers)?

[Alan Griffiths (alan-griffiths)]

> Is there any reason we shouldn't just enable ESM for core18 and core20 builds in Launchpad

While I like that solution, that would mean that local builds (running in Multipass/LXD) could have different content than Launchpad builds

[Alex Murray (alexmurray)]

> While I like that solution, that would mean that local builds (running in Multipass/LXD) could have different content than Launchpad builds

But that is already the case for base: core snaps as Colin mentioned above where esm-infra+esm-apps for xenial is already enabled for Launchpad builds.

Personally I think the idea of getting ESM automatically when using launchpad (and build.snapcraft.io by extension) for building you snap is an awesome product offering (but the decision to actually turn that on is above my pay grade)

[Alex Murray (alexmurray)]

This was fixed in the review-tools package via https://code.launchpad.net/~alexmurray/review-tools/+git/review-tools/+merge/436677 which has now been merged and deployed with a configuration to ignore security updates (ie USNs) that reference esm-apps.

[Jamie Strandboge (jdstrand)]

> Is there any reason we shouldn't just enable ESM for core18 and core20 builds in Launchpad, as we did for core a while back (see https://ubuntu.com/blog/how-does-ubuntu-16-04-entering-extended-security-maintenance-esm-affect-snap-publishers)?

I came across this issue with a snap using core18 as a base. If Launchpad builds aren't enabling ESM by default for core18 and higher, how can I tell Launchpad to use ESM for my snap ('snapcraft --ua-token <ua-token>' works locally)?

[Alex Murray (alexmurray)]

hey jdstrand! Sadly there is no way to get LP to build a snap with ESM enabled currently.

[Jamie Strandboge (jdstrand)]

Hey Alex,

Has anything changed in the last few months? https://forum.snapcraft.io/t/call-for-testing-snapcraft-7-4-0/35264 talks about core18 EOL and refers to https://canonical.com/blog/ubuntu-18-04-eol-for-devices which advocates buying Pro. This is somewhat misleading since while I have Pro, I can't take full advantage of it in my snaps built in LP. Besides building locally, is there anything I can do to use my ESM with snap builds? If not, are there plans for this (and what is the timeline)?

Thanks!

[Alex Murray (alexmurray)]

Hey Jamie :)

I believe the plan is to allow publishers to enrol a Pro token with the Store which will then delegate that to LP for the builds, but as far as I know that is only a plan. At this stage, the best advice I can give is to migrate to core20 or core22 (which I realise is non-trivial and a bit of a cop-out) but is the only feasible way forward currently for publishers who want to keep the stage-packages of their snaps up-to-date. To keep things clearer for publishers, until it is possible to use the store to enable a snap to build with Ubuntu Pro, I have disabled the USN notification service from sending notifications for updates which come from esm-infra/bionic.

Sorry I don't have better news.