apt_pkg configuration leaks in get_pkg_candidate_version

[Renan Rodrigo]

[Impact]
Users who import and run the uaclient.apt.get_pkg_candidate_version function will have their apt_pkg configuration pointed to the ubuntu-advantage-tools managed esm cache while running the same process.

The fix is to use the same context manager used for security-status, which guarantees that the configuration is the same before and after u-a-t access any of the Caches.

[Test Case]
- On any release, in a Python interpreter:
```
import apt
from uaclient.apt import get_pkg_candidate_version
print(len(apt.Cache()))
v = get_pkg_candidate_version('vim') # arbitrary choice, may be any package
print(len(apt.Cache()))
```

The size of the Cache should match, before and after the function call.
On u-a-t 27.14, this fails.

[Regression Potential]
If we fix this the wrong way, people may still get their apt_pkg config in a state they wouldn't expect for the specific python process they are running. This would be the same as not fixing it. Our test aims to mitigate the possibility of such thing happening.

[Discussion]
There is a really small chance of this bug happening, given there are no user flows including this function being called directly, and process isolation takes care of the rest. However, given the specificities of the apt and apt_pkg integration in u-a-t, it is important to fix this and cover any corner case.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.1~23.04.1

---------------
ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

 -- Renan Rodrigo <email address hidden> Thu, 23 Mar 2023 13:41:05 -0300

[Andreas Hasenack (ahasenack)]

Hello Renan, or anyone else affected,

Accepted ubuntu-advantage-tools into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~22.10 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Renan, or anyone else affected,

Accepted ubuntu-advantage-tools into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~22.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Renan, or anyone else affected,

Accepted ubuntu-advantage-tools into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~20.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Renan, or anyone else affected,

Accepted ubuntu-advantage-tools into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~18.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Andreas Hasenack (ahasenack)]

Hello Renan, or anyone else affected,

Accepted ubuntu-advantage-tools into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ubuntu-advantage-tools/27.14.4~16.04 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Renan Rodrigo (renanrodrigo)]

I am attaching the results of the test scenarios to verify this bug is fixed.

This bug was introduced in version 27.14, which only got to lunar, and then it was fixed there. For the SRU, the test shows that this function did not exist before, and the -proposed version of ubuntu-advantage-tools is correct and does not bring the bug.

I am marking verification-done for this bug on all supported releases.

[Andreas Hasenack (ahasenack)]

I verified the test results and am satisfied that they show the executed planned test case, and that the results are correct.

The package built correctly in all architectures and Ubuntu releases it was meant for.

There are no DEP8 regressions.

There is no SRU freeze ongoing at the moment.

There is no halted phasing on the previous update.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~16.04

---------------
ubuntu-advantage-tools (27.14.4~16.04) xenial; urgency=medium

  * Backport new upstream release: (LP: #2011477) to xenial

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:50:05 -0300

[Chris Halse Rogers (raof)]

The verification of the Stable Release Update for ubuntu-advantage-tools has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~18.04

---------------
ubuntu-advantage-tools (27.14.4~18.04) bionic; urgency=medium

  * Backport new upstream release: (LP: #2011477) to bionic

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:49:20 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~20.04

---------------
ubuntu-advantage-tools (27.14.4~20.04) focal; urgency=medium

  * Backport new upstream release: (LP: #2011477) to focal

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:25 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~22.04

---------------
ubuntu-advantage-tools (27.14.4~22.04) jammy; urgency=medium

  * Backport new upstream release: (LP: #2011477) to jammy

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:43 -0300

[Launchpad Janitor (janitor)]

This bug was fixed in the package ubuntu-advantage-tools - 27.14.4~22.10

---------------
ubuntu-advantage-tools (27.14.4~22.10) kinetic; urgency=medium

  * Backport new upstream release: (LP: #2011477) to kinetic

ubuntu-advantage-tools (27.14.4) lunar; urgency=medium

  * timer: disable update_contract_info job (LP: #2015302)
  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on non-amd64 systems (LP: #2015241)

ubuntu-advantage-tools (27.14.3) lunar; urgency=medium

  * livepatch: prevent livepatch from auto-enabling and subsequently failing
    on interim releases (LP: #2013409)

ubuntu-advantage-tools (27.14.2~23.04.1) lunar; urgency=medium

  * status:
    - always use dpkg instead of lscpu for fetching architecture
      information (LP: #2012735)

ubuntu-advantage-tools (27.14.1~23.04.1) lunar; urgency=medium

  * New upstream release 27.14.1
    - apt: fix a configuration leak in the apt.get_pkg_candidate_version
      function (LP: #2012642)

ubuntu-advantage-tools (27.14~23.04.1) lunar; urgency=medium

  * d/ubuntu-advantage-tools.{postinst,postrm,preinst}:
    - migrate certain settings out of uaclient.conf to a new file managed by
      the pro config subcommand (LP: #2004280)
  * d/ubuntu-advantage-tools.postinst:
    - refactor PREVIOUS_PKG_VER as a global variable
    - simplify how we add notices
  * New upstream release 27.14 (LP: #2011477)
    - api: new u.unattended_upgrades.status.v1 endpoint for querying status of
      unattended upgrades
    - apt:
      + remove legacy apt-hook
      + deliver json apt-hook for interim releases
      + fix cloud identification logic in json apt-hook
      + make all calls to esm-cache isolated from system configuration
        (LP: #2008280)
      + only set up the esm cache on supported systems (LP: #2004018)
    - fix:
      + format the output to be more readable (LP: #1926182)
      + add option to attach during a fix without a token
      + verify if fixed version can be installed before trying (LP: #2006705)
    - livepatch: show warning if current kernel is not supported
    - locks: alert user about corrupted lock files (LP: #1996931)
    - logging: logs are now formatted as jsonlines
    - motd: remove esm-apps announcement
    - notices: new representation on disk as separate files (LP: #1987738)
    - realtime: remove ubuntu-realtime package on disablement
    - status:
      + removed contract info update check network call
      + no longer includes warnings about notices when non-root (LP: #2006138)
      + unattached status sends virt type to contract server for better
        resource availability calculation
    - timer jobs: add daily job to check for contract updates
    - yaml: always import distro-provided pyyaml (LP: #2007234, LP: #2007241)

 -- Renan Rodrigo <email address hidden> Thu, 06 Apr 2023 10:48:43 -0300