should depend on apt-transport-https (was: fails to download andale32.exe, spams my cron every night)

[Marius Gedminas]

Every night since January 12 2017 I'm getting an error like this from cron:

    From: Cron Daemon <email address hidden>
    To: <email address hidden>
    Subject: Cron <root@xenial64> test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
    Date: Thu, 12 Jan 2017 04:25:33 +0000 (UTC)

    /etc/cron.daily/update-notifier-common:
    W: Can't drop privileges for downloading as file '/var/lib/update-notifier/package-data-downloads/partial/andale32.exe' couldn't be accessed by user
    '_apt'. - pkgAcquire::Run (13: Permission denied)
    E: The method driver /usr/lib/apt/methods/https could not be found.
    E: Download Failed
    ttf-mscorefonts-installer: downloading http://downloads.sourceforge.net/corefonts/andale32.exe
    ttf-mscorefonts-installer: processing...

ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: ttf-mscorefonts-installer 3.4+nmu1ubuntu2
ProcVersionSignature: Ubuntu 4.4.0-59.80-generic 4.4.35
Uname: Linux 4.4.0-59-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.4
Architecture: amd64
Date: Mon Jan 16 10:01:49 2017
JournalErrors:
 Error: command ['journalctl', '-b', '--priority=warning', '--lines=1000'] failed with exit code 1: Hint: You are currently not seeing messages from other users and the system.
       Users in the 'systemd-journal' group can see all messages. Pass -q to
       turn off this notice.
 No journal files were opened due to insufficient permissions.
PackageArchitecture: all
SourcePackage: msttcorefonts
UpgradeStatus: No upgrade log present (probably fresh install)

[Marius Gedminas (mgedmin)]

I suspect that SourceForge started redirecting HTTP links to HTTPS lately, and this package is now missing a Depends: apt-transport-https.

[Naël (nathanael-naeri)]

More likely to be a manifestation of bug 1607535, fixed in the development release by bug 1651923.

Please check those bugs, try and install manually with "sudo apt-get install [--reinstall] ttf-mscorefonts-installer" or "sudo dpkg-reconfigure ttf-mscorefonts-installer" depending on whether the package is installed or not on your system, compare error messages, and add duplicate status if it is indeed one.

Also, you'll find possible workarounds in bug 1607535.

[Marius Gedminas (mgedmin)]

It's quite possible there's more than one bug here!

    E: The method driver /usr/lib/apt/methods/https could not be found.

does not look like a 404 error from a mirror due to a misquoted URL, but once I sudo apt install apt-transport-https, I'll probably be seeing the bugs you mentioned.

*sigh*

[Marius Gedminas (mgedmin)]

Yep, installing apt-transport-https changes the nightly cron error from the above to a 404 because of a space in the URL.

[Naël (nathanael-naeri)]

You're right indeed, your issue is likely different from bug 1607535, but once you install apt-transport-https you should run into bug 1607535.

That package is normally installed as a Recommends of ubuntu-standard: did you install your system without Recommends?

Going through the comments of bug 1651923's duplicates (a lot of them are wrongly marked IMHO), it appears downloads.sourceforge.net was already redirecting to HTTPS urls on 2016-11-24 (if not before, but I couldn't find evidence of it). You're having that issue since 2017-01-12 only: was it when you first tried installing this package?

[Marius Gedminas (mgedmin)]

This is a libvirt virtual machine that I've installed with ubuntu-vm-builder on a 16.04 LTS host. The full command, if you're interested, was

    ubuntu-vm-builder kvm xenial \
    --libvirt qemu:///system \
    --tmpfs=2048 \
    --rootsize 20480 \
    --ssh-key=/root/.ssh/authorized_keys \
    --ssh-user-key=/root/.ssh/authorized_keys \
    --lock-user \
    --suite xenial \
    --components main,restricted,universe,multiverse \
    --addpkg openssh-server \
    --addpkg avahi-daemon \
    --addpkg vim \
    --addpkg git \
    --addpkg acpid \
    --addpkg unattended-upgrades \
    --addpkg command-not-found \
    --addpkg software-properties-common \
    --addpkg openjdk-8-jre-headless \
    --addpkg htop \
    --addpkg strace \
    --addpkg linux-image-generic \
    --hostname xenial64 \
    --domain lan \
    --bridge br0 \
    --mem 1024 --cpus 2

etckeeper tells me I've installed ttf-mscorefonts-installer on Aug 18, 2016. At that time I was getting nightly cron errors that looked like this:

    /etc/cron.daily/update-notifier-common:
    Err:1 http://downloads.sourceforge.net/corefonts/andale32.exe
      403 Forbidden
    W: Can't drop privileges for downloading as file '/var/lib/update-notifier/package-data-downloads/partial/andale32.exe' couldn't be accessed by user
    '_apt'. - pkgAcquire::Run (13: Permission denied)
    E: Failed to fetch http://downloads.sourceforge.net/corefonts/andale32.exe 403 Forbidden

    E: Download Failed
    ttf-mscorefonts-installer: downloading http://downloads.sourceforge.net/corefonts/andale32.exe

because my local apt proxy was denying sourceforge downloads. When I eventually figured that out and added the right domains to /etc/squid-deb-proxy/mirror-dstdomain.acl on the proxy host, the cron script succeeded downloading and extracting the font files. This was on Aug 23, 2016.

Then I have an unattended-upgrades log from 2016-11-04 that upgraded update-notifier-common, which also ran the downloads successfully.

And then I have an unattended-upgrades log from 2017-01-06 that upgraded update-notifier-common again, and this one failed with

    E: The method driver /usr/lib/apt/methods/https could not be found.
    N: Is the package apt-transport-https installed?

and since then every night the cron script with the original message.

(I was mistaken about the dates in my original report -- I thought I left all of the cron errors in my inbox, but apparently I'd already saved the errors from Jan 6 through 11 in my mail archive.)

I'm fine with this bug being closed as wontfix, since I...

[Naël (nathanael-naeri)]

Thanks for the additional information. Even though normal installs have the package already, I personally feel that the apt-transport-https dependency should be added, be it only for consistency's sake. But I am not the package maintainer and I can't help further, sorry. Perhaps ping them directly if they don't weight in.

This is probably an Ubuntu-only bug since the Debian package downloads the fonts with wget instead of update-notifier and apt-helper.