Can no longer successfully download Flash during postinst

[feren]

[Impact]

Since Adobe Flash Player is officially no longer available or end of life, they seem to have made a redirect to a link, that pepperflashplugin-nonfree likely uses for obtaining Flash, to the 'End of Life' page of the Flash website. This means that when installing pepperflashplugin-nonfree from now on it'll keep trying to download the HTML file for the end-of-life page.

The proposed uploads are plain no-change SRU backports of the dummy package in hirsute sync'ed from Debian. With that we prevent more users from stalling their package system by trying to install or update pepperflash.

[Test Case]

* Install pepperflashplugin-nonfree from
  {groovy,focal,bionic,xenial}-proposed

* Confirm that it installs successfully without causing any issues
  with the package system.

* Run the "update-pepperflashplugin-nonfree --install" command and
  see the EOL notice.

[Where problems could occur]

We replace an obsolete package which creates issues with a dummy. The upgrade removes a config file in /etc, and the download and install functionality is not present in the new version. TBH I can't think of anything special.

[Other Info]

Ubuntu 20.04.1 LTS
Newly installed pepperflashplugin-nonfree - 1.8.6ubuntu1

Someone should probably update this package to, instead of trying in vain to download Flash, show a notice saying Flash has reached end-of-life and so this package is no longer available. Packages like Opera from the official Opera repository still depend on this package, currently.

Output:
Unpacking pepperflashplugin-nonfree (1.8.6ubuntu1) ...
Setting up pepperflashplugin-nonfree (1.8.6ubuntu1) ...
--2021-01-13 18:18:25-- https://get.adobe.com/flashplayer/webservices/json/?platform_type=Linux&platform_arch=x86_64&browser_dist=Chrome
Resolving get.adobe.com (get.adobe.com)... 193.104.215.66
Connecting to get.adobe.com (get.adobe.com)|193.104.215.66|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://www.adobe.com/products/flashplayer/end-of-life.html?platform_type=Linux&platform_arch=x86_64&browser_dist=Chrome [following]
--2021-01-13 18:18:25-- https://www.adobe.com/products/flashplayer/end-of-life.html?platform_type=Linux&platform_arch=x86_64&browser_dist=Chrome
Resolving www.adobe.com (www.adobe.com)... 2a02:26f0:104::1701:f2c0, 2a02:26f0:104::1701:f2cb, 176.255.202.96, ...
Connecting to www.adobe.com (www.adobe.com)|2a02:26f0:104::1701:f2c0|:443... connected.

[feren (ferenos)]

It's worth noting that this DOES NOT result in a failed install - it merely makes installation take forever to do.

[Gunnar Hjalmarsson (gunnarhj)]

Thanks for your well-written bug report. :)

[Gunnar Hjalmarsson (gunnarhj)]

To the sponsor:

I'm asking for help with:

* A forced sync of pepperflashplugin-nonfree from unstable to hirsute

* Uploads of the SRUs as proposed in this PPA:

  https://launchpad.net/~gunnarhj/+archive/ubuntu/pepperflashplugin-nonfree

  (please use -v1.8.7 when building)

[Thomas Ward (teward)]

Gunnar:

I'd like to talk to the SRU team before anyone sponsors this - this type of behavior is something I would want approved before anyone puts it into the repos.

[Gunnar Hjalmarsson (gunnarhj)]

@Thomas: Fair enough. I realize that this is a bit beyond the normal procedure for SRUs. OTOH it's carefully considered.

Please let's do that on Monday at the latest, since it's a matter of some urgency. (Ideally it should have reached the users on New Year's Day.)

[Gunnar Hjalmarsson (gunnarhj)]

In the light of Thomas' hesitation expressed in comment #4, can some member of the SRU team please give your advance notice whether the way proposed above to kill the functionality of the broken pepperflashplugin-nonfree package is appropriate.

[Łukasz Zemczak (sil2100)]

Looking at this briefly, I'm trying to think if there's any other, negative implications of such a change. Of course we want to keep stable series as stable as possible, avoiding big changes without a good reason, but to me it feels that right now the package as-is is anyway a no-op and only holds up updates. Are there also any possible side effects?

Normally I'd kill the package altogether, but since it's a stable series I think the dummy-package approach seems fine. I'm fine with getting it uploaded.

[Gunnar Hjalmarsson (gunnarhj)]

Thanks Łukasz! As I wrote in the "Where problems could occur" section above, I can't think of any adverse side effects.

@Thomas: Are you willing now to sponsor it in accordance with my request in comment #3?

[Thomas Ward (teward)]

Yes, I'll sponsor it, give me about 30 minutes for lunch first, I haven't eaten since lunch yesterday.

[Gunnar Hjalmarsson (gunnarhj)]

Absolutely. Enjoy your meal. :)

[Thomas Ward (teward)]

Version strings updated accordingly, and now all versions (1.8.7ubuntuX.Y.1) are sitting in the respective proposed queues. This now awaits the SRU team's actions.

[Gunnar Hjalmarsson (gunnarhj)]

Thanks! Can you please sync to hirsute too?

As regards version, I was probably not clear. I meant:

debuild -S -v1.8.7

OTOH it doesn't matter much.

[Thomas Ward (teward)]

I did it the hard way - everything needs adjusted version strings if
we're pushing to multiple distros at once, otherwise dpkg and such barfs.

On 1/19/21 1:32 PM, Gunnar Hjalmarsson wrote:
> debuild -S -v1.8.7

[Thomas Ward (teward)]

Sync from unstable to hirsute accepted and being processed.

[Łukasz Zemczak (sil2100)]

Thank you for providing the SRUs! I have a question though before we proceed, please be patient with me here: it feels to me that this package will now remove/uninstall any already installed/downloaded flash plugin, or is it just some configuration file? Since I see that `update-pepperflashplugin-nonfree --uninstall` will now be ran instead of `--install --fast`. I don't really know the history of flash (didn't use it for ages now) so not sure when it stopped being available - and if the existing binaries still work or not - but are there any ill implications of that `--uninstall` happening? Like, could it be that some people with already installed packages have still a working flash plugin? Or is that not possible?

I just want to make sure that this update won't, by accident, disrupt some existing weird workflows of people relying on having it around. Since I'm +1 on no longer installing the plugin as it's not available for download, but removing something that might have been already installed on the users machine - well, for this I'd have to know if for instance the plugin does not work anymore anyway.

[Gunnar Hjalmarsson (gunnarhj)]

@Łukasz: Flash is dead since the year end. Adobe and the big browser vendors have coordinated its EOL.

Possibly - I haven't bothered to investigate it that deep - there is a use case where people want to keep the latest Flash plugin, do some special configuration for the purpose, and use it locally together with some obsolete browser version. But even if such a use case exists, I don't think we should let it block this step. I'd say that there is no longer any reason for us to support any kind of Flash. Think of removing existing plugins as a security measure.

Let me add that the principal Flash package on Ubuntu was adobe-flashplugin, provided via Canonical partner. That package was recently killed in the same manner. If you like you can check with Chris Coulson about his considerations.

Killing pepperflashplugin-nonfree is also an OEM request (bug #1871471).

[Launchpad Janitor (janitor)]

This bug was fixed in the package pepperflashplugin-nonfree - 1.8.8

---------------
pepperflashplugin-nonfree (1.8.8) unstable; urgency=medium

  * QA upload.
  * Adobe Flash Player has reached End-of-Life and is no longer functional or
    available for download:
    https://www.adobe.com/products/flashplayer/end-of-life.html
  * Turn into a dummy package taking care of removing the previously installed
    plugin. (Closes: #979689) (LP: #1911463)
  * Remove download and install functionality.
  * Remove chromium integration.

 -- Andreas Beckmann <email address hidden> Fri, 15 Jan 2021 16:47:39 +0100

[Thomas Ward (teward)]

Łukasz:

Up until the EOL date, Flash provided copies of the PPAPI and NPAPI plugins on their Flash Debug Downloads page. Since that date, all versions of the plugins have been yanked (even in the archived versions!) and only the standalone executables exist for the running of Flash files. Attempting to get the older versions gives you a page stating "The Flash Player archive page has been decommissioned. Customers requiring Flash Player can visit our download page for the latest available version" - which in turn points to the EOL page

While *technically* I have a copy from the last full site snag I did of the debug binaries on the 28th of December, since Adobe and everyone yanked support the only way to **get** those binaries to install the NPAPI or PPAPI plugins is to have an older copy already downloaded and available.

With the major players of the browser market (Edge, Firefox, Chrome, Chromium, etc.) all yanking the plugin and forcing it to be permanently disabled or removed in a default environment anyways, and the only solution to bypass that is to disable EOL removal and plugin disabling flags in Chrome/Firefox, and then install a variant from the Partner repository from August, or if you're me manually install the PPAPI or NPAPI plugins where they have to go. However, since 100% of the universe does NOT have access to my last-version-of-flash-plugin downloads, that invalidates the ability for MOST users to get the plugin.

In either case, replacing this with a dummy package should be done - with the OEM request and the effective killing of the Partner repository flash version, older versions would have the same problem as any other, and only a manual installation of the NPAPI or PPAPI plugins **if you happened to have them prior to the yank of them by Adobe** is the only way to still 'get' Flash support it seems.

[Łukasz Zemczak (sil2100)]

Thank you for the backstory and additional information Gunnar, Thomas!

[Łukasz Zemczak (sil2100)]

hm, I actually don't like the new version numbering - it is very confusing. Since this is a straight backport of 1.8.8, suddenly using 1.8.7ubuntuX.Y.1 seems weird - this implies that this is based on 1.8.7, which it is not (as the changelog entry only mentions a straight backport). In such cases where 1.8.8ubuntuX.Y.1 can't be used, I think Gunnar's 1.8.8~ubuntuX.Y.1 is the proper way to go. Let me sync those.

[Łukasz Zemczak (sil2100)]

Hello feren, or anyone else affected,

Accepted pepperflashplugin-nonfree into groovy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/1.8.8~ubuntu20.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-groovy to verification-done-groovy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-groovy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello feren, or anyone else affected,

Accepted pepperflashplugin-nonfree into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/1.8.8~ubuntu20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello feren, or anyone else affected,

Accepted pepperflashplugin-nonfree into bionic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/1.8.8~ubuntu18.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-bionic to verification-done-bionic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-bionic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Łukasz Zemczak (sil2100)]

Hello feren, or anyone else affected,

Accepted pepperflashplugin-nonfree into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/pepperflashplugin-nonfree/1.8.8~ubuntu16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-xenial to verification-done-xenial. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-xenial. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Gunnar Hjalmarsson (gunnarhj)]

Maybe worth adding:

For the case somebody really would want to keep playing with the last Flash plugins for some reason, both the NPAPI and PPAPI ones (for amd64 as well as i386) are available in this adobe-flashplugin tarball:

https://launchpad.net/ubuntu/+archive/partner/+sourcefiles/adobe-flashplugin/1:20201208.1-0ubuntu0.20.10.1/adobe-flashplugin_20201208.1.orig.tar.gz

and probably at a lot of other places on internet.

[Gunnar Hjalmarsson (gunnarhj)]

I verified the test case

- on groovy using pepperflashplugin-nonfree 1.8.8~ubuntu20.10.1 from groovy-proposed

- on focal using pepperflashplugin-nonfree 1.8.8~ubuntu20.04.1 from focal-proposed

- on bionic using pepperflashplugin-nonfree 1.8.8~ubuntu18.04.1 from bionic-proposed

- on xenial using pepperflashplugin-nonfree 1.8.8~ubuntu16.04.1 from xenial-proposed

( Nice to see Unity again on 16.04 :) )

[feren (ferenos)]

I've verified this fix works on focal-proposed

Package version: 1.8.8~ubuntu20.04.1 (focal-proposed)

[Łukasz Zemczak (sil2100)]

Ok, teward convinced me that indeed there seems to be no reason for us having to wait the full 7-day verification period for this one (as it can't really get much worse than the existing packages). So releasing it early.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pepperflashplugin-nonfree - 1.8.8~ubuntu20.10.1

---------------
pepperflashplugin-nonfree (1.8.8~ubuntu20.10.1) groovy; urgency=medium

  * No-change backport from hirsute as an SRU (LP: #1911463)

pepperflashplugin-nonfree (1.8.8) unstable; urgency=medium

  * QA upload.
  * Adobe Flash Player has reached End-of-Life and is no longer functional or
    available for download:
    https://www.adobe.com/products/flashplayer/end-of-life.html
  * Turn into a dummy package taking care of removing the previously installed
    plugin. (Closes: #979689) (LP: #1911463)
  * Remove download and install functionality.
  * Remove chromium integration.

 -- Gunnar Hjalmarsson <email address hidden> Sat, 16 Jan 2021 19:39:00 +0100

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for pepperflashplugin-nonfree has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package pepperflashplugin-nonfree - 1.8.8~ubuntu20.04.1

---------------
pepperflashplugin-nonfree (1.8.8~ubuntu20.04.1) focal; urgency=medium

  * No-change backport from hirsute as an SRU (LP: #1911463)

pepperflashplugin-nonfree (1.8.8) unstable; urgency=medium

  * QA upload.
  * Adobe Flash Player has reached End-of-Life and is no longer functional or
    available for download:
    https://www.adobe.com/products/flashplayer/end-of-life.html
  * Turn into a dummy package taking care of removing the previously installed
    plugin. (Closes: #979689) (LP: #1911463)
  * Remove download and install functionality.
  * Remove chromium integration.

 -- Gunnar Hjalmarsson <email address hidden> Sat, 16 Jan 2021 19:39:00 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package pepperflashplugin-nonfree - 1.8.8~ubuntu18.04.1

---------------
pepperflashplugin-nonfree (1.8.8~ubuntu18.04.1) bionic; urgency=medium

  * Backport from hirsute as an SRU (LP: #1911463)
  * debian/control, debian/compat:
    - Replace debhelper-compat with debhelper >= 9

pepperflashplugin-nonfree (1.8.8) unstable; urgency=medium

  * QA upload.
  * Adobe Flash Player has reached End-of-Life and is no longer functional or
    available for download:
    https://www.adobe.com/products/flashplayer/end-of-life.html
  * Turn into a dummy package taking care of removing the previously installed
    plugin. (Closes: #979689) (LP: #1911463)
  * Remove download and install functionality.
  * Remove chromium integration.

 -- Gunnar Hjalmarsson <email address hidden> Sat, 16 Jan 2021 19:42:00 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package pepperflashplugin-nonfree - 1.8.8~ubuntu16.04.1

---------------
pepperflashplugin-nonfree (1.8.8~ubuntu16.04.1) xenial; urgency=medium

  * Backport from hirsute as an SRU (LP: #1911463)
  * debian/control, debian/compat:
    - Replace debhelper-compat with debhelper >= 9

pepperflashplugin-nonfree (1.8.8) unstable; urgency=medium

  * QA upload.
  * Adobe Flash Player has reached End-of-Life and is no longer functional or
    available for download:
    https://www.adobe.com/products/flashplayer/end-of-life.html
  * Turn into a dummy package taking care of removing the previously installed
    plugin. (Closes: #979689) (LP: #1911463)
  * Remove download and install functionality.
  * Remove chromium integration.

 -- Gunnar Hjalmarsson <email address hidden> Sat, 16 Jan 2021 19:42:00 +0100