security.ubuntu.com lines in sources.list get overwritten with the mirror chosen by the user

[Till Ulen]

It is best to keep the security.ubuntu.com lines at the end of your /etc/apt/sources.list when you use a mirror to make sure you get timely security updates even if your mirror breaks. [1]

[1] http://www.outflux.net/blog/archives/2008/08/20/ubuntu-security-repository-structure/

However, when the user selects a mirror from the list provided by the Software Sources tool, the tool will replace all security.ubuntu.com entries with references to the same mirror. I expected it to keep the security.ubuntu.com lines, either as the only source of security updates (by leaving them intact) or as a secondary source that comes after the selected mirror. For instance, a line such as
  deb http://mirror.example.com/ubuntu/ lucid-security main restricted
would be followed by a line like
  deb http://security.ubuntu.com/ubuntu lucid-security main restricted

I'm testing with Ubuntu 10.04 Lucid Beta 2 booted from the live DVD.

Steps to reproduce:

1. Back up your /etc/apt/sources.list.
2. Open System → Administration → Software Sources.
3. On the Ubuntu Software tab (opened by default) select "Other..." from the "Download from" drop-down list. A "Choose a Download Server" window will open.
4. Select Russian Federation → mirror.yandex.ru and click Choose Server.
5. Compare your updated /etc/apt/sources.list to the backup.

ProblemType: Bug
DistroRelease: Ubuntu 10.04
Package: software-properties-gtk 0.75.9
ProcVersionSignature: Ubuntu 2.6.32-19.28-generic 2.6.32.10+drm33.1
Uname: Linux 2.6.32-19-generic i686
Architecture: i386
Date: Thu Apr 22 01:23:35 2010
LiveMediaBuild: Ubuntu 10.04 "Lucid Lynx" - Beta i386 (20100406.1)
PackageArchitecture: all
ProcEnviron:
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: software-properties

[Till Ulen (tillulen)]

This is the updated version of /etc/apt/sources.list at the end of step 4.

[dino99 (9d9)]

There is no support on such deprecated version; that one has died long time ago.