adds ESM to sources.list.d unconditionally, despite it being x86-only
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
| ubuntu-advantage-script |
Fix Released
|
Unknown
|
||
| ubuntu-advantage-tools (Ubuntu) |
High
|
Andreas Hasenack | ||
| Trusty |
High
|
Andreas Hasenack |
Bug Description
[Impact]
The ubuntu-
Turns out that ESM is only available for the x86 architecture, and installing that sources.list snippet for other architectures leads to apt-get update failures.
A mitigation was put in place on the ESM repository to publish an empty archive for these unsupported architectures, so apt-get update won't fail.
The change in this SRU adds another case for when postinst configures and unconfigures ESM, and that is an architecture check via `dpkg --print-
This by itself is not enough to prevent users from trying to enable esm-infra on non-x86 architectures, as the contract server is still incorrectly advertising that support. This has been fixed in the staging deployment and a production deployment with this change should happen soon as well, completing the fix for this issue.
[Test Case]
# Install the current trusty-updates ubuntu-
$ sudo apt install ubuntu-
# verify that apt-get update is hitting the esm repository:
$ sudo apt-get update | grep esm
Get:1 https:/
Get:2 https:/
...
# verify that an esm pinning file was installed. Check that esm.ubuntu.com shows up in the apt-cache policy output, and that its pinning is negative:
$ apt-cache policy | grep esm
-32768 https:/
origin esm.ubuntu.com
-32768 https:/
origin esm.ubuntu.com
# upgrade to the ubuntu-
$ sudo apt install ubuntu-
$ apt-get update | grep esm
<empty>
$ apt-cache policy | grep esm
<empty>
# conversely, on a x86 system, the output should remain the same, i.e., esm should be listed and again with a negative pinning
[Regression Potential]
The logic relies on architecture names returned by `dpkg --print-
[Other Info]
The knowledge about which architectures are supported is now statically stored in the package, which is a bit unfortunate. The final authority is the contract server, and the actual esm repository. This information is sent to the client, but we are not making a network call in postinst to verify that. One reason being that the launchpad builders and DEP8 runners block such egress traffic.
If esm-infra was already enabled before applying the update, it will become disabled on non-x86 architectures. Since there are no non-x86 ESM updates available, this is just reflecting the truth about the support.
[Original Description]
The shiny new ubuntu-
Personally, I think it's a bug we don't publish ESM for all the same arches as we released for (even if we don't update all the packages for all arches, people would at least get things like tzdata updates), but if the intent is to be strictly x86-only, then ubuntu-
Related branches
- Bryce Harrington: Approve on 2019-11-18
- Chad Smith: Pending requested 2019-11-14
-
Diff: 44 lines (+16/-1)2 files modifieddebian/changelog (+6/-0)
debian/postinst (+10/-1)
Philip Roche (philroche) wrote : | #1 |
Mark Morlino (markmorlino) wrote : | #2 |
This seems to require a 2-part fix:
1. The ubuntu-
2. Empty Release files can be added so that trusty machines of other architectures that have already been setup with ESM by the new ua tool can run apt without errors
Changed in ubuntu-advantage-tools (Ubuntu): | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Andreas Hasenack (ahasenack) |
Changed in ubuntu-advantage-tools (Ubuntu Trusty): | |
status: | New → Triaged |
importance: | Undecided → High |
assignee: | nobody → Andreas Hasenack (ahasenack) |
Changed in ubuntu-advantage-script: | |
status: | Unknown → New |
Adam Conrad (adconrad) wrote : | #3 |
If we update the archives (which seems to be the current plan of attack), I'm not sure we need to update the tool to not enable it. It would be nice if it mentioned that the arch you're on isn't supported, so you don't expect kernel updates and the like, but it's harmless to let those people get tzdata and distro-info-data updated.
Let's see how the archive hackery goes on Monday, though.
Changed in ubuntu-advantage-tools (Ubuntu Trusty): | |
status: | Triaged → In Progress |
Andreas Hasenack (ahasenack) wrote : | #4 |
A server-side mitigation was put in place and apt-get update shouldn't fail anymore with esm disabled, but the sources.list snipped file in place, on non-x86 arches. There is another issue still in that the ua server is reporting esm-infra as being available for non-x86 arches, which is incorrect. That is also being addressed.
description: | updated |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
Changed in ubuntu-advantage-script: | |
status: | New → Fix Released |
Hello Adam, or anyone else affected,
Accepted ubuntu-
Please help us by testing this new package. See https:/
If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-
Further information regarding the verification process can be found at https:/
N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.
Changed in ubuntu-advantage-tools (Ubuntu Trusty): | |
status: | In Progress → Fix Committed |
tags: | added: verification-needed verification-needed-trusty |
description: | updated |
Andreas Hasenack (ahasenack) wrote : | #6 |
= Trusty verification =
# install current uat from updates on ppc64el
ubuntu-
Installed: 19.6~ubuntu14.04.3
Candidate: 19.6~ubuntu14.04.3
Version table:
*** 19.6~ubuntu14.04.3 0
500 http://
ubuntu@
ppc64le
ubuntu@
ppc64el
# apt-get update hits the esm repo. It doesn't fail because the server published
# empty repositories for non-x86
ubuntu@
Get:1 https:/
Get:2 https:/
Get:3 https:/
Get:4 https:/
Get:5 https:/
Ign https:/
Ign https:/
Ign https:/
Ign https:/
# verify that esm pinning was installed and is negative:
ubuntu@
-32768 https:/
origin esm.ubuntu.com
-32768 https:/
origin esm.ubuntu.com
# upgrade to the package in proposed:
ubuntu@
ubuntu-
Installed: 19.6~ubuntu14.04.4
Candidate: 19.6~ubuntu14.04.4
Version table:
*** 19.6~ubuntu14.04.4 0
500 http://
# verify esm repo isn't hit anymore:
ubuntu@
ubuntu@
1
# verify esm pinning isn't in place anymore:
ubuntu@
ubuntu@
ubuntu@
total 8
drwxr-xr-x 2 root root 4096 Nov 27 13:34 ./
drwxr-xr-x 7 root root 4096 Nov 27 13:33 ../
ubuntu@
# update: the server-side changes were deployed already, and now esm is
# correctly no longer advertised for non-x86 systems:
ubuntu@
One moment, checking your subscription first
ESM Infra is not available for platform ppc64le.
Supported platforms are: amd64, i386, i686, x86_64
# repeating the test on x86 shows no change in behaviour
# current version from updates:
ubuntu@t1:~$ apt-cache policy ubuntu-
ubuntu-
Installed: 19.6~ubuntu14.04.3
Candidate: 19.6~ubuntu14.04.3
Version table:
*** 19.6~ubuntu14.04.3 0
500 http://
# esm repo is hit:
ubuntu@t1:~$ sudo apt-get update | grep esm
Get:6 https:/
Get:7 https:/
Get:9 https:/
...
# esm pinne...
tags: |
added: verification-done-trusty removed: verification-needed-trusty |
tags: |
added: verification-done removed: verification-needed |
The verification of the Stable Release Update for ubuntu-
Launchpad Janitor (janitor) wrote : | #8 |
This bug was fixed in the package ubuntu-
---------------
ubuntu-
* d/postinst: only configure ESM on supported architectures (LP: #1851858)
-- Andreas Hasenack <email address hidden> Thu, 14 Nov 2019 14:34:50 -0300
Changed in ubuntu-advantage-tools (Ubuntu Trusty): | |
status: | Fix Committed → Fix Released |
Changed in ubuntu-advantage-tools (Ubuntu): | |
status: | Triaged → Fix Committed |
Launchpad Janitor (janitor) wrote : | #9 |
This bug was fixed in the package ubuntu-
---------------
ubuntu-
* d/templates: add a debconf note on upgrade from pre-ubuntu pro package
* d/control: create a separate ubuntu-
delivers the tooling and scripts necessary to auto-attach pro machines.
This change breaks/replaces ubuntu-
* d/maintscript: rm_conffile /etc/init/
* d/postint: remove stale systemd symlinks which have migrated to ubuntu-pro
* d/rules: only install the apt hook on trusty
* d/rules: provide --no-start to debhelper to avoid auto-attach on pkg install
* Release 20.2:
- ubuntu-pro:
+ azure: fix detection of DatasourceAzureNet as azure on trusty
+ generalize identity_doc to return dict instead of string
+ auto-attach: any 4XX errors during auto-attach are the result of non-Pro
+ auto-attach: handle 403 errors raised by contract server for invalid vms
- attach: persist any status config changes after attach failures
- output: add messaging using a different subscription if attached
-- Chad Smith <email address hidden> Thu, 20 Feb 2020 11:13:15 -0700
Changed in ubuntu-advantage-tools (Ubuntu): | |
status: | Fix Committed → Fix Released |
We (CPC) are seeing this issue too when trying to build Trusty non amd64/i386 images.
When we hit this yesterday Security team confirmed that ESM doesn't support other arches but we shouldn't block builds because of this change.