Comment 1 for bug 2003018

In the SRU review it was noticed that the apt environment used to update the ESM cache is not really isolated from the system. For example, we noticed that the APT::Update::Pre-Invoke hook was called twice if a user ran just "apt update".

APT::Update::Pre-Invoke {
        "[ ! -e /run/systemd/system ] || systemctl start --no-block apt-news.service esm-cache.service || true";
};

https://pastebin.ubuntu.com/p/hkZyzKmjj8/ shows the hook being called twice: line 29, and line 45.

This happens because esm-cache.service, in the end, calls apt update again (via the python library). We just don't get a nasty loop here because systemd won't start a second copy of esm-cache.service.

This lack of isolation is a concern. All hooks from the system apt (defined in /etc/apt) will be called by the esm-only apt, maybe even in parallel, depending on timing. There are hooks to update stamp files, and motd. There are many unknowns here.

We discussed this at length with the Pro team, and will take the following approach:
- the Pro team work on isolating the esm-cache apt instance, and pull in only very specific configs from the system apt (/etc/apt), like proxy settings, and other settings they identify as being needed
- I will accept u-a-t into proposed, so that the other aspects of this SRU can be tested in parallel, but with the condition that: a) the Pro team will come up with a new set of fixes on top for the "shared config" issue identified above, and upload a new version to proposed; b) this package I'm accepting into proposed today MUST NOT be released. I will add a block-proposed tag to this bug to that effect
- when the improved package is ready to be uploaded, it shall be accepted in to proposed on top of today's package, and a new round of testing will be done. Initially only on top of the new changes, but if possible, the whole test suite.