Ubuntu
software-properties package

adding ppa in software sources does not retrieve pgp key

Bug #888417 reported by Britt Yazel on 2011-11-10

This bug affects 3 people

	Status	Importance	Assigned to	Milestone
One Hundred Papercuts	Fix Released	Medium	Papercuts Ninjas
software-properties (Ubuntu)	Fix Released	Undecided	Unassigned	Ubuntu ubuntu-12.04-beta-1
Oneiric	Won't Fix	Undecided	Unassigned
Precise	Fix Released	Undecided	Unassigned	Ubuntu ubuntu-12.04-beta-1

Bug Description

adding a new software source such as "ppa:libreoffice/ppa" does not retrieve the key as it once did to allow me to install software from ppa's. When using the gui it says "software sources not varified" or something of the like after doing a software update, but when I add the ppa via the command line it prompts me to retrieve the key and then it works.

I am running Ubuntu 11.10 x64

Tags:

Related branches

lp://staging/ubuntu/precise/software-properties

CVE References

2011-4407

Dmitry Shachnev (mitya57) on 2011-11-10

affects:

ubuntu → software-properties (Ubuntu)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-12-03:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in software-properties (Ubuntu):
status:	New → Confirmed

Chris Wilson (notgary-deactivatedaccount) on 2011-12-14

no longer affects:	software-center
no longer affects:	software-center (Ubuntu)
Changed in hundredpapercuts:
importance:	Undecided → Medium
status:	New → Confirmed

Chris Wilson (notgary-deactivatedaccount) on 2011-12-14

Changed in hundredpapercuts:
assignee:	nobody → Papercuts Ninja (papercuts-ninja)
milestone:	none → precise-7-system-administration

Revision history for this message

Britt Yazel (bwyazel) wrote on 2012-01-13:

This issue is still not fixed and it NEEDS to get fixed. This makes adding PPA's completely unusable....and that is kind of a big deal.....

Revision history for this message

Britt Yazel (bwyazel) wrote on 2012-01-23:

Hope this issue gets fixed before the release of the LTS. It's a shame that a bug such as this has slipped through the cracks for so long.

Marc Deslauriers (mdeslaur) on 2012-01-30

Changed in software-properties (Ubuntu Oneiric):
status:	New → Confirmed
tags:	added: rls-p-tracking
Changed in software-properties (Ubuntu Precise):
milestone:	none → ubuntu-12.04-beta-1

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-01-30:

proposed_fix.patch Edit (1.2 KiB, text/plain)

This is caused by the AddPPASigningKeyThread being killed off before having a chance to actually import the PPA key. Here is a proposed fix.

Ubuntu Foundations Team Bug Bot (crichton) on 2012-01-31

tags:

added: patch

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-02-03:

This bug was fixed in the package software-properties - 0.82.3

---------------
software-properties (0.82.3) precise; urgency=low

  [ Brian Murray ]
  * when adding new repositories use sourceslist.add instead of append thereby
    preventing duplicate entires. Thanks to Nick Russo for the patch.
    LP: #854841

  [ Robert Roth ]
  * Updated expand properties to properly expand the bottom component to avoid
    putting empty space between components. LP: #912557
  * Added symbolic link for add-apt-repository manpage under the
    apt-add-repository name, LP: #620098
  * Changed Revert button mnemonic to avoid collision with Remove, LP: #652523
  * Handle URLError from ppa pages, instruct the user to check the internet
    connection (LP: #502698)

  [ Marc Deslauriers ]
  * SECURITY UPDATE: incorrect ssl certificate validation (LP: #915210)
    - softwareproperties/ppa.py: use pycurl to download the signing key
      fingerprint.
    - tests/test_lp.py: add test.
    - debian/control: add python-pycurl dependency.
    - CVE-2011-4407
  * Wait for PPA GPG key to get imported before ending thread (LP: #888417)
-- Marc Deslauriers <email address hidden> Fri, 03 Feb 2012 08:16:22 -0500

Changed in software-properties (Ubuntu Precise):
status:	Confirmed → Fix Released

Timothy Arceri (t-fridey) on 2012-02-03

Changed in hundredpapercuts:
status:	Confirmed → Fix Released

Revision history for this message

Jamie Strandboge (jdstrand) wrote on 2013-05-21:

Thank you for reporting this bug to Ubuntu. oneiric has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against oneiric is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.