3rd party sources block OS updates.

Bug #1316262 reported by James Lewis
12
This bug affects 2 people
Affects Status Importance Assigned to Milestone
apt (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Google appear to have started doing GeoLocation on IPv6, and hence I discovered that some failure modes of 3rd party software sources which are automatically added by google when using Google Talk can cause updates to cease completely.

The graphical update tool reports that there are no updates available,.. infact there were more than 30.... I get this at the command line:-

root@trinity:/# apt-get update
Ign http://extras.ubuntu.com trusty InRelease
---- SNIP ---
Get:2 http://security.ubuntu.com trusty-security Release [58.5 kB]
Get:3 http://dl.google.com stable InRelease [1,540 B]
15% [3 InRelease gpgv 1,540 B] [Connecting to gb.archive.ubuntu.com (2001:67c:1360:8c01::18)] [2 Release 6,381 B/58.5 kB 11%] [Waiting for headers] [Waiting for hSIgn http://dl.google.com stable InRelease
E: GPG error: http://dl.google.com stable InRelease: Clearsigned file isn't valid, got 'NODATA' (does the network require authentication?)
root@trinity:/#

The content of the file in question can be seen below:-

root@trinity:/# more /var/lib/apt/lists/partial/dl.google.com_linux_talkplugin_deb_dists_stable_InRelease
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head><title>Google - Product Unavailable</title>
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<style type="text/css">

body {
 font-family: arial,sans-serif;
 color: #333333;
 margin:10px;
 margin-right:20px;
}

table#header {
 margin-bottom:10px;
}

h1 {
 margin-top:8px;
 font-size:16px;
 border-bottom:1px solid #999;
 padding-bottom:3px;
}

td#content, td#content td {
 font-size:13px;
}

#footer {
 font-size:13px;
 color:#666;
 border-top:1px solid #ccc;
 padding-top:12px;
 margin-top:20px;
}
</style>

</head>
<body>

<table border="0" cellpadding="0" cellspacing="0" width="100%" id="header">
<tr>
 <td style="padding-right:8px;"><a href="http://www.google.com/"><img src="http://www.google.com/images/google_sm.gif" width="143" height="59" border="0" al
t="Google"></a></td>
 <td width="100%">
 <table cellspacing="0" cellpadding="0" border="0" width="100%">
    <tr>
     <td bgcolor="#ffffff"><h1>This product is not available in your country</h1></td>
    </tr>
    </table>
 </td>
</tr>
<tr>
 <td>&nbsp;</td>
    <td id="content" valign="top">

 <p style="padding:10px 0px;">Thanks for your interest, but the product that you're trying to download is not available in your country.</p>

 <div id="footer">©2006 Google - <a href="http://www.google.com">Home</a> - <a href="http://www.google.com/about.html">About Google</a></div>
 </td>
</tr>
</table>

</body>
</html>
root@trinity:/#

I imagine a great number of people have installed Google Talk plugins and if this results in them never again getting software/security updates due to an error in Google's geo-location then that should be considered a serious issue, obviously other 3rd party sources could cause this issue.

It seems that failed 3rd party sources should be handled gracefully.... BTW, I am in England.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: apt 1.0.1ubuntu2
ProcVersionSignature: Ubuntu 3.13.0-24.46-generic 3.13.9
Uname: Linux 3.13.0-24-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 2.14.1-0ubuntu3
Architecture: amd64
CurrentDesktop: Unity
Date: Mon May 5 19:27:19 2014
InstallationDate: Installed on 2014-02-07 (87 days ago)
InstallationMedia: Ubuntu 14.04 LTS "Trusty Tahr" - Alpha amd64 (20140207)
SourcePackage: apt
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
James Lewis (james-fsck) wrote :
information type: Private Security → Public Security
information type: Public Security → Public
Revision history for this message
Seth Arnold (seth-arnold) wrote :

Does this prevent updates from other sources from being installed correctly? If so it'd be nice to at least get that fixed up.

It should be noted that the remote sources are in complete control of your computer -- they can provide packages that run scripts as root and they can replace any package on the system. Limiting the scope of what package repositories can do on your computer with AppArmor or SELinux is a seriously daunting challenge. In the same way that you need to be careful who gets sudo access on your computers you also need to be careful to whom you give apt sources access.

Thanks

Revision history for this message
James Lewis (james-fsck) wrote :

Yes, it prevented all updates from being applied until I removed this source, or changed to an IP address where the file returned by google was not an HTML error message.

Revision history for this message
James Lewis (james-fsck) wrote :

In reply to the comment that 3rd party sources are in control of your computer... indeed this is certainly true, and I agree that changing this is well outside the scope of a bug... but it should not be the case that a mistake by a 3rd party source (or indeed simply traveling to a location where that 3rd party source is not available) stops all other updates indefinitely.

Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in apt (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.