Comment 6 for bug 1059576

I'm not sure about a spec page. But the whitelist is just for a smoother experience. As I recall, aptdaemon whitelists packages from universe that match a webapps regex. Because it's a feature of Ubuntu out of the box, it makes it more seamless.

But there are two issues here. One is that it's asking for a password at all (the whitelist request) and the other is that it's suggesting a package from universe is not from a trusted source.