24.04 LTS needs pro for complete upgrade?

[jesmh]

Ubuntu Version:
Kubuntu 24.04

Desktop Environment (if applicable):
KDE Plasma

Problem Description:
While ugrading, I got the „more updates through esm-apps available“ message. I did the test now. I did upgrade, I enabled pro, I run upgrade again. And yes: there has been delivered upgrades.

Why do I need a pro subscription while still in standard lifetime time span?

I expect to do not need pro when using supported version of Kubuntu…

I would be glad about explanation on that circumstances. =)

To reproduce:

1. have a supported-version system without pro enabled
2. do upgrade
3. enable pro
4. do upgrade again
5. you will get upgrades, you didn’t got before.

Relevant System Information:
I don’t know whats needed here for my question.

Screenshots or Error Messages:

john@kubuntu-T490:~$ sudo apt update && sudo apt upgrade -dy
OK:1 http://ch.archive.ubuntu.com/ubuntu noble InRelease
OK:2 http://ch.archive.ubuntu.com/ubuntu noble-updates InRelease                                                                
OK:3 http://security.ubuntu.com/ubuntu noble-security InRelease                                                                 
OK:4 http://ch.archive.ubuntu.com/ubuntu noble-backports InRelease        
OK:5 https://linux.teamviewer.com/deb stable InRelease                    
OK:6 https://updates.signal.org/desktop/apt xenial InRelease
Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Aktualisierung für 11 Pakete verfügbar. Führen Sie »apt list --upgradable« aus, um sie anzuzeigen.
Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Paketaktualisierung (Upgrade) wird berechnet… Fertig
Die folgenden Pakete wurden automatisch installiert und werden nicht mehr benötigt:
  linux-headers-6.8.0-101 linux-headers-6.8.0-101-generic linux-image-6.8.0-101-generic linux-modules-6.8.0-101-generic linux-modules-extra-6.8.0-101-generic linux-modules-nvidia-580-6.8.0-101-generic
  linux-objects-nvidia-580-6.8.0-101-generic linux-signatures-nvidia-6.8.0-101-generic linux-tools-6.8.0-101 linux-tools-6.8.0-101-generic
Verwenden Sie »sudo apt autoremove«, um sie zu entfernen.
Get more security updates through Ubuntu Pro with 'esm-apps' enabled:
  vlc-plugin-qt libvlc5 libimage-magick-perl freerdp2-x11 qt5-qmake-bin
  libmagickcore-6.q16-7t64 libzvbi-common qtbase5-dev-tools vlc-data
  libqt5xml5t64 libvlccore9 libjs-katex qt5-gtk-platformtheme
  libmagick++-6.q16-9t64 vlc imagemagick libqt5sql5t64 vlc-bin
  libmagickcore-6.q16-7-extra libqt5test5t64 libwinpr2-2t64 vlc-l10n gimp-data
  libcjson1 libpostproc57 vlc-plugin-samba libqt5gui5t64 libmbedcrypto7t64
  gimp libsvn1 libavcodec60 libgstreamer-plugins-bad1.0-0 libzvbi0t64
  libimage-magick-q16-perl libqt5printsupport5t64 vlc-plugin-notify
  libgraphicsmagick++-q16-12t64 qtbase5-dev libqt5concurrent5t64 libavutil58
  libqt5widgets5t64 imagemagick-6.q16 libswscale7 libfreerdp-client2-2t64
  libqt5dbus5t64 vlc-plugin-access-extra libqt5network5t64 vlc-plugin-skins2
  libqt5opengl5-dev libqt5opengl5t64 fonts-katex vlc-plugin-video-splitter
  libgimp2.0t64 libswresample4 imagemagick-6-common fig2dev
  vlc-plugin-video-output accountwizard libqt5sql5-sqlite 7zip qt5-qmake
  libavformat60 gstreamer1.0-plugins-bad libfreerdp2-2t64 mupdf-tools
  libgraphicsmagick-q16-3t64 libqt5sql5-mysql libbcprov-java libvlc-bin
  libqt5core5t64 vlc-plugin-base vlc-plugin-visualization libavfilter9
  libmagickwand-6.q16-7t64
Learn more about Ubuntu Pro at https://ubuntu.com/pro
Die folgenden Aktualisierungen sind wegen Phasenstufung zurückgestellt worden:
  libnss-systemd libpam-systemd libsystemd-shared libsystemd0 libudev1 systemd systemd-dev systemd-resolved systemd-sysv systemd-timesyncd udev
0 aktualisiert, 0 neu installiert, 0 zu entfernen und 11 nicht aktualisiert.
john@kubuntu-T490:~$ sudo pro attach ABCDEFGHIJKLMNOPQRSTUVWXYZ123
Enabling Ubuntu Pro: ESM Apps
Ubuntu Pro: ESM Apps enabled
Enabling Ubuntu Pro: ESM Infra
Ubuntu Pro: ESM Infra enabled
Enabling Livepatch
Livepatch enabled
This machine is now attached to 'Ubuntu Pro - free personal subscription'

SERVICE          ENTITLED  STATUS       DESCRIPTION
anbox-cloud      yes       disabled     Scalable Android in the cloud
esm-apps         yes       enabled      Expanded Security Maintenance for Applications
esm-infra        yes       enabled      Expanded Security Maintenance for Infrastructure
fips-updates     yes       disabled     FIPS compliant crypto packages with stable security updates
landscape        yes       disabled     Management and administration tool for Ubuntu
livepatch        yes       enabled      Canonical Livepatch service
realtime-kernel* yes       disabled     Ubuntu kernel with PREEMPT_RT patches integrated
usg              yes       disabled     Security compliance and audit tools

 * Service has variants

NOTICES
Operation in progress: pro attach

For a list of all Ubuntu Pro services and variants, run 'pro status --all'
Enable services with: pro enable <service>

     Account: admin+ubuntu@jesmh.de
Subscription: Ubuntu Pro - free personal subscription
john@kubuntu-T490:~$ sudo apt update && sudo apt upgrade -dy
OK:1 http://ch.archive.ubuntu.com/ubuntu noble InRelease
OK:2 http://ch.archive.ubuntu.com/ubuntu noble-updates InRelease                                                                                                                                             
OK:3 http://security.ubuntu.com/ubuntu noble-security InRelease                                                                                                                                        
OK:4 http://ch.archive.ubuntu.com/ubuntu noble-backports InRelease                                                                                   
OK:5 https://linux.teamviewer.com/deb stable InRelease                                                                                               
OK:6 https://updates.signal.org/desktop/apt xenial InRelease                                    
OK:7 https://esm.ubuntu.com/apps/ubuntu noble-apps-security InRelease   
OK:8 https://esm.ubuntu.com/apps/ubuntu noble-apps-updates InRelease
OK:9 https://esm.ubuntu.com/infra/ubuntu noble-infra-security InRelease
OK:10 https://esm.ubuntu.com/infra/ubuntu noble-infra-updates InRelease
Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Aktualisierung für 85 Pakete verfügbar. Führen Sie »apt list --upgradable« aus, um sie anzuzeigen.
Paketlisten werden gelesen… Fertig
Abhängigkeitsbaum wird aufgebaut… Fertig
Statusinformationen werden eingelesen… Fertig
Paketaktualisierung (Upgrade) wird berechnet… Fertig
Die folgenden Pakete wurden automatisch installiert und werden nicht mehr benötigt:
  linux-headers-6.8.0-101 linux-headers-6.8.0-101-generic linux-image-6.8.0-101-generic linux-modules-6.8.0-101-generic linux-modules-extra-6.8.0-101-generic linux-modules-nvidia-580-6.8.0-101-generic
  linux-objects-nvidia-580-6.8.0-101-generic linux-signatures-nvidia-6.8.0-101-generic linux-tools-6.8.0-101 linux-tools-6.8.0-101-generic
Verwenden Sie »sudo apt autoremove«, um sie zu entfernen.
Die folgenden Aktualisierungen sind wegen Phasenstufung zurückgestellt worden:
  libnss-systemd libpam-systemd libsystemd-shared libsystemd0 libudev1 systemd systemd-dev systemd-resolved systemd-sysv systemd-timesyncd udev
Die folgenden Pakete werden aktualisiert (Upgrade):
  7zip accountwizard fig2dev fonts-katex freerdp2-x11 gimp gimp-data gstreamer1.0-plugins-bad imagemagick imagemagick-6-common imagemagick-6.q16 libavcodec60 libavfilter9 libavformat60 libavutil58
  libbcprov-java libcjson1 libfreerdp-client2-2t64 libfreerdp2-2t64 libgimp2.0t64 libgraphicsmagick++-q16-12t64 libgraphicsmagick-q16-3t64 libgstreamer-plugins-bad1.0-0 libimage-magick-perl
  libimage-magick-q16-perl libjs-katex libmagick++-6.q16-9t64 libmagickcore-6.q16-7-extra libmagickcore-6.q16-7t64 libmagickwand-6.q16-7t64 libmbedcrypto7t64 libpostproc57 libqt5concurrent5t64 libqt5core5t64
  libqt5dbus5t64 libqt5gui5t64 libqt5network5t64 libqt5opengl5-dev libqt5opengl5t64 libqt5printsupport5t64 libqt5sql5-mysql libqt5sql5-sqlite libqt5sql5t64 libqt5test5t64 libqt5widgets5t64 libqt5xml5t64
  libsvn1 libswresample4 libswscale7 libvlc-bin libvlc5 libvlccore9 libwinpr2-2t64 libzvbi-common libzvbi0t64 mupdf-tools qt5-gtk-platformtheme qt5-qmake qt5-qmake-bin qtbase5-dev qtbase5-dev-tools vlc vlc-bin
  vlc-data vlc-l10n vlc-plugin-access-extra vlc-plugin-base vlc-plugin-notify vlc-plugin-qt vlc-plugin-samba vlc-plugin-skins2 vlc-plugin-video-output vlc-plugin-video-splitter vlc-plugin-visualization
74 aktualisiert, 0 neu installiert, 0 zu entfernen und 11 nicht aktualisiert.
74 esm-apps security updates
Es müssen 128 MB an Archiven heruntergeladen werden.
Nach dieser Operation werden 76,8 kB Plattenplatz zusätzlich benutzt.
Holen:1 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 libimage-magick-perl all 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm8 [40,1 kB]
Holen:2 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 imagemagick-6-common all 8:6.9.12.98+dfsg1-5.2ubuntu0.1~esm8 [71,2 kB]
[…]                                                                              
Holen:43 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 libavcodec60 amd64 7:6.1.1-3ubuntu5+esm7 [5.852 kB]                                                                                    
Ign:43 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 libavcodec60 amd64 7:6.1.1-3ubuntu5+esm7                                                                                                 
Holen:44 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 libavutil58 amd64 7:6.1.1-3ubuntu5+esm7 [401 kB]
[…]                                                                        
Holen:73 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 vlc-plugin-video-splitter amd64 3.0.20-3ubuntu0.1~esm1 [46,9 kB]                                                                       
Holen:74 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 vlc-plugin-visualization amd64 3.0.20-3ubuntu0.1~esm1 [44,3 kB]                                                                        
Holen:43 https://esm.ubuntu.com/apps/ubuntu noble-apps-security/main amd64 libavcodec60 amd64 7:6.1.1-3ubuntu5+esm7 [5.852 kB]                                                                                    
Es wurden 124 MB in 6 min 16 s geholt (328 kB/s).                                                                                                                                                                 
Herunterladen abgeschlossen; Nur-Herunterladen-Modus aktiv
john@kubuntu-T490:~$ 

[guiverc]

Ubuntu Pro includes two items

• includes ESM or extended security fixes which start when standard support has ended; ie. 5 years after initial release
• includes optional security fixes on packages in the universe repository; as only main and restricted get security fixes on a normal install.

The additional updates you’re seeing are in my second item, as Ubuntu has historically only provided security fixes for packages in main and restricted. By enabling Pro, you’re getting the optional fixes available for packages in universe too.

The flavors (Kubuntu) are community based, and we don’t get coverage from the Ubuntu Security team (I’m a member of the Lubuntu team) [without Pro].

SecurityTeam/FAQ - Ubuntu Wiki

Ubuntu Pro - FAQ

This document was prepared in collaboration with Ubuntu community leads. Executive summary Your Ubuntu LTS is still secured in exactly the same way it has always been, with five years of free security updates for the ‘main’ packages in the distribution, and best-effort security coverage for everything else. This has been the promise of Ubuntu since our first LTS in 2006, and remains exactly the same. In fact, thanks to our expanded security team, your LTS is better secured today than ever befor…

https://ubuntu.com/security/esm

You’re not using the latest version of Kubuntu, that’s Kubuntu 25.10 or the 2025-October release, with 24.04 being three releases before that latest release.

You may be confusing ESM & Pro, as its ESM that starts when standard support ends (Pro has benefits during the standard support years as you’re discovering).

[jesmh]

Hi guiverc,
thanks for your comprehensive answer. Please, can you just write two more sentences about what it means to use a flavor in concern to the updates served by the different repositories?

[guiverc]

@jesmh

Please, can you just write two more sentences about what it means to use a flavor in concern to the updates served by the different repositories?

I’m not sure what you’re asking sorry.

The system I’m using now is a Ubuntu one as far as I’m concerned, I may have installed it with Lubuntu media; but it’s still Ubuntu to me, as all Ubuntu and flavors use the same repositories.

guiverc@d7050-next:~/uwn/issues/938$   cat /var/log/installer/media-info 
Lubuntu 25.10 "Questing Quokka" - Daily amd64 (20250603)

The packages included on Ubuntu Desktop, Ubuntu Server and the main Ubuntu products are all found in the main repository.

The community packages are found in universe which highlights they don’t get security checks (by the Ubuntu Security team), plus it’s where they are. Other packages are also found there too, most coming from upstream Debian sid (imported as source code & packages built on Ubuntu infrastructure).

If it’s the main versus universe you’re asking about though, I’ll provide an official link that may describe it better.

Repositories/Ubuntu - Community Help Wiki

as example, I can see where an installed packages are with an apt policy command, eg.

guiverc@d7050-next:~/uwn/issues/938$   apt policy ubuntu-desktop lubuntu-desktop
ubuntu-desktop:
  Installed: 1.570
  Candidate: 1.570
  Version table:
 *** 1.570 500
        500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
        100 /var/lib/dpkg/status
lubuntu-desktop:
  Installed: 26.04.3
  Candidate: 26.04.3
  Version table:
 *** 26.04.3 500
        500 http://archive.ubuntu.com/ubuntu resolute/universe amd64 Packages
        100 /var/lib/dpkg/status

You’ll note ubuntu-desktop which contains the Ubuntu (GNOME) desktop comes from main, where the Lubuntu (LXQt) desktop I’m currently using comes from universe as it’s a community sourced packaged (from a team I’m a member with).

PS: If you’re wondering why both are installed; I like multi-desktop installs, and I use GNOME on occasion when I want a ‘change’, or Xfce etc. - I’m quirky I guess.

[peterwhite23]

@guiverc

as Ubuntu has historically only provided security fixes for packages in main and multiverse.

I think, you meant to say “main and restricted” there?

[guiverc]

@peterwhite23

I think, you meant to say “main and restricted” there?

Yeah I did.. Thanks, corrected.

[jesmh]

okay, thanks. I got it.

@guiverc

The flavors (Kubuntu) are community based, and we don’t get coverage from the Ubuntu Security team.

When using Ubuntu as-it-is, main system relies on main repository. When using a flavor, main system relies on main and universe repository (e.g. my desktop).

Thanks again for your answers!

[peterwhite23]

@jesmh

When using Ubuntu as-it-is, main system relies on main repository. When using a flavor, main system relies on main and universe repository (e.g. my desktop).

Not quite. All Ubuntu flavors, including “vanilla”, use the universe repository by default, IIRC. And it can always be enabled manually, if that isn’t the case. And that’s where Ubuntu Pro comes in, by also covering security support of universe.