Why is Extended Security Maintenance needed for apps in Ubuntu 20.04.x LTS in 2021?

I am also having the same problem as @ghiamar above, now doing apt-get upgrade throws this instead of upgrading the packages it was supposed to:

The following security updates require Ubuntu Pro with 'esm-apps' enabled:
  libmagickcore-6.q16-dev libmagickwand-dev libopenexr-dev libopenexr25
  libmagickcore-6.q16-6-extra libmagickwand-6.q16-6 imagemagick-6.q16
  libmagickcore-6.q16-6 imagemagick-6-common libmagickcore-6-arch-config
  libmagickwand-6-headers libmagickwand-6.q16-dev libmagickcore-6-headers
Learn more about Ubuntu Pro at https://ubuntu.com/pro
0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.

I am running Ubuntu 22.04.1 LTS aarch64 and I also attached the machine to my Ubuntu Pro subscription with sudo pro attach TOKEN and it showed now attached to said subscription . Then I tried to enable esm-apps support with sudo pro enable esm-support but it doesnt support arm64 architecture yet.

$ pro enable esm-apps --beta
One moment, checking your subscription first
Ubuntu Pro: ESM Apps is not available for platform arm64.
Supported platforms are: amd64, i386.

I honestly hate to say it but this has become really frustrating as an end user to solve and how Ubuntu has started to “hijack” packages in this sense so it won’t let you upgrade them as it normally should. Does canonical now want to charge for LTS distro support? Do we now need to pay just to upgrade some packages? I hope a smooth resolution is provided on this. Looking forward for a prompt response from the team.

1 Like

i have filed:

for you …

4 Likes

Greetings ogra,
Thank you. I greatly appreciate the prompt response. It really means a lot to me. G’day.

hi @ogra! Can you clarify if Ubuntu server 20.04.5 LTS support is charged now? Because today I also tried to upgrade with sudo apt update && sudo apt dist-upgrade and got

The following security updates require Ubuntu Pro with ‘esm-apps’ enabled:

1 Like

You can get security updates for universe packages (which did not exist before) if you enable esm/pro, yes…

it is free for everyone for up to 5 machines (or 50 if you are a community member) …

if you don’t want that, you can just ignore the message and will have no security updates for universe packages like before…

1 Like

Thanks! can you point me out on how to enable it for my box for free? Just have one Ubuntu server thanks!

There is a tutorial at https://ubuntu.com/pro/tutorial that should walk you through…

Cool, already had my Ubuntu One account. Have another question, maybe a little off topic, let’s say I install Ubuntu server 22.04 on the very same machine that I’ve just enabled pro (Ubuntu server 20.04), will that count as two machines? (subtracting one more box from the 5 free boxes)

I must admit that I don’t know that :slight_smile: but happy you solved it… perhaps @renanrodrigo knows more?

First of all, thanks for checking out the Pro subscriptions! We see the esm-apps with the universe support as a great addition to the Ubuntu users and hope it’s useful for you too.

Responding to the specific question: only active machines are counted. If you upgrade your 20.04 system to 22.04, or if you do a full reinstall and attach it again, it will still count as a single active machine.

Feel free to reach out for any other question or comment (:

2 Likes

So just to understand this correctly, since I was also hit out of the blue with:

The following security updates require Ubuntu Pro with 'esm-apps' enabled:
redis redis-tools redis-server

Do you not provide updates for packages unless unless I buy a subscription?
Does this mean I will be arbitrarily be stuck with old versions of certain packages?

1 Like

Canonical has never provided security updates for universe packages until this week, so nothing has changed for you if you decide to simply ignore the message …

If you instead decide to opt-in for free, you will get these security updates…

1 Like

I think that Canonical should change the sentence The following security updates require Ubuntu Pro with ‘esm-apps’ enabled: to something more friendly like Get more security updates with Ubuntu Pro with ‘esm-apps’ enabled:

1 Like

OK, but if the package maintainers release new versions of their packages, be it security update or feature update or whatever, I will get them, right?

And I think my main question is: is anything changing if I use Ubuntu Server LTS that I download from the website, or will I be required to pay for it in the near future?

1 Like

Packages in LTS releases usually do only get updated under extremely strict conditions and are very rare (even more though for universe)… nothing changed in that respect, it is just that you can optionally get additional security updates now that have not been provided before.

The images you download and their behavior has not changed.

The service is paid for by commercial users with larger server farms so that it can be provided for free to home users and small businesses (up to 5 machines or 50 if you are an Ubuntu community member, as mentioned a few times above), this is why it requires registration.

2 Likes

Help me make sure I understand the new Pro world:

  • Main packages patched for (almost) any reason by the Ubuntu Security Team will continue to go into -security
  • Universe packages that are patched for CVEs by the community and uploaded by a MOTU will go into -updates
  • Universe packages patched for CVEs by the Ubuntu Security Team will go into esm/apps instead of -security and require a Pro subscription to access. Will these eventually make their way to -security or -updates? Or must non-Pro folks await the next release?

Over in the community support channels, for many years we’ve been telling folks that esm is something most folks don’t need (and generally shouldn’t enable) until LTS community support ends…by which time they should have migrated to a newer release anyway.

This seems a big change to the advice that must be given out. Over in AskUbuntu, for example, there are years of older questions that may now be spouting inaccurate advice about the uses of esm. A bit of clarification for support volunteers might be in order so we’re clear about what’s changed, we’re not spouting mistaken information, and we can effectively combat rumors and FUD.

Here’s an example of confusion among support volunteers: https://askubuntu.com/questions/1452299/im-getting-the-error-the-following-security-updates-require-ubuntu-pro-with-e

A request on AskUbuntu for clarification: https://askubuntu.com/questions/1452497/what-are-esm-apps-and-how-do-they-relate-to-ubuntu-pro . The comments show that some very experienced support volunteers are a bit fuzzy on the topic yet.

Also, my favorite support troubleshooting tool (rmadison) doesn’t seem to pick up esm repos.

5 Likes

Hi all, I have a doubt.
In the past, Canonical has never provided security updates for packages in “Universe”, that’s why we see the message in the terminal mentioning Ubuntu Pro.

OK.
But if I want to get rid of that message? shouldn’t it be enough to disable the repository that theoretically provides those updates? If I am not mistaken it would be:

deb http://security.ubuntu.com/ubuntu jammy-security universe # REQUIRES UBUNTU PRO subscription

I already tried this, but I still see the ad.

I don’t want to register/subscribe to a service to get these security updates that I never had in the past.
I just want to remove that annoying and unnecessary message from the apt output.

How can I achieve this?

Thanks!

2 Likes

I found this comment on reddit .

I tried just commenting all the content in the file /etc/apt/apt.conf.d/20apt-esm-hook.conf and it just worked.
This is probably temporary, but at least it is something.

2 Likes

oh that gives a relief, it works. Thank you so much for sharing it @jesusangelm :heart:

Can you guys try this?

pro config set apt_news=false