Why is Extended Security Maintenance needed for apps in Ubuntu 20.04.x LTS in 2021?

OK, but if the package maintainers release new versions of their packages, be it security update or feature update or whatever, I will get them, right?

And I think my main question is: is anything changing if I use Ubuntu Server LTS that I download from the website, or will I be required to pay for it in the near future?

1 Like

Packages in LTS releases usually do only get updated under extremely strict conditions and are very rare (even more though for universe)… nothing changed in that respect, it is just that you can optionally get additional security updates now that have not been provided before.

The images you download and their behavior has not changed.

The service is paid for by commercial users with larger server farms so that it can be provided for free to home users and small businesses (up to 5 machines or 50 if you are an Ubuntu community member, as mentioned a few times above), this is why it requires registration.

2 Likes

Help me make sure I understand the new Pro world:

  • Main packages patched for (almost) any reason by the Ubuntu Security Team will continue to go into -security
  • Universe packages that are patched for CVEs by the community and uploaded by a MOTU will go into -updates
  • Universe packages patched for CVEs by the Ubuntu Security Team will go into esm/apps instead of -security and require a Pro subscription to access. Will these eventually make their way to -security or -updates? Or must non-Pro folks await the next release?

Over in the community support channels, for many years we’ve been telling folks that esm is something most folks don’t need (and generally shouldn’t enable) until LTS community support ends…by which time they should have migrated to a newer release anyway.

This seems a big change to the advice that must be given out. Over in AskUbuntu, for example, there are years of older questions that may now be spouting inaccurate advice about the uses of esm. A bit of clarification for support volunteers might be in order so we’re clear about what’s changed, we’re not spouting mistaken information, and we can effectively combat rumors and FUD.

Here’s an example of confusion among support volunteers: https://askubuntu.com/questions/1452299/im-getting-the-error-the-following-security-updates-require-ubuntu-pro-with-e

A request on AskUbuntu for clarification: https://askubuntu.com/questions/1452497/what-are-esm-apps-and-how-do-they-relate-to-ubuntu-pro . The comments show that some very experienced support volunteers are a bit fuzzy on the topic yet.

Also, my favorite support troubleshooting tool (rmadison) doesn’t seem to pick up esm repos.

5 Likes

Hi all, I have a doubt.
In the past, Canonical has never provided security updates for packages in “Universe”, that’s why we see the message in the terminal mentioning Ubuntu Pro.

OK.
But if I want to get rid of that message? shouldn’t it be enough to disable the repository that theoretically provides those updates? If I am not mistaken it would be:

deb http://security.ubuntu.com/ubuntu jammy-security universe # REQUIRES UBUNTU PRO subscription

I already tried this, but I still see the ad.

I don’t want to register/subscribe to a service to get these security updates that I never had in the past.
I just want to remove that annoying and unnecessary message from the apt output.

How can I achieve this?

Thanks!

2 Likes

I found this comment on reddit .

I tried just commenting all the content in the file /etc/apt/apt.conf.d/20apt-esm-hook.conf and it just worked.
This is probably temporary, but at least it is something.

2 Likes

oh that gives a relief, it works. Thank you so much for sharing it @jesusangelm :heart:

Can you guys try this?

pro config set apt_news=false

I don’t know if this is related to the recent Ubuntu Pro movements, but is it just me or does everyone have a bunch of packages with updates that have been held back?

The following packages have been kept back:
grub-efi-amd64-bin grub-efi-amd64-signed libdrm-amdgpu1 libdrm-common libdrm-intel1 libdrm-nouveau2 libdrm-radeon1 libdrm2 libegl-mesa0
libgbm1 libgl1-mesa-dev libgl1-mesa-dri libglapi-mesa libglx-mesa0 libxatracker2 mesa-va-drivers mesa-vdpau-drivers mesa-vulkan-drivers
python3-software-properties snapd software-properties-common software-properties-qt ubuntu-advantage-tools
0 upgraded, 0 newly installed, 0 to remove and 23 not upgraded.

@ghiamar I ran that command but got the following message:

[info] A new version is available: 27.13.2~22.04.1
Please run:
sudo apt-get install ubuntu-advantage-tools
to get the latest version with new features and bug fixes.

1 Like

no, it is not … it is related to https://help.ubuntu.com/community/PhasedUpdates

4 Likes

Seems to work, upgraded with sudo apt-get install ubuntu-advantage-tools then ran sudo pro detach and ran a package update and the message seems gone…

I also got:

Ubuntu Pro: ESM Apps is not available for platform arm64

Hope this is resolved soon as it is a catch 22 situation.

Make sure to click the “affects me too” link on the bug report…

2 Likes

Done… Thank you…

1 Like

Thank you for the bug report, I got the same problem.

1 Like

Hello all,

So, after taking a look, arm64 is actually supported and should be available to Pro users.
This was fixed in the backend today. People who attach from now on will have full access to esm-infra and esm-apps from Bionic onwards.

If you are attached already, please:

  • Run sudo pro status and check there is a message saying that a contract change happened, and asking you to run sudo pro refresh
  • Well, run sudo pro refresh to get the new (and correct) contract data
  • Run sudo pro status again: you should see esm-apps now available.
  • Enable it with sudo pro enable esm-apps

As for other architectures (armhf, for instance) which are actually unsupported - we are working to avoid showing that updates are available, and will provide more info on the bug that Oliver opened.

As always, feel free to reach out for any doubt, question or problem.

4 Likes

Awesome! Thank you alot for providing the update. I just did those steps and they worked smoothly. :heart:

4 Likes

sudo pro config set apt_news=false did not remove the Ubuntu Pro commercial for me. :unamused:

1 Like

I tried both sudo pro config set apt_news=false as well as sudo pro detach and neither worked for me.

I tried @jesusangelm solution of commenting out the lines in /etc/apt/apt.conf.d/20apt-esm-hook.conf and for now, that’s working.

I’m not happy that I need to work this hard to disable something like this.