I am trying to understand the do-release-upgrade
process i.e. the way that Ubuntu prompts me to upgrade to the next spring or autumn Ubuntu release.
After reading the sources for ubuntu-release-upgrader
I found the /etc/update-manager/meta-release file on my system. This file appears use an HTTP URL to point to http://changelogs.ubuntu.com/meta-release where the various Ubuntu releases from Warty 04.10 to Raring 13.04 are listed. This file lists the releases, their support status, the date of release and has a link to the Release
file.
Now the Release
file has a corresponding GPG signature and the sha1sum of the Packages
file which, in turn, has the sha1sum of the individual DEB binaries that get installed. The recent releases also have an upgrade script and a corresponding GPG signature for these too. All sounds good.
My question is about the meta-release
file itself. It is not served over HTTPS and I cannot find a GPG signature for it. If somebody replaces this file could they somehow cause my machine to upgrade...
- ...to a signed release that hasn't yet gone through security testing?
- ...to an old release that is not supported and has unfixed security vulnerabilities?
UpgradeToolSignature
is still there, so it will only upgrade using a tool signed by Canonical (but yeah, that does not mitigate the concerns you have).