339

I see a lot of interesting programs out there that can only be obtained by adding a "PPA" to the system but, if I'm understanding correctly, we should stay within the official "repositories" for adding software to our system.

Is there any way for a novice to know if a "PPA" is safe or if it should be avoided? What tips should the user know about when dealing with a PPA?.

2
  • 2
    See also: askubuntu.com/questions/7662/… Dec 12, 2012 at 6:33
  • You could check if there is a snappy package available too. They tend to be limited by security rules. You have to explicitly grant certain permissions to some snaps, though the general issue is the same (you need to trust the publisher).
    – Ken Sharp
    Jun 22, 2018 at 8:22

9 Answers 9

237

PPA (Personal Package Archive) are used to include a specific software to your Ubuntu, Kubuntu or any other PPA compatible distro. The "safeness" of a PPA depends mostly on 3 things:

  1. Who made the PPA - An official PPA from WINE or LibreOffice like ppa:libreoffice/ppa and a PPA that I created myself are not the same. You do not know me as a PPA maintainer, so the trust issue and safety is VERY low for me (Since I could have made a corrupted package, incompatible package or anything else bad), but for LibreOffice and the PPA they offer in their website, THAT gives a certain safety net to it. So depending on who made the PPA, how long he or she has been making and maintaining the PPA will influence a little bit on how safe the PPA is for you. PPA's as mentioned above in the comments are not certified by Canonical.

  2. How many users have used the PPA - For example, I have a PPA from http://winehq.org in my personal PPA. Would you trust ME with 10 users that confirm using my PPA having 6 of them saying it sucks than to the one Scott Ritchie offers as ppa:ubuntu-wine/ppa in the official winehq website. It has thousands of users (including me) that use his PPA and trust his work. This is work that has several years behind it.

    You can check the number of downloads from a PPA with the PPA Stats webpage.

  3. How updated the PPA is - Let us say you are using Ubuntu 10.04 or 10.10, and you want to use THAT special PPA. You find out that the last update to that PPA was 20 years ago.. O.o. The chances you have on using THAT PPA are null. Why?. Because the package dependencies that PPA needs are very old and maybe the updated ones change so much code that they wont work with the PPA and possibly break your system if you install any of the packages of that PPA to your system.

How updated a PPA influences the decision to use it if he/she wants to use THAT PPA. If not they would rather go look for another one more up to date. You do not want Banshee 0.1 or Wine 0.0.0.1 or OpenOffice 0.1 Beta Alpha Omega Thundercat Edition with the latest Ubuntu. What you want is a PPA that is updated to your current Ubuntu. Remember that a PPA mentions for what Ubuntu version is made for or multiple Ubuntu versions was made for.

As an example of this here is an image of the versions that are supported in the Wine PPA:

enter image description here

Here you can see that this PPA is supported since Dinosaurs.

One BAD thing about how updated a PPA is, if the PPA maintainer tends to push into the PPA the latest, greatest and cutting edge version of a specific package. The down side of this is that if you are going to test the latest of something, you ARE going to find some bugs. Try to stick with PPAs that are updated to a stable version and not a unstable, testing or dev version since it might/will contain bugs. The idea of having the latest is also to TEST and say what problems were found and solve them. An example of this are the daily Xorg PPAs and Daily Mozilla PPAs. You will get about 3 daily updates for X.org or Firefox if you get the dailies. This is because of the work the put in there and if you are using their daily PPAs it means you want to help with bug hunting or development and NOT for a production environment.

Basically stick with this 3 and you will be safe. Always look for the maker/maintainer of the PPA. Always see if many users have used it and always see how updated the PPA is. Places like OMGUbuntu, Phoronix, Slashdot, The H, WebUp8 and even here in AskUbuntu are good sources to find many users and articles talking about and recommending some PPAs that they have tested.

Stable PPA Examples - LibreOffice, OpenOffice, Banshee, Wine, Kubuntu, Ubuntu, Xubuntu, PlayDeb, GetDeb, VLC are good and safe PPAs from MY experience.

Semi Stable PPA - X-Swat PPA is a in the middle PPA between bleeding edge and stable.

Bleeding Edge PPA - Xorg-Edgers is a bleeding edge PPA although I should mention that after 12.04, this PPA has become more and more stable. I would still mark it as bleeding edge but it is stable enough for end users.

Selectable PPA - Handbrake offers here a way for the user to choose, do you want a stable version or do you want the bleeding edge (Also referred to as Snapshot) version. In this case you can select what you want to use.

Note that in the case of using for example the X-Swat ppa with the Xorg-Edgers PPA, you will get a mixed between the two (With priority towards Xorg-Edgers). This is because both are trying to include almost the same packages, so they will overwrite each other and only the most updated one will show in your repositories (Except if you manually tell it to grab the package from X-Swat).

Some PPAs might update some of your packages when you add them to your repository because they will overwrite with their own version a certain package to make the PPA software work on your system correctly. This might be some code packages, python versions, etc.. Other like the LibreOffice PPA will remove all existence of the OpenOffice from your system to install the LibreOffice packages there. Basically read what other users have commented about a specific package and also read if the package is compatible with your Ubuntu version.

As the comment below suggest by Jeremy Bicha, some bleeding edge (PPAs that stay very up to date including adding Alpha, Beta or RC quality software in the PPA) could potentially damage your whole system (In the worst case). Jeremy mentions an example of many.

8
  • Is this true for the multitude of PPA's that you need to install to get themes like equinox, elementary etc?
    – abel
    Aug 13, 2011 at 17:42
  • 2
    Yes. It applies to any PPA. Remember that a PPA its just an easy way to update a program or group of programs via someone that takes it into their time to have them upgraded. So it is a place where someone dedicates his or her time for something to be updated or compatible with the latest/older system. But since it is a human that is doing it, there might be mistakes on the way. Aug 13, 2011 at 21:40
  • 20
    How does one discover how many users a PPA has?
    – damien
    Sep 16, 2013 at 3:57
  • Does adding a PPA give hackers some holes to pass through? Apr 28, 2018 at 10:25
  • @mathmaniage The source code has to be uploaded and built by the system, so the source code is available to check at any time.
    – Ken Sharp
    Jun 26, 2019 at 18:00
58

To develop PPA's on launchpad, the contributor must have signed the ubuntu code of conduct. This signifies the the developer must abide to a minimum set of standards.

Usually people should then consult the ubuntuforums to see who has used particular ppa's and if they could cause any issues.

For a "novice" or "noob" - my best advice is to steer clear of PPA's until you feel confident that you understand a few things about the command line, potential error messages and a few things how to diagnose issues.

To remove ppa's causing issues, you can most of the time use "ppa_purge"

If you are feeling nervous, then consider an image backup of your computer with a tool like clonezilla. That way, if things go wrong and you cant resolve it, at least you have a quick means to restore your computer back to the way it was before you started playing.

Having said all that, ppa's are extremely useful to get the latest versions of software - especially for those that dont try to upgrade every 6 months and stick with the LTS version of ubuntu.

5
  • 1
    I would love your answer at the top just for the advise to novices. :(
    – Braiam
    Sep 5, 2013 at 23:42
  • @fossFreedom: do I recieve automatic updates if I install via ppa or apt-get install utility Sep 14, 2013 at 12:32
  • 1
    @user01 - if the person who created the PPA updates the package with a new version, yes - you'll get the update automatically if you have added the PPA first then apt-get install package
    – fossfreedom
    Sep 14, 2013 at 12:39
  • 4
    Of course, an malicious user isn't going to be stopped by having to sign the code of conduct...
    – evilsoup
    Aug 5, 2014 at 14:38
  • 1
    Backups won't save you from digital theft (e.g. a malicious PPA sending your browser cookies or ssh keys back home). If you are really feeling nervous, it should be safe to install and run the PPA inside a virtual machine, container or schroot. Jan 2, 2017 at 7:26
23

All the concerns listed by others here are extremely important to understand. That said, since this is open source, we can tell exactly what the PPA has changed from the version of the package in Ubuntu. We'll use the PPA from this duplicate as an example.

First we'll grab the source from the PPA dget a tool that will download all the pieces of a Debian source package given a link to the dsc file:

dget -u https://launchpad.net/~anton0/+archive/unity/+files/unity_5.12-0ubuntu2~ppa1.dsc

I found that link by clicking "View package details":

View package details

And then:

find dsc file

Next, we'll get the source of the package in the Ubuntu archive:

apt-get source unity

Finally, we'll use debdiff to see the differences between the source of the two packages:

debdiff unity_5.12-0ubuntu1.1.dsc unity_5.12-0ubuntu2~ppa1.dsc

The output of that command is about three hundred lines long, so I'll put it on a pastebin instead of directly into the window. Now, I can't vouch for how good the code is since I don't really know C++, but it seems to be doing what it claims and not anything malicious.

2
  • 2
    +1, but your pastebin link is broken. Dec 4, 2015 at 20:22
  • This is an excellent example of how to check what has been done with a PPA package. The link to the pastebin is utterly irrelevant. +1
    – Ken Sharp
    Jun 26, 2019 at 18:02
21

It isn't just a matter of malware, as has already been said. It is also that some of the software might really still be in the testing stage and not ready for production use. If you install it and rely upon it to get work done, you might find that it is buggy, unreliable, and can crash - leaving you without the work you have done.

Some of it might also not get along well with other aspects of Ubuntu, such as Unity or Gnome, causing problems that are difficult to trace, and perhaps even making your system unstable.

This is not because the software is bad, but because it has perhaps not yet been fully tested, or because it was made available so that people could test it, but not yet intended to be generally released as production software. So you should use caution, although some of it is really quite good.

A number of months ago I installed a recommended package from a particular PPA, and it trashed my system enough that I had to reinstall Ubuntu. I was a new user and didn't know what else to do; with a bit more knowledge I might have been able to solve the problem and restore it without doing a reinstall (although that, too, was useful to me in learning Ubuntu, but if I had worked saved on my machine I would have lost it).

So be careful, ask questions, make frequent backups (!!!), and know that malware is unlikely (though not impossible).

14

A PPA is a web folder that contains software you can install. It really isn't much more complicated than that. When you install a package, you do that with root privileges and the package has scripts that are run, so they are run as root. That means installing any software is dangerous and you do need to trust the developer or distributor.

An apt archive, PPA or otherwise, is polled regularly for updates to software you have installed. The "problem" with that, is that anyone can provide a newer package of software you have installed. For instance, you can add a PPA in order to get a nice theme and automatic updates of that theme. But once you have added that repository, the owner can add a patched openssh-server package, for instance, and it will appear as an update in Ubuntu. This can be done a year after you added the PPA, so you need to pay attention to updates.

The PPA system does prevent third-parties from tampering with the packages, however, so if you do trust the developer/distributor, then PPAs are very safe. For instance, if you install Google Chrome, then they add a PPA so that you'll receive automatic updates for it. They add "deb http://dl.google.com/linux/chrome/deb/ stable main". If the DNS server you use was hacked to point dl.google.com somewhere else, then they could push patched software onto everyone who had installed Chrome. But Ubuntu would refuse to install them since they could not be signed with Googles private key. So in that regard, PPAs are very secure.

It is not possible to say that a PPA is safe or not. It depends on the people who use it to distribute software. With free software, people can look at the source and see if it is safe or not. When lots of people use an archive, like Ubuntu regular archives, then you have peer review. Small archives with few users don't have that, so they are less trustworthy. The main lesson is that no matter what system you use, you should take care when installing software.

13

Building upon Luis Alvarado's answer, you should be aware of these risks:

  • Malicious packages—Packages might try to harm you. This is easy for them because they can run any code with administrative privileges.
  • Poor quality or incompatible software—An application might not work well. It might accidentally cause damages by, for example, interfering with other software, destroying your data, or leaking private information.

and you should be attentive to these factors:

  • Honesty of the maintainer—Might the maintainer secretly try to harm you?
  • Security of the maintainer—Is the maintainer vulnerable to attack by a third party?
  • Reliability of the maintainer—Will the maintainer respond to the need for updates within a reasonable time frame? Are they committed to maintaining the PPA in the long-term?
  • Security of the repository—Are packages signed by the maintainer?
  • Performance of the software—Is the software bug-free and compatible with your system?
8

The packages on PPA's aren't checked for things like malware. So while someone might be packaging something like XBMC for you, they could very easily also be adding some spyware/malware as well. This is why you shouldn't just add any random PPA.

5
  • can u please say what exactly is XMBC, i am quite a new ubu Dec 1, 2011 at 20:25
  • XBMC is a media center software. It is good and safe software. He only used it as an example, it could be any software.
    – Anonymous
    Dec 1, 2011 at 20:29
  • what can a malware do in ubuntu, it should ask permission for anything and everything right? Dec 1, 2011 at 20:30
  • Once you've installed it (i.e. given it root permission to copy its files to system directories and run custom scripts) it can do anything it wishes with the system. That's why it is important to install packages from trusted sources.
    – arrange
    Dec 1, 2011 at 20:39
  • Incorrect. When you install a piece of software, you are root when doing so. It's rather easy to take that permission and start doing bad things.
    – tgm4883
    Dec 1, 2011 at 20:40
3

When you add ppa and install a program through it.

Basically you give permission to reside that program in allowed executable area (/bin/ /sbin/ /usr/bin/).

Now if program itself is/has somehow a malware then system won't complain about it as you are the one who added ppa considering its trustworthy.

When program comes from the Ubuntu repositories they are first checked (I would like to say thoroughly but I don't know :P) so those from Ubuntu repositories are free of malware/spywares for sure.

For any other ppa its upto you/user to decide whether to trust it or no.

4
  • what can a malware do in ubuntu, it should ask permission for anything and everything right? Dec 1, 2011 at 20:27
  • 6
    When you install the software it will ask for root permission (the screen darkens and you enter your password). At this point it could do anything: delete everything from your box, install a keylogger, change your desktop background to hello kitty, anything.
    – SCdF
    Dec 1, 2011 at 20:29
  • 1
    @sanjayasanjuubuntu: while installing it asks for permission to reside in executable area, once it is there it can access for any non-su information easily. There are programs which need su permission to execute however if program itself has extra baggage (read malware) added while packaging, it can execute with no issues when you type in your password.
    – wisemonkey
    Dec 1, 2011 at 20:35
  • Dev PPAs are the safest route and also need to see the contributor's duration at Launchpad. These factors guarantee a safe, stable system using PPAs for latest programs. I have found this route to keep my LTS running for long with the particular new versions of programs I use. Oct 15, 2015 at 7:30
0

Not sure why some people think it is funny to deride people seeking knowledge.

about PPA

"sudo add-apt-repository universe"

"add-apt-repository" is a special tool that helps us install new programs on the computer. It's like adding new toys to your toy collection.

And "universe" is a special place where the computer keeps lots of different programs that we can use. It's like a big toy store with lots of different toys to choose from.

So when we type "sudo add-apt-repository universe" into the computer, we're telling it to give us permission to use lots of different programs from the special place called "universe". It's like getting a key to the big toy store so we can pick out lots of fun new toys to play with!

Why should I trust universe?

When we talk about "universe" in the context of the command "sudo add-apt-repository universe", we're actually referring to a special software repository that is maintained and supported by the developers of Ubuntu Linux operating system.

A software repository is like a big online library that stores many different programs that you can download and install on your computer. The universe repository contains many open-source software programs that are freely available to use.

The developers of Ubuntu Linux are a well-respected group in the open-source software community, and they have a reputation for carefully curating and maintaining the software programs that are included in their repositories. They also regularly update the programs to ensure that they are safe and secure to use.

So, in short, you can trust the universe repository because it is maintained by a reputable group of developers who are committed to providing quality software programs that are safe and secure to use.

Why should I trust deadsnakes

"sudo add-apt-repository ppa:deadsnakes/ppa" is a command that adds a Personal Package Archive (PPA) to your Ubuntu Linux operating system.

A PPA is a software repository maintained by an individual or a group of individuals outside of the official Ubuntu Linux repositories. In this case, the PPA "deadsnakes" is maintained by the "deadsnakes" team, who provide updated and alternate versions of Python programming language for Ubuntu users.

By running this command, you are adding the "deadsnakes" PPA to your system, which will allow you to download and install the Python programming language packages that are provided by the "deadsnakes" team.

It's important to note that while PPAs can be a useful source for software packages, they are not officially supported by Ubuntu Linux developers and may not undergo the same rigorous testing and quality assurance as packages from the official repositories.

Therefore, you should be cautious when adding PPAs to your system and only use PPAs from trusted sources. In this case, the "deadsnakes" team is a well-respected group in the Python programming community and their PPA is generally considered to be a safe and reliable source for Python packages.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .