9

What happens if there is a security problem in a package in the universe repository four years after the 12.04 LTS release; will the package be updated from upstream, patched, or left alone?

It's my understanding that the "5 years of support & security updates" applies only to the core of Ubuntu -- anything in Main repository. Not for things in the Universe repository.

For a more specific example -- if I install Ruby now, and want to use it for the next several years on 12.04 and it has a security vulnerability; while this might be patched in the upstream (so I could always download the latest from their website and compile it myself or use a PPA), will this upstream fix be migrated into the precise package repositories? What about backports?

2 Answers 2

7
+50

Packages in Universe are community maintained. Whether or not they get security updates depends entirely on the community who uses them.

Instructions for contributing security updates for packages in Universe are here:

https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures#Preparing_an_update

Basically, anybody can file a bug, attach a debdiff, subscribe the ubuntu-security-sponsors team and someone from the team will look at it to make sure it's ok, and then sponsor it to the archive.

5

The example you provided, Ruby, is in the main repository and is supported for five years:

$ apt-cache show ruby | grep -E "(^Supported|pool)"
Filename: pool/main/r/ruby-defaults/ruby_4.8_all.deb
Supported: 5y

See also my answer to "Does 12.04 LXDE have LTS?" and How do I get a list of non-LTS packages installed efficiently?.

For software from universe, it's not even supported officially at all, let alone for five years. From the Community Wiki on the repositories:

Canonical does not provide a guarantee of regular security updates for software in the universe component, but will provide these where they are made available by the community.

However, you can expect most severe issues on popular packages being patched by the community maintaining the software in universe. Just no guarantees.

For the backports my view is that these should not be used in production.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .