0

I've got a question regarding having the same software in different source PPAs.

Let's say I add a PPA to get a software from some dev. Later on, this dev decides to add to his PPA a custom version of another software that I happen to already have on my computer.

Next time I do sudo apt-get upgrade, I will receive his custom version if it has a higher version number than mine. It is a problem because the code might be malicious or break my workflow. Overall, this would be considered as a PPA hijack.

Explaining this in a foreign language isn't easy for me, so I figured out a diagram could help visualize the issue.

Diagram explaining the issue

Is there any way for me, as a user, to prevent receiving updates from a software if the source PPA has changed since the last update/install? I know I can freeze (or pin) a version, but it means I won't get updates at all (even if it's a legit one), so it doesn't really solve this issue.

I tried posting on /r/linux4noobs and crossposted on /r/linuxquestions, but I didn't really get much answers.

In my opinion, this seems to be a huge security issue and I'm surprised it isn't mentioned more. I'm still pretty new to Linux in general tho, so I might not be understanding something here. I'm open-minded and willing to understand how apt works, so feel free to point out anything I'm missing!

Thanks for future answers.

Improve this question
2
  • These two solutions would mean I can't get legit updates from both PPA regarding their own software, so it doesn't really solve my issue. I understand I should only add PPA that I trust, but sometimes there's simply no other way to get a software. Moreover, I would be interested in a way to tell the system to only download the apps I want from a given PPA, and not any newer version of any software, as it acts by default.
    – anlnrd
    Feb 28, 2020 at 17:11
  • @Terrance Have you heard of any alternative to apt that you could point me to which would allow some sort of "whitelist" when adding sources, or which would solve this issue due to their core organization?
    – anlnrd
    Feb 28, 2020 at 17:21

1 Answer 1

Reset to default
0

It's important to understand that PPAs are not intended for trusted, widespread distribution of updates.

Trusted distribution of updates should generally run through the official Ubuntu repositories. PPAs, while hosted by Canonical as a public service, are not the official Ubuntu repositories.

PPAs are intended for testing and limited distribution, and they are an important element of the Ubuntu development ecosystem.

However, their nature as a self-signed free repository means that PPAs can be misused by both users and by developers. This venue is littered with the tears of folks who misused PPAs as a sole source or an upgrade path.

In other words, you take a risk when you use PPAs.

  • If you discover a developer who uses PPA as a method of distributing released (non-testing) software, please encourage them to contribute their software to Debian so it can have much wider distribution, community testing and support, and can be discovered by many more users.

  • If you use PPAs on top of an LTS release of Ubuntu in order to get the latest software, then consider using one of Ubuntu's "interim" (6-month) releases instead. They are just as stable, each release updates your entire software stack software, and it's tested and supported by this community.

Improve this answer
1
  • Thanks for your answer, it helps me understand a bit more what PPA and APT were designed for. It's gonna be difficult to encourage big companies (Microsoft for VSCode, Google for Chrome...) to contribute more to Debian instead of releasing .deb packages (which add a custom PPA upon install), but I'll keep that in mind if I happen to see a regular dev misusing PPA.
    – anlnrd
    Feb 28, 2020 at 18:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .