3

For the limited number of package I looked at (e.g. apache), I found that the package version in the updates repository is always newer than or equal to the version available in the security repository (provided that they exist). This gives me the impression that all security patches posted to the security repository are also posted to the updates repository. If this is true, I can remove all <release_name>-security entries in my apt sources.list and the <release_name>-updates entries will still give me the security patches. This will speed up apt-get update quite a bit.

The best documentation I can found regarding the repositories is on the community help page

  1. "Important Security Updates (raring-security)". Patches for security vulnerabilities in Ubuntu packages. They are managed by the Ubuntu Security Team and are designed to change the behavior of the package as little as possible -- in fact, the minimum required to resolve the security problem. As a result, they tend to be very low-risk to apply and all users are urged to apply security updates.
  2. "Recommended Updates (raring-updates)". Updates for serious bugs in Ubuntu packaging that do not affect the security of the system.

However, it does not mention whether the updates repository also includes everything in the security repository. Can anyone confirm (or disconfirm) this?

1 Answer 1

0

You are correct, when packages are pushed to the security repository for a given release, there is an automated process that also copies the security update to the corresponding updates repository. The reason for this is to reduce the bandwidth load on the security.ubuntu.com servers.

However, the recommendation is to keep pointing your apt source.list at the security repo at security.ubuntu.com, but after the rest of your entries. The reason for this is that if you are using a mirror other than archive.ubuntu.com, it's possible that the mirror you're pointing at falls behind or is out of date with respect to the primary archive hosts. If that happens, apt will still pull important security updates from security.ubuntu.com. However, if the update is available on the other archive mirror and security.ubuntu.com, apt will pull from the repository that is listed earlier in the sources.list configuration file. As you point out, it does admittedly come at the cost of slowing down atp-get update a bit.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .