0
# ubuntu-security-status
X packages installed, of which:
Y receive package updates with LTS until 4/2025

The output does not mention ESM. I activated my UA subscription on this machine, and the output is still the same. What does it mean?

  1. X-Y packages currently do not receive updates. If so, how can this be fixed?

  2. All of the X installed packages currently receive updates. At some point in the future before 4/2025, X-Y of them will stop receiving updates, unless ESM is activated (which should be the case after activating UA).

  3. Other, please specify.

5
  • 1
    ESM only provides critical updates. Many packages will no longer get updates. ESM is not intended as a replacement for upgrading to a supported release. All users on ESM are strongly encouraged to upgrade to a supported release. Finally, releases that have gone into ESM do not receive community support, including on Ask Ubuntu. You can pay Canonical for a support plan if you need more support beyond access to critical updates. See: ubuntu.com/security/esm and ubuntu.com/blog/…
    – Nmath
    Mar 1, 2022 at 22:32
  • ESM is not the point then; upgrading to the next release every 3 or so years is fine for me. Question remains: what is the status of the X-Y packages not named as supported until 4/2025? I guess they are from universe or multiverse. Are there any guarantees for such packages? Perhaps as a commercial option? Mar 1, 2022 at 22:46
  • 1
    Not all packages are supported for 5 years. For example, there's only three years of support for all of the flavours of Ubuntu except for Ubuntu Server and Ubuntu Desktop (GNOME)
    – Nmath
    Mar 1, 2022 at 23:21
  • Can we say that as long as I upgrade to the next Ubuntu release every 3 years, all packages will be supported? I'm reading some articles right now, and they claim that packages in universe and multiverse are not covered by any such guarantees. So in theory such packages could already have been outdated (possibly with security problems) on the day the currently installed version of Ubuntu was released. Mar 1, 2022 at 23:29
  • 1
    You should probably do some more research about how Ubuntu is developed, especially in terms of how software upstream makes it way into Ubuntu releases. Ubuntu doesn't develop all of the software in Ubuntu repositories. And the version numbers of software aren't the same between different releases. So Ubuntu 20.04 will have different versions of software than Ubuntu 21.10. The newer release can actually have newer versions of the same software than the LTS and 21.10 and its packages will still become unsupported before the LTS packages do.
    – Nmath
    Mar 1, 2022 at 23:45

2 Answers 2

1

The output should be the same until your LTS release reaches the end of its Standard Support (5 years). Then ESM begins.

Let's run through an example: Let's say you have package foo from the main repository on your Ubuntu 20.04 LTS system...

  • Standard Support for LTS releases is 5 years. So until April 2025, ALL users of foo will receive security upgrades from the Ubuntu Security Team via the focal-main repository (not ESM). The focal-main repo is open for all users without registration.

  • At the end of 5 years, Standard Support ends. Security upgrades in focal-main cease...and begin in ESM. ESM requires an Ubuntu Advantage subscription.

Packages in universe and multiverse are generally ineligible for ESM support. The Canonical-paid engineers on the Ubuntu Security Team promise to provide support for main and partner...and commit to nothing else. Security upgrades for packages in universe and multiverse should be coming from community volunteer members of the Ubuntu Security Team, but there is currently a shortage of willing volunteers to do that work.

Also, keep in mind that most security upgrades provided by the Ubuntu Security team are in the form of patched packages, NOT version bumps. The original purpose of an LTS is a long-term platform with the fewest software changes possible. Folks who want newer software during those 5+ years should look at non-LTS releases of Ubuntu.

3
  • Can anything be said about packages not from main? I guess about X-Y packages on my system are from universe or multiverse. Mar 1, 2022 at 23:08
  • @LasseKliemann added two paragraphs to answer your follow-up question.
    – user535733
    Mar 1, 2022 at 23:56
  • Very good answer. Just one addition: There is also ESM-Apps that covers Universe repo. It is a paid subscription but it comes already enabled on Ubuntu Pro.
    – Carlos B
    Mar 17, 2022 at 20:27
0

ubuntu-security-status is not ESM aware. It is referring to regular updates and not security patches. If ESM is enabled, you can check status with sudo ua status, and a new feature on ua which is in beta:

sudo ua security-status --format yaml --beta

For example, in 18.04 Pro, support status gives you:

ubuntu@ip-172-31-91-xx:~$ ubuntu-support-status --show-unsupported
Support status summary of 'ip-172-31-91-97':

You have 499 packages (99.0%) supported until April 2023 (Canonical - 5y)

You have 0 packages (0.0%) that can not/no-longer be downloaded
You have 5 packages (1.0%) that are unsupported


No longer downloadable:


Unsupported: 
krb5-locales libgssapi-krb5-2 libk5crypto3 libkrb5-3 libkrb5support0 

And shows that it is on half of life, but, ESM will maintain security updates even for those packages.

In the same machine sudo ua security-status --format yaml --beta gives me:

summary:
  num_esm_apps_updates: 5
  num_esm_infra_updates: 0
  num_installed_packages: 504
  num_standard_security_updates: 16
  ua:
    attached: true
    enabled_services:
    - esm-apps
    - esm-infra
    entitled_services:
    - esm-apps
    - esm-infra

Guess which 5 packages are shown under ESM updates :)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .