41

I use the package texlive-full, which installs imagemagick and other related packages. When I check for updates, I get this message:

The following security updates require Ubuntu Pro with 'esm-apps' enabled:
  imagemagick libopenexr25 libmagick++-6.q16-8 libmagickcore-6.q16-6-extra
  libmagickwand-6.q16-6 imagemagick-6.q16 libmagickcore-6.q16-6
  imagemagick-6-common

Which means that if I want to use texlive-full with Ubuntu 22.04, I have to pay $500 per year to have a secured distro, as far as I understand what is written.

Is there a way to avoid that, for example by not installing everything installed by texlive-full?

EDIT:

gaucher@mars:~$ apt policy texlive-full
texlive-full:
  Installé : 2021.20220204-1
  Candidat : 2021.20220204-1
 Table de version :
 *** 2021.20220204-1 500
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe i386 Packages
        100 /var/lib/dpkg/status

My configuration (yes I am using Ubuntu 22.04):

enter image description here

Added on request:

gaucher@mars:~$ apt policy imagemagick
imagemagick:
  Installé : 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1
  Candidat : 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1
 Table de version :
 *** 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1 500
        500 https://esm.ubuntu.com/apps/ubuntu jammy-apps-security/main amd64 Packages
        100 /var/lib/dpkg/status
     8:6.9.11.60+dfsg-1.3build2 500
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
Improve this question
1

6 Answers 6

Reset to default
20

I have found the solution. Run:

sudo pro enable esm-apps

and then update using the usual way and imagemagick and all related packages will be updated.

If Ubuntu Pro support is enabled on your Ubuntu Desktop, you can go to Software & Updates and open the Ubuntu Pro tab.

Software & Updates

In this context, it should be noted that "ESM Apps" cover applications from the universe repository.

Note that it is necessary to have an account on ubuntu.com and this feature is free for up to 5 machines.

See the Q&A about Ubuntu Pro.

Improve this answer
3
  • 30
    Doesn't looks like a solution when the goal is to continue using a system without having to switch on a subscription
    – Dario Petrillo
    Jan 28 at 16:28
  • 2
    @DarioPetrillo You're right. The solution is not complete. It is necessary to have an account on ubuntu.com at first. It is free up to 5 machines: I have one desktop PC and two laptops PC with Ubuntu 22.04.
    – Philippe Gaucher
    Jan 28 at 19:53
  • 1
    Doesn't work, even after creating the needed account and getting a token
    – Bytor
    Feb 2 at 16:53
18

Here is a solution that doesn't require subscribing or registering. It removes the helpful look what you could get if you sign up message. This is not the most elegant, but it takes care of the immediate issue:

the file /etc/apt/apt.conf.d/20apt-esm-hook.conf provides the hook that calls the marketing message generation. Removing that is an option

mkdir -p relocated_apt
sudo mv /etc/apt/apt.conf.d/20apt-esm-hook.conf ~/relocated_apt/.

now when you run apt upgrade the message does not show.

Note this doesn't survive updates if a new version gets put there, which may happen more as this new feature is rolled out/updated.

Improve this answer
5
  • 3
    While this may remove the message, it doesn't fix the security vulnerability that the message is warning you that you're affected by.
    – Joseph Sible-Reinstate Monica
    Jan 30 at 17:31
  • 4
    This solution addresses the issue of getting a message that is perceived as an error. If the OP does not want to subscribe (or be reminded about it in a confusing way), this removes the message.
    – John Manecke
    Jan 30 at 22:00
  • 2
    Help me to better understand this. Is there a security vulnerability here? If I'm running Debian stable, the version of imagemagick I'll have is the same as what I'm getting from universe without the esm-apps. I generally consider Debian stable a to be well updated from a security perspective. Agree moving to esm-apps provides a path to increased security, but I'm not sure running without it means I'm running with security vulnerabilities? Does this issue raise up to something you modify the output of apt for?
    – John Manecke
    Jan 30 at 22:05
  • Yes, it appears 20.04 and 22.04 do have some vulnerabilities that only ESM provides updates for. As for Debian, you'll have to check with Debian to see if the same applies because Debian offers slightly different package versions that may be patched.
    – mchid
    Feb 2 at 14:30
  • Like for this CVE, oldstable (buster) is patched but stable (bullseye) is not.
    – mchid
    Feb 2 at 14:44
17

This is an additional support stream

From reddit.com/r/linux/, user Patch86UK:

For clarity: This is not a roadblock being put on an existing support stream, it is a new support stream. Previously Ubuntu did not provide security patches for "Universe" repo packages (instead relying on upstream patches to happen when they happen). The Ubuntu security team are now producing in-house security patches for these packages, but only where Pro has been opted into (which is free for personal use).

If you do not want to opt in to Pro you still have the same level of support you had before (and the same level of support that you have with 99% of other distros).

Improve this answer
7
  • 1
    I'm now considering Debian 11. This is a terrible idea by the Ubuntu team.
    – Gary
    Feb 4 at 22:47
  • 8
    It is time to consider to move away from Ubuntu...
    – Kaspacainoombro
    Feb 5 at 21:05
  • 15
    I feel like this will be widely misunderstood. There were no previous updates of this kind. This updates are available only in Ubuntu because this is additional work by them. Debian will not receive these up until the community patches them, at which point they'll be available in "non-paid" ubuntu. So this is on top of what you'd get on Debian.
    – s3v3n
    Feb 6 at 8:15
  • 1
    @Gary There really isn't a difference with Debain as the Imagemagick vulnerabilities haven't been patched (except for old-stable as far as I can tell). This isn't any different than it was before with the Universe repository, only now Imagemagick has been moved to Universe which I do feel was a bad move considering all the vulnerabilities that pop up with this group of packages.
    – mchid
    Feb 6 at 23:46
  • 1
    @Gary Also, I think it should be noted that ImageMagick appears to be fully patched in 22.10 and also for 18.04 (because in 18.04, ImageMagick was still in main, not Universe).
    – mchid
    Feb 6 at 23:51
12

Have you actually tried going to https://ubuntu.com/pro ? I just did, and after logging in, I received a "Free Personal Token" that never expires and includes up to 5 machines.

Then you just need to run "sudo pro attach your-personal-token" and that's it :)

Improve this answer
3
  • 1
    Yes it is more or less what I did with my other Ubuntu PC :-). I am registred for livepatch so I have an account on ubuntu.com. It is why the solution I gave works by the way ; otherwise the first step is to register on ubuntu.com to get an account.
    – Philippe Gaucher
    Jan 28 at 19:03
  • 1
    I have to pay now for it. Maybe it recently changed.
    – hongo
    Feb 8 at 16:17
  • 1
    @hongo It's free for personal use, for up to 5 machines.
    – Philippe Gaucher
    Feb 9 at 12:54
1

While most answers discuss ESM, TeXLive without (Ubuntu's version of) imagemagick might be a reasonable goal by itself.

Regarding which packages in texlive-full actually require imagemagick, you could simply do a sudo apt remove imagemagick-6-common after installing texlive-full.

But if you plan to use tlmgr, you should avoid installing texlive-full and just follow this guide on tex.stackexchange. However, imagemagick might still be pulled in by other TeX-related packages, e.g., on my system kbibtex recommends latex2rtf (not part of TeXLive, but on CTAN) which requires imagemagick-6-common.

Improve this answer
-1

You get the message because there are packages available from the ESM repository.

Comment out the ESM repository to avoid the message (this step is needed for 18.04 but may not be necessary for 22.04):

sudo sed -i 's/^deb/# &/g' /etc/apt/sources.list.d/ubuntu-esm-apps.list

EDIT:

They added an additional sources list file in var/lib/... so run the following command to comment out the ESM repository (this step applies to all versions):
sudo sed -i 's/^deb/# &/g' /var/lib/ubuntu-advantage/apt-esm/etc/apt/sources.list.d/ubuntu-esm-apps.list

and then update apt and verify the changes:

sudo apt update
sudo apt full-upgrade

There should be no more ESM message when you run apt.

Also, see this related question to inhibit the ESM advert message at login.

Improve this answer
3
  • 6
    I see the message but don't have that file (what it seems a copy is on /var/lib/ubuntu-advantage/apt-esm/etc/apt/sources.list.d/ubuntu-esm-apps.list). On apt.conf.d I have the same references on 50unattended-upgrades and 20apt-esm-hook.conf, though.
    – Pablo Bianchi
    Feb 6 at 14:01
  • @PabloBianchi Yeah. This no longer works and I started getting the message again like last week so something must've changed. Of course, if that's the file then comment the repository out in /var/lib/ubuntu-advantage/apt-esm/etc/apt/sources.list.d/ubuntu-esm-apps.list instead. It's literally the same concept just a different file path.
    – mchid
    Feb 26 at 3:37
  • @PabloBianchi Yes, I just tested this by commenting out the repositories in /var/lib/ubuntu-advantage/apt-esm/etc/apt/sources.list.d/ubuntu-esm-apps.list and the message no longer appears. It can't check which packages are available if the repository is disabled. If no ESM updates are available, then there will be no message.
    – mchid
    Feb 26 at 3:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.