6

How do I find the full "community history" of how the updates listed by "software updater" made it into my Ubuntu machine?

The question is for the general workflow to obtain the "community history" of updates, not the "community history" of all updates available.

What I am after is for example

  • Patch(es) related to the update on mailing list(s)
  • Community discussions about the update
  • Source code related to the update
  • Git commits related to the update
  • People responsible for the update
  • How does software updater know which repositories to fetch updates from?
  • If software updater finds updates for a specific package in different repositories, but one is older and the other is newer, how does it select?
  • etc

Background:
It seems about once or a couple of times each week the "Software updater" displays:

Updated software is available for this computer. Do you want to install it now?

From what I understand, these updates are the same as SRUs - Stable Release Updates? Or are only updates from Canonical/Ubuntu called "SRUs", while non-Canonical/Ubuntu updates are not called SRUs?

Here is a screenshot of my "Software Updater", how do I for example find the "community origin" (patch(es), discussions, etc, if any) of the Chrome update (Available version: 44.0.2403.157-1) which is highlighted in the screenshot? Then when this update is installed, where do I find info about it on my machine?

Software Updater

How do I list all the updates installed on my machine and how do I list all the available updates that are not yet installed?

The suggested duplicate of "Show apt-get installed packages history via commandline?" asks about listing packages installed, my question is about updates and how to trace the origin of the updates and how they make into my Ubuntu machine.

Improve this question
0

2 Answers 2

Reset to default
4

First off, an important clarification:

The terms "Stable Release Updates" and "Security Updates" (don't forget them!) apply to packages in main, universe, restricted and multiverse. PPAs or other third-party repositories may have their own release schedules and policies. In your screenshot I see "google-chrome-stable" -- this is not a Ubuntu package and it does not follow the Ubuntu release schedule.

Having said that, here's what you asked for:

  • For every Ubuntu update, the point of reference is the Launchpad bug. This is where you can find most of the information related to the problem(s) and solution(s).

    You can get the bug numbers by checking the changelog of each package. For example, as of writing, this is the last entry from apt-get changelog nautilus:

    nautilus (1:3.14.2-0ubuntu9.1) vivid; urgency=low

  * debian/patches/ignore-no-desktop-if-not-first-launch.patch:
    - Don't shut off the desktop when external application calls nautilus
      --no-desktop on a running GNOME desktop. (LP: #1453655)

 -- Chow Loong Jin <[email protected]>  Wed, 24 Jun 2015 11:50:03 +0800

    As you can see, the log entry refers to bug #1453655.

    For security bugs, generally the bug report is private (to prevent malicious people from accessing critical information) and, generally, instead of the Launchpad bug number you'll find the CVE number.

  • Patches applied by Ubuntu (or by Debian) are in the source package, in the debian/patches directory. If you want to download the source packages for Nautilus, use apt-get source nautilus.

    If a Stable Release Update or a Security Update introduces a new version of the software (e.g. a new version of Firefox), you'll have to look upstream for the full delta.

    Not all package sources are available under version control (git, hg, bzr, ...).

  • Discussion generally happen on Launchpad. If necessary, the ubuntu-devel mailing list may be used too.

  • People responsible for updates are the people who provide the updates (package maintainers or contributors), the Ubuntu SRU Team and the Ubuntu Security Team.

    Note that not all of these people are Canonical employees. Be kind and don't forget those contributors who use their spare time to maintain stability and security in Ubuntu :-)

  • The process for Stable Release Updates and Security Updates is documented on the Ubuntu Wiki: https://wiki.ubuntu.com/StableReleaseUpdates and https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

Improve this answer
9
  • Thank you for your answer! So when "software updater " pops up with a list of updates as in the screenshot, how do I know which updates are non-ubuntu updates and where they come from? I guess an idea would be to add this info to "software updater " to make it easy accessible, if it isn't already?
    – Markus
    Sep 10, 2015 at 2:20
  • 1
    @Markus: from the software updater window, I don't know. From the command line: apt-cache policy package-name. This will list all available versions of the package and their origin (the package with the highest version is the one that is going to be installed).
    – Andrea Corbellini
    Sep 11, 2015 at 8:16
  • 1
    @Markus: not sure I have understood your question. However, if you want to see the history of all packages that have been already installed or upgraded or removed, check /var/log/apt/history.log and /var/log/dpkg.log. Note though that if security is your concern, and if somebody can install/upgrade arbitrary packages, then these logs (as well as other files) can be compromised.
    – Andrea Corbellini
    Sep 11, 2015 at 9:39
  • 1
    @Markus: if you install software without using a package manager, then it's your responsibility to keep track of them. Ubuntu's Software Updater, APT, dpkg only know about packages in the repositories.
    – Andrea Corbellini
    Sep 12, 2015 at 11:31
  • 1
    "Software Updater" is a frontend to APT, so yes: it uses /etc/apt/sources.list and related files. It works by querying the sources listed in /etc/apt/sources.list and validating the responses using GPG signatures. To check whether you are using the official package or not, use apt-cache policy. To list packages that can be upgraded, use apt-get -u upgrade. About the ChangeSummary: please open a new question (and maybe link it here in the comments, so that I can provide an answer).
    – Andrea Corbellini
    Sep 15, 2015 at 15:16
2

Regarding linux kernel, you can look into the kernel git and see all commits.

Regarding other packages, in most cases there is a launchpad bug link in changelog.

You can see the history of updates in /var/log/apt/history.log

For each package you can get a changelog by

apt-get changelog <package_name>

You can follow that link and see the history of that bug.

Regarding packages provided by 3rd parties, like Google Chrome and PPAs, there is no specific way to get this information. It can be available or not. It depends on 3rd parties.

Google Chrome is provided by Google and Ubuntu community is not involved. You can ask at Google support sites if this information is available. I am not sure that it is.

You can see how SRU works at Ubuntu wiki

Improve this answer
16
  • 1
    If you click some other package, not google-chrome, you will see changelog. There is always a bug link there. Regarding google-chrome, no one in Canonical is responsible for that.
    – Pilot6
    Sep 1, 2015 at 12:52
  • 1
    Canonical does not "bring it in". You install it using a deb file from google site, and updates are made from google repositories.
    – Pilot6
    Sep 1, 2015 at 13:06
  • 1
    I already answered this. You can find a launchpad bug number in the changelog and open it there. You will see who reported the bug, comments there and who fixed it.
    – Pilot6
    Sep 2, 2015 at 15:23
  • 1
    I added that too.
    – Pilot6
    Sep 3, 2015 at 8:46
  • 1
    If you ask about Ubuntu packages, then yes, they came through SRU procedure to get to updates. Third party packages from PPA or other repositories have their own procedures.
    – Pilot6
    Sep 3, 2015 at 14:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .