I sparingly add PPAs for things like resilio-sync, and more up-to-date versions of key software.

I'm worried that if I do an large upgrade, any one of those PPAs might provide a version of something I don't want it to. Maybe it's a compromised system library, or maybe it just isn't a desirable source for a particular piece of software.

Is there a way to lock down a PPA to only provide certain packages?

(This is not a duplicate of this one as that question is about excluding specific packages from a PPA... I want to only allow specific packages).

  • 4
    The best is to simply not add PPA you are not sure you can trust. Still, you can simply deactivate the PPA before doing such large upgrade – M. Becerra Mar 19 '17 at 20:50
  • 2
    Possible duplicate of Is it possible to only allow specific packages updates from a PPA – muru Mar 20 '17 at 8:32
  • Not a duplicate of that one. That one is about pinning and excluding specific packages from a PPA. – Greg Bell Mar 20 '17 at 20:28
  • " receive updates for a specific package but deny updates from the same PPA for other packages." doesn't seem to be "excluding specific packages" – muru Mar 23 '17 at 4:48
  • You're right, although the SO answer refers to text that is no longer in the Ubuntu document, and the Ubuntu document says "Pinning is a process that allows you to remain on a stable release of Ubuntu (or any other debian system) while grabbing packages from a more recent version. ". I guess that means I can de-prioritize a PPA and prevent it from 'winning' against the official PPAs. Regardless, I'm not really happy with the question at all, since it's pretty weird to trust a PPA to give me a clean package X, but think it would somehow give me a dirty package Y. – Greg Bell Mar 24 '17 at 9:28

From a security point of view we should not use any PPA at all. There is no guarantee that a maintainer of a personal package archive will not upload unwanted software at any time in the future. Anybody can become such a maintainer. Also see "What are PPAs and how do I use them?" for more on PPAs.

Nevertheless it appears to be unlikely that a maintainer we trust goes rogue in the future to all of a sudden post malware without anybody else noticing and stopping them. Still, we do not know for sure, and there is no security team watching over any PPA.

Therefore it is good practise to only add a PPA from a source we trust. After only installing a single desired package and its dependencies we should remove the PPA again to avoid unwanted upgrades of this or other packages that are or will also be maintained in this archive.

So from a trusted PPA we may proceed as follows without much risk:

sudo apt-add-repository ppa:<user>/<ppa-name>
sudo apt-get update
sudo apt-get install <package_from_ppa>
sudo apt-add-repository --remove ppa:<user>/<ppa-name>
sudo apt-get update
| improve this answer | |
  • It seems pinning might be a way of de-prioritizing PPAs so that they never beat out the official repos in an upgrade... then I'd have to manually pick the particular package in the PPA for upgrade. Does that seem like a reasonable idea? – Greg Bell Mar 24 '17 at 9:29
  • @GregBell in case you want to keep the PPA in your sources, or need regular updates for a single package then, yes, pinning is the way to go. – Takkat Mar 24 '17 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.