[Bug 1906541] Re: [SRU] [focal] command-not-found metadata support

[Brian Murray]

Thanks for working on this, the debdiff looks good to me but we'll need
two debdiffs one for focal and one for groovy as they are both released.
Additionally, the packages will have need to have a different number
scheme which you can find guidance for here:

https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging

I'll do that when sponsoring the package.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1906541

Title:
  [SRU] [focal] command-not-found metadata support

Status in debmirror package in Ubuntu:
  Confirmed

Bug description:
  [Impact]

   * Starting with Ubuntu Focal (20.04), the APT client expects APT
  sources to provide command-not-found (cnf) metadata files.

   * This package provides package mirrors, however does not support
  mirroring this cnf metadata up until upstream version 1:2.32, which is
  later than the version in Focal (20.04) and Groovy (20.10).

   * This upload cherry-picks upstream commits 292e9e9c, 39055366 and
  9606535d, in order to add the cnf metadata support.

  [Test Case]

   * Create a mirror of e.g. `bionic main` and `focal main`: debmirror
  -d bionic,focal -s main --passive --keyring=/usr/share/keyrings
  /ubuntu-archive-keyring.gpg --progress /opt/debmirror

   * Serve the root directory of /opt/debmirror as webroot.

   * Point APT `sources.list` at this webroot: deb
  http://mirror.example.com/ubuntu/ focal main

   * Attempt to run `apt update` on Focal (20.04) client to see that it
  fails to obtain the cnf metadata.

   * Optionally run `apt update` on Bionic (18.04) client to see that it
  works fine without the cnf metadata.

  [Where problems could occur]

   * New cnf files are expected to be created and maintained by the
  debmirror package. The regression risk for incorrectly downloading
  these files does not serve more harm than not downloading the files
  whatsoever (current state of 20.04 release), as the APT client does
  not use the mirror in either case.

   * The change as uploaded was released in upstream as part of 1:2.32,
  tagged 23 Mar 2019, and is part of Debian stable. This serves as
  evidence of it having had testing carried out over time.

  [Other Info]

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/debmirror/+bug/1906541/+subscriptions