Public bug reported: - installed: apt 3.2.0 and libapt-pkg7.0 3.2.0 (amd64, Ubuntu 26.04.1 LTS), source package apt 3.2.0 - dsc file: apt_3.2.0.dsc SHA256 364347278a531cf073f809a14f84617c2b935cfb324bd413aa01c214b6f8a3e8, signature verified with gpgv, key 4FB588A84C2DDE79A74C77876FA458DD1DB03F71 - source file: apt_3.2.0.tar.xz SHA256 dcd186912a7b8553cc885412127925858ee340c655e2f26e77eacdab23f48089, matches Checksums-Sha256 in the signed .dsc
Description: apt update prints "Notice: Missing Signed-By in the sources.list(5) entry for 'https://mirror.yandex.ru/ubuntu'" intermittently, although the deb822 .sources file has Signed-By on every stanza. The notice appears when the mirror answers a conditional request with a 200 and a body whose Date is older than the local InRelease. apt then keeps the local file, which is the intended behaviour (pkgAcqMetaBase::VerifyVendor, "prevention of downgrading us to older (still valid) files"). The notice is a side effect of how that is done, and nothing tells the user that the download was rejected as older. Cause (from reading apt-pkg/acquire-item.cc, apt-pkg/metaindex.cc, apt- pkg/deb/debmetaindex.cc and apt-private/private-update.cc in 3.2.0): 1. LoadLastMetaIndexParser() clones the entry with debReleaseIndex::UnloadedClone() and loads the local InRelease into the clone. UnloadedClone() passes only URI, Dist, the trust flag and the release options to the constructor. The configured Signed-By (set on the original through SetSignedBy()) is not copied, so the clone's SignedBy is empty. 2. In VerifyVendor, when the clone's Date is later than the downloaded one, apt sets IMSHit, removes the download, and calls MetaIndexParser->swapLoad(LastMetaIndexParser). 3. metaIndex::swapLoad() does std::swap(SignedBy, OldMetaIndex->SignedBy). The configured value goes into the clone, which is then deleted, and the entry that stays in use has an empty SignedBy. 4. DoUpdate in private-update.cc then sees S->GetSignedBy().empty() and prints the notice for a deb822 entry (or an audit message for a one-line entry). Problems: 1. The notice is wrong: the entry has Signed-By. The real event is "the mirror served an older Release". 2. Nothing says the downloaded file was rejected as older. The output shows "Get:" for the suite, as for a normal refresh. 3. The notice is only printed on a terminal, so logs of non-interactive runs show nothing at all. This is not rare on a real mirror. 8 consecutive requests to mirror.yandex.ru for resolute-backports/InRelease returned the current Date (Fri 23 Oct 2026 07:42:02 UTC) 7 times and an older one (Thu 22 Oct 2026 05:19:40 UTC) once. archive.ubuntu.com, ru.archive.ubuntu.com, de.archive.ubuntu.com and ftp.fau.de all returned the current one. Conditional requests behave differently per server. With If-Modified- Since one hour later than Last-Modified, five nginx-based hosts (mirror.yandex.ru, ru.archive.ubuntu.com, mirrors.edge.kernel.org, mirror.truenetwork.ru, mirror.corbina.net) answered 200 (yandex even for an equal value, since its Last-Modified differed between requests), while Apache and Traffic Server hosts (archive.ubuntu.com, ftp.fau.de, de.archive.ubuntu.com) answered 304. A 200 with an older body is what sends apt into the keep-local path. Reproduce: 1. Copy /var/lib/apt/lists to a scratch directory. 2. Edit "Date:" in one InRelease to a later date than the mirror's current one. 3. Run: apt update -o Dir::State::lists=<copy> against a mirror that answers 200 to the conditional request. Captured output on a terminal (one suite edited, resolute-backports; progress-bar fragments dropped, third-party "Ign:" lines and "Reading package lists... N%" lines replaced by [...]): $ apt update -o Dir::State::lists=/var/tmp/aptlists-test Hit:1 https://mirror.yandex.ru/ubuntu resolute InRelease Hit:2 https://mirror.yandex.ru/ubuntu resolute-updates InRelease Get:3 https://mirror.yandex.ru/ubuntu resolute-backports InRelease [137 kB] Hit:4 http://security.ubuntu.com/ubuntu resolute-security InRelease [...] Fetched 137 kB in 31s (4,450 B/s) [...] 7 packages can be upgraded. Run 'apt list --upgradable' to see them. Notice: Missing Signed-By in the sources.list(5) entry for 'https://mirror.yandex.ru/ubuntu' Notice: Some sources can be modernized. Run 'apt modernize-sources' to do so. The sources file has "Signed-By: /usr/share/keyrings/ubuntu-archive- keyring.gpg" on both stanzas. The "modernize" line is printed by the same check in private-update.cc, for one-line entries whose Signed-By is empty. It also shows up falsely for an entry that does set signed-by. In a fresh ubuntu:26.04 container with the single one-line entry "deb [signed-by=/usr/share/keyrings/ubuntu-archive-keyring.gpg] http://mirror.yandex.ru/ubuntu resolute-updates main", 8 consecutive runs of "apt update" on a terminal gave 7 runs with "Hit:" and no notice, and 1 run with "Get:1 http://mirror.yandex.ru/ubuntu resolute- updates InRelease [137 kB]" in which the Date of the local InRelease was the same before and after (the download was not adopted). Only that run printed "Notice: Some sources can be modernized". That fits the keep- local path described above, where Signed-By ends up empty. The same entry against archive.ubuntu.com (answers 304) did not print it in two runs. Expected: - No Missing Signed-By notice for entries that have Signed-By. Either UnloadedClone() copies the configured SignedBy, or swapLoad() does not swap it (it is configuration of the entry, not data from the Release file). - A message that names the real event, with both dates, for example "InRelease for <URI> is older than the local copy (<new> < <old>), keeping the local copy". - Any message should go to normal stdout to be captured by automation. Not done: I have not built a patch for this. ** Affects: apt (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172092 Title: apt update: bogus "Missing Signed-By" notice, and no message, when the mirror serves an older Release than the local one To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/2172092/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
