Ubuntu 23.10 to Offer Improved Management of PPAs for Better Security

posted by Marius Nestor on May 16, 2023,
updated May 18, 2023

Development of Ubuntu 23.10 kicked off at the end of April 2023 and now we start to see new features landing in the upcoming release. One of these new features was revealed by Canonical’s Julian Andres Klode on the Ubuntu mailing list and it’s related to how PPA archives will be handled.

Until now, Ubuntu managed PPA archives through a traditional .list file that was stored in the /etc/apt/sources.list.d/ directory and accompanied by a GPG keyring stored on /etc/apt/trusted.gpg.d.

Read on

OMG Ubuntu:

• Ubuntu Makes ‘Significant Changes’ to PPAs for 23.10

  A new version of the software-properties package is rolling out to Mantic Minotaur daily builds. The update makes brings a “significant change” to the way personal package archives (better known as PPAs) are managed on Ubuntu systems.

  What’s changing?

  Well, in current versions of Ubuntu when you add a PPA (via the command line — you can add them via Software & Updates but I’m not sure how key handling works there) a .list file for the PPA is created in /etc/apt/sources.list.d/, and the corresponding gpg keyring placed at /etc/apt/trusted.gpg.d.

It's FOSS:

• Ubuntu 23.10 To Bring Security Enhanced PPAs

  Ubuntu upgrades constantly enhance functionalities and add security fixes.

  However, it is not often that you see some changes to some of the core mechanisms.

  With Ubuntu 23.10, the PPA functioning gets better. At least, you'll see fewer warnings in the terminal.

Linux Magazine:

• Changes Are Coming to How Ubuntu PPAs Are Used

  With the upcoming Ubuntu 23.10 (Mantic Minotaur), there will be a considerable change to how PPAs are handled. As you may know, in the current iteration of the software-properties software, when you add PPA from the command line, a .list file is created in /etc/apt/sources.list.d/, and the associated GPG key is added to /etc/apt/trusted.gpg.d/.

  When 23.10 is released, those PPAs will use the deb822 format for .source files and their corresponding GPG keys will be added directly to the file in a Signed-By field. This means users won't have to manage a collection of .list files.