[SRU] plasma-distro-release-notifier gets EOL data from git.launchpad.net

Bug #2039492 reported by Erich Eickmeyer
12
This bug affects 1 person
Affects Status Importance Assigned to Milestone
plasma-distro-release-notifier (Ubuntu)
Fix Released
Critical
Simon Quigley
Jammy
Fix Released
Critical
Simon Quigley
Lunar
Won't Fix
Undecided
Unassigned
Mantic
Won't Fix
Undecided
Unassigned
Noble
Fix Released
Critical
Simon Quigley
Oracular
Fix Released
Critical
Simon Quigley

Bug Description

[Impact]

This isn't really an impact to users, but is certainly an impact to Launchpad's servers. plasma-distro-release-notifier is an upgrade notifier for plasma desktops and is seeded in Kubuntu and Ubuntu Studio. Its primary function is to notify users of a new upgrade available and when they will no longer receive updates to their current Ubuntu version. Since this impacts two flavors, for LTS versions, this is 3 years.

However, in its present form, plasma-distro-release-notifier gets its information from https://git.launchpad.net/plasma-distro-release-notifier/plain/eol.json?h=eol and checks that exact URL every login. This may have an impact on Launchpad's git servers.

Simon Quigley has been kind enough to patch plasma-distro-release-notifier to use Ubuntu's distro-info-data to grab the information from /usr/share/distro-info/ubuntu.csv while subtracting two years for LTS releases since Kubuntu and Ubuntu Studio only support LTS releases for three years. Simon has also sent this patch upstream.

Simon's work upstream has stalled-out. Instead I have moved the eol.json file to be a local file and pointed the URL to be a local file:// to get the file from the machine locally. Ideally it would just get the information from distro-info-data per Simon's patch, but this works for now.

[Test Case]

 * Simply install Ubuntu Studio or Kubuntu, any supported version.

 * Upon login, plasma-distro-release-notifier will grab eol.json from git.launchpad.net via the above URL. This is not desired.

 * Simon's patch removes this requirement and uses on-disk distro-info-data instead, and my patch just gets the eol.json file locally.

 * To trigger with the new version, Jammy will already be popping-up that 24.04 is available. For Noble, edit the on-disk json file at /usr/share/distro-release-notifier/eol.json.

[What could go wrong]

This notifier was originally used in KDE Neon, and as such, had to be patched to work with Ubuntu. KDE Neon still would pull from KDE's servers to get the json file to calculate the EOL dates This patch does rewrite a lot of that code, but seems to be solid nonetheless.

Attached is a screenshot of 22.04 in a VM, set to normal upgrades, and being "tricked" into thinking it's about to go EOL via date rewrites in /usr/share/distro-info/ubuntu.csv and it seems to work wonderfully.

With the local eol.json file, this uses the QUrl class of Qt to grab the file:// URL of a local file. This has the same effect of grabbing it from another source except it does it locally and therefore prevents the DoS issue we were having on Launchpad. This is documented at https://doc.qt.io/qt-6/qurl.html#fromLocalFile. I imagine this could go wrong in that it might not actually work, in which case it will just no-op and not report the number of days left until EOL for Kubuntu and Ubuntu Studio.

Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :
Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

Simon's original patch. I will be doing the upload, so this is just here for informational purposes.

description: updated
Revision history for this message
Simon Quigley (tsimonq2) wrote :

Some small notes, just for reference.

Yes, this is my patch, and with the notable exception of the (testing) changelog entry, the patch is up to date. Thank you for taking care of the paperwork and additional testing.

We could totally clean up the QtNetworkReply headers, either in this upload or the next one. The impact there is negligible, since this is the only usage of such headers.

Also, this removes some MOCK_RELEASE functionality. This Is Fine, because the package has no autopkgtests (this was a pain to test manually, so I will be fixing this!) and as such, that conditional was only used for local testing.

My patch doesn't have traction upstream yet, but besides $past_issues I don't see why they'd reject it: https://invent.kde.org/system/distro-release-notifier/-/merge_requests/6

Side note: I noticed only the C++11 standard is enforced, when all of KDE and Qt use C++17 (this is worth double checking). **This will cause issues when those libraries start using newer features.** (I dealt with this bug last cycle in LXQt.)

Thanks.

Revision history for this message
Simon Quigley (tsimonq2) wrote :

Aww, I forgot DEP-3 headers :/ that would block me from sponsoring an upload, why I forgot it in my own is beyond me.

Changed in plasma-distro-release-notifier (Ubuntu Lunar):
status: New → In Progress
Changed in plasma-distro-release-notifier (Ubuntu Jammy):
status: New → In Progress
importance: Undecided → High
Changed in plasma-distro-release-notifier (Ubuntu Lunar):
importance: Undecided → High
Changed in plasma-distro-release-notifier (Ubuntu Jammy):
assignee: nobody → Erich Eickmeyer (eeickmeyer)
Changed in plasma-distro-release-notifier (Ubuntu Lunar):
assignee: nobody → Erich Eickmeyer (eeickmeyer)
Revision history for this message
Simon Quigley (tsimonq2) wrote :

sitter did a (quite impressive) code review upstream. While this code does work, and his comments are more "we use camelCase" and "this is the right method," I'd really like to get this right.

Erich, what say you?

Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

I have no problem with that and have asked for a reject of the current uploads pending new uploads.

Changed in plasma-distro-release-notifier (Ubuntu Jammy):
assignee: Erich Eickmeyer (eeickmeyer) → Simon Quigley (tsimonq2)
Changed in plasma-distro-release-notifier (Ubuntu Lunar):
assignee: Erich Eickmeyer (eeickmeyer) → Simon Quigley (tsimonq2)
Changed in plasma-distro-release-notifier (Ubuntu Mantic):
assignee: Erich Eickmeyer (eeickmeyer) → Simon Quigley (tsimonq2)
Changed in plasma-distro-release-notifier (Ubuntu Noble):
assignee: Erich Eickmeyer (eeickmeyer) → Simon Quigley (tsimonq2)
Revision history for this message
Brian Murray (brian-murray) wrote :

Ubuntu 23.04 (Lunar Lobster) has reached end of life, so this bug will not be fixed for that specific release.

Changed in plasma-distro-release-notifier (Ubuntu Lunar):
status: In Progress → Won't Fix
Revision history for this message
Brian Murray (brian-murray) wrote :

Ubuntu 23.10 (Mantic Minotaur) has reached end of life, so this bug will not be fixed for that specific release.

Changed in plasma-distro-release-notifier (Ubuntu Mantic):
status: In Progress → Won't Fix
Revision history for this message
Guruprasad (lgp171188) wrote :

Hi Erich and Simon, I am Guruprasad from the Launchpad team. In the recent days, we are seeing a significant spike in the number of these requests (not sure if there is a pattern related to the clients, day of the week, or time of the day) and that is adversely affecting the Launchpad git hosting service. Is this something you can look into fixing soon? Thanks!

Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

Hi Guruprasad,

We were told initially that this wasn't a huge high priority problem by Colin Watson, so we shelved it for a while. With this, it definitely needs to be a priority.

Simon had a working patch, but upstream wanted better code-correctness before we implemented it, so that's what has stalled. If it's affecting git hosting, then that's a gigantic problem and I do apologize. We can get this solved ASAP, but I need Simon since I need that patch.

Changed in plasma-distro-release-notifier (Ubuntu Jammy):
importance: High → Critical
Changed in plasma-distro-release-notifier (Ubuntu Noble):
importance: High → Critical
Changed in plasma-distro-release-notifier (Ubuntu Oracular):
importance: High → Critical
Revision history for this message
Guruprasad (lgp171188) wrote :

Hi Erich, thanks for the quick response. Since the large number of requests haven't gone down, we have blocked all requests to that path at the load balancer, for the time being, to minimize the impact to the git hosting infrastructure.

Please let us know if this will cause any adverse effects to Kubuntu/Ubuntu Studio users.

Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

I think what might end up happening is, in the short-term, moving the eol.json hosting to github. That would at least fix the pending issue. Once that fix is released, we can then work on the patch to use distro-info-data again.

description: updated
Changed in plasma-distro-release-notifier (Ubuntu Oracular):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package plasma-distro-release-notifier - 20220915-0ubuntu7

---------------
plasma-distro-release-notifier (20220915-0ubuntu7) oracular; urgency=medium

  * Move EOL data to Github (LP: #2039492)
  * Update set-ubuntu-version.patch to 24.10

 -- Erich Eickmeyer <email address hidden> Wed, 11 Sep 2024 09:42:39 -0700

Changed in plasma-distro-release-notifier (Ubuntu Oracular):
status: Fix Committed → Fix Released
Changed in plasma-distro-release-notifier (Ubuntu Oracular):
status: Fix Released → In Progress
Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

So, not actually fixed. Per Robie Basak, all we've done is passed a hot potato to another service. I have devised a way to place the eol.json locally.

description: updated
Changed in plasma-distro-release-notifier (Ubuntu Oracular):
status: In Progress → Fix Committed
Changed in plasma-distro-release-notifier (Ubuntu Lunar):
assignee: Simon Quigley (tsimonq2) → nobody
Changed in plasma-distro-release-notifier (Ubuntu Mantic):
assignee: Simon Quigley (tsimonq2) → nobody
Changed in plasma-distro-release-notifier (Ubuntu Lunar):
importance: High → Undecided
Changed in plasma-distro-release-notifier (Ubuntu Mantic):
importance: High → Undecided
description: updated
Revision history for this message
Chris Halse Rogers (raof) wrote : Please test proposed package

Hello Erich, or anyone else affected,

Accepted plasma-distro-release-notifier into noble-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/plasma-distro-release-notifier/20220915-0ubuntu6.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-noble to verification-done-noble. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-noble. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in plasma-distro-release-notifier (Ubuntu Noble):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-noble
Changed in plasma-distro-release-notifier (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Chris Halse Rogers (raof) wrote :

Hello Erich, or anyone else affected,

Accepted plasma-distro-release-notifier into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/plasma-distro-release-notifier/20220915-0ubuntu0.22.04.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package plasma-distro-release-notifier - 20220915-0ubuntu8

---------------
plasma-distro-release-notifier (20220915-0ubuntu8) oracular; urgency=medium

  * Move EOL data to local file (LP: #2039492)

 -- Erich Eickmeyer <email address hidden> Wed, 11 Sep 2024 17:56:03 -0700

Changed in plasma-distro-release-notifier (Ubuntu Oracular):
status: Fix Committed → Fix Released
Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

For Jammy this was rather easy:

$ apt-cache policy plasma-distro-release-notifier

plasma-distro-release-notifier:
  Installed: 20220915-0ubuntu0.22.04.2
  Candidate: 20220915-0ubuntu0.22.04.2
  Version table:
 *** 20220915-0ubuntu0.22.04.2 500
        500 http://archive.ubuntu.com/ubuntu jammy-proposed/universe amd64 Packages
        100 /var/lib/dpkg/status
     20220915-0ubuntu0.22.04.1 500
        500 http://archive.ubuntu.com/ubuntu jammy-updates/universe amd64 Packages

Merely running the live session in the ISO image gives the popup that 24.04.1 is available. Upgrading to the version where the eol.json file is local results in the popup with the EOL countdown information as shown in the attached screenshot.

tags: added: noble oracular verification-done-jammy
removed: lunar mantic verification-needed-jammy
Revision history for this message
Erich Eickmeyer (eeickmeyer) wrote :

For noble, slightly more complicated as there's no release for it. However, the release notifier does have a mechanism if a MOCK_RELEASE environment variable is set containing any information and returns a notification.

$ apt-cache policy plasma-distro-release-notifier
plasma-distro-release-notifier:
  Installed: 20220915-0ubuntu6.1
  Candidate: 20220915-0ubuntu6.1
  Version table:
 *** 20220915-0ubuntu6.1 100
        100 http://archive.ubuntu.com/ubuntu noble-proposed/universe amd64 Packages
        100 /var/lib/dpkg/status
     20220915-0ubuntu6 500
        500 http://archive.ubuntu.com/ubuntu noble/universe amd64 Packages

Ran the live session in the ISO image, added 'export MOCK_RELEASE=true' in /etc/profile.d/mockrelease.sh. Then changed the EOL date in the eol.json file. Resulted in the EOL countdown information as shown in the attached screenshot. Version shown is '42' as the mock version to upgrade to.

tags: added: verification-done verification-done-noble
removed: verification-needed verification-needed-noble
Revision history for this message
Andreas Hasenack (ahasenack) wrote :

Thanks for the expedited verification!

We discussed this with the launchpad team and the consensus at the moment is that, with the block on that URL in place, there is no need to rush this SRU through updates with 0-day aging. I'll remain subscribed to this bug, so should things change, or more information surface, please let us know.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package plasma-distro-release-notifier - 20220915-0ubuntu6.1

---------------
plasma-distro-release-notifier (20220915-0ubuntu6.1) noble; urgency=medium

  * Move EOL data to local file (LP: #2039492)

 -- Erich Eickmeyer <email address hidden> Wed, 11 Sep 2024 18:33:51 -0700

Changed in plasma-distro-release-notifier (Ubuntu Noble):
status: Fix Committed → Fix Released
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Update Released

The verification of the Stable Release Update for plasma-distro-release-notifier has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package plasma-distro-release-notifier - 20220915-0ubuntu0.22.04.2

---------------
plasma-distro-release-notifier (20220915-0ubuntu0.22.04.2) jammy; urgency=medium

  * Move EOL data to local file (LP: #2039492)

 -- Erich Eickmeyer <email address hidden> Wed, 11 Sep 2024 18:57:23 -0700

Changed in plasma-distro-release-notifier (Ubuntu Jammy):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.