1
  1. Question:

When you install Ubuntu Advantage (package ubuntu-advantage-tools) on Xenial, and enable only esm-infra service, it installs the file /etc/apt/sources.list.d/ubuntu-esm-infra.list with the two following lines:

deb https://esm.ubuntu.com/infra/ubuntu xenial-infra-security main
deb https://esm.ubuntu.com/infra/ubuntu xenial-infra-updates main

xenial-infra-security ok, I want to have that. But what is the purpose of xenial-infra-updates ?

Is it the same style like having xenial-security and xenial-updates in /etc/apt/sources.list ?

I only have the following in /etc/apt/sources.list:

deb         http://de.archive.ubuntu.com/ubuntu/        xenial                  main restricted universe multiverse
deb         http://security.ubuntu.com/ubuntu           xenial-security         main restricted universe multiverse

so no xenial-updates since we only wanted to have pure security updates and no more (e.g. bugfix) updates (to keep the change minimal), should/could one then delete the entry xenial-infra-updates? Did not find any documentation about that.

  1. Question:

Having an Ubuntu Xenial Host with the following /etc/apt/sources.list:

deb         http://de.archive.ubuntu.com/ubuntu/        xenial                  main restricted universe multiverse
deb         http://security.ubuntu.com/ubuntu           xenial-security         main restricted universe multiverse
deb         http://security.ubuntu.com/ubuntu           xenial-updates          main restricted universe multiverse

so with xenial-updates, would it be ok to have only the following /etc/apt/sources.list.d/ubuntu-esm-infra.list

deb https://esm.ubuntu.com/infra/ubuntu xenial-infra-security main

so no xenial-infra-updates, to keep the ESM-Updates minimal security-only? (background: we learned that once you enabled xenial-updates in /etc/apt/sources.list you cannot remove it anymore, because afterwards you cannot install new packages that depend on other packages that had been updated through xenial-updates, so the version of the depended package is newer than the to-be-installed package expects, so you have broken dependencies)

It would be nice if both questions could be answered with either yes or no, and if second question can be answered with yes, I would appreciate an explanation why exactly that would be.

1 Answer 1

3

According to Security Team at Ubuntu

-updates:

includes things that have gone through the StableReleaseUpdates process, and contain various important bug fixes. Anything built for "-updates" is built on top of which ever version of a package is newest between "-updates" and "-security", so that nothing in "-updates" will introduce security regressions.

While -security:

includes only updated packages that contain security-related fixes, and are built to not require anything from "-updates". Anything built for "-security" is built on top of which ever version of a package is newest between "-updates" and "-security", so that nothing in "-security" will introduce bug regressions.

Thus, if you are ok with having the system without bug fixes and enhancements, you can simply comment out the update line, in your case:

deb https://esm.ubuntu.com/infra/ubuntu xenial-infra-updates main
1
  • Edit: I expanded to a second question.
    – Daku
    Oct 19, 2021 at 9:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .