Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #235122 > unrolled thread

Repo. ppa.launchpad.net

Back to article view | Back to linux.debian.user

Contents

  Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-12 12:20 +0200
    Re: Repo. ppa.launchpad.net Andrei POPESCU <andreimpopescu@gmail.com> - 2021-05-12 17:00 +0200
      Re: Repo. ppa.launchpad.net David Wright <deblis@lionunicorn.co.uk> - 2021-05-12 18:10 +0200
        Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-12 19:00 +0200
      Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-12 18:30 +0200
        Re: Repo. ppa.launchpad.net Stefan Krusche <linux@stefan-krusche.de> - 2021-05-12 19:30 +0200
          Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-12 20:10 +0200
            Re: Repo. ppa.launchpad.net Stefan Krusche <linux@stefan-krusche.de> - 2021-05-13 07:30 +0200
              Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-13 08:30 +0200
                Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-13 09:20 +0200
                  Re: Repo. ppa.launchpad.net Stefan Krusche <linux@stefan-krusche.de> - 2021-05-13 11:50 +0200
                    Re: Repo. ppa.launchpad.net Greg Wooledge <greg@wooledge.org> - 2021-05-13 13:00 +0200
                      Re: Repo. ppa.launchpad.net David Wright <deblis@lionunicorn.co.uk> - 2021-05-13 17:20 +0200
                        Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-13 18:10 +0200
                          Re: Repo. ppa.launchpad.net David Wright <deblis@lionunicorn.co.uk> - 2021-05-13 21:10 +0200
                            Re: Repo. ppa.launchpad.net Richmond <richmond@criptext.com> - 2021-05-13 23:10 +0200
                              Re: Repo. ppa.launchpad.net David Wright <deblis@lionunicorn.co.uk> - 2021-05-14 18:00 +0200

#235122 — Repo. ppa.launchpad.net

This repo has crept into my sources.d an I don't know why it is there. I
don't recall installing any audio-recorder or asking for anything from
ubuntu. How did it get there?

This error occured in aptitude update:

Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish Release                                                    
  404  Not Found [IP: 91.189.95.85 80]

[toc] | [next] | [standalone]

#235132

[Multipart message — attachments visible in raw view] — view raw

On Mi, 12 mai 21, 10:51:55, Richmond wrote:
> This repo has crept into my sources.d an I don't know why it is there. I
> don't recall installing any audio-recorder or asking for anything from
> ubuntu. How did it get there?
> 
> This error occured in aptitude update:
> 
> Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish Release                                                    
>   404  Not Found [IP: 91.189.95.85 80]

Try this search to find installed packages from non-Debian sources:

    aptitude search '?narrow(?installed,!?origin(Debian))'


(it will also match packages that aren't available from the repositories 
anymore, a.k.a. obsolete, if you have any)

Kind regards,
Andrei
-- 
http://wiki.debian.org/FAQsFromDebianUser

[toc] | [prev] | [next] | [standalone]

#235135

On Wed 12 May 2021 at 17:54:55 (+0300), Andrei POPESCU wrote:
> On Mi, 12 mai 21, 10:51:55, Richmond wrote:
> > This repo has crept into my sources.d an I don't know why it is there. I
> > don't recall installing any audio-recorder or asking for anything from
> > ubuntu. How did it get there?

No idea. AIUI the sysadmin has complete control over that file.
I would:

  $ ls -l /etc/apt/sources.list*
  -rw-r--r-- 1 root root 1023 Apr  3  2020 /etc/apt/sources.list
  -rw-r--r-- 1 root root    0 Apr  3  2020 /etc/apt/sources.list~

  /etc/apt/sources.list.d:
  total 0
  $ 

to see when it was last modified¹. Then I would:

  $ less /var/log/apt/history.log*

and see if the packages being installed around that time give you any
clue as to why it might have been changed (by the sysadmin). The clues
might be indirect, like, say, installing a package that lacked enough
functionality to do a particular task, which caused you to take some
action of other.

> > This error occured in aptitude update:
> > 
> > Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish Release                                                    
> >   404  Not Found [IP: 91.189.95.85 80]
> 
> Try this search to find installed packages from non-Debian sources:
> 
>     aptitude search '?narrow(?installed,!?origin(Debian))'
> 
> 
> (it will also match packages that aren't available from the repositories 
> anymore, a.k.a. obsolete, if you have any)

¹ If you've already edited it again, to rectify the problem, then
  it's the backup that might have the more useful datestamp. Or
  it might be any files you have in the subdirectory.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#235139

David Wright <deblis@lionunicorn.co.uk> writes:


> and see if the packages being installed around that time give you any
> clue as to why it might have been changed (by the sysadmin). The clues
> might be indirect, like, say, installing a package that lacked enough
> functionality to do a particular task, which caused you to take some
> action of other.
>

Looking at the dates it seems the culprit may have been linphone, which
didn't show up in aptitude search '?narrow(?installed,!?origin(Debian))'

Linphone fell over with a segmentation fault, so I will remove it
anyway.

[toc] | [prev] | [next] | [standalone]

#235137

Andrei POPESCU <andreimpopescu@gmail.com> writes:

> On Mi, 12 mai 21, 10:51:55, Richmond wrote:
>> This repo has crept into my sources.d an I don't know why it is there. I
>> don't recall installing any audio-recorder or asking for anything from
>> ubuntu. How did it get there?
>> 
>> This error occured in aptitude update:
>> 
>> Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish Release                                                    
>>   404  Not Found [IP: 91.189.95.85 80]
>
> Try this search to find installed packages from non-Debian sources:
>
>     aptitude search '?narrow(?installed,!?origin(Debian))'
>
>
> (it will also match packages that aren't available from the repositories 
> anymore, a.k.a. obsolete, if you have any)
>

Thanks. It lists a few, Zoom seems the most likely culprit.

[toc] | [prev] | [next] | [standalone]

#235141

Am Mittwoch, 12. Mai 2021 schrieb Richmond:
> Andrei POPESCU <andreimpopescu@gmail.com> writes:
> > On Mi, 12 mai 21, 10:51:55, Richmond wrote:
> >> This repo has crept into my sources.d an I don't know why it is
> >> there. I don't recall installing any audio-recorder or asking for
> >> anything from ubuntu. How did it get there?
> >>
> >> This error occured in aptitude update:
> >>
> >> Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish
> >> Release 404  Not Found [IP: 91.189.95.85 80]
> >
> > Try this search to find installed packages from non-Debian sources:
> >
> >     aptitude search '?narrow(?installed,!?origin(Debian))'
> >
> >
> > (it will also match packages that aren't available from the
> > repositories anymore, a.k.a. obsolete, if you have any)
>
> Thanks. It lists a few, Zoom seems the most likely culprit.

This might help, too:

dpkg -S /etc/sources.d/audio-recorder.list # or whatever that file is
called

If the file has been installed from a package the name of the package
should be listed.

Kind regards,
Stefan

[toc] | [prev] | [next] | [standalone]

#235145

Stefan Krusche <linux@stefan-krusche.de> writes:

> Am Mittwoch, 12. Mai 2021 schrieb Richmond:
>> Andrei POPESCU <andreimpopescu@gmail.com> writes:
>> > On Mi, 12 mai 21, 10:51:55, Richmond wrote:
>> >> This repo has crept into my sources.d an I don't know why it is
>> >> there. I don't recall installing any audio-recorder or asking for
>> >> anything from ubuntu. How did it get there?
>> >>
>> >> This error occured in aptitude update:
>> >>
>> >> Err:6 http://ppa.launchpad.net/audio-recorder/ppa/ubuntu impish
>> >> Release 404  Not Found [IP: 91.189.95.85 80]
>> >
>> > Try this search to find installed packages from non-Debian sources:
>> >
>> >     aptitude search '?narrow(?installed,!?origin(Debian))'
>> >
>> >
>> > (it will also match packages that aren't available from the
>> > repositories anymore, a.k.a. obsolete, if you have any)
>>
>> Thanks. It lists a few, Zoom seems the most likely culprit.
>
> This might help, too:
>
> dpkg -S /etc/sources.d/audio-recorder.list # or whatever that file is
> called
>
> If the file has been installed from a package the name of the package
> should be listed.
>
> Kind regards,
> Stefan

 sudo dpkg -S /etc/apt/sources.list.d/audio-recorder-ubuntu-ppa-impish.list 
dpkg-query: no path found matching pattern
/etc/apt/sources.list.d/audio-recorder-ubuntu-ppa-impish.list

Note it is sources.list.d not sources.d, I don't know why. There is
nothing in that file audio-recorder-ubuntu-ppa-impish.list

[toc] | [prev] | [next] | [standalone]

#235148

Hi Richmond,

Am Mittwoch, 12. Mai 2021 schrieb Richmond:
> Stefan Krusche <linux@stefan-krusche.de> writes:
> > Am Mittwoch, 12. Mai 2021 schrieb Richmond:
> >> Andrei POPESCU <andreimpopescu@gmail.com> writes:
> >> > On Mi, 12 mai 21, 10:51:55, Richmond wrote:
> >> >> This repo has crept into my sources.d an I don't know why it is

That's probably "sources.list.d", then, right?

> > This might help, too:
> >
> > dpkg -S /etc/sources.d/audio-recorder.list # or whatever that file
> > is called
> >
> > If the file has been installed from a package the name of the
> > package should be listed.
> >
> > Kind regards,
> > Stefan
>
>  sudo dpkg -S
> /etc/apt/sources.list.d/audio-recorder-ubuntu-ppa-impish.list
> dpkg-query: no path found matching pattern
> /etc/apt/sources.list.d/audio-recorder-ubuntu-ppa-impish.list

If I'm not mistaken, that could mean that there had been installed a 
package which put the file there but didn't delete it after uninstall 
because it wasn't *purged* but just *uninstalled*. CMIIW, please.

> Note it is sources.list.d not sources.d, I don't know why. 

That is correct, not "sources.d". I was sloppy when I copied that from 
your message… ;-)

> There is 
> nothing in that file audio-recorder-ubuntu-ppa-impish.list

A quick online search yielded this which might also help you to find out 
where the file came from:

https://launchpad.net/~audio-recorder/+archive/ubuntu/ppa

Kind regards,
Stefan

[toc] | [prev] | [next] | [standalone]

#235149

Stefan Krusche <linux@stefan-krusche.de> writes:

>
>> Note it is sources.list.d not sources.d, I don't know why. 
>
> That is correct, not "sources.d". I was sloppy when I copied that from 
> your message… ;-)

Yes, I was correcting myself. I thought it was sources.d until I tried
to search there and it didn't exist. :)

>
>> There is 
>> nothing in that file audio-recorder-ubuntu-ppa-impish.list
>
> A quick online search yielded this which might also help you to find out 
> where the file came from:
>
> https://launchpad.net/~audio-recorder/+archive/ubuntu/ppa
>

I haven't installed any audio recorder that I know of, but I did install
vlc recently, which I think may be able to record audio. But that is
part of debian:

 aptitude -v show vlc|grep -i archive
Archive: stable, stable, now

[toc] | [prev] | [next] | [standalone]

#235151

Richmond <richmond@criptext.com> writes:

> I haven't installed any audio recorder that I know of, but I did install
> vlc recently, which I think may be able to record audio. But that is
> part of debian:
>
>  aptitude -v show vlc|grep -i archive
> Archive: stable, stable, now

Another possibility is Signal as it is able to record voice
messages. And it seems to have multiple versions installed.

sudo aptitude -v show signal-desktop|grep -i archive
Archive: xenial, now
Archive: xenial
Archive: xenial
Archive: xenial
Archive: xenial

[toc] | [prev] | [next] | [standalone]

#235152

Am Donnerstag, 13. Mai 2021 schrieb Richmond:
> Richmond <richmond@criptext.com> writes:
> > I haven't installed any audio recorder that I know of, but I did
> > install vlc recently, which I think may be able to record audio.
> > But that is part of debian:
> >
> >  aptitude -v show vlc|grep -i archive
> > Archive: stable, stable, now
>
> Another possibility is Signal as it is able to record voice
> messages. And it seems to have multiple versions installed.
>
> sudo aptitude -v show signal-desktop|grep -i archive
> Archive: xenial, now
> Archive: xenial
> Archive: xenial
> Archive: xenial
> Archive: xenial

If you have installed these as .deb packages *and* the sources.list file
was installed thereby then you should find it with the dpkg -S command
I proposed in a previous mail.

There may also be the possibility that the sources.list file has been
created at install time through pre-/postinstall scripts, I think, but
that seems rather unusual to me. I think, I can't further help along
here.

[toc] | [prev] | [next] | [standalone]

#235157

On Thu, May 13, 2021 at 11:48:37AM +0200, Stefan Krusche wrote:
> > sudo aptitude -v show signal-desktop|grep -i archive
> > Archive: xenial, now
> > Archive: xenial
> > Archive: xenial
> > Archive: xenial
> > Archive: xenial
> 
> If you have installed these as .deb packages *and* the sources.list file
> was installed thereby then you should find it with the dpkg -S command
> I proposed in a previous mail.

Not if the sources.list.d/*.list entry was created by a postinst script.
dpkg -S only shows you files that are included in the package's tarball,
not files that are generated at installation time.

[toc] | [prev] | [next] | [standalone]

#235162

On Thu 13 May 2021 at 06:59:04 (-0400), Greg Wooledge wrote:
> On Thu, May 13, 2021 at 11:48:37AM +0200, Stefan Krusche wrote:
> > > sudo aptitude -v show signal-desktop|grep -i archive
> > > Archive: xenial, now
> > > Archive: xenial
> > > Archive: xenial
> > > Archive: xenial
> > > Archive: xenial
> > 
> > If you have installed these as .deb packages *and* the sources.list file
> > was installed thereby then you should find it with the dpkg -S command
> > I proposed in a previous mail.
> 
> Not if the sources.list.d/*.list entry was created by a postinst script.
> dpkg -S only shows you files that are included in the package's tarball,
> not files that are generated at installation time.

Seeing "xenial" above, I typed   ubuntu signal package   into google
and clicked on the second link:
https://websiteforstudents.com/how-to-install-signal-desktop-on-ubuntu-16-04-17-10-18-04/
Here's the script it recommends you run. I notice that it pipes the
output of curl straight into sudo'd commands without a care in the world:

  suXdo apt install curl
  curl -s https://updates.signal.org/desktop/apt/keys.asc | suXdo apt-key add -
  echo "deb [arch=amd64] https://updates.signal.org/desktop/apt xenial main" | suXdo tee -a /etc/apt/sources.list.d/signal-xenial.list
  suXdo apt update && suXdo apt install signal-desktop

I'm surprised it doesn't do a quick upgrade while it's about it.
Anyway, that's what I call self-inflicted.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#235165

David Wright <deblis@lionunicorn.co.uk> writes:


> I'm surprised it doesn't do a quick upgrade while it's about it.
> Anyway, that's what I call self-inflicted.
>

Those aren't the instructions given on the Signal website.

[toc] | [prev] | [next] | [standalone]

#235170

On Thu 13 May 2021 at 16:42:09 (+0100), Richmond wrote:
> David Wright <deblis@lionunicorn.co.uk> writes:
> 
> > I'm surprised it doesn't do a quick upgrade while it's about it.
> > Anyway, that's what I call self-inflicted.
> 
> Those aren't the instructions given on the Signal website.

As you prefer. I typed   signal debian   into google and clicked on
the top link:
  https://signal.org › download
which took me to
  https://signal.org/en/download/
I clicked on the blue   Download for Linux   button, and the following appeared:

  Linux (Debian-based) Install Instructions

  # NOTE: These instructions only work for 64 bit Debian-based
  # Linux distributions such as Ubuntu, Mint etc.

  # 1. Install our official public software signing key
  wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg
  suXdo mv signal-desktop-keyring.gpg /usr/share/keyrings/

  # 2. Add our repository to your list of repositories
  echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |\
    suXdo tee -a /etc/apt/sources.list.d/signal-xenial.list

  # 3. Update your package database and install signal
  suXdo apt update && suXdo apt install signal-desktop

Comparing this with what I posted before, I see that curl (Optional)
is replaced by wget (Standard), and one can assume the latter
is already installed.

Step 1 differs in that it stores the .gpg key instead of .asc.
I'm not aware of any significance in one format or the other.

Step 2 differs in that a specific key is used for verification,
rather than any key on the keyring.

Step 3 is identical.

Comments as before.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#235173

David Wright <deblis@lionunicorn.co.uk> writes:

> On Thu 13 May 2021 at 16:42:09 (+0100), Richmond wrote:
>> David Wright <deblis@lionunicorn.co.uk> writes:
>> 
>> > I'm surprised it doesn't do a quick upgrade while it's about it.
>> > Anyway, that's what I call self-inflicted.
>> 
>> Those aren't the instructions given on the Signal website.
>
> As you prefer. I typed   signal debian   into google and clicked on
> the top link:
>   https://signal.org › download
> which took me to
>   https://signal.org/en/download/
> I clicked on the blue   Download for Linux   button, and the following appeared:
>
>   Linux (Debian-based) Install Instructions
>
>   # NOTE: These instructions only work for 64 bit Debian-based
>   # Linux distributions such as Ubuntu, Mint etc.
>
>   # 1. Install our official public software signing key
>   wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg
>   suXdo mv signal-desktop-keyring.gpg /usr/share/keyrings/
>
>   # 2. Add our repository to your list of repositories
>   echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |\
>     suXdo tee -a /etc/apt/sources.list.d/signal-xenial.list
>
>   # 3. Update your package database and install signal
>   suXdo apt update && suXdo apt install signal-desktop
>
> Comparing this with what I posted before, I see that curl (Optional)
> is replaced by wget (Standard), and one can assume the latter
> is already installed.
>
> Step 1 differs in that it stores the .gpg key instead of .asc.
> I'm not aware of any significance in one format or the other.
>
> Step 2 differs in that a specific key is used for verification,
> rather than any key on the keyring.
>
> Step 3 is identical.
>
> Comments as before.


The command being piped to sudo, which you are concerned about, in the
second version is the output from echo, which is the deb
command. So it is doing what it says it is doing, adding the repo. The
key is validated by gpg.

The curl version is dubious because it doesn't validate the key, so it
could contain a ; and some other commands. But I don't know why anyone
would follow those instructions for students.

None of this shows that installing signal added the ppa.launchpad.net
repo.. So it is not self inflicted.

[toc] | [prev] | [next] | [standalone]

#235190

On Thu 13 May 2021 at 21:42:41 (+0100), Richmond wrote:
> David Wright <deblis@lionunicorn.co.uk> writes:
> > On Thu 13 May 2021 at 16:42:09 (+0100), Richmond wrote:
> >> David Wright <deblis@lionunicorn.co.uk> writes:
> >> 
> >> > I'm surprised it doesn't do a quick upgrade while it's about it.
> >> > Anyway, that's what I call self-inflicted.
> >> 
> >> Those aren't the instructions given on the Signal website.
> >
> > As you prefer. I typed   signal debian   into google and clicked on
> > the top link:
> >   https://signal.org › download
> > which took me to
> >   https://signal.org/en/download/
> > I clicked on the blue   Download for Linux   button, and the following appeared:
> >
> >   Linux (Debian-based) Install Instructions
> >
> >   # NOTE: These instructions only work for 64 bit Debian-based
> >   # Linux distributions such as Ubuntu, Mint etc.
> >
> >   # 1. Install our official public software signing key
> >   wget -O- https://updates.signal.org/desktop/apt/keys.asc | gpg --dearmor > signal-desktop-keyring.gpg
> >   suXdo mv signal-desktop-keyring.gpg /usr/share/keyrings/
> >
> >   # 2. Add our repository to your list of repositories
> >   echo 'deb [arch=amd64 signed-by=/usr/share/keyrings/signal-desktop-keyring.gpg] https://updates.signal.org/desktop/apt xenial main' |\
> >     suXdo tee -a /etc/apt/sources.list.d/signal-xenial.list
> >
> >   # 3. Update your package database and install signal
> >   suXdo apt update && suXdo apt install signal-desktop
> >
> > Comparing this with what I posted before, I see that curl (Optional)
> > is replaced by wget (Standard), and one can assume the latter
> > is already installed.
> >
> > Step 1 differs in that it stores the .gpg key instead of .asc.
> > I'm not aware of any significance in one format or the other.
> >
> > Step 2 differs in that a specific key is used for verification,
> > rather than any key on the keyring.
> >
> > Step 3 is identical.
> >
> > Comments as before.
> 
> The command being piped to sudo, which you are concerned about, in the
> second version is the output from echo, which is the deb
> command. So it is doing what it says it is doing, adding the repo.

No, I can read echo too; it's the command before that one. I wrote:
   "I notice that it pipes the output of curl straight into sudo'd
    commands without a care in the world"
and the second version uses "wget -O-" ≡ "curl -s".

> The key is validated by gpg.
> 
> The curl version is dubious because it doesn't validate the key, so it
> could contain a ; and some other commands.

I don't see any validation of the key. IOW I don't see who is
represented by that key. You could just check the signal .deb file
against a SHA sum published on their page. That's what I meant.

The only difference appears to be that the first post puts the
ascii version onto the keyring, whereas the second puts the
binary version. I assume apt is unfazed by the difference.

> But I don't know why anyone
> would follow those instructions for students.

That was the first set. The second set of instructions was on
https://signal.org   and I assume that's the homepage for signal.
I presume that people would follow them to install the package,
and that you didn't. (I don't know what you did.)

> None of this shows that installing signal added the ppa.launchpad.net
> repo..

That wasn't my intent: Greg had dealt with that, in that one can
examine /var/lib/dpkg/info/*.p* for any "foreign" packages, and
read what they would have done when one installed them.

> So it is not self inflicted.

The sysadmin who executes the echo line above (step 2) would be the
person who added the repository, so that would be self-inflicted.
Where I wouldn't use that term in when the change was indirectly
made in, say, a script that was itself downloaded.

Let me make it clear: this is not an accusation against you.
All you did was to mention "signal", whereupon I showed how somebody
might follow foreign instructions for installing a foreign package,
casually add a line to their sources.list, and, job done, forget all
about it. Signal just happened to be a perfect example, in that one
could cut and paste either of those instruction sets off the screen,
all without really digesting what they did. Again, not an accusation.

We're casting around for explanations of how a line like
http://ppa.launchpad.net/audio-recorder/ppa/ubuntu
got into *your* sources.list. I can only make suggestions about
possible mechanisms, not determinations. You're the one who presumably
wants to do that.

Cheers,
David.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web