[Bug 1744318] Re: changelogs.ubuntu.com should be using HTTPS

[Launchpad Bug Tracker]

This bug was fixed in the package ubuntu-release-upgrader - 1:18.04.12

---------------
ubuntu-release-upgrader (1:18.04.12) bionic; urgency=medium

  [ Simon Quigley ]
  * Port away from kdesudo.

  [ Brian Murray ]
  * Increase the size of the buffer used when calculating the free space to
    estimate for the initramfs.

 -- Brian Murray <brian at ubuntu.com>  Wed, 21 Mar 2018 16:32:15 -0700

** Changed in: ubuntu-release-upgrader (Ubuntu Bionic)
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to ubuntu-release-upgrader in
Ubuntu.
https://bugs.launchpad.net/bugs/1744318

Title:
  changelogs.ubuntu.com should be using HTTPS

Status in ubuntu-release-upgrader package in Ubuntu:
  Fix Released
Status in update-manager package in Ubuntu:
  Fix Released
Status in ubuntu-release-upgrader source package in Bionic:
  Fix Released
Status in update-manager source package in Bionic:
  Fix Released

Bug description:
  Although the packages listed in meta-release files on
  changelogs.ubuntu.com are signature-checked there doesn't appear to be
  any way to verify the meta-release files are valid so a man-in-the-
  middle could maliciously supply an alternate meta-release.

  meta-release files should be signed with the archive GPG key and/or
  delivered over HTTPS.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1744318/+subscriptions