[Bug 1744318] Re: changelogs.ubuntu.com should be using HTTPS

[Julian Andres Klode]

old version tries to connect to port 80, hangs because I blocked it.

[pid  1035] connect(3, {sa_family=AF_INET, sin_port=htons(80), sin_addr=inet_addr("91.189.95.15")}, 16) = -1 EINPROGRESS (Operation now in progress)
[pid  1035] poll([{fd=3, events=POLLOUT|POLLERR}], 1, 20000

afterwards it uses HTTPS:

# strace -e connect -f do-release-upgrade
[...]
[pid  8264] connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("91.189.95.15")}, 16) = 0
[pid  8264] connect(3, {sa_family=AF_INET6, sin6_port=htons(443), inet_pton(AF_INET6, "2001:67c:1560:8008::11", &sin6_addr), sin6_flowinfo=0, sin6_scope_id=0}, 28) = 0
[pid  8264] connect(3, {sa_family=AF_INET, sin_port=htons(443), sin_addr=inet_addr("91.189.95.15")}, 16) = -1 EINPROGRESS (Operation now in progress)
[pid  8264] +++ exited with 0 +++
strace: Process 8265 attached
[pid  8265] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8265, si_uid=0, si_status=0, si_utime=0, si_stime=1} ---
strace: Process 8266 attached
[pid  8266] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=8266, si_uid=0, si_status=0, si_utime=0, si_stime=0} ---
Please install all available updates for your release before upgrading.
+++ exited with 1 +++

I can't get this container to actually show me there's an update
availagble, but it works fine in another, maybe I broke some cache file?

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to update-manager in Ubuntu.
https://bugs.launchpad.net/bugs/1744318

Title:
  changelogs.ubuntu.com should be using HTTPS

Status in ubuntu-release-upgrader package in Ubuntu:
  Fix Released
Status in update-manager package in Ubuntu:
  Fix Released
Status in ubuntu-release-upgrader source package in Xenial:
  Fix Committed
Status in update-manager source package in Xenial:
  Fix Committed
Status in ubuntu-release-upgrader source package in Bionic:
  Fix Released
Status in update-manager source package in Bionic:
  Fix Released

Bug description:
  [Impact]
  Although the packages listed in meta-release files on changelogs.ubuntu.com are signature-checked there doesn't appear to be any way to verify the meta-release files are valid so a man-in-the-middle could maliciously supply an alternate meta-release.

  meta-release files should be signed with the archive GPG key and/or
  delivered over HTTPS.

  [Test case]
  Block port 80 access to changelogs.ubuntu.com and check that do-release-upgrade still works

  [Regression potential]
  This breaks any clients behind a proxy where HTTPS (CONNECT on the proxy) is not allowed.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ubuntu-release-upgrader/+bug/1744318/+subscriptions