Bug #15978

Tails 3.9 apt config references tor-0.3.4.x-experimental packages, which are no longer available

Added by kogorman 2018-09-25 19:43:30 . Updated 2018-10-04 10:42:43 .

Status:
Resolved
Priority:
Normal
Assignee:
Category:
Target version:
Tails_3.9.1
Start date:
2018-09-25
Due date:
% Done:

100%

Feature Branch:
Type of work:
Code
Blueprint:

Starter:
Affected tool:
Deliverable for:

Description

Tails 3.9 apt sources lists include a reference to tor-0.3.4-experimental components, which are no longer available on the Tor Project repos. This breaks `sudo apt-get update`, and automatic installation of packages from the Persistent volume.

Steps to Reproduce

Start Tails 3.9 with an admin password.
In a terminal, run sudo apt-get update

Expected Behavior

sudo apt-get update completes without error.

Actual Behavior

sudo apt-get update fails with error:

... Ign:7 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages Ign:9 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en Ign:5 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main all Packages Ign:7 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages Ign:9 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en Ign:5 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main all Packages Err:7 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main amd64 Packages 404 Not Found Ign:9 tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch/main Translation-en Fetched 61.9 kB in 13s (4,546 B/s) Reading package lists... Done W: The repository 'tor+"$":http://sdscoq7snqtznauu.onion/torproject.org tor-experimental-0.3.4.x-stretch Release' does not have a Release file. N: Data from such a repository can't be authenticated and is therefore potentially dangerous to use. N: See apt-secure(8) manpage for repository creation and user configuration details. E: Failed to fetch tor+"$":http://sdscoq7snqtznauu.onion/torproject.org/dists/tor-experimental-0.3.4.x-stretch/main/binary-amd64/Packages 404 Not Found E: Some index files failed to download. They have been ignored, or old ones used instead.

Subtasks

Related issues

Related to Tails - Feature #16931: Automatic test: don't include any deb.torproject.org experimental APT source Resolved
Related to Tails - Bug #16883: Tails 3.15 apt config references tor-0.4.0.x-experimental packages, which are no longer available Resolved

History

#1 Updated by mercedes508 2018-09-26 08:45:21

  • Status changed from New to Confirmed
  • Assignee set to intrigeri
  • Target version set to Tails_3.10.1

Thanks for filling this ticket.
It will be fixed in the next release, and isn’t a big deal concerning Tails use.

#2 Updated by redshiftzero 2018-09-26 17:26:49

For your prioritization I want to flag that we have multiple SecureDrop users hitting this issue. We have a CLI tool that runs `apt-get update` as part of installing additional apt packages that we need. We’re tracking here: https://github.com/freedomofpress/securedrop/issues/3827.

#3 Updated by eloquence 2018-09-26 23:16:25

As a bit of additional background, this causes installation of SecureDrop using Tails 3.9 to fail. It also causes a failure of updates of the client-side code on workstations running SecureDrop 3.9. That’s a pretty severe issue from the standpoint of the SecureDrop dev team.

We’ve drafted an advisory that I want to give you a chance to review, in case you would like us to re-frame the language in any way. We’re planning to post it tomorrow end-of-business PDT. Here’s the current draft:
https://docs.google.com/document/d/1EDYeGPb393CbFJIARP23YjmeoCFThNYoSATPC1eAT5I/edit#

If there’s any possibility of cutting a point release before 3.10 to fix this, that would help the SecureDrop user community (many news organizations around the world) a lot, but we understand if that’s not possible. Thanks for the super-fast initial response!

#4 Updated by mercedes508 2018-09-28 10:18:05

OK, thanks for the context and input. I’ll let the dev take care of changing the prio accordingly.

#5 Updated by mercedes508 2018-09-28 10:44:49

I received 3 bug reports since monday 24th about that issue.
And the only usecase broken by that issue clearly identified is the SecureDrop use, described above.

#6 Updated by mercedes508 2018-09-30 13:32:32

Received another bug report about that. It also more generally blocks the use of additional software apparently.

#7 Updated by chinul 2018-10-01 05:08:25

Hello Tails devs,

I’m replying here after finding this issue via a web search for the failure symptoms when attempting to apt-get some packages in Tails 3.9.

I am a developer using a Tails-based environment plus some startup scripts to install the tools I need to be able to contribute to projects like Bitcoin and https://bisq.network with a reasonable degree of privacy.

This issue impacts my workflow since I can’t install software packages like tmux, expect and others that I usually use currently, making it much harder to do my work.

Let me know if there is any workaround or if there’s an expected date when a fix might be available, and thank you in advance!

#8 Updated by kogorman 2018-10-01 14:15:07

Hi chinui,

Not a tails dev (an FPF flunky), but the workaround we’re recommending for SecureDrop users is described here: https://securedrop.org/news/advisory-installationworkstation-update-failure-tails-39/ - it’s pretty simple, but unfortunately not persistent across reboots.

#9 Updated by intrigeri 2018-10-01 14:42:03

  • Status changed from Confirmed to Fix committed
  • Assignee deleted (intrigeri)
  • Target version changed from Tails_3.10.1 to Tails_3.9.1
  • % Done changed from 0 to 100

This was fixed a week ago on our stable branch. We’ll release Tails 3.9.1 with the fix within a few days. Sorry for the inconvenience!

#10 Updated by anonym 2018-10-04 10:42:43

  • Status changed from Fix committed to Resolved

#11 Updated by intrigeri 2019-08-01 10:31:55

  • related to Feature #16931: Automatic test: don't include any deb.torproject.org experimental APT source added

#12 Updated by sajolida 2019-08-28 08:48:22

  • related to Bug #16883: Tails 3.15 apt config references tor-0.4.0.x-experimental packages, which are no longer available added