As documented in bug 954483 and bug 1004503 update-manager was attaching apt-clone system state information which included usernames and passwords from apt sources files. apt-clone has been modified to scrub the sources files (bug 1029021) before creating them and update-manager should be updated to take advantage of this and start including apt system state information again as it is useful in debugging distribution upgrades.
[Impact]
update-manager is not currently include apt clone system state information when creating apport reports for sending to Launchpad. This information is essential for debugging distribution upgrades and should be included.
[Test Case]
0) Install apt-clone version 0.2.2ubuntu1 as this includes necessary functionality
1) Create a file /etc/apt/sources.list.d/my-ppa.list with a line like so:
'deb http://bdmurray:<email address hidden>/bdmurray/hda/ubuntu precise main'
2) Edit /etc/default/grub so that you have a line missing a final quote:
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash
3) start a distribution upgrade from Oneiric to Precise
4) there should now be a file in /var/log/dist-upgrade named apt-clone_system_state.tar.gz; copy this to /tmp/ and tar xfvz it
5) look for bdmurray and g00dpassw0rd in the extracted version of my-ppa.list
With the version of update-manager from -proposed my-ppa.list should contain USERNAME:PASSWORD instead of my nick and password.
[Regression Potential]
It is possible that usernames and passwords will appear in apt-clone_system_state.tar.gz but test case in this bug report is pretty solid. Additionally this same code has been in quantal since early July.
This is already done in quantal, in ubuntu-