Custom uploads cannot be effectively staged in a PPA

Bug #1036616 reported by Colin Watson
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Launchpad itself
Fix Released
Low
Colin Watson

Bug Description

If you copy an upload including custom files from a PPA to the primary archive, then the code that's supposed to send custom uploads through the upload queue doesn't work. This is because of the getTargetArchive shenanigans in CustomUploadsCopier, which returns None if the original upload was to a PPA. We need to fix this in order to be able to stage security fixes to (in particular) UEFI images in the ubuntu-security PPA.

As part of fixing this, it will be mandatory to make copied custom uploads go through some equivalent of BuildDaemonUploadPolicy.autoApprove, which causes all UEFI uploads to the primary archive to require manual approval in order to prevent anyone with upload privileges to Ubuntu being able to produce images signed with the Ubuntu UEFI key. We are saved from a security vulnerability by the fact that UEFI uploads copied from a PPA are not signed due to this bug, and that UEFI uploads copied from the primary archive will already have been through sufficient manual approval; but we must fix this before making copies of custom uploads from PPAs work.

Tags: qa-ok uefi

Related branches

Changed in launchpad:
status: New → Triaged
importance: Undecided → Low
Colin Watson (cjwatson)
Changed in launchpad:
assignee: nobody → Colin Watson (cjwatson)
status: Triaged → In Progress
Revision history for this message
Launchpad QA Bot (lpqabot) wrote :
tags: added: qa-needstesting
Changed in launchpad:
status: In Progress → Fix Committed
Colin Watson (cjwatson)
tags: added: qa-ok
removed: qa-needstesting
Colin Watson (cjwatson)
Changed in launchpad:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.