No safety from breaking system with Adept

Bug #55549 reported by Sean Hodges
4
Affects Status Importance Assigned to Milestone
adept (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

Binary package hint: adept

Adept should have failsafe security measures for packages that will cause system to uninstall core packages if removed.

An example of this is "avahi-common3" - While attempting to remove a zeroconf installation I had been playing with I attempted to remove this package, thinking it was part of my recent experimenting.

It attempted to remove the entire KDE base, along with a number of my custom packages. I got a total of 200 packages, including kubuntu-desktop and a number of core packages in the list... There was no warning dialog to stop me from starting this process before I killed adept.

I have not had this problem when I use apt-get, as it makes it clear what it will be removing/upgrading and asks for confirmation before executing the task (checked this with "libavahi-common3" as well). There is no such security in Kubuntu's default package manager.

Situations like this should be identified and alerted to the user with a warning dialog, as many users of graphical package managers will either not think to carefully check the packages being removed before hitting Apply, or will forget to check.

In addition, perhaps a "safety switch" in the Settings menu could be added, to ensure users cannot remove important packages such as "kubuntu-desktop" and "linux-image-386" without disabling the safety switch first (obviously some kind of alert should appear to tell the user if safety switch has blocked a removal/install).

I was going to add my sources.list, but I've since asked others to check this - some with mostly default repos, and they've all had the same outcome with "avahi-common3".

Regards,

Sean

Revision history for this message
kko (kko) wrote :

Confirmed a long time ago. The lack of safeguards is why I stopped using Adept, so I can't comment on any progress made in it since. (Perhaps ironically, 'adept --version' reports "2.0 Destroyer"... ;-)

Changed in adept:
status: Unconfirmed → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.