9 ms·

Ubuntu 18.04.2 LTS Released

77 points by slyrus 8y ago

slyrus 8y ago
Apparently 18.04.2 LTS has been released, as that's what my box reports running now. I don't see any clear announcements of the actual release, but perhaps they're just hard to find on the various ubuntu wiki/planet/mailing list/etc... sites.
- Lorkki 8y ago
  It should make no difference to an existing installation. The point releases to LTS really just mean that the installer images are kept up to date.
  - copperx 8y ago
    So that means that if my system says it's version 18.04.1 and reports "your system is up to date", then I am up to date?
    - gerdesj 8y ago
      If you have done apt update and apt upgrade recently followed by a reboot then it will show .2 on login. I have just confirmed this on a VM.
  - maccam94 8y ago
    Not true, they also come with hardware enablement updates (new kernel, graphics drivers, X and Wayland).
dcminter 8y ago
I for one would very much like to see this bug in 18.04 fixed as a priority: https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/1796027 https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/1... The Java 11 package installs Java 10. This was supposed to be a short term hack (because Ubuntu's long term supported version 18.04 was being released shortly before Java's long term supported version 11) but it's been a good while now - six months or so. The short term support version 18.10 of Ubuntu has Java 11 so it's very non-obvious what the blocker is. To me this seems like a really poor choice. The result of installing the Java 11 package but getting Java 10 clearly fails the principle of least astonishment. If we can live without the fix a quarter of the way to the next LTS edition of Ubuntu then we could have lived with Java 10 as the preferred (and correctly named) package in the first place. Meanwhile the bug asks us not to spam with requests for updates yet there's no suggestion of where we can go to gauge what the timescales we're up against are. It definitely dents my confidence in Ubuntu as a well organised distribution.
- alanfranzoni 8y ago
  This looked like a decent idea when the package was created, but turned into a disaster, an example of how NOT to do things.
  - ploxiln 8y ago
    Yeah, I'm sympathetic to the Ubuntu maintainers - at this point there are teams/companies which have built some server application/service on Ubuntu 18.04, and expect no backwards-incompatible changes for 5 years (the classic stable distro objective), but if openjdk-11 is updated from openjdk 10.x to 11.x then some stuff will stop working. I'm curious how they'll resolve it (and I think an additional half-year past the openjdk-11 release is reasonable, in the overall 5-year timeframe). (Meanwhile, apparently, some users have come to expect an upstream release to get into ubuntu stable updates within 2 days ?!)
    - alanfranzoni 8y ago
      Jdk 10 is unsupported already.
      - ploxiln 8y ago
        Stable linux distros have a long history of backporting security patches themselves - RHEL does this the most/longest, Debian and Ubuntu somewhat less but still a lot. They've given up on web browsers, but for most other stuff, definitely including java, they certainly can and do support what they have released. In the linked issue, it notes that they already have backported some security fixes that were in 11.0.1 to openjdk-10.
        alanfranzoni 8y ago
        Possible, but is it a good idea? If the package is called "openjdk-11", I want JDK 11.
- pram 8y ago
powersj 8y ago
This is not an official announcement and it has not been officially declared released or ISOs updated. The last official comment was it was delayed till Thursday, Feb. 14: https://lists.ubuntu.com/archives/ubuntu-release/2019-February/004694.html https://lists.ubuntu.com/archives/ubuntu-release/2019-Februa... Those preparing the release will update release notes and fixed bug lists (like this one) before the release.
- powersj 8y ago
  The official release announcement is now out: https://lists.ubuntu.com/archives/ubuntu-release/2019-February/004702.html https://lists.ubuntu.com/archives/ubuntu-release/2019-Februa...
clinta 8y ago
I wish there was some announcement about when HWE kernels will be available for 18.04. This page has not yet been updated. https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack#Kernel.2FSupport-1.A18.04.x_Ubuntu_Kernel_Support https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack#Ker...
jake_the_third 8y ago
Does it include the fix for apt's recent mirror redirect vulnerability? If not, any update to a fresh system would be trivially susceptible to a MITM attack if redirects aren't disabled. This includes docker images as well: https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html Canonical really should enable https as an additional layer of protection. This isn't the first time a bug in apt's authentication was found and it's unlikely that this bug will be the last.
- powersj 8y ago
  Fixed in January: https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-3462.html https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... edit: the updated, point release ISOs will have the fix

77 points by slyrus 8y ago

Apparently 18.04.2 LTS has been released, as that's what my box reports running now. I don't see any clear announcements of the actual release, but perhaps they're just hard to find on the various ubuntu wiki/planet/mailing list/etc... sites.

Lorkki 8y ago
It should make no difference to an existing installation. The point releases to LTS really just mean that the installer images are kept up to date.
- copperx 8y ago
  So that means that if my system says it's version 18.04.1 and reports "your system is up to date", then I am up to date?
  - gerdesj 8y ago
    If you have done apt update and apt upgrade recently followed by a reboot then it will show .2 on login. I have just confirmed this on a VM.
- maccam94 8y ago
  Not true, they also come with hardware enablement updates (new kernel, graphics drivers, X and Wayland).

dcminter 8y ago

I for one would very much like to see this bug in 18.04 fixed as a priority: https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/1796027 https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/1... The Java 11 package installs Java 10. This was supposed to be a short term hack (because Ubuntu's long term supported version 18.04 was being released shortly before Java's long term supported version 11) but it's been a good while now - six months or so. The short term support version 18.10 of Ubuntu has Java 11 so it's very non-obvious what the blocker is. To me this seems like a really poor choice. The result of installing the Java 11 package but getting Java 10 clearly fails the principle of least astonishment. If we can live without the fix a quarter of the way to the next LTS edition of Ubuntu then we could have lived with Java 10 as the preferred (and correctly named) package in the first place. Meanwhile the bug asks us not to spam with requests for updates yet there's no suggestion of where we can go to gauge what the timescales we're up against are. It definitely dents my confidence in Ubuntu as a well organised distribution.

alanfranzoni 8y ago
This looked like a decent idea when the package was created, but turned into a disaster, an example of how NOT to do things.
- ploxiln 8y ago
  Yeah, I'm sympathetic to the Ubuntu maintainers - at this point there are teams/companies which have built some server application/service on Ubuntu 18.04, and expect no backwards-incompatible changes for 5 years (the classic stable distro objective), but if openjdk-11 is updated from openjdk 10.x to 11.x then some stuff will stop working. I'm curious how they'll resolve it (and I think an additional half-year past the openjdk-11 release is reasonable, in the overall 5-year timeframe). (Meanwhile, apparently, some users have come to expect an upstream release to get into ubuntu stable updates within 2 days ?!)
  - alanfranzoni 8y ago
    Jdk 10 is unsupported already.
    - ploxiln 8y ago
      Stable linux distros have a long history of backporting security patches themselves - RHEL does this the most/longest, Debian and Ubuntu somewhat less but still a lot. They've given up on web browsers, but for most other stuff, definitely including java, they certainly can and do support what they have released. In the linked issue, it notes that they already have backported some security fixes that were in 11.0.1 to openjdk-10.
      - alanfranzoni 8y ago
        Possible, but is it a good idea? If the package is called "openjdk-11", I want JDK 11.
pram 8y ago

powersj 8y ago

This is not an official announcement and it has not been officially declared released or ISOs updated. The last official comment was it was delayed till Thursday, Feb. 14: https://lists.ubuntu.com/archives/ubuntu-release/2019-February/004694.html https://lists.ubuntu.com/archives/ubuntu-release/2019-Februa... Those preparing the release will update release notes and fixed bug lists (like this one) before the release.

powersj 8y ago
The official release announcement is now out: https://lists.ubuntu.com/archives/ubuntu-release/2019-February/004702.html https://lists.ubuntu.com/archives/ubuntu-release/2019-Februa...

clinta 8y ago

I wish there was some announcement about when HWE kernels will be available for 18.04. This page has not yet been updated. https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack#Kernel.2FSupport-1.A18.04.x_Ubuntu_Kernel_Support https://wiki.ubuntu.com/Kernel/RollingLTSEnablementStack#Ker...

jake_the_third 8y ago

Does it include the fix for apt's recent mirror redirect vulnerability? If not, any update to a fresh system would be trivially susceptible to a MITM attack if redirects aren't disabled. This includes docker images as well: https://justi.cz/security/2019/01/22/apt-rce.html https://justi.cz/security/2019/01/22/apt-rce.html Canonical really should enable https as an additional layer of protection. This isn't the first time a bug in apt's authentication was found and it's unlikely that this bug will be the last.

powersj 8y ago
Fixed in January: https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-3462.html https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2... edit: the updated, point release ISOs will have the fix