Confirmed the root cause. 1. The temporary auth file used for validation is named `90ubuntu- advantage-validation`, which is read later than `90ubuntu-advantage`, the file containing the persisted, validated credentials used by the Ubuntu Pro client.
2. The line for ESM infra in `90ubuntu-advantage` is `machine esm.ubuntu.com/ login bearer password <TOKEN>`, which shadows the line used for ESM infra legacy `machine esm.ubuntu.com/infra-legacy/ login bearer password <TOKEN>` in `90ubuntu-advantage-validation` if doing a simple prefix match. 3. The temporary credential is valid, but it isn't being used when `apt- helper` runs to check the credentials. The Pro client incorrectly rejects the attempt to enable ESM legacy infra and does not persist the credentials to disk. This bug only affects 14.04 Trusty because the version of `apt` there does a simpler first-match-wins when checking credentials in `/etc/apt/auth.conf.d`. This also confirms that the fix is appropriate because it instructs `apt-helper` to use only the temporary credential. It cannot be shadowed by existing credentials. Reproducer (WARNING: deletes Pro creds--do not run on a real system): ``` #!/bin/bash set -u AUTHDIR=/etc/apt/auth.conf.d URL="https://esm.ubuntu.com/infra-legacy/ubuntu/pool/"; echo "=== release: $(lsb_release -ds 2>/dev/null || head -1 /etc/issue) ===" echo "=== apt: $(apt-get --version 2>/dev/null | head -1) ===" mkdir -p "$AUTHDIR" printf 'machine esm.ubuntu.com/ login bearer password FAKE_BROAD\n' > "$AUTHDIR/90ubuntu-advantage" printf 'machine esm.ubuntu.com/infra-legacy/ login bearer password FAKE_VALID\n' > "$AUTHDIR/90ubuntu-advantage-validation" chmod 600 "$AUTHDIR"/90ubuntu-advantage* opens=$(strace -f -e trace=open,openat \ /usr/lib/apt/apt-helper download-file "$URL" /tmp/netrc-test-out 2>&1 \ | grep -E 'auth\.conf\.d/90ubuntu-advantage') echo "--- auth.conf.d opens ---" echo "$opens" echo "-------------------------" if ! echo "$opens" | grep -q '90ubuntu-advantage'; then echo "VERDICT: auth.conf.d not consulted at all (no netrcparts support)" elif echo "$opens" | grep -q '90ubuntu-advantage-validation'; then echo "VERDICT: reads BOTH parts -> later files ARE consulted -> bug NOT present" else echo "VERDICT: opens ONLY 90ubuntu-advantage, STOPS at first prefix match -> BUG PRESENT" fi rm -f "$AUTHDIR"/90ubuntu-advantage* /tmp/netrc-test-out ``` -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2165073 Title: Cannot enable esm-infra-legacy on Trusty To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ubuntu-advantage-tools/+bug/2165073/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
