I'm getting the message: "The following security updates require Ubuntu Pro with 'esm-apps' enabled" when updating Ubuntu 22.04

Question

I use the package texlive-full, which installs imagemagick and other related packages. When I check for updates, I get this message:

The following security updates require Ubuntu Pro with 'esm-apps' enabled:
  imagemagick libopenexr25 libmagick++-6.q16-8 libmagickcore-6.q16-6-extra
  libmagickwand-6.q16-6 imagemagick-6.q16 libmagickcore-6.q16-6
  imagemagick-6-common

Which means that if I want to use texlive-full with Ubuntu 22.04, I have to pay $500 per year to have a secured distro, as far as I understand what is written.

Is there a way to avoid that, for example by not installing everything installed by texlive-full?

EDIT:

gaucher@mars:~$ apt policy texlive-full
texlive-full:
  Installé : 2021.20220204-1
  Candidat : 2021.20220204-1
 Table de version :
 *** 2021.20220204-1 500
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe i386 Packages
        100 /var/lib/dpkg/status

My configuration (yes I am using Ubuntu 22.04):

Added on request:

gaucher@mars:~$ apt policy imagemagick
imagemagick:
  Installé : 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1
  Candidat : 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1
 Table de version :
 *** 8:6.9.11.60+dfsg-1.3ubuntu0.22.04.1+esm1 500
        500 https://esm.ubuntu.com/apps/ubuntu jammy-apps-security/main amd64 Packages
        100 /var/lib/dpkg/status
     8:6.9.11.60+dfsg-1.3build2 500
        500 http://fr.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages

Answer 1

This is an additional support stream

From reddit.com/r/linux/, user Patch86UK:

For clarity: This is not a roadblock being put on an existing support stream, it is a new support stream. Previously Ubuntu did not provide security patches for "Universe" repo packages (instead relying on upstream patches to happen when they happen). The Ubuntu security team are now producing in-house security patches for these packages, but only where Pro has been opted into (which is free for personal use).

If you do not want to opt in to Pro you still have the same level of support you had before (and the same level of support that you have with 99% of other distros).

Answer 2

Here is a solution that doesn't require subscribing or registering. It removes the helpful look what you could get if you sign up message. This is not the most elegant, but it takes care of the immediate issue:

the file /etc/apt/apt.conf.d/20apt-esm-hook.conf provides the hook that calls the marketing message generation. Removing that is an option

mkdir -p ~/relocated_apt
sudo mv /etc/apt/apt.conf.d/20apt-esm-hook.conf ~/relocated_apt/.

now when you run apt upgrade the message does not show.

Note this doesn't survive updates if a new version gets put there, which may happen more as this new feature is rolled out/updated.

Answer 3

I have found the solution. Run:

sudo pro enable esm-apps

and then update using the usual way and imagemagick and all related packages will be updated.

If Ubuntu Pro support is enabled on your Ubuntu Desktop, you can go to Software & Updates and open the Ubuntu Pro tab.

In this context, it should be noted that "ESM Apps" cover applications from the universe repository.

Note that it is necessary to have an account on ubuntu.com and this feature is free for up to 5 machines.

See the Q&A about Ubuntu Pro.

Answer 4

Solution 1: Enable the Pro repository

That repository is not public, it's free for up to 5 machines, it requires setting up an account (email, username, password), and it gives you additional security updates. To do that, register at https://ubuntu.com/pro, get your personal token, then run:

    sudo pro attach your-personal-token

This is what Ubuntu recommends itself.

Solution 2: Remove the advertisement permanently

sudo dpkg-divert --divert /etc/apt/apt.conf.d/20apt-esm-hook.conf.bak --rename --local /etc/apt/apt.conf.d/20apt-esm-hook.conf

This will effectively add a .bak suffix to the conf file, immediately disabling it. This will continue to work with future apt upgrades as well.

To confirm that it is working, run apt upgrade. If everything works correctly, you should no longer see the extra text.

Answer 5

Have you actually tried going to https://ubuntu.com/pro ? I just did, and after logging in, I received a "Free Personal Token" that never expires and includes up to 5 machines.

Then you just need to run "sudo pro attach your-personal-token" and that's it :)

Answer 6

These have not helped me (they do not persist):

1. moving/removing /etc/apt/apt.conf.d/20apt-esm-hook.conf
2. changing the token in the /etc/apt/apt.conf.d/20apt-esm-hook.conf file from true to false

I have not found a workaround for this that persists. However, I do note from a discussion on reddit:

We don't show it in apt-get (anymore) because scripts parse apt-get output and break whereas apt output is for humans only.

I can confirm that the message does not (as of yet) get called when using apt-get or if using nala as a front end.

Definitely not a 'solution' as such, but it does allow me to not be reminded how much I hate Ubuntu every time I run an update :)

Answer 7

While most answers discuss ESM, TeXLive without (Ubuntu's version of) imagemagick might be a reasonable goal by itself.

Regarding which packages in texlive-full actually require imagemagick, you could simply do a sudo apt remove imagemagick-6-common after installing texlive-full.

But if you plan to use tlmgr, you should avoid installing texlive-full and just follow this guide on tex.stackexchange. However, imagemagick might still be pulled in by other TeX-related packages, e.g., on my system kbibtex recommends latex2rtf (not part of TeXLive, but on CTAN) which requires imagemagick-6-common.

Answer 8

To disable:

chmod a-x /usr/lib/ubuntu-advantage/apt-esm-json-hook
sudo pro disable esm-apps

To enable:

chmod a+x /usr/lib/ubuntu-advantage/apt-esm-json-hook
sudo pro enable esm-apps
sudo pro attach XXXXXXXXXXXXXX  << your token got from ubuntu.com/pro