Bug 649

Suggested fix:

Remove the /etc/apt/sources.list.d/trinity.list entry altogether, a keyring package should do just that, install a keyring.

A user would normally have already their sources list set up, before apt-get/aptititude install any TDE package (and may be confused what has overwritten a custom entry and/or then have duplicate or even conflicting sources for the same packages) There is no good reason for it.

I did not expect a keyring to install an apt source which duplicated a pre-existing pre-requisite apt source, and which confused me no end during an attempted upgrade.

I have to agree with David Hare's suggested fix - please remove the apt source from trinity keyring.

As it is I don't want to lose the keyring by uninstalling the package but deleting or editing the apt source file makes the installation inconsistent.

I guess for now I'll just have to delete the unwanted file and leave the installed package inconsistent.

I was following an existing Ubuntu pattern when I generated that package.  I guess I could split the sources.list entries into a second package (trinity-apt-ppa); would that work?

The idea was to eventually alter the installation instructions to download a single "bootstrap" deb file which would then install the sources.list entries, etc. saving the users a couple of manual entry steps.

Splitting the package would make the problem avoidable but I'm not sure of the utility of the new trinity-apt-ppa.

It seems you'd have to manually download the package and install it and I don't see how you'd have keyring protection when doing it.

Personally I find it easier to edit /etc/apt/sources.list but if others prefer the trinity-apt-ppa approach I could certainly live with the split you propose providing that trinity-apt-ppa was not a dependency of any other (non-bootstrap) package.

Thanks!

You wouldn't have keyring protection, but you could at least have https protection from the TDE server.  Right now there is no protection whatsoever on the key download during bootstrap, which is hardly ideal.

I brought up the trinity-apt-ppa package idea as I wasn't sure about it either, but now that I think about it with some changes to the installation process we could have higher security and easier installation.

Packages split off in GIT hash 61508ec (tde-packaging).  The archive package name is trinity-apt-archive.

My suggestion for the new installation process looks something like this:

cd /tmp/

wget https://ppa.quickbuild.pearsoncomputing.net/trinity/trinity-nightly-builds/ubuntu/pool/main/t/trinity-keyring/trinity-keyring_14.0.0-r1-0debian6.0.0+pr7_all.deb

wget https://ppa.quickbuild.pearsoncomputing.net/trinity/trinity-nightly-builds/ubuntu/pool/main/t/trinity-apt-archive/trinity-apt-archive_14.0.0-r1-0debian6.0.0+pr1_all.deb

sudo dpkg -i trinity-keyring_14.0.0-r1-0debian6.0.0+pr7_all.deb trinity-apt-archive_14.0.0-r1-0debian6.0.0+pr1_all.deb

sudo apt-get install kubuntu-default-settings-trinity kubuntu-desktop-trinity

Comments?

Marking SRUONLY as this is fixed for R14.

(In reply to Timothy Pearson from comment #6)
> Comments?

Looks good thanks.  I'll test it as soon as I see the Jessie update in nightly builds.

I started trying to upgrade from v3.5.13 to nighty build (NB) a few days ago (when Jessie i386 NB was incomplete due to rebuilding) so until now my trinity-keyring's /etc/apt/sources.list.d/trinity.list pointed to v3.5.13.

An updated trinity-keyring just came through from NB which changed /etc/apt/sources.list.d/trinity.list to point to NB but did not delete it.

So now I've got "Duplicate sources.list entry" errors when I "apt-get update" because I already had NB in my /etc/apt/sources.list - which is how trinity-keyring came to be updated.

For now I'll just delete the /etc/apt/sources.list.d/trinity.list until a version of trinity-keyring arrives without it.

As per comment 7, this is fixed in R14.

Verified fixed in or before 4:14.0.4-0debian9.0.0+0~a.