Images contain out-of-date packages
Metadata
Current evaluation
Enhancement to update packages in base images. The dist-upgrade at image setup time suggested by sergiusens has been implemented in craft-providers.
Suggested action: close stale
Reason: The enhancement has been implemented: craft_providers/bases/ubuntu.py now runs 'apt-get -y dist-upgrade' at image setup time (commit 38e304f, PR #814). The issue is no longer relevant as the requested feature is in place.
Impact:
60
Quick Win:
48.0
Staleness:
70
Complexity:
20
Confidence:
85
Support Request:
0
Issue body
### What needs to get done
Possible solutions:
- Call `apt upgrade` or `apt dist-upgrade` when setting up base images
- Request new images regularly or in an automated fashion
- Use the `daily` images
We may need a similar to solution for the `devel` image in multipass: https://github.com/canonical/multipass/blob/d1371f2d313c32bd711a11fecd1e726360a87243/src/daemon/custom_image_host.cpp#L131
### Why it needs to get done
Compared to launchpad builds, Snapcraft builds packages with outdated packages.
Snapcraft uses `buildd` release images that are only created per the [request](https://chat.canonical.com/canonical/pl/zi13n98ahffoubfwpumigjjnnw) of the Multipass or Starcraft teams.
For example, the [jammy buildd image](https://cloud-images.ubuntu.com/buildd/releases/jammy/) was created on 2022-08-30. It comes with openssl `3.0.2-0ubuntu1`. The latest [version](https://packages.ubuntu.com/jammy/openssl) available for jammy is `3.0.2-0ubuntu1.15` and contains patches for over a dozen CVEs.
Source: @simondeziel via https://chat.canonical.com/canonical/pl/syj53kqpjfbg3b1xn9z8u1gtja
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
60
Quick Win:
48.0
Staleness:
70
Complexity:
20
Confidence:
85
Support Request:
0
|
close stale | Enhancement to update packages in base images. The dist-upgrade at image setup time suggested by sergiusens has been implemented in craft-providers. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
75
Complexity:
60
Confidence:
90
Support Request:
5
|
keep open | Tracking outdated packages in Snapcraft base images. Maintainers acknowledge the problem and suggest running dist-upgrade at setup time. Awaiting implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
45
Complexity:
30
Confidence:
85
Support Request:
5
|
keep open | Snapcraft builds use outdated buildd base images with unpatched CVEs. A maintainer suggested running dist-upgrade at setup time and an internal ticket was created. Awaiting implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
65
Complexity:
20
Confidence:
70
Support Request:
0
|
keep open | Snapcraft base images contain outdated packages compared to launchpad builds. Maintainers suggested running dist-upgrade at setup time, but no implementation or follow-up has occurred in over six months. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
craft-providers#814
(confidence 85%)
PR #814 implemented dist-upgrade at image setup time, addressing the core concern of this issue.
Related issues
No related issues found above the similarity threshold.