update manager notification area icon may be wrong in certain cases

Thanks for your bugreport.

I just tried this on my hardy install and can not reproduce this on a stock install. I had a bunch of secuirty updates, selected only "gnutls" and installed those. After that the icon remained a "security udpates" needed one.

Could you please run:
$ /usr/lib/update-notifier/apt-check
and attach the output? Could you also please attach your /etc/apt/sources.list

i could but right now I've no security updates.
Another thing that maybe I've forgot to add is that I've the proposed repository enabled as you will see from the sources.list. Additionally I've also the winehq repository enabled following winehq instructions
anyway here's what was requested

~$ /usr/lib/update-notifier/apt-check
Reading package lists... Done
Building dependency tree
Reading state information... Done
34;0

I'm going to try this command also the next time i will get security updates and I will be able to reproduce the problem.

strangely the security updates released today (regarding ruby and openssl didn't make the problem come out, i've tried installing one after another and there is still the security icon as expected). At this point i've only to wait for an update in the linux-generic and correlated packages as it happened for sure in that case (check picture).
these were the results of today updates done one by one
~$ /usr/lib/update-notifier/apt-check
Reading package lists... Done
Building dependency tree
Reading state information... Done
37;5~$ /usr/lib/update-notifier/apt-check
Reading package lists... Done
Building dependency tree
Reading state information... Done
36;4~$ /usr/lib/update-notifier/apt-check
Reading package lists... Done
Building dependency tree
Reading state information... Done
33;1~$ /usr/lib/update-notifier/apt-check
Reading package lists... Done
Building dependency tree
Reading state information... Done
33;1

Thanks for this additional information.

I see the bug now too, the trouble here is that if two version of linux are available, it may get confused. I was able to reproduce it with the stock hardy linux-generic installed and the following packages in the archive:
$ rmadion linux-generic
[..]
linux-generic | 2.6.24.18.20 | hardy-security/restricted | amd64, i386
linux-generic | 2.6.24.19.21 | hardy-updates/restricted | amd64, i386

update-manager groks that the version in updates includes the changes of a version in security, but update-notifier does not.

Here is the diff:

=== modified file 'data/apt-check'
--- data/apt-check 2008-01-04 15:30:39 +0000
+++ data/apt-check 2008-06-30 15:43:20 +0000
@@ -29,6 +29,15 @@
     sys.exit(-1)

+def isSecurityUpgrade(ver):
+ " check if the given version is a security update (or masks one) "
+ for (file, index) in ver.FileList:
+ if (file.Archive.endswith("-security") and
+ file.Origin == "Ubuntu"):
+ return True
+ return False
+
+
 # -------------------- main ---------------------

 # be nice
@@ -91,15 +100,25 @@
 security_updates = 0
 for pkg in cache.Packages:
     if depcache.MarkedInstall(pkg) or depcache.MarkedUpgrade(pkg):
+ inst_ver = pkg.CurrentVer
+ cand_ver = depcache.GetCandidateVer(pkg)
         # check if this is really a upgrade or a false positive
         # (workaround for ubuntu #7907)
- if depcache.GetCandidateVer(pkg) != pkg.CurrentVer:
- upgrades = upgrades + 1
- ver = depcache.GetCandidateVer(pkg)
- for (file, index) in ver.FileList:
- if (file.Archive.endswith("-security") and
- file.Origin == "Ubuntu"):
- security_updates += 1
+ if cand_ver != inst_ver:
+ # check for security upgrades
+ upgrades = upgrades + 1
+ if isSecurityUpgrade(cand_ver):
+ security_updates += 1
+ break
+ # now check for security updates that are masked by a
+ # canidate version from another repo (-proposed or -updates)
+ for ver in pkg.VersionList:
+ if (inst_ver and apt_pkg.VersionCompare(ver.VerStr, inst_ver.VerStr) <= 0):
+ #print "skipping '%s' " % ver.VerStr
+ continue
+ if isSecurityUpgrade(ver):
+ security_updates += 1
+ break

 # print the number of upgrades
 if options.show_package_names:

This bug was fixed in the package update-notifier - 0.71

---------------
update-notifier (0.71) intrepid; urgency=low

  * data/apt-check:
    - check for intermediate version when checking if a upgrade
      is security releated or not. its possible that a upgrade
      is available in -security and a newer one in -updates that
      has the security fixes applied as well but shows up in
      update-notifier as a normal update instead of a security
      releated one (LP: #239673)

 -- Michael Vogt <email address hidden> Mon, 30 Jun 2008 17:37:20 +0200

I uploaded a fix (that works for me) to

deb http://ppa.launchpad.net/mvo/ubuntu/ hardy main

Feedback is welcome.

Accepted into -proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

This fix seems to cause the regression: #251494 and should not be moved to -updates until this is investgiated further.

The fix for this issue got added to hardy-updates in update-notifier 0.70.9, but the changelog only referred to the fixed regression bug that the first attempt at fixing this issue introduced. Marking closed.