Default sources.list file has source packages enabled by default

Bug Description

The default sources.list file has source packages enabled by default, this is bad for the average user (especially those on modems) because they are very unlikely to use source packages, however they will still have the download overhead of the packages list.

For most people the deb-src lines could simply be commented out by default.

(Bug reported at the behest of Robert Collins)

Implementing this would probably invalidate bug 301602. See also bug 987264.

Mailing list discussion:
https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2013-May/thread.html#14503
https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2013-July/thread.html#14617

I'm not sure what sets the package lists - I suspect ubuiqity...

I thought this was a very good point when it was raised to me, which is why I encouraged this bug to be filed.

I reported against apt as it was the one package I saw that tried to create a sources.list, but yes, the initial list on Ubuntu probably does come from somewhere else.

I don't agree with changing this. I recognise that there is an extra download cost involved (which I would point out is only something like 30% of the cost of downloading the indices for binary packages), but I think this is offset by our ability to simplify documentation of certain intermediate topics that involve downloading source packages as a result.

Colin, that could be easily circumvented by automatically enabling the source repositories when you first use "apt-get source" or any other program to get a source package. The download cost is pretty high (several mb's each time), especially for people on slow connections. The percentage of people actually using them is probably very low.

'apt-get source' and similar operations typically run as non-root users.
'apt-get update' needs to run as root.

If somebody wants to improve apt somehow, definitely be my guest, but
I'm not going to put the cart before the horse.

If ran as non-root user it could just simply display a message how to enable the source repositories. I think that simple change is well worth the the many mb's of bandwidth saved for millions of users.

Feel free to discuss this with the apt maintainers. However, we plan to
address the bandwidth concerns separately with
https://blueprints.launchpad.net/ubuntu/+spec/rsync-based-deb-downloads,
so I'm not that worried about the bandwidth question at the moment. I
would much rather deliver a system that's as useful as possible out of
the box with no additional configuration, so this option is preferable
to me.

Yeah Colin, but you (and the rest of us) are developers who actually care about the source packages ;)

Regardless, the reality of the situation is that the mirrors themselves are clogged; cutting out Sources.gz from the download list of every user doesn't just save them a 4 megabytes to download, it means that everyone else on the mirror gets their Packages.gz that much quicker. More importantly, this bandwidth and time is saved on that all important first use experience.

Now that we have System->Administration->Software Sources, reenabling the package source repos is very easy, moreso then even installing build-essential.

So, anyway, I suggest commenting it out by default. Small sacrifice for us devs ;)

Actually developers like me who are already familiar with the
distribution aren't my concern; it's all the cases where documentation
says "first go and edit /etc/apt/sources.list, then apt-get source ...".
I feel that an ethically important part of free software is making it
trivial for people to get source code even if they aren't familiar with
the way the particular distribution they're using is put together.
Although I do concede your point that Software Sources makes it easier
than it used to be.

Can we defer this discussion until after zsync (or whatever) is
implemented please? I don't intend to do anything precipitous until
after that anyway.

That does sound reasonable Colin.

As an aside, we might also want to look into the error message apt-get source spews out if you have commented out source lines: if that told you to check software sources then very few people would ever be left scratching their head...

On Thu, Jul 16, 2009 at 11:44:16AM -0000, Scott Ritchie wrote:
> As an aside, we might also want to look into the error message apt-get
> source spews out if you have commented out source lines: if that told
> you to check software sources then very few people would ever be left
> scratching their head...

I agree, that'd be good. Perhaps somebody could file a separate bug
against apt for that? If that were fixed I'd be willing to change the
defaults ...

Note that nowadays we have pull-lp-source, which does the same job as apt-get source, but does not rely on having Deb-Src entries in sources.list.

New discussion started today in 2016 on Ubuntu Development Discussion mailing list:
https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2016-January/016150.html

I disagree.

1) non-root users can fetch source packages with pull-lp-source
2) non-root users can fetch source packages with chdist
3) ubuntu users buy pre-installed IoT, routers, phones, tablets, laptops, desktops, servers, clouds, mainframes
4) For fast majority of ubuntu users, the concept and religion of free software is valuable
5) But most of them do not practice their rights.

Yes, pulling source and rebuilding a package is nice. From commandline, which one needs to know how to use... And to do it probably, one will be doing it in sbuild anyway.

I find it ironic that most of Ubuntu products have sources disabled, including launchpad builders, yet the "default" is enabled by default. In practice, it really only needs to be enabled on developer machines which by definition is always less than the number of installations.

This is the same sort of logic, where "obvious" seems to end up as default. E.g. default ubuntu archive location is ports.ubuntu.com because majority of architectures are hosted there, with amd64 & i386 as an exception. yet in plenty of configs i see default set to archive.ubuntu.com with 5 overrides stating that it should be ports.ubuntu.com. Whilst we provide sources by default, it's an opt-in behavior of an installed machine, which requires an interactive user, with a highly specialized knowledge to perform the operation.

This bug was fixed in the package apt-setup - 1:0.104ubuntu3

---------------
apt-setup (1:0.104ubuntu3) xenial; urgency=high

* Fix apt-setup/enable-source-repositories in security & overlay
generators.
* Set apt-setup/enable-source-repositories default to false. LP: #74747
* For freedom, set apt-setup/enable-source-repositoreis=true. I'm open
to be overruled by a technical board decision.

-- Dimitri John Ledkov <email address hidden> 2016年1月28日 20:40:54 +0000

This bug is fixed with commit d3e803ad to cloud-init on branch master.
To view that commit see the following URL:
https://git.launchpad.net/cloud-init/commit/?id=d3e803ad

This bug was fixed in the package cloud-init - 18.4-5-g6ee8a2c5-0ubuntu1

---------------
cloud-init (18.4-5-g6ee8a2c5-0ubuntu1) cosmic; urgency=medium

* New upstream snapshot.
- tools: Add cloud-id command line utility
- instance-data: Add standard keys platform and subplatform. Refactor ec2.
- net: ignore nics that have "zero" mac address. (LP: #1796917)
- tests: fix apt_configure_primary to be more flexible
- Ubuntu: update sources.list to comment out deb-src entries. (LP: #74747)

-- Chad Smith <email address hidden> 2018年10月09日 16:56:35 -0600

This bug is believed to be fixed in cloud-init in version 18.5. If this is still a problem for you, please make a comment and set the state back to New

Thank you.

Tracked in Github Issues as https://github.com/canonical/cloud-init/issues/2169