Install Ubuntu Pro package slices¶

This guide explains how to fetch and install Ubuntu Pro package slices using Chisel.

Pre-requisites¶

You must have an Ubuntu Pro subscription. See Ubuntu Pro documentation .

Configure archive definitions¶

To fetch and install Pro package slices, you need to define the Pro archives. Chisel uses the archives.<name>.pro field to define a Pro archive and archives.<name>.priority field to specify the priority of multiple archives defined.

# chisel.yaml
format: v1
archives:
  <name-1>:
    pro: <supported-pro-value>
    priority: <value-1>
    ...
  <name-2>:
    pro: <supported-pro-value>
    priority: <value-2>
    ...

The following pro values are supported, and if specified, the archive points to their corresponding base URLs.

`pro` value	Base repository URL
`fips`	https://esm.ubuntu.com/fips/ubuntu
`fips-updates`	https://esm.ubuntu.com/fips-updates/ubuntu
`esm-apps`	https://esm.ubuntu.com/apps/ubuntu
`esm-infra`	https://esm.ubuntu.com/infra/ubuntu

Tip

Although not enforced, the following priority values are suggested when pro is used:

`pro` value	Suggested `priority`
`fips`	20
`fips-updates`	21
`esm-apps`	16
`esm-infra`	15
`""` (empty, indicates a non-Pro archive)	10

Configure archive credentials¶

If the system is using the Pro client and the services are enabled, the credentials will be automatically picked up from /etc/apt/auth.conf.d/. However, you must change the default permissions of the credentials file(s) so that Chisel can read it.

# Enable the service(s) related to the Pro archive(s)
# you want Chisel to fetch Pro packages from.
# This will also generate the esm-infra archive credentials.
sudo pro enable esm-infra

# Provide read access to the user.
sudo setfacl -m u:$USER:r /etc/apt/auth.conf.d/90ubuntu-advantage

# Or, alternatively,
sudo chmod u+r /etc/apt/auth.conf.d/90ubuntu-advantage

The location of the credentials can also be configured using the environment variable CHISEL_AUTH_DIR. If unset, it defaults to /etc/apt/auth.conf.d. Chisel will fail if it does not have read access to the credentials.

Example of `chisel.yaml` with Pro archive definitions¶

The following archive definitions are taken from the chisel.yaml file of ubuntu-20.04 release of the chisel-releases repository .

# chisel.yaml (ubuntu-20.04)
format: v1

archives:
  # archive.ubuntu.com/ubuntu/      (amd64, i386)
  # ports.ubuntu.com/ubuntu-ports/  (other arch)
  ubuntu:
    priority: 10
    version: 20.04
    components: [main, universe]
    suites: [focal, focal-security, focal-updates]
    public-keys: [ubuntu-archive-key-2018]

v2-archives:
  # esm.ubuntu.com/fips/ubuntu/
  ubuntu-fips:
    pro: fips
    priority: 20
    version: 20.04
    components: [main]
    suites: [focal]
    public-keys: [ubuntu-fips-key-v1]

  # esm.ubuntu.com/fips-updates/ubuntu/
  ubuntu-fips-updates:
    pro: fips-updates
    priority: 21
    version: 20.04
    components: [main]
    suites: [focal-updates]
    public-keys: [ubuntu-fips-key-v1]

  # esm.ubuntu.com/apps/ubuntu/
  ubuntu-esm-apps:
    pro: esm-apps
    priority: 16
    version: 20.04
    components: [main]
    suites: [focal-apps-security, focal-apps-updates]
    public-keys: [ubuntu-apps-key]

  # esm.ubuntu.com/infra/ubuntu/
  ubuntu-esm-infra:
    pro: esm-infra
    priority: 15
    version: 20.04
    components: [main]
    suites: [focal-infra-security, focal-infra-updates]
    public-keys: [ubuntu-esm-key-v2]
...

We have the archive credentials in the /etc/apt/auth.conf.d/90ubuntu-advantage file, generated by the Pro client. It looks like the following:

machine esm.ubuntu.com/fips/ubuntu/ login bearer password <REDACTED>
machine esm.ubuntu.com/fips-updates/ubuntu/ login bearer password <REDACTED>
machine esm.ubuntu.com/apps/ubuntu/ login bearer password <REDACTED>
machine esm.ubuntu.com/infra/ubuntu/ login bearer password <REDACTED>

Finally, run Chisel to install the required packages.

~$ chisel cut --release ubuntu-20.04 --root out/ openssl_bins

2025/02/11 15:28:20 Consulting release repository...2025/02/11 15:28:22 Fetching current ubuntu-20.04 release...2025/02/11 15:28:22 Processing ubuntu-20.04 release...2025/02/11 15:28:22 Selecting slices...2025/02/11 15:28:22 Fetching ubuntu-fips fips (pro) 20.04 focal suite details...2025/02/11 15:28:24 Release date: Wed, 06 Mar 2024 16:15:23 UTC2025/02/11 15:28:24 Fetching index for ubuntu-fips fips (pro) 20.04 focal maincomponent...2025/02/11 15:28:25 Fetching ubuntu-fips-updates fips-updates (pro) 20.04focal-updates suite details...2025/02/11 15:28:26 Release date: Mon, 10 Feb 2025 15:20:29 UTC2025/02/11 15:28:26 Fetching index for ubuntu-fips-updates fips-updates (pro)20.04 focal-updates main component...2025/02/11 15:28:28 Fetching ubuntu-esm-apps esm-apps (pro) 20.04focal-apps-security suite details...2025/02/11 15:28:28 Release date: Thu, 06 Feb 2025 01:13:05 UTC2025/02/11 15:28:28 Fetching index for ubuntu-esm-apps esm-apps (pro) 20.04focal-apps-security main component...2025/02/11 15:28:29 Fetching ubuntu-esm-apps esm-apps (pro) 20.04focal-apps-updates suite details...2025/02/11 15:28:29 Release date: Wed, 10 Aug 2022 20:35:13 UTC2025/02/11 15:28:29 Fetching index for ubuntu-esm-apps esm-apps (pro) 20.04focal-apps-updates main component...2025/02/11 15:28:30 Fetching ubuntu-esm-infra esm-infra (pro) 20.04focal-infra-security suite details...2025/02/11 15:28:30 Release date: Tue, 16 Aug 2022 12:06:54 UTC2025/02/11 15:28:30 Fetching index for ubuntu-esm-infra esm-infra (pro) 20.04focal-infra-security main component...2025/02/11 15:28:30 Fetching ubuntu-esm-infra esm-infra (pro) 20.04focal-infra-updates suite details...2025/02/11 15:28:31 Release date: Tue, 16 Aug 2022 12:05:13 UTC2025/02/11 15:28:31 Fetching index for ubuntu-esm-infra esm-infra (pro) 20.04focal-infra-updates main component...2025/02/11 15:28:31 Fetching ubuntu 20.04 focal suite details...2025/02/11 15:28:34 Release date: Thu, 23 Apr 2020 17:33:17 UTC2025/02/11 15:28:34 Fetching index for ubuntu 20.04 focal main component...2025/02/11 15:28:34 Fetching index for ubuntu 20.04 focal universe component...2025/02/11 15:28:35 Fetching ubuntu 20.04 focal-security suite details...2025/02/11 15:28:35 Release date: Tue, 11 Feb 2025 6:22:56 UTC2025/02/11 15:28:35 Fetching index for ubuntu 20.04 focal-security maincomponent...2025/02/11 15:28:37 Fetching index for ubuntu 20.04 focal-security universecomponent...2025/02/11 15:28:38 Fetching ubuntu 20.04 focal-updates suite details...2025/02/11 15:28:39 Release date: Tue, 11 Feb 2025 8:18:37 UTC2025/02/11 15:28:39 Fetching index for ubuntu 20.04 focal-updates maincomponent...2025/02/11 15:28:40 Fetching index for ubuntu 20.04 focal-updates universecomponent...2025/02/11 15:28:41 Fetchingpool/main/g/glibc/libc6_2.31-0ubuntu9.17_amd64.deb...2025/02/11 15:28:43 Fetchingpool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.fips.23_amd64.deb...2025/02/11 15:28:44 Fetchingpool/main/o/openssl/openssl_1.1.1f-1ubuntu2.fips.23_amd64.deb...2025/02/11 15:28:45 Extracting files from package "libc6"...2025/02/11 15:28:52 Extracting files from package "libssl1.1"...2025/02/11 15:28:56 Extracting files from package "openssl"...

Note that the libssl1.1 and openssl packages are fetched from the Pro archives.

Install Ubuntu Pro package slices¶

Pre-requisites¶

Configure archive definitions¶

Configure archive credentials¶

Example of chisel.yaml with Pro archive definitions¶

Example of `chisel.yaml` with Pro archive definitions¶