Jugmac00 on Launchpad Blog

Protect your Launchpad API tokens with a security key

Jürgen Gmach — Mon, 19 Oct 2026 20:40:02 +0000

Supply-chain attacks that harvest developer credentials are on the rise. The Shai-Hulud campaign, for example, used automated scanners to sweep up any secrets they could find in files and keyrings. If you use Launchpad’s API, one of those secrets is your API token – and until now it has been about as safe as the laptop it sits on.

Launchpad now supports hardware-bound API tokens: you can tie your API access to a USB FIDO2 security key, such as a YubiKey, so that a stolen token is useless to an attacker who does not have your physical key.

The problem

Tools like lp-shell and ubuntu-archive-tools use the launchpadlib library to talk to Launchpad. After you log in, launchpadlib stores your OAuth token – either as a plaintext file on disk or in your desktop keyring. The keyring is unlocked when you log in to your session, so to anything running as you, or to malware that can read your files, that token is effectively plaintext.

For most people that is an acceptable risk. For core developers, stable release update team members, archive administrators, and Launchpad developers who run a lot of unaudited code, it is a tempting target.

The idea

Hardware-bound API tokens change what gets stored. Instead of a usable token, launchpadlib stores a long-lived OAuth refresh grant that is useless on its own. To do anything with it, launchpadlib has to ask your security key to sign a challenge from Launchpad, which mints a short-lived access token for the actual API calls.

The stored grant cannot mint a token without the key. So if an attacker copies your grant, they get nothing – the signing happens on a device they do not have.

How it works

Once you have registered a key and issued a grant, logging in looks like this:

launchpadlib loads your stored refresh grant.
It asks Launchpad for a challenge.
Your security key signs the challenge (you touch the key, and enter its PIN if it has one).
Launchpad verifies the signature against your registered key and returns a short-lived access token.
launchpadlib uses that token for API calls until it is close to expiry, then you need to touch your hardware key to renew.

The signing step is a standard WebAuthn assertion – the same mechanism browsers use for passkeys – so it builds on a well-tested security model.

Keeping it usable

Security that gets in the way does not get used, so the design keeps everyday work smooth:

A minted access token is reused until it is nearly expired, so you are not touching your key on every command.
Long-running scripts keep working; the token is renewed as needed.
The grant is stored in your keyring by default, or in a file you control if you prefer.

What it protects – and what it doesn’t

Being honest about the boundaries matters:

Opportunistic theft of stored credentials – the main thing this defends against. A scanner that grabs your grant gets something it cannot use.
Targeted attacks on your user session – if an attacker can already run code as you, they could still capture a freshly minted access token. Reducing that exposure is future work.
Root-level compromise – out of scope. If an attacker owns the machine, no client-side measure fully protects you.

This is also specifically about programmatic access through launchpadlib, not logging in to the Launchpad website, and it is not intended for automation or bot accounts.

Try it

You will need a USB FIDO2 security key and launchpadlib with the fido2 extra:

pip install 'launchpadlib[fido2]'

Then register your key, issue a grant, and log in with it. The step-by-step instructions are in the Launchpad documentation’s how-to, Use hardware-bound API tokens, with the design and protocol covered in the developer docs.

We would love your feedback as you start using it! feedback@launchpad.net

Phasing out Bazaar code hosting

Jürgen Gmach — Fri, 06 Jun 2025 09:26:22 +0000

What is Bazaar code hosting?

Bazaar is a distributed revision control system, originally developed by Canonical. It provides similar functionality compared to the now dominant Git.

Bazaar code hosting is an offering from Launchpad to both provide a Bazaar backend for hosting code, but also a web frontend for browsing the code. The frontend is provided by the Loggerhead application on Launchpad.

Sunsetting Bazaar

Bazaar passed its peak a decade ago. Breezy is a fork of Bazaar that has kept a form of Bazaar alive, but the last release of Bazaar was in 2016. Since then the impact has declined, and there are modern replacements like Git.

Just keeping Bazaar running requires a non-trivial amount of development, operations time, and infrastructure resources - all of which could be better used elsewhere.

Launchpad will now begin the process of discontinuing support for Bazaar.

Timelines

We are aware that the migration of the repositories and updating workflows will take some time, that is why we planned sunsetting in two phases.

Phase 1

Loggerhead, the web frontend, which is used to browse the code in a web browser, will be shut down imminently. Analyzing access logs showed that there are hardly any more requests from legit users, but almost the entire traffic comes from scrapers and other abusers. Sunsetting Loggerhead will not affect the ability to pull, push and merge changes.

Phase 2

Updated timeline

From December 11th, 2025 (was September 1st in the first announcement), we do not intend to have Bazaar, the code hosting backend, any more. Users need to migrate all repositories from Bazaar to Git between now and this deadline.

Migration paths

The following blog post describes all the necessary steps on how to convert a Bazaar repository hosted on Launchpad to Git.

Migrate a Repository From Bazaar to Git

Call for action

Our users are extremely important to us. Ubuntu, for instance, has a long history of Bazaar usage, and we will need to work with the Ubuntu Engineering team to find ways to move forward to remove the reliance on the integration with Bazaar for the development of Ubuntu. If you are also using Bazaar and you have a special use case, or you do not see a clear way forward, please reach out to us to discuss your use case and how we can help you.

You can reach us in #launchpad:ubuntu.com on Matrix, or submit a question or send us an e-mail via feedback@launchpad.net.

It is also recommended to join the ongoing discussion at https://discourse.ubuntu.com/t/phasing-out-bazaar-code-hosting/62189.

Sunsetting Launchpad's mailing lists

Jürgen Gmach — Thu, 22 May 2025 17:42:38 +0000

What are Launchpad’s mailing lists?

Launchpad’s mailing lists are team-based mailing lists, which means that each team can have one of them. E-mails from Launchpad’s mailing lists contain lists.launchpad.net in their address.

For more information on the topic please see https://documentation.ubuntu.com/launchpad/user/explanation/launchpad-mailing-lists/.

What are they not?

Please note that both lists.canonical.com and lists.ubuntu.com are not managed by Launchpad, but by Canonical Information Systems.

Timeline

Launchpad will no longer offer mailing lists as of the end of October 2025, which aligns with the end of the 25.10 cycle.

Migration paths

Depending on your use case, there are different alternatives available.

For a couple of years now, discourse has become a viable alternative for most scenarios. Launchpad also offers the Answers feature for discussions. If it is not so much about communication, but more about receiving information, e.g. for updates on a bug report, you should be aware that you can also subscribe teams to bugs.

Call for action

We are aware that your use case may be very different from the above listed ones. If you are using Launchpad’s mailing lists today and you do not see a clear way forward, please reach out to us to discuss your use case and how we can help you.

Please contact us on Matrix (#launchpad:ubuntu.com) or drop as a message via feedback@launchpad.net.

Please note that this is still work in progress, and we will provide more information over the upcoming weeks and months.

Make your first open source contribution

Jürgen Gmach — Tue, 29 Apr 2025 15:00:22 +0000

Launchpad and the Open Documentation Academy Live in Málaga

Launchpad is a web-based platform to support collaborative software development for open source projects. It offers a comprehensive suite of tools including bug tracking, code hosting , translation management, and package building

Launchpad is tightly integrated with the Ubuntu ecosystem, serving as a central hub for Ubuntu development and community contributions. Its features are designed to streamline the process of managing, developing, and distributing software in a collaborative environment.

Launchpad aims to foster strong community engagement by providing features that support collaboration, community management, and user participation, positioning itself as a central hub for open source communities.

Canonical’s Open Documentation Academy is a collaboration between Canonical’s documentation team and open source newcomers, experts, and those in-between, to help us all improve documentation, become better writers, and better open source contributors.

A key aim of the project is to set the standard for inclusive and welcoming collaboration while providing real value for both the contributors and the projects involved in the programme.

Join us at OpenSouthCode in Málaga

Launchpad and the Open Documentation Academy will join forces at OpenSouthCode 2025 in the wonderful city of Málaga, Spain, on June 20 - 21 2025.

The Open Documentation Academy will have a hands-on documentation workshop at the conference, where the participants will learn how to do meaningful open source contributions with the help of the Diátaxis documentation framework.

Launchpad’s Jürgen Gmach will be on-site and help you to land your first open source contribution.

Please register at https://www.opensouthcode.org/conferences/opensouthcode2025 - the conference and the workshop are free of charge. If you have any questions, please do not hesitate to reach out to us at feedback@launchpad.net.

Tenemos muchas ganas de conoceros. ¡Nos vemos en Málaga!