Migrating From Ubuntu PPA to Real Ubuntu Packages

[Jason A. Donenfeld]

Hi folks,

At long last, Ubuntu now supports WireGuard on releases 20.04, 19.10,
18.04, and 16.04, which means we've got all currently supported LTS
releases covered. For that reason, we're in the process of sunsetting
the PPA that previously provided packages to some users. This email
details possible changes users might consider.

The right way to install WireGuard on Ubuntu now consists of a single
command:

    $ sudo apt install wireguard

This "wireguard" package will *automatically* pull in either one or two
packages with it:

  1) wireguard-tools: this will always be pulled in and provides wg(8)
     and wg-quick(8).
  2) wireguard-dkms: this will only be pulled in if your kernel doesn't
     already come with WireGuard.

As suggested by (2), most Ubuntu kernels now come with WireGuard out of
the box, even older releases, to which WireGuard has been backported.
This is great news and will result in much better reliability during
upgrades, as well as smoother compatibility with SecureBoot. You can
learn if your Ubuntu kernel comes with WireGuard out of the box by
running this command:

zx2c4 at bionicman:~$ dpkg --get-selections | grep -v deinstall | cut -f 1 | grep linux-image | xargs apt-cache show | grep ^Provides: | grep wireguard-modules
Provides: wireguard-modules (= 1.0.20200611-1ubuntu1~18.04.1), zfs-modules (= 0.7.5-1ubuntu16.9)

Or alternatively:

zx2c4 at bionicman:~$ ls -l /lib/modules/$(uname -r)/kernel/wireguard/wireguard.ko
-rw-r--r-- 1 root root 286985 Jul  9 23:13 /lib/modules/4.15.0-112-generic/kernel/wireguard/wireguard.ko

If those messages are *not* printed, then it simply means that your
Ubuntu kernel does not (yet) come with WireGuard out of the box, in
which case, the above "sudo apt install wireguard" command will
*automatically* install wireguard-dkms along with it.

Users should never need to manually install wireguard-tools or
wireguard-dkms. Rather, *only* install the "wireguard" package, and this
will automatically choose the correct additional packages to pull in.

For those who previously used the PPA, if the above commands indicate
that your kernel *does* come with WireGuard, then you'll probably want
to *remove* the wireguard-dkms package if it has not already been
automatically removed:

    $ sudo apt remove wireguard-dkms

As well, all previous users of the PPA may remove it:

   $ sudo add-apt-repository --remove ppa:wireguard/wireguard

>From this point forward, all updates will be handled by Canonical from
the main Ubuntu package repositories. No PPAs are needed.

Hopefully this process should be fairly smooth. Most users have already
had Canonical-blessed WireGuard installed for some time now, so it
should be fairly smooth sailing.

Let me know if you have any questions.

Regards,
Jason

PS: In case you missed the announcement from two weeks ago, we intend
to sunset support for Ubuntu 14.04 in the PPA, and afterwards remove the
PPA itself:
- https://lists.zx2c4.com/pipermail/wireguard/2020-July/005670.html
- https://data.zx2c4.com/sunset-wg-14.04.gif