Comment 5 for bug 789596

I think that a positive formulation of the sentence would be best. It should name only those who are accountable, not parties that are not. If Canonical or MOTUs are not involved, don't name them. People might skip over the little word 'not'.

"Updates for SOFTWARE are provided by VENDOR" does seem the best solution for third-party apps to me. I would name the vendor explicitly, so interested managers can check the company's track record without having to look somewhere else on the overview page.

For the community maintained packages something like "SOFTWARE is made available in Ubuntu by the community. Updates may or may not be provided."

The case of PPAs or unknown third-party repositories is a bit difficult, since you may have overlap with earlier versions in official repositories and you cannot easily refer to the name of the repository. However, we can say that Google's official Chrome repository or that of Dropbox are more thrustworthy than myfunrepo.example.com/ubuntu would be. It would be good to say "Updates for Google Chrome are (may be?) provided by Google." That's a reasonable statement. However, for <myfunrepo.example.com/ubuntu> I'd say something like "SOFTWARE is made available for Ubuntu by a third-party. Updates may be made available."

Furthermore, Canonical will provide updates for Empathy Internet Messaging after October 2012, but in a different release of Ubuntu. Shouldn't that be reflected in the string as well, or would that be too much information?