[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: [OT?] debmirror does not add index files



* Reinhard Tartler <siretart@tauware.de> [060524 15:21]:
> Goswin von Brederlow wrote:
> > Try using http. Or try reprepro instead. I'm considering orphaning
> > debmirror in favour of reprepro.
> 
> does reprepro support 'real' mirroring of Packages/Sources file
> preserving signatures from the upstream mirror? From what I see it does
> not.

It does not and most likely will not. One of my motives of writing
reprepro was placing files into a consistent pool/ directory and
supporting arbitrary combinations or subset of package indicies
(i.e. Packages/Sources files).

Since the pre-pool files have been moved into the pool reprepro and
dak seem to agree about the path names of the files an thus it can
happen that the Packages files it generated are the same like the
one it updates from. But that is pure coincidence and there is no
way to ensure it, so the signatures cannot be used to verify it.

Reprepro has it place where you have either a subset (like only the
packages you want to install, and the computer just install everything
possible with some little scripts) or merge (like stable+security-updates),
or when you have distributions you mirror and collections of local
packages (or local packages added to an mirrored distribution, though
that gets a bit messy over time so I do not recommend it). In all that
cases there are at least some parts you have to sign yourself anyway if
you want to verify, so signing all with one key and checking only that in
the clients is the easiest solution anyway.

For a real pure 1:1 some-index-files mirror it is the wrong tool and
as I said earlier in this mail slowly getting a big too long is unlikely
to ever become the right tool for it, unless someone comes up with ideas
I never dreamed of. I'd really like to see some other program available
doing that different job, as different tools for different jobs tend to
get their jobs done better.

Hochachtungsvoll,
  Bernhard R. Link

-- 
Sendmail is like emacs: A nice operating system, but missing
an editor and a MTA.



Reply to: