Bug#879755: debootstrap fails with current sid without apt-transport-https and https URLs

[Philipp Kern <pkern@debian.org>]

On 10/27/2017 9:52 PM, Julian Andres Klode wrote:
> On Fri, Oct 27, 2017 at 09:40:00PM +0200, Philipp Kern wrote:
>> [ +jak +deity ]
>>
>> On 2017-10-25 12:38, Petr Cech wrote:
>>> apt 1.6~alpha removed binary package apt-transport-https and therefor
>>> debootstrap with a https URL fails with dependency error:
>>>
>>> I: Checking component main on https://deb.debian.org/debian...
>>> E: Couldn't find these debs: apt-transport-https
>>>
>>> Following patch fixes it for current sid distribution.
>>>
>>> --- sid.orig    2017-10-25 12:31:16.729013116 +0200
>>> +++ sid 2017-10-25 12:31:29.789138601 +0200
>>> @@ -35,7 +35,7 @@
>>>
>>>         case $MIRRORS in
>>>             https://*)
>>> -               base="$base apt-transport-https ca-certificates"
>>> +               base="$base ca-certificates"
>>>                 ;;
>>>         esac
>>>  }
>>
>> Can we please have a transitional package? I don't think it's particularly
>> helpful to try and patch all debootstraps out there to install properly over
>> https if we can avoid it by having an empty transitional package for now.
> Well, we had one for four months already - and the removal was announced on
> June 27th, even before the alpha launched in experimental. I'm not sure it's
> worth reintroducing it for such an uncommon scenario. And you still have to
> fix it anyway. If I readd and remove it later again somebody else will appear
> and want it back.

I understand that debootstrap needs to be fixed. That's only half of the
point:

Unless we also fix stable and various other distros they won't be able
to debootstrap sid via https. Now I grant that it's possibly not that
common, but given how the web now converges on https everywhere, maybe
it is? (deb.debian.org publicly states that it does https even though
that actually goes through the redirector - and ironically it also still
tells to install apt-transport-https because that's the cross-suite
instruction that's needed on stable.)

So keep it for one release maybe?

The other half of the point is that sid is symlinked to various suites,
so when we fix debootstrap we'd have a script divergence for the coming
release.

Kind regards
Philipp Kern