Re: apt-get may accept inconsistent data

["Cameron Dale" <camrdale@gmail.com>]

On 5/4/08, Goswin von Brederlow <goswin-v-b@web.de> wrote:
>  But you are right. There is something wrong here that is not squids
>  fault:
>
>  Apt-get should not even send an "If-Modified" query imho. After
>  fetching the Release file is already knows with near certainty if the
>  local file is current or not. It should check the Checksums of the
>  local file and then either keep it or fetch it. Asking
>  If-Modified-Since can only lead to triggering a bug like the squid
>  one.

Having just implemented something like this in my apt-p2p program, I
can tell you that this is definitely possible. But, in doing it I
learned why I think apt does not use this method, which may be some
combination of these issues:

1) apt doesn't store much state between runs, including not storing
the hashes of downloaded files

2) there's no guarantee that a file is unchanged when apt is run again

3) getting an HTTP 304 response may be faster than hashing a 20 MB
file, especially considering that a request may need to be sent after
finding an out of date hash

4) apt downloads compressed Packages files, but only stores the
uncompressed ones

None of these issues are insurmountable of course, but the issue is
more complicated than it at first seems.

Cameron