Pinning, Local Repositories

[Ryan King <rking@panoptic.com>]

I am working on a project where we need to maintain several deployments of
our code.  I want to set up a repostory so we can:
    - Package our main code up as a .deb
    - Package CPAN modules up that don't already have .deb's
    - Force certain versions of packages /not/ to upgrade until we're
      ready.

On apt.example.net, I have:
    ~apt/htdocs/binary/*.deb

On glumble.example.net, I have:
    /etc/apt/sources.list
        deb http://apt.example.net binary/
        # ... normal repo's
    /etc/apt/preferences
        Package: *
        Pin: release o=Example
        Pin-Priority: 900
    apt-cache policy
        # a bunch of 500's, then:
        900 http://apt.example.net binary/ Packages
        release o=Example
        origin apt.example.net

The setup works for the simple cases of when we put a package up that's
newer than the one in the distro's repository, but the pinning seems to
have no effect.  If I upload libfoo-perl.0.deb, it doesn't take
preference over the distro's libfoo-perl.1.deb.

I've tried a bunch of different options with pinning, but I guess I'm to
the point where I give up and ask the experts.  My figurin' is that the
o=Example part is not the right thing to key on.



And while I'm at it, I might as well ask: is there a standard way of doing
authentication and encryption for the local repositories?  Using "https://";
in my sources.list gives:
    E: The method driver /usr/lib/apt/methods/https could not be found
...and I'm pretty sure I have no idea how to do authentication.  Both of
these things kind of go against the spirit of an open-source repository, I
suppose.  Maybe I should just do my own downloading with scp, and then the
solution is fairly complete - assuming I can get those packages to not be
overridden by the distro's packages.

Thanks for your help!
-rjk