Bug#886745: apt: sources.list option to fetch InRelease by specified hash

[Colin Watson <cjwatson@debian.org>]

Package: apt
Version: 1.6~alpha6
Severity: wishlist

We've been looking at ways to make our image building more reliable
across publisher runs (Launchpad in our case).  Conceptually, we'd like
to be able to build images from a snapshot of the archive, so that we
can schedule several image builds at the same time and they'll all be
constructed based on the same view of the archive even if the builds are
dispatched at slightly different times.  However, we don't really have
an archive snapshotting facility at the moment, and putting that
together just for this would be quite resource-intensive.

A much less resource-intensive option would be a sources.list option
that tweaks the path to the InRelease file within the suite to be a
by-hash path.  For example, we might do something like this:

  deb [inrelease-by-hash=$sha256sum] http://...

Or this:

  deb [inrelease-path=by-hash/SHA256/$sha256sum] http://...

With this, and the corresponding publisher changes to store InRelease
files in by-hash with some suitable stay of execution, then all we'd
need to do would be adjust the sources.list that's dispatched to the
builder, and as long as all the builds in question started within some
reasonable time then they'd all build with the exact same view of the
archive even if there's a little bit of skew in exactly when they start.
It would be like a cheaper version of snapshot that's limited to the
time that index files hang around in by-hash.

I think this is probably just a matter of a few tweaks around
constructMetaIndexURI and friends.  If you think this makes sense, I
could deal with extending the Launchpad publisher to save InRelease
files in by-hash.

Thanks,

-- 
Colin Watson                                       [cjwatson@debian.org]