Bug#848194: Want way to get Release (or InRelease) file from cache

[Colin Watson <cjwatson@debian.org>]

Hi,

I don't know if it helps or hinders this bug since I have rather
different reasons from Ian, but I found myself looking at this bug today
because I also wanted a way to get hold of an [In]Release file.  The
difference is that I'm not trying to get hold of it for a particular
package, but for (roughly) a sources.list entry; but all my other
requirements seem basically the same as Ian's.  My use case is as
follows, and you can tell me if it's too different to include in the
same report:

 * In order to be able to implement an "import the contents of this
   repository into our database" task in debusine
   (https://freexian-team.pages.debian.net/debusine/), I want to
   discover which architectures are supported by a given suite in a
   repository, assuming that it has at least a Release file.  And of
   course then I want to be able to fetch all the files, but at least
   that part isn't so hard.

 * If you already know which architectures you want, then this is easy.
   But if you want to ask the repository which architectures it
   supports, as far as I know the only sensible way is to consult the
   Release file.

 * Acquiring and verifying Release files correctly is, as I'm sure you
   know, challenging.  I would like to avoid writing my own code to call
   gpgv in just the right way (again).  I've been here before with
   #918304.

 * I'd hoped to use python-debian, but its GPG verification support is
   currently not as good as it should be (#710923) and in any case what
   you get from its Release file handling is not very helpful
   (#1067160).

 * So I looked at apt/python-apt.  I know how to instantiate a temporary
   apt cache with its own configuration (in the manner of chdist(1), for
   instance), and if I could discover the available architectures after
   an initial fetch then I could call "apt-get update" a second time
   with APT::Architectures set and then I'd have everything.  However,
   given a cache, I seem to be able to access basically everything
   _except_ for the Release file in documented ways.  As mentioned in
   this bug, "apt-get indextargets" omits the Release file.

For now, I'll probably dodge the problem by requiring the user to
specify which architectures they want, and then I don't need the Release
file.  But I feel like I'm missing something.

Thanks,

-- 
Colin Watson (he/him)                              [cjwatson@debian.org]