3 ms·
I'm well aware of how traditional "dumb" mirrors work (e.g. ftpsync), and those would indeed just mirror the packages with their incorrect signatures. But for a
by ryukafalz 10y ago
I'm well aware of how traditional "dumb" mirrors work (e.g. ftpsync), and those would indeed just mirror the packages with their incorrect signatures. But for an internal network, surely you'd want something more like aptly[0] so you can roll back to a working version?
[0] https://www.aptly.info/doc/overview/ https://www.aptly.info/doc/overview/
- user5994461 10y agoaptly 1.0.0 => released on 27 march, that's exactly 1 month ago. First commit done in 2014. It's funny how people always mention workarounds that were non existent or non viable at the time of the issue. ;) I have worked on mirrors a few times in my career. I am sadly well aware than even the best mirroring solutions are rather poor. Not gonna argue that they have flaws. Not gonna argue that we wish for better.
- ryukafalz 10y agoI suspect it was usable long before the 1.0 release - v0.1 from 2014 appears to have had repo snapshot support: https://github.com/smira/aptly/tree/3f82edf5d6c50ed6988297a436dfb5eb06754408 https://github.com/smira/aptly/tree/3f82edf5d6c50ed6988297a4... Nonetheless, it probably wasn't nearly as stable, and certainly wasn't as well-known then. So I'll concede that it may not have been viable at that point.
- user5994461 10y agoHonestly, it's reasonable to live with an apt outage one day a year. Any workaround that adds critical components in the distribution chain is guaranteed to make it worse. The Docker crypto fuckup was quite peculiar. The distribution pipeline can't handle that. It also broke their other repos (including ubuntu) and propagated to the mirrors.