4 ms·

Yeah the problem is getting to that point. Check out the docs on setting up an apt repo: https://wiki.debian.org/HowToSetupADebianRepository https://wiki.debia

by tdicola 12y ago

Yeah the problem is getting to that point. Check out the docs on setting up an apt repo: https://wiki.debian.org/HowToSetupADebianRepository https://wiki.debian.org/HowToSetupADebianRepository Good luck figuring out the easy way of using reprepro and S3 from that page.

eikenberry 12y ago
Point taken.
geofft 12y ago
The sad part is it's even easier than that, if your goal is hosting like two packages. Stick a bunch of debs in a directory, make sure your default GPG key is reasonable, then run `apt-ftparchive packages . > Packages`, `apt-ftparchive release . > Release`, and `gpg -ab < Release > Release.gpg`. Then toss the whole thing on a web server that supports plain HTTP. Honestly I bet GitHub Pages is good enough. The syntax for sources.list is then "deb http://path/to/your/directory http://path/to/your/directory ./". Users can pick up your key by piping it into "sudo apt-key add -", or they can "sudo apt-key adv --keyserver... --recv-key..." with the usual GPG options (and check the fingerprint the same way). The problem is that most serious users will quickly want tooling to do things like keep track of which versions of which packages are in the archive, not have two versions of the same package, support multiple distros/releases, support separate "test" and "production" areas, etc. And that's where the complexity shows up. (Also why you never see "./" sources.list lines in real life.) But for "Hey, I built these three packages", it's kind of perfect.
- e12e 12y ago
  Let me just remind everyone that wiki.debian.org is, well, a wiki. I'm on a mobile right now, so I trying to consolidate the apt/repo-pages, trimming the obviously (too) old information - and adding a more visible "this is how simple this stuff can be, even with proper gpg-signing, and http support" -- is a little too cumbersome. But I've for a while now been intending to help out a bit -- the wiki is somewhat neglected (compared to, say the excellent arch linux wiki). Mostly I think the Debian wiki is in need of some pretty mundane wiki clean-up: consolidation, simplification and modernization (consentrate on documenting current stable and testing). But more impirtant than me actually doing that, is convincing all of you to update the wiki whenever you encounter errors or missing information! :-) (No affilation with the Debian project other than being a long time user of Debian)
  - geofft 12y ago
    I feel appropriately chastened now. :-) But that page is huge, and apt-ftparchive is in fact listed halfway down, but it's marked as deprecated two places. And the thought of doing general cleanup on that page (which it can use) is a bit more difficult than just adding some docs, as is the thought of arguing about just how deprecated is deprecated. But I will try to make some changes to that page.
  - voltagex_ 12y ago
    Tried to create an account on the wiki, got error 919 and a message to contact the debian-www mailing list. Just hoping the list isn't members only now. If anyone wants to collaborate on fixing that apt page then my email is in my profile. It should only take about an hour to clean up.
    - e12e 12y ago
      I just signed up without any problems. Did you try again?
      - voltagex_ 12y ago
        Yeah, got a reply that indicated I'd been caught in a spam filter (at $EMPLOYER, behind a proxy). All sorted now
- voltagex_ 12y ago
  What do you mean by the GPG key being reasonable?
  - JoshTriplett 12y ago
    Making sure "gpg" with no options does something sane and references the key you want it to reference.
  - geofft 12y ago
    It should exist, and it should be the one you want to use to sign the archive. If not, make another keypair and ... figure out how the GPG command line works. :)

by tdicola 12y ago

eikenberry 12y ago

Point taken.

geofft 12y ago

The sad part is it's even easier than that, if your goal is hosting like two packages. Stick a bunch of debs in a directory, make sure your default GPG key is reasonable, then run `apt-ftparchive packages . > Packages`, `apt-ftparchive release . > Release`, and `gpg -ab < Release > Release.gpg`. Then toss the whole thing on a web server that supports plain HTTP. Honestly I bet GitHub Pages is good enough. The syntax for sources.list is then "deb http://path/to/your/directory http://path/to/your/directory ./". Users can pick up your key by piping it into "sudo apt-key add -", or they can "sudo apt-key adv --keyserver... --recv-key..." with the usual GPG options (and check the fingerprint the same way). The problem is that most serious users will quickly want tooling to do things like keep track of which versions of which packages are in the archive, not have two versions of the same package, support multiple distros/releases, support separate "test" and "production" areas, etc. And that's where the complexity shows up. (Also why you never see "./" sources.list lines in real life.) But for "Hey, I built these three packages", it's kind of perfect.

e12e 12y ago
Let me just remind everyone that wiki.debian.org is, well, a wiki. I'm on a mobile right now, so I trying to consolidate the apt/repo-pages, trimming the obviously (too) old information - and adding a more visible "this is how simple this stuff can be, even with proper gpg-signing, and http support" -- is a little too cumbersome. But I've for a while now been intending to help out a bit -- the wiki is somewhat neglected (compared to, say the excellent arch linux wiki). Mostly I think the Debian wiki is in need of some pretty mundane wiki clean-up: consolidation, simplification and modernization (consentrate on documenting current stable and testing). But more impirtant than me actually doing that, is convincing all of you to update the wiki whenever you encounter errors or missing information! :-) (No affilation with the Debian project other than being a long time user of Debian)
- geofft 12y ago
  I feel appropriately chastened now. :-) But that page is huge, and apt-ftparchive is in fact listed halfway down, but it's marked as deprecated two places. And the thought of doing general cleanup on that page (which it can use) is a bit more difficult than just adding some docs, as is the thought of arguing about just how deprecated is deprecated. But I will try to make some changes to that page.
- voltagex_ 12y ago
  Tried to create an account on the wiki, got error 919 and a message to contact the debian-www mailing list. Just hoping the list isn't members only now. If anyone wants to collaborate on fixing that apt page then my email is in my profile. It should only take about an hour to clean up.
  - e12e 12y ago
    I just signed up without any problems. Did you try again?
    - voltagex_ 12y ago
      Yeah, got a reply that indicated I'd been caught in a spam filter (at $EMPLOYER, behind a proxy). All sorted now
voltagex_ 12y ago
What do you mean by the GPG key being reasonable?
- JoshTriplett 12y ago
  Making sure "gpg" with no options does something sane and references the key you want it to reference.
- geofft 12y ago
  It should exist, and it should be the one you want to use to sign the archive. If not, make another keypair and ... figure out how the GPG command line works. :)