On Wed, 2026-10-07 at 12:38 +0200, Johannes Schauer Marin Rodrigues wrote: > Hi, > > Quoting Benjamin Drung (2026-06-25 11:10:37) > > I thought about it. We should handle security.ubuntu.com separately. It > > might > > be useful to use resolute-security from the mirror that you specified and > > have security.ubuntu.com as fallback. So > > > > ``` > > mmdebstrap --suites="%s %s-updates %s-security" resolute resolute.tar > > http://my.mirror.example/ubuntu > > ``` > > > > would create: > > > > ``` > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > http://my.mirror.example/ubuntu resolute main > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > http://my.mirror.example/ubuntu resolute-updates main > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > http://my.mirror.example/ubuntu resolute-security main > > deb [signed-by="/usr/share/keyrings/ubuntu-archive-keyring.gpg"] > > http://security.ubuntu.com/ubuntu resolute-security main > > ``` > > > > What do you think? > > is the main purpose of the --suites option with %s placeholders you propose to > add security mirrors?
No. This request is unrelated to the security mirror. The purpose is to ease selecting what to use. I have these use cases: * Build an Ubuntu chroot that is equivalent to the Ubuntu builders for normal uploads, i.e. have --suites="%s %s-updates %s-proposed" plus the security pocket. * Build an Ubuntu chroot for security builds, i.e. have --suites="%s" plus the security pocket. Sometimes it's useful to test with the updates pocket enabled, but the proposed pocket disabled. And some might want to add the backports pocket. To reduce the load on http://security.ubuntu.com/ubuntu/ I want to have the security pocket served by http://security.ubuntu.com/ubuntu/ but also from my local mirror. > If mmdebstrap would automatically add security and updates suites for a Ubuntu > stable release, which use-case for the --suites option would remain and would > the remaining use-case warrant a new option? Always adding the updates pocket is not always what users might want. My proposal would be to make the pockets configurable and always add the security mirror. So for the modern deb822 format it would be this: ``` Types: deb URIs: $mirror Suites: $suites Components: $components Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg Types: deb URIs: http://security.ubuntu.com/ubuntu/ Suites: ${series}-security Components: $components Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg ``` -- Benjamin Drung Debian & Ubuntu Developer
