Re: unsigned repositories

2019-08-15 Thread Thorsten Glaser
>JFTR: aptitude (and all other libapt-based frontends) can make use of >that feature via the config option APT::Sources::With, the commandline >flag is just syntactic sugar. Doesn’t match my use case of repository injection for anything that might call apt later. I could, perhaps, add stuff to ap

Re: unsigned repositories

2019-08-06 Thread Simon McVittie
On Mon, 05 Aug 2019 at 11:25:53 +0100, Simon McVittie wrote: > On Mon, 05 Aug 2019 at 10:09:09 +0200, David Kalnischkies wrote: > > The other thing is repositories without a Release file, which seems to > > be something used (legally) by the same class of repositories only, too. > > [in OBS] anyth

Re: unsigned repositories

2019-08-05 Thread Simon McVittie
On Mon, 05 Aug 2019 at 10:11:07 +0200, David Kalnischkies wrote: > On Mon, Jul 29, 2019 at 08:01:47AM +0100, Simon McVittie wrote: > > sbuild also uses aptitude instead of apt (for its more-backports-friendly > > resolver) in some configurations, and that doesn't have --with-source. > > JFTR: apti

Re: unsigned repositories

2019-08-05 Thread Simon McVittie
On Mon, 05 Aug 2019 at 10:09:09 +0200, David Kalnischkies wrote: > So far all usecases mentioned here seem to be local repositories > though. Nobody seems to be pulling unsigned repositories over the > network [for good reasons]. On CI systems at work, I've often found it to be useful to use [trus

Re: unsigned repositories

2019-08-05 Thread Johannes Schauer
Hi, Quoting David Kalnischkies (2019-08-05 10:09:09) > So far all usecases mentioned here seem to be local repositories though. > Nobody seems to be pulling unsigned repositories over the network [for good > reasons]. So perhaps we can agree on dropping support for unsigned > repositories for ever

Re: unsigned repositories

2019-08-05 Thread David Kalnischkies
On Mon, Jul 29, 2019 at 08:01:47AM +0100, Simon McVittie wrote: > sbuild also uses aptitude instead of apt (for its more-backports-friendly > resolver) in some configurations, and that doesn't have --with-source. JFTR: aptitude (and all other libapt-based frontends) can make use of that feature vi

Re: unsigned repositories

2019-08-05 Thread David Kalnischkies
On Mon, Jul 29, 2019 at 10:53:45AM +0200, Johannes Schauer wrote: > squeeze ended, we finally were able to remove a few hundred lines of code from Julian is hoping that removing support for unsigned repositories would do the same for us with the added benefit that for apt these lines are security

Re: unsigned repositories

2019-07-29 Thread Paul Wise
On Mon, Jul 29, 2019 at 3:02 PM Simon McVittie wrote: > > On Mon, 29 Jul 2019 at 00:17:17 +, Thorsten Glaser wrote: > > echo "deb [trusted=yes] file://$base ./" > > >"/etc/apt/sources.list.d/$this.list" > > sbuild and autopkgtest (and probably other build/CI tools) also rely on > being able to

Re: unsigned repositories

2019-07-29 Thread Johannes Schauer
Hi, with my sbuild-maintainer-hat on I would also like to vehemently argue against apt dropping support for unsigned repositories. Quoting Simon McVittie (2019-07-29 09:01:47) > On Mon, 29 Jul 2019 at 00:17:17 +, Thorsten Glaser wrote: > > echo "deb [trusted=yes] file://$base ./" > > >"/etc/

Re: unsigned repositories

2019-07-29 Thread Simon McVittie
On Mon, 29 Jul 2019 at 00:17:17 +, Thorsten Glaser wrote: > echo "deb [trusted=yes] file://$base ./" >"/etc/apt/sources.list.d/$this.list" sbuild and autopkgtest (and probably other build/CI tools) also rely on being able to inject local packages into a build/test environment using a [trusted=

Re: unsigned repositories

2019-07-28 Thread Thorsten Glaser
I actually have a use case: injecting packages from /var/cache/pbuilder/base.cow-somedist/repo/ into APT from an optional cowbuilder hook script that I can enable (chmod +x) when needed. The hook script has the interesting constraint that it adds a repository to APT with*out* running apt-get updat

Re: unsigned repositories

2019-07-14 Thread Jeremy Stanley
On 2019-07-14 21:23:57 +0200 (+0200), Eduard Bloch wrote: [...] > I am looking at this from the POV of a regular/lazy user. The next best > tool here is apt-ftparchive. Does it help you with signing? No. Does its > manpage even mention InRelease signing in any way? Not really. [...] On that note,

Re: unsigned repositories

2019-07-14 Thread Russ Allbery
Eduard Bloch writes: > I am looking at this from the POV of a regular/lazy user. The next best > tool here is apt-ftparchive. Does it help you with signing? No. Does its > manpage even mention InRelease signing in any way? Not really. For what it's worth, if I were setting up a small personal re

Re: unsigned repositories

2019-07-14 Thread Eduard Bloch
Hallo, * Sam Hartman [Sun, Jul 14 2019, 02:07:55PM]: > > "Eduard" == Eduard Bloch writes: > > Eduard> Hallo, * Sam Hartman [Sun, Jul 14 2019, 08:46:18AM]: > >> > "Julian" == Julian Andres Klode writes: > >> > >> Please carefully consider uses of apt besides the system leve

Re: unsigned repositories

2019-07-14 Thread Sam Hartman
> "Eduard" == Eduard Bloch writes: Eduard> Hallo, * Sam Hartman [Sun, Jul 14 2019, 08:46:18AM]: >> > "Julian" == Julian Andres Klode writes: >> >> Please carefully consider uses of apt besides the system level >> apt running as root installing packages on the system.

Re: unsigned repositories

2019-07-14 Thread Eduard Bloch
Hallo, * Sam Hartman [Sun, Jul 14 2019, 08:46:18AM]: > > "Julian" == Julian Andres Klode writes: > > Please carefully consider uses of apt besides the system level apt > running as root installing packages on the system. > > What about when I use the apt libraries to explore some repository an

Re: unsigned repositories

2019-07-14 Thread Sam Hartman
> "Julian" == Julian Andres Klode writes: Please carefully consider uses of apt besides the system level apt running as root installing packages on the system. What about when I use the apt libraries to explore some repository and parse its packages files etc. Asking people to go set up the