Your message dated Sat, 26 Apr 2025 09:19:54 +0200
with message-id <db4786d4-82cb-4201-b74a-736974087...@debian.org>
and subject line Re: Bug#1104093: apt doesn't download dep11 files of a
self-hosted repository
has caused the Debian Bug report #1104093,
regarding apt doesn't download dep11 files of a self-hosted repository
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
1104093: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104093
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: apt
Version: 3.0.0
X-Debbugs-CC: m...@debian.org
I own and manage a self-hosted Debian repository
(https://repo.dawn.org.in/apt). This repository implements the dep11
specification to provide metadata files for the hosted packages. I use
`appstream-generator` for generating the metadata. The appstream files
are stored correctly in the directory named dep11
(dists/stable/main/dep11) as per the specification. The Release and
InRelease files are also updated afterwards to include these files.
However for some reason, apt never fetches the dep11 files from the
repository. I checked the file access permissions on the web-server and
cross checked them by manually accessing the files via `wget`. It seems
that apt doesn't even try to fetch the metadata from the server. To
confirm this, I manually checked /var/lib/apt/lists. There is no
evidence of any appstream data downloaded from the repository. I also
checked /var/lib/swcatalog. appstreamcli does not recognize the app (in
this case, the repository hosts a game called wikilynx
(in.org.dawn.wikilynx)). appstreamcli is able to recognize the app from
Flathub metadata.
I cross checked the directory structure and Release file with Debian
repositories, except for the fact that the repo does not implement
fetch-by-hash method, there is no visible difference in placement of
these dep11 files. I have tested this in several clients and none of
them showed any difference.
Here is a sample `apt update` output on one of my systems.
$ sudo apt update
Get:1 http://deb.debian.org/debian sid InRelease [205 kB]
Get:2 http://deb.debian.org/debian sid/contrib Sources [64.6 kB]
Get:3 http://deb.debian.org/debian sid/main Sources [11.0 MB]
Get:4 https://repository.spotify.com stable InRelease [3,316 B]
Get:5 https://repo.dawn.org.in/apt stable InRelease [8,038 B]
Get:6 https://repository.spotify.com stable/non-free amd64 Packages
[1,643 B]
Get:7 https://repo.dawn.org.in/apt stable/main amd64 Packages [2,984 B]
Get:8 https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs vscodium
InRelease [3,411 B]
Get:9 http://deb.debian.org/debian sid/non-free-firmware Sources [7,192 B]
Get:10 https://paulcarroty.gitlab.io/vscodium-deb-rpm-repo/debs
vscodium/main amd64 Packages [1,208 B]
Get:11 http://deb.debian.org/debian sid/non-free Sources [87.1 kB]
Get:12 http://deb.debian.org/debian sid/main amd64 Packages [10.1 MB]
Get:13 http://deb.debian.org/debian sid/main Translation-en [7,406 kB]
Get:14 http://deb.debian.org/debian sid/main amd64 Components [5,216 kB]
Get:15 http://deb.debian.org/debian sid/main Icons (48x48) [3,759 kB]
Get:16 http://deb.debian.org/debian sid/main Icons (64x64) [7,710 kB]
Get:17 http://deb.debian.org/debian sid/contrib amd64 Packages [67.6 kB]
Get:18 http://deb.debian.org/debian sid/contrib Translation-en [58.3 kB]
Get:19 http://deb.debian.org/debian sid/contrib amd64 Components [39.8 kB]
Get:20 http://deb.debian.org/debian sid/contrib Icons (48x48) [63.5 kB]
Get:21 http://deb.debian.org/debian sid/contrib Icons (64x64) [137 kB]
Get:22 http://deb.debian.org/debian sid/non-free amd64 Packages [132 kB]
Get:23 http://deb.debian.org/debian sid/non-free Translation-en [88.4 kB]
Get:24 http://deb.debian.org/debian sid/non-free amd64 Components [5,264 B]
Get:25 http://deb.debian.org/debian sid/non-free Icons (48x48) [29 B]
Get:26 http://deb.debian.org/debian sid/non-free Icons (64x64) [26.5 kB]
Get:27 http://deb.debian.org/debian sid/non-free-firmware amd64 Packages
[6,984 B]
Get:28 http://deb.debian.org/debian sid/non-free-firmware Translation-en
[4,707 B]
Get:29 http://deb.debian.org/debian sid/non-free-firmware amd64
Components [24.3 kB]
Get:30 http://deb.debian.org/debian sid/non-free-firmware Icons (48x48)
[29 B]
Get:31 http://deb.debian.org/debian sid/non-free-firmware Icons (64x64)
[29 B]
Fetched 46.3 MB in 5s (8,697 kB/s)
All packages are up to date.
$
The repository is configured like this.
sudo sh -c "curl https://repo.dawn.org.in/.keys/dawn-repo.gpg >
/usr/share/keyrings/dawn-repo.gpg"
sudo sh -c "echo deb [signed-by=/usr/share/keyrings/dawn-repo.gpg]
https://repo.dawn.org.in/apt stable main >
/etc/apt/sources.list.d/dawn.list"
For your reference, there is also a web-server to host the html, media
and hints (https://metainfo.dawn.org.in).
I believe apt should fetch the dep11 files from the repository to let
appstream load the downloaded metadata files.
The output given above is from Debian GNU/Linux trixie/sid, kernel
6.12.22-amd64, libc6 2.41-7, apt 3.0.0 and appstream 1.0.5-1.
--- End Message ---
--- Begin Message ---
On April 25, 2025 4:07:31 PM GMT+02:00, Penguin <peng...@dawn.org.in> wrote:
>I cross checked the directory structure and Release file with Debian
>repositories, except for the fact that the repo does not implement
>fetch-by-hash method, there is no visible difference in placement of these
>dep11 files. I have tested this in several clients and none of them showed any
>difference.
The uncompressed files are missing from InRelease as such they are being
ignored.
Hashes for the uncompressed final data must always be included.
Please also note that you inadvertently include hashes for old Release.gpg and
InRelease files in your Release/InRelease files.
--
sent from my phone, excuse the brevity, if any
--- End Message ---
