Hi, I don't know if it helps or hinders this bug since I have rather different reasons from Ian, but I found myself looking at this bug today because I also wanted a way to get hold of an [In]Release file. The difference is that I'm not trying to get hold of it for a particular package, but for (roughly) a sources.list entry; but all my other requirements seem basically the same as Ian's. My use case is as follows, and you can tell me if it's too different to include in the same report:
* In order to be able to implement an "import the contents of this repository into our database" task in debusine (https://freexian-team.pages.debian.net/debusine/), I want to discover which architectures are supported by a given suite in a repository, assuming that it has at least a Release file. And of course then I want to be able to fetch all the files, but at least that part isn't so hard. * If you already know which architectures you want, then this is easy. But if you want to ask the repository which architectures it supports, as far as I know the only sensible way is to consult the Release file. * Acquiring and verifying Release files correctly is, as I'm sure you know, challenging. I would like to avoid writing my own code to call gpgv in just the right way (again). I've been here before with #918304. * I'd hoped to use python-debian, but its GPG verification support is currently not as good as it should be (#710923) and in any case what you get from its Release file handling is not very helpful (#1067160). * So I looked at apt/python-apt. I know how to instantiate a temporary apt cache with its own configuration (in the manner of chdist(1), for instance), and if I could discover the available architectures after an initial fetch then I could call "apt-get update" a second time with APT::Architectures set and then I'd have everything. However, given a cache, I seem to be able to access basically everything _except_ for the Release file in documented ways. As mentioned in this bug, "apt-get indextargets" omits the Release file. For now, I'll probably dodge the problem by requiring the user to specify which architectures they want, and then I don't need the Release file. But I feel like I'm missing something. Thanks, -- Colin Watson (he/him) [cjwat...@debian.org]
