enable multiple debian repositories - #353
Open
andrewmrich wants to merge 5 commits into
Open
andrewmrich wants to merge 5 commits into
andrewmrich wants to merge 5 commits into
Conversation
A Debian release is served by more than one archive. Security updates live on
a different host than the main archive, so a single upstream.debian URL cannot
serve a complete suite set and -security suites are unreachable.
Add upstream.debian_repositories, a name-to-URL map served at /debian/{name}/,
modelled on upstream.apk. The field is additive: upstream.debian keeps serving
/debian/pool/... and /debian/dists/... with unchanged cache identities, so
existing deployments and their warm caches are unaffected, and the scalar
field and PROXY_UPSTREAM_DEBIAN are untouched.
Named repositories scope both caches by name, since the same filename can hold
different bytes in different archives. Metadata keys are hashed over name,
upstream URL, and path, as APKHandler does. Names are validated through
validateNamedUpstreams, and "pool" and "dists" are refused because they would
shadow the main archive's own paths.
An unconfigured first path segment stays a main-archive path rather than
returning 404 as the APK handler does: the main archive is unnamed and serves
paths of its own at the root.
The motivation for separate archives was repeated across six files and the reserved-name rationale across five. Keep each in one place -- the reference docs -- and leave the code comments to what an informed reader cannot get from the code: why an unknown first segment is not a 404 as it is for APK, and why the main archive keeps its legacy cache identities. Comments and prose only; no behaviour change.
andrewmrich
force-pushed
the
arich/debian-repositories
branch
from
September 16, 2026 17:23
3569ec5 to
658664a
Compare
A request to /debian/{name}/ for a name that is not configured fell through
to the main archive, so a typo surfaced as the upstream's own HTML 404 with
no mention of the repository. The reply now names the unknown repository and
lists the configured ones.
Scoped to {name}/dists/ and {name}/pool/. The main archive serves README,
indices/ and project/ at its root, so an unknown first segment stays a
main-archive path everywhere else.
apt prints only the status line, so this is visible via curl or the proxy
log rather than in apt output.
andrewmrich
marked this pull request as ready for review
September 19, 2026 00:32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
upstream.debianis a single URL, but a Debian release is served by more than one archive. Security updates ship fromhttps://security.debian.org/debian-security, a different host from the main archive. So a client pointed at the proxy can't write a completesources.list, andtrixie-securityis unreachable.This adds
upstream.debian_repositories, a name-to-URL map served at/debian/{name}/, matching the existingupstream.apk:/debian/pool/and/debian/dists/still addressupstream.debianwith unchanged cache identities, andTestDebianHandler_LegacyCacheKeysUnchangedpins those literals, so existing deployments keep their warm caches. Config load refusespoolanddistsas repository names, since either would shadow the main archive's own root path.#56 proposed a hardcoded
debian-securityroute. A map covers that case and others with it, which is what I ran:apt-get updateand installs through this branch from adebian:bookworm-slimclient, againstdeb.debian.org,security.debian.org,cli.github.com/packages, and asnapshot.debian.orgtimestamp, all configured together. With the main archive and the GitHub CLI repo in onesources.list,apt install ghresolvedghfrom the third-party repo and itsgitdependency from the main archive in one transaction.Testing is arm64 only, and some runs used
trusted=yes, so it didn't exercise signature verification.