Latest revision as of 04:59, 21 June 2011

We now have our own apt repository on hephaestus. We don't mirror the entire Debian repo; we just have our own packages. Cfengine places the appropriate line in sources.list on each machine.

It has packages under distribution "lenny" or "squeeze" (as appropriate), section "main". The origin is set to UGCS for easy pinning (use a line like "Pin: release o=UGCS"). Use

deb http://apt.ugcs.caltech.edu/debian lenny main

to use our packages on your system.

Signatures

The archive is signed with the key apt@ugcs.caltech.edu; you can get it from a keyserver. Its key ID is 19BF57EC, and its fingerprint is 5387 F633 29C8 90F5 A185 F392 7DB8 8140 19BF 57EC

Adding Packages

We are using reprepro to maintain the repository. The repository directory is writable by the sysadmin group, so you don't need to use sudo to add a a package. If you built a package correctly (with source and all), you can add it with the following command:

reprepro -Vb /afs/.ugcs/public/apt include lenny package_version.changes

Most packages should be built for both i386 and amd64. On one of the architectures, build with 'dpkg-buildpackge -B' to not include the architecture independent parts (reprepro will complain if you try to upload the same thing twice and it has a different checksum).

You can also include a .deb like:

reprepro -Vb /afs/.ugcs/public/apt includedeb lenny package.deb

After adding a package, you should sign the release file.

cd /afs/.ugcs/public/apt/dists/lenny
GNUPGHOME=/afs/.ugcs/public/apt/conf/gnupg gpg --armor --detach-sign Release
mv Release.asc Release.gpg

The base Release file contains md5's and sha1's of everything else, so it's the only thing you need to sign. Please don't forget to do it- otherwise aptitude will complain about installing packages from untrusted sources.

Toughguy forward

Since debian netboot installer images have difficulty with our weird networking, http://hephaestus/toughguy is a proxy for http://toughguy/public/linux/debian

Apt Repository

Latest revision as of 04:59, 21 June 2011

Signatures

Adding Packages

Toughguy forward

Views

Personal tools

Navigation

Search

Toolbox

@@ Line 1: / Line 1: @@
-It would be really  nice to have our own apt repository to distribute our own packages.  For example, we have customized versions of bacula that need to get to all of the servers.  We could also distribute openafs-modules, etc and save ourselves a bunch of time.
+We now have our own apt repository on hephaestus.  We don't mirror the entire Debian repo; we just have our own packages.  Cfengine places the appropriate line in sources.list on each machine.
-==Implementation==
+It has packages under distribution "lenny" or "squeeze" (as appropriate), section "main".  The origin is set to UGCS for easy pinning (use a line like "Pin: release o=UGCS").  Use
-The beginnings of this are set up on hephaestus.  Ask Matt about its current status.
+  deb http://apt.ugcs.caltech.edu/debian lenny main
+to use our packages on your system.
-==See==
+=Signatures=
-* We would also like a [[Buildserver]], but that's not quite as necessary.
+The archive is signed with the key apt@ugcs.caltech.edu; you can get it from [http://wwwkeys.eu.pgp.net a keyserver].  Its key ID is 19BF57EC, and its fingerprint is 5387 F633 29C8 90F5 A185  F392 7DB8 8140 19BF 57EC
-* See http://www.debian-administration.org/articles/286
-[[Category:Wishlist]]
+=Adding Packages=
+We are using reprepro to maintain the repository.  The repository directory is writable by the sysadmin group, so you don't need to use sudo to add a a package.  If you built a package correctly (with source and all), you can add it with the following command:
+ reprepro -Vb /afs/.ugcs/public/apt include lenny package_version.changes
+Most packages should be built for both i386 and amd64.  On one of the architectures, build with 'dpkg-buildpackge -B' to not include the architecture independent parts (reprepro will complain if you try to upload the same thing twice and it has a different checksum).
+You can also include a .deb like:
+ reprepro -Vb /afs/.ugcs/public/apt includedeb lenny package.deb
+After adding a package, you should sign the release file.
+ cd /afs/.ugcs/public/apt/dists/lenny
+ GNUPGHOME=/afs/.ugcs/public/apt/conf/gnupg gpg --armor --detach-sign Release
+ mv Release.asc Release.gpg
+The base Release file contains md5's and sha1's of everything else, so it's the only thing you need to sign.  Please don't forget to do it- otherwise aptitude will complain about installing packages from untrusted sources.
+=Toughguy forward=
+Since debian netboot installer images have difficulty with our weird networking, http://hephaestus/toughguy is a proxy for http://toughguy/public/linux/debian
+See also:  [[Building_Packages]]
+[[Category:Sysadmin_Documentation]]