Does Anduin OS Maintain Its Own APT Repository?

[siyamsec-lab]

Does Anduin OS maintain its own APT repository, or does it primarily use the upstream Debian repositories? I’m curious about how packages and Anduin-specific updates are managed.

[MLuc24]

No custom APT repository — it's upstream Ubuntu only. The build writes sources.list with four lines and nothing else (src/mods/01-apt-source-mod/install.sh, and again for the installed system in 41-target-apt-mirror-mod):

cat << EOF > /etc/apt/sources.list
deb $MIRROR $TARGET_UBUNTU_VERSION main restricted universe multiverse
deb $MIRROR $TARGET_UBUNTU_VERSION-updates main restricted universe multiverse
deb $MIRROR $TARGET_UBUNTU_VERSION-backports main restricted universe multiverse
deb $MIRROR $TARGET_UBUNTU_VERSION-security main restricted universe multiverse
EOF

TARGET_UBUNTU_VERSION is questing and the default mirror is http://archive.ubuntu.com/ubuntu/ (src/args.sh), so apt upgrade on AnduinOS pulls exactly what Ubuntu ships, security updates included.

The Anduin-specific parts aren't packages at all — they're applied to the image at build time by the ~60 scripts under src/mods/ (theming, GNOME extensions, snap removal, branding, and so on). Nothing there installs a .deb from an Anduin server, so there's no channel for them to be updated through apt afterwards.

Distro-level updates go through a separate path instead. The build installs a do_anduinos_upgrade command that fetches a version-specific script from the project's own site:

VERSION=$(grep -oP "VERSION_ID=\"\K\d+\.\d+" /etc/os-release)
URL="https://www.anduinos.com/upgrade/$VERSION"
SCRIPT_CONTENT=$(wget -qO- "$URL")

So in practice: packages are Ubuntu's problem and arrive by apt; the AnduinOS layer moves version to version by running that upgrade script, not by upgrading packages.

[samwhelp]

Based on my current understanding:

@MLuc24 The approach you mentioned is the one used by AnduinOS-1.

AnduinOS-2, however, supplements the standard Ubuntu package repositories with its own repository (https://packages.anduinos.com/).

This is similar to the approach taken by Linux Mint (http://packages.linuxmint.com/).

However, the Debian packages for AnduinOS-2 are generated using Apkg, a tool developed by @Anduin2017.

The source packages is hosted at https://github.com/AiursoftWeb/AnduinOS-Packages.

Apkg is also used to deploy these Debian packages to the repository.

I have a previous record related to this topic:

• #354 - How to add apt sources from AnduinOS

This might help in understanding the concepts in this part.

AnduinOS-2 Released announcements

• #348 - Announcing AnduinOS 2.0 Beta: The Declarative Revolution and the New Era of Distro Engineering
• #356 - AnduinOS 2.0 Released: A Declarative Rebuild of the Linux Desktop
• #385 - AnduinOS 2.0.1
• #389 - AnduinOS Introduces Why AI: An On-Device, Privacy-Focused UNIX AI Tool

[MLuc24]

@samwhelp is right and my answer was wrong. Thanks for the correction.

I read Anduin2017/AnduinOS, whose default branch is 1.4, and reported it as the current state without checking whether that repo is still where AnduinOS is built. It isn't — v2 lives in AiursoftWeb/AnduinOS-2, and that one does have its own repository (args.sh, branch master):

# AnduinOS APT config package name (can also be anduinos-apt-config-dev).
export APT_CONFIG_PACKAGE="anduinos-apt-config"

# APKG server URL for AnduinOS-branded overlay packages (dev: apkg-dev.aiursoft.com).
export APKG_SERVER="https://packages.anduinos.com"

# GPG certificate name on the APKG server (used to download and verify the repo).
# The cert is fetched from: $APKG_SERVER/artifacts/certs/$APKG_CERT_NAME

packages.anduinos.com is live and serves artifacts/anduinos/ alongside artifacts/certs/, and the repo is signed — the cert is fetched from the server and used to verify it.

So the accurate answer to the original question is the opposite of what I gave: v2 supplements upstream Ubuntu with its own signed repository, packages are built and published with Apkg, and apt is wired up by an anduinos-apt-config package rather than by a sources.list written at image build time. What I described — four Ubuntu lines and nothing else — is the 1.x approach.

The Linux Mint comparison is apt: upstream for everything ordinary, own repo for the distro's own packages.

[Anduin2017]

No for AnduinOS 1.
Yes for AnduinOS 2. Yes: https://packages.anduinos.com/

[siyamsec-lab]

Thank you for giving me the answers I am trying to understand the Architecture of the operating system