mirror repository without Release file

[HerrBerg]

I'd like to mirror the debian repository of sonarqube.
With

deb http://downloads.sourceforge.net/project/sonar-pkg/deb binary/

in sources.list apt-get update works fine.

creating a mirror with aptly (v0.9.5) using the command

aptly mirror create -ignore-signatures=true mirror-sonarqube http://downloads.sourceforge.net/project/sonar-pkg/deb binary/

results in an error of receiving the Release file which indeed is not available in this repository.

Is there a way to work around this issue?

[smira]

There has already been some issue around that... this is for flat Debian repositories without Relese. Probably this should be fixed.

[ffrank]

I believe that this is addressed by #434.

[Kepler-Br]

It's been a long time since initial discussion, but the problem seems to persist
In my case I'm trying to mirror https://nvidia.github.io/nvidia-docker/ubuntu18.04/amd64
My command is

aptly -config=/app/aptly.json -keyring=/app/trustedkeys.gpg -architectures="amd64" --with-sources mirror create nvidia-docker-ubuntu18.04-amd64 https://nvidia.github.io/nvidia-docker/ubuntu18.04/amd64 ./

[tplueer]

I'm having the same issue, for example with:
https://artifacts.opensearch.org/releases/bundle/opensearch/2.x
or
https://apt.grafana.com/

Is there any workaround until this gets implemented?

[neolynx]

Hi and thanks for reporting !

Unfortunately no, there is no workaround, the implementation is still broken a bit :(
But I started working on a fix: #1308 :)

[neolynx]

A fix was merged to master, could you give it a try ?

on a side note, both repos are actually signed, and it is highly recommended to verify signatures, which can be done as follows:

opensearch

curl -fsSL https://artifacts.opensearch.org/publickeys/opensearch.pgp | gpg --import --no-default-keyring --keyring=trustedkeys.gpg
aptly mirror create opensearch https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt stable

grafana

curl -fsSL https://apt.grafana.com/gpg.key | gpg --import --no-default-keyring --keyring=trustedkeys.gpg
aptly mirror create grafana https://apt.grafana.com stable

[tplueer]

Hi,

it looks like the root cause of my problem was somewhere else. After I created the mirrors with your commands, it worked with aptly 1.5.0

I was using the aptly API to create the mirrors and I think missed the Distribution which needed to be set to stable, that resulted in the following errors, so I thought that just the Release file was missing ...

Error #01: unable to fetch mirror: HTTP code 404 while fetching https://apt.grafana.com/Release
Error #01: unable to fetch mirror: HTTP code 403 while fetching https://artifacts.opensearch.org/releases/bundle/opensearch/2.x/apt/Release

Thanks for your help though!

[neolynx]

so, did it work now, with signature verification ?

if you need to not verify the signatures that will require the latest nightly build...