Vagrant package repo/ppa

[leth]

It'd be great if there were a package repo I could add to my system so that vagrant updates would happen automagically.

Obviously not an urgent requirement ;)
Keep up the good work!

[gwillem]

@mitchellh, what are your reasons for not using an Ubuntu PPA repo? Are you fine if somebody else sets it up and maintains it?

[tmatilai]

Ubuntu PPA is not a perfect choice, as you can't upload only binary packages (.deb) there. Vagrant packages are now made using (the fantastic) fpm which eliminates the need to maintain source package. It would be possible to create a "vagrant-installer" package which just downloads and installs the official vagrant.deb from downloads.vagrantup.com, but it is still extra effort to maintain it.

Also the PPA repo URIs include Ubuntu release code names. As the same package can be installed to all Debian derivatives and versions (well, i386 and amd64 with minimum glibc requirement), this at least seems a bit funny.

For me a better approach would be to have apt.vagrantup.com. One repo that could be used for all Debianoids. As the Vagrant packages are already stored in Amazon S3, the apt repository could be there too. deb-s3 looks like a promising tool for that (/cc @krobertson).

I have only maintained private apt repositories using reprepro, but I'm happy to help building and maintaining official Vagrant apt repo if that helps. Or maybe we can start building an unofficial one and see if it gets promoted later?

[thedrow]

I still think it would make life much easier for Ubuntu users to use a PPA, despite the maintenance effort. There is a pending issue jordansissel/fpm#170 that requests to support PPAs. If someone would contribute a patch that could help progressing this issue forward.

[CarlFK]

I have wallowed around trying to maintain my own PPA, so I appreciate the effort required.

given it doesn't look like the local devs are too interested in wallowing around (and I don't blame them, see above) I think it is best to stop bugging them and put that effort into finding someone proficient in packaging who will at a minimum get a single build up, and then submit the results here.

If such a thing existed now, but was out of date, I would spend a few hours trying to update it. I suspect I am not alone.

to be clear: I am not interested in trying to package it, and I have no idea if will be interested in updating something later when it falls out of date. I am just suggesting a use of efforts given my experience and reading the comments here.

[tmatilai]

I've heard rumors that the situation might be resolved in the future. =)

But in the meanwhile I tested to create a repo with deb-s3. Instructions to use it are here.

The downside is that all the debs need to be copied also there. So I started to over-engineer a setup which only stores the metadata and redirects the package downloads to files.vagrantup.com. The idea is make it totally automatic, so that it fetches tags and refs from the github repo, and metadata from S3. The work-in-progress can be found here. I'll try to get the repo running tonight if DadOps allows. ;)

[naftulikay]

All that really needs to be done for Debian at least is to simply upload
releases to a Launchpad repository, AFAIK. Since you guys are already
packaging the software, it shouldn't be so difficult.
On May 16, 2014 7:30 AM, "Jesús Cerquides" notifications@github.com wrote:

+1

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/12#issuecomment-43337704
.

[juriansluiman]

@rfkrocktk vagrant-installers use fpm on GNU/Linux for packaging. Because Launchpad (main hoster for the PPAs) does not allow to upload .deb files, you have to let them build the package for you. As long as fpm does not support this, it's quite tedious for this repo to build first with fpm and then let Launchpad do it again.

[naftulikay]

Yeah, I get that, Launchpad annoys me terribly.

You might have to do it yourself. I'm not sure about any software available
which makes managing debian repositories easy.

Does anyone else subscribed here know how to simply and easily manage
Debian package repositories?

[thedrow]

What about https://github.com/krobertson/deb-s3?

[rsrchboy]

On Fri, May 16, 2014 at 8:06 AM, rfkrocktk notifications@github.com wrote:

All that really needs to be done for Debian at least is to simply upload
releases to a Launchpad repository, AFAIK. Since you guys are already
packaging the software, it shouldn't be so difficult.

Seriously, the source packaging can just be uploaded, launchpad will do its
thing, and as an advantage the packages will actually be built against the
same level of ubuntu people want to use them against. If something breaks,
well, then it's broken and needs to be addressed.

I suspect that this is not a technical decision so much as an unfortunate
political one.

[tmatilai]

As explained before, there are no source packages. The official deb packages are just packed up with fpm after building all the things.

I have tried to poke both @mitchellh and @bintray to enable the apt repo in bintray.com, but didn't get any answer what it would require.

[rsrchboy]

As explained before, there are no source package.

@tmatilai apologies -- I must have missed that. As someone who has spent way more time building packages than I really care to think about I still find approaches along those lines... tricky for my brain to handle.

I'm certainly willing to host a public S3 repo, assuming the costs aren't atrocious. :) Is there currently any sort of notification system (mailing list, twitter, etc) I could tie into to make sure things are kept current?

[tmatilai]

You can subscribe to the bintray project to get notified when new versions are uploaded.

I already started a project to semi-automatically build only metadata to S3, but that was before bintray hosting. But I could get back to that if bintray can't offer the apt repo directly as they advertice.

[rsrchboy]

Interesting. Looks like bintray provides an API through which package information can be obtained -- even if we had to poll it every hour or two that should work nicely.

Well, there goes my evening :)

[benjaminoakes]

I'm still using Vagrant 1.4.3, just because it's easier to manage. This locks me out of Vagrant Cloud, etc.

I'd love a repo just to get a more modern version of Vagrant, automatically.

[jsteel44]

Use a distribution that packages Vagrant. Arch is one.

[ivan-kolmychek]

@jsteel44 Your suggestion is good, but it does not help Ubuntu-using devs I work with. ;)
I use ArchLinux on both my desktops and it packages latest vagrant indeed. But it still will be awesome to get repos for Debian and Ubuntu too.

[naftulikay]

Stop trolling. You might as well just tell us to compile it ourselves. Of
course we know how to compile it ourselves, but the main concern here is
getting updates consistently. I, for one, don't have time every day to
Google every package I've installed and manually check the version numbers.
Plus, it's nice having PGP signed packages to know authenticity.

On Wed, Oct 1, 2014 at 11:30 AM, Ivan Kolmychek notifications@github.com
wrote:

@jsteel44 https://github.com/jsteel44 Your suggestion is good, but it
does not help Ubuntu-using devs I work with. ;)
I use ArchLinux on both my desktops and it packages latest vagrant indeed.
But it still will be awesome to get repos for Debian and Ubuntu too.

—
Reply to this email directly or view it on GitHub
#12 (comment)
.

[benjaminoakes]

What's required to make this happen? It's been an open issue since 2012, and there seem to be a number of people interested in having it. If one of the Vagrant maintainers could step in to let the community know how we can help make this a reality, I'd guess you'd get a couple of volunteers...

[i-trofimtschuk]

i really don't know what's hindering this.

it's already packaged as a deb, so what's left ist setting up a new location like http://www.vagrantup.com/repo/ or http://repo.vagrantup.com/
and set up a repo using a tool like reprepro https://wiki.debian.org/SettingUpSignedAptRepositoryWithReprepro

then all you have to do for every version is this:

reprepro includedeb <osrelease> <debfile>

[benjaminoakes]

@mitchellh How can the community help with this?

[rmetzler]

@mitchellh https://packagecloud.io/ might be a nice hosted solution

[thedrow]

@hashicorp is already using bintry and they have debian repositories. They just need to set them up.

[hackel]

Time to dump FPM. The reason that Debian packages are so vastly superior to their RPM counterparts is because the packaging is done right, and Debian policy must be strictly adhered to, resulting in reliable, high-quality packages. I don't want to install some random binary-only package that installs things to /opt (a directory which shouldn't even exist!). It feels so amateurish. If you don't want to maintain your own proper packages, that's fine. Let the professional package maintainers for Debian, Ubuntu, etc. do it and give us proper updates in a PPA. Stop releasing your own binaries! There is no reason this should work differently than any other myriad of software packages out there.

[gboddin]

Okay so :

https://gist.github.com/gboddin/d3fa7e386868a0862b81

Apt source line :

deb http://oraw.waro.be/vagrant deb main

Not signed, so you know :)

The mentioned script is ran everyday at midnight, so you get daily updates

regards,

[alexanderadam]

@gboddin cool stuff! 👍

(although an official repo would be ideal of course) 😉

[thedrow]

That's an improvement but still. hashicorp uses bintray which already provides debian repositories.

[gboddin]

Yeah well, considering the amount of +1, let's assume they just don't care about making their product widely available.

That's okay, I just did it to ease the life of the devs working with it, but to me Vagrant is now depcrecated, slow, and not community focused (let's say dead).

Make a proper source code, it'll build wherever you want, the fact that it needs that kind of hacks says it all for me.

Period.

[artem-sidorenko]

In case somebody wants to integrate the new releases api for populating own repos , it works for me like this:

curl -s https://releases.hashicorp.com/vagrant/index.json | jq --raw-output '.versions | to_entries | max_by(.key) | .value.builds | .[] | select(.arch=="x86_64") | select(.os=="debian") | .url '

[daveadams]

Very nice, @artem-sidorenko. I'm looking at other Hashicorp projects and I see that Consul has a release candidate for a future version out, which comes up in your query as the top result. So I added a filter step (the with_entries line) to get rid of anything matching /-rc[0-9]+$. Possibly there's a safer way to match, but in any case:

curl -s https://releases.hashicorp.com/vagrant/index.json \
    | jq --raw-output \
        '.versions
        | with_entries(select(.key | test("-rc[0-9]+$") | not))
        | to_entries
        | max_by(.key)
        | .value.builds[]
        | select(.arch=="x86_64")
        | select(.os=="debian")
        | .url'

[wolfgang42]

@artem-sidorenko Thanks! I've just updated my repo to use the new API.

With this API it also becomes very easy to add other Hashicorp projects to the repository; I've filed wolfgang42/vagrant-deb#3 and will get around to it eventually if someone doesn't beat me to it.

[teohhanhui]

http://vagrant-deb.linestarve.com is currently down... Any reason why HashiCorp wouldn't just provide an official repository?

[wolfgang42]

@teohhanhui http://vagrant-deb.linestarve.com is back up again. My entire web server was down, Apache apparently didn't come back up after an upgrade.

Check @sethvargo's comment above for HashiCorp's reasons for not currently providing a repository.

[pwaring]

Is there anything the community can do to help resolve this issue? The lack of a PPA means that Ubuntu users either have to use an old version of Vagrant (e.g. 1.8.1 doesn't work with Homestead) or download the latest version from the Vagrant website and then have to update manually (there doesn't seem to be an announce list for new versions either so you have to remember to check the downloads page every so often).

[ashkulz]

To co-exist with the existing infrastructure, one possibility is as follows:

• Install reprepro using sudo apt-get install -y reprepro
• Generate signing key using gpg2 (see guide from DigitalOcean which has separate master and signing keys)
• Run the script below with the .deb files in the current directory (need to change the key IDs to values generated in above step).
• transfer the debian/ directory to the CDN.

#!/bin/bash

SIGNING_KEY="12345678"
PUBLIC_KEY="1234567890123456789012345678901234567890"
KEYSERVER="keyserver.ubuntu.com"
REPO_URL="https://releases.hashicorp.com/debian"

rm -fr debian/
mkdir -p debian/conf
echo ask-passphrase > debian/conf/options
cat > debian/conf/distributions <<END
Codename: hashicorp
Components: extra
Architectures: i386 amd64
SignWith: $SIGNING_KEY
END
reprepro -b debian/ includedeb hashicorp *.deb
cat > debian/setup.sh <<END
sudo apt-get install -y apt-transport-https
sudo apt-key adv --keyserver $KEYSERVER --recv $PUBLIC_KEY
echo "deb $REPO_URL hashicorp extra" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update
END
rm -fr debian/conf debian/db

Someone above posted a guide with aptly, but I find reprepro easier to use when you simply have to create a repository from .deb packages generated by fpm. Either way, I do hope some solution gets implemented...

[artem-sidorenko]

@ashkulz you can turn existing debs to apt repository even without any special tools (almost)

The point is that this issue is not on the high-priority list :-(

[wolfgang42]

Coincident (mostly) with the release of Vagrant 2.0, I've completely rewritten the code behind vagrant-deb.linestarve.com. This new version generates the repository directly from the HashiCorp releases page and provides redirects to the actual packages.
This has a number of benefits:

• Package files will be downloaded directly from HashiCorp, alleviating concerns about tampering.
• Increased integrity verification: the SHA256 in the Packages file comes directly from their API, and the signature of the SHA256SUMS file is now checked against the HashiCorp GPG key.
• I can publish every version of Vagrant, not just the ones that fit on my disk.
• I've also enabled HTTP Strict Transport Security on the domain (currently with a low max-age in case something goes wrong).

I've tested these changes fairly thoroughly, but if you have any problems please file an issue or send me an email so I can look into it.

[supersexy]

Still no official repo in 2019? WHY?

[asm0dey]

Because Arch linux rules the world, That's why! To be serious I still don't have nay sane ide why is it so hard to build repo.

[arnt]

FWIW I once worked at a similar company with similar problem, and this task would most likely have fallen to me. The task isn't particularly hard, but it's a thing that needs to be done, and it's a kind of thing where you need expertise in a field quite far from the usual work, or else you'll get hounded by the peanut gallery. You probably will be hounded anyway, because someone will disagree with whatever you do, but if you're not an expert those people will be factually right, and that's a problem.

Hashicorp will have no shortage of other things to do. That's how life is with opensource users.

[ashkulz]

@arnt: is it possible for you to elaborate on what the gotchas can be? I'm in a similar position for a project I maintain.

[arnt]

Making a package repo involves leaving your own code and writing something "in" debian's codebase, based on and using debian's idioms. The documentation isn't too good, as usual. Learning how to do good work in a new codebase takes time.

There may be binary choices where both alternatives have drawbacks. If so, you may assume that one of the issue reporters disagrees with whatever you do and will try to engage you in a long discussion. Deep debian expertise helps with that, but acquiring that expertise also takes a lot of time.

So this is a simple task that may be assumed to take a lot of time.

In my case we had haters. (I have an email from Richard Stallman wishing for my personal bankruptcy.) AFAICT Hashicorp doesn't struggle with that kind of crap, but I don't know you. You (@ashkulz) may have that problem, in which case I feel sorry for you. It's important that the haters aren't factually right. The customers and would-be customers mustn't hear the haters be factually right. Making newbie mistakes is a bad idea.

Further, it's acceptable to do work that benefits the free users and doesn't affect the customers. The customers don't mind that. But if the new repo introduces stability problem for existing customer sites, that's a major problem.

Sorry about this digression. Please send me mail if you want to continue the digression.

[asm0dey]

sidenote: you don't need deep packaging expertise if you're using tools like https://www.aptly.info/

[BassemN]

There is an updated PPA here https://launchpad.net/~tiagohillebrandt/+archive/ubuntu/vagrant

[supersexy]

@BassemN - thank you very much, but this is not "official", is it? I already have a long list of several repos for different projects that start to be abandoned because the positively engaged maintainer will go on with different things, looses interest, whatever. It is really very appreciated that people take on this and do the work of hashicorp, but I still would like to have an official repo maintained by the company that produces this software, signed with a key by that company.

Also I do not want to maintain a repo myself, for same reasons.

[arnt]

@supersexy you could send email to sales@hashicorp.com and ask for a quote, you know. It's a commercial establishment, they'll provide services for pay.

[unicell]

With the introduction of Official HashiCorp Linux Repository, this issue should've been resolved I think?

https://www.hashicorp.com/blog/announcing-the-hashicorp-linux-repository

[BassemN]

@unicell vagrant is not added yet to the HashiCorp Linux Repository

[unicell]

@BassemN Seems readily available already.

$  apt-cache madison vagrant
   vagrant |   2.2.10-4 | https://apt.releases.hashicorp.com focal/main amd64 Packages
   vagrant |      2.2.9 | https://apt.releases.hashicorp.com focal/main amd64 Packages

[BassemN]

@unicell thank you 👍