Documentation
¶
Overview ¶
Package aptrepo refreshes apt repository indexes.
It parses /etc/apt/sources.list and /etc/apt/sources.list.d/, fetches each source's InRelease (or Release + Release.gpg), verifies the PGP signature against the repo's keyring, then downloads and SHA-256-checks the binary-arch Packages indexes. Output goes to /var/lib/apt/lists/ in apt's own filename layout, so pkg/aptcache reads it directly.
AllowUnverifiedRepos relaxes the missing-trust-anchor case (no key in the source's Signed-By target, no key matched in the default trust paths). A signature that is present but fails to verify is always fatal.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNoTrustAnchor = errors.New("aptrepo: no usable trust anchor for source")
ErrNoTrustAnchor is returned when no usable keyring file can be found for a source, or when the available keys do not include the signing key. The caller decides whether to escalate (strict mode) or fall back to the AllowUnverifiedRepos opt-in.
var ErrUnknownSigner = errors.New("aptrepo: signature made by unknown entity")
ErrUnknownSigner is returned when a signature is present and well-formed but was made by a key not in the trust anchor. This is distinct from a *bad* signature (corrupted data / wrong key material) and is treated the same as ErrNoTrustAnchor for the AllowUnverifiedRepos opt-in: the repo hasn't been trusted yet.
var ErrUnsigned = errors.New("aptrepo: release file is not signed")
ErrUnsigned is returned when the fetched Release / InRelease file contains no signature data at all. The caller decides how to handle it based on AllowUnverifiedRepos.
Functions ¶
func AllowUnverifiedRepos ¶
func AllowUnverifiedRepos() bool
AllowUnverifiedRepos returns the effective opt-in state — the union of the CLI flag and the env var fallback.
func IsVerificationError ¶
IsVerificationError reports whether err is solely a signature verification failure (unknown signer or no trust anchor) rather than a network or I/O error. Callers that have already fetched enough indexes for their purposes can use this to downgrade such errors to warnings instead of aborting.
func SetAllowUnverifiedRepos ¶
func SetAllowUnverifiedRepos(v bool)
SetAllowUnverifiedRepos sets the process-wide opt-in to bypass the Signed-By guard. Wire this from the CLI (e.g. --allow-unverified-repos) before calling Update / GetUpdates. The flag persists for the lifetime of the process.
func Update ¶
Update fetches every (suite, component, arch) combination from every configured apt source, verifies hashes, and writes the indexes to disk.
Returns the number of (source, component, arch) tuples that succeeded and any error encountered. On partial failure (e.g. one mirror down) it returns the count + a non-fatal error.
The Signed-By guard is honoured according to the global opt-in (SetAllowUnverifiedRepos / YAP_ALLOW_UNVERIFIED_REPOS). Callers wanting per-invocation control should use UpdateWithOptions directly.
Types ¶
type Options ¶
type Options struct {
// AllowUnverifiedRepos disables the refusal-on-Signed-By guard. Callers
// running inside CI containers against well-known mirrors over HTTPS
// may opt into this until GPG verification lands. When false, the
// effective value falls back to the process-wide flag set via
// SetAllowUnverifiedRepos or the YAP_ALLOW_UNVERIFIED_REPOS env var.
AllowUnverifiedRepos bool
}
Options controls Update's behaviour. The zero value is the strict default.
Source Files