Re: Bug#992692: general: Use https for {deb,security}.debian.org by default

From	Michael Stone <mstone@debian.org>
Newsgroups	linux.debian.devel
Subject	Re: Bug#992692: general: Use https for {deb,security}.debian.org by default
Date	2021-09-10 21:20 +0200
Message-ID	<CVUe5-kH-1@gated-at.bofh.it> (permalink)
References	(5 earlier) <CVrON-7CM-9@gated-at.bofh.it> <CVrON-7CM-7@gated-at.bofh.it> <CVPR8-63A-5@gated-at.bofh.it> <CVQka-6sC-3@gated-at.bofh.it> <CVT8l-8aG-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Fri, Sep 10, 2021 at 08:02:42PM +0200, David Kalnischkies wrote:
>On Fri, Sep 10, 2021 at 11:08:38AM -0400, Michael Stone wrote:
>> On Fri, Sep 10, 2021 at 04:33:42PM +0200, David Kalnischkies wrote:
>> > On Thu, Sep 09, 2021 at 08:53:21AM -0400, Michael Stone wrote:
>> > > The only thing I could see that would be a net gain would be to generalizes
>> > > sources.list more. Instead of having a user select a specific protocol and
>> > > path, allow the user to just select high-level objects. Make this a new
>> > > pseudo-protocol for backward compatibility, and introduce something like
>> > >   deb apt:// suite component[s]
>> > > so the default could be something like
>> > >   deb apt:// bullseye main
>> > >   deb apt:// bullseye/updates main
>> > > then the actual protocols, servers, and paths could be managed by various
>> > > plugins and overridden by configuration directives in apt.conf.d. For
>> >
>> > In this scheme the Debian bullseye main repo has the same 'URI' as the
>> > Darts bullseye main repo. So, you would need to at least include an
>> > additional unique identifier of the likes of Debian and Darts, but
>> > who is to assign those URNs?
>> > (Currently we are piggybacking on the domain name system for this)
>>
>> I have no idea what darts is, so I don't have an answer. :)
>
>"Darts" was just a play on "bullseye". It is not hard to imagine
>a repository which has the same suite and component(s) but is not
>Debian itself. As a pseudo-random [= its in an other topic here] real
>example you can take Wine (https://dl.winehq.org/wine-builds/debian/).
>So to what is "deb apt:// bullseye main" referring? Debian or Wine?
>
>And to pre-empt the most common response: As an apt dev I can assure you
>that we won't accept a solution involving "I am on Debian, so it means
>Debian" as that is impossible to correctly guess programmatically (for
>example on derivatives using a small overlay repo).

I'd considered adding a scope to the model, e.g., apt://debian.org but 
removed it for simplicity. If that was a desired feature then there'd 
either have to be some sort of well-known path or such a distribution 
would need to provide a policy plugin for that scope. Alternatively, 
they could just use the existing http/https/whatever syntax in 
sources.list for their overlay if they didn't want to bother. Same for 
third party repos. 

>> > > their thing, and a plugin like auto-apt-proxy can override defaults to do
>> > > something more complicated, using more policy-friendly .d configurations
>> > > rather than figuring out a way to rewrite some other package's configuration
>> > > file.
>> >
>> > JFTR: auto-apt-proxy has nothing to do with sources. It is true that
>> > apt-cacher-ng (and perhaps others) have a mode of operation in which you
>> > prefix the URI of your (in that case caching) proxy to the URI of the
>> > actual repo, but that isn't how a proxy usually operates and/or is
>> > configured.
>>
>> I have no idea what you're saying here.
>
>And I have no idea if you know what you are talking about.
>
>auto-apt-proxy already uses an interface apt provides to configure the
>proxy at runtime. It isn't in the business of modifying sources.list nor
>has it any interest in that. So you using it as an example for a plugin
>who could use your proposed scheme to modify the sources at runtime
>makes no sense.

The concern I was responding to was that switching to https breaks the 
case of using auto-apt-proxy to cache the transaction. Just turning the 
proxy on and off isn't sufficient if the default sources.list uses https 
instead of http--you'd currently have to both turn the proxy on *and* 
change sources.list from http to https. Hence my musings on whether it's 
possible/desirable to separate the configuration of what to use as a 
transport from the configuration of what repository is desired.

More generally, if we're talking about changing the default way that 
people interact with debian it just seems like a good time to ponder 
whether specifying sources the same way we did in 1998 makes sense given 
how many changes there have been to expectations about how we use
internet resources. Maybe the answer is yes, and I'm not arguing that 
there has to be a change or that what I threw out as a possibility is 
the right answer, but it does seem worth considering.

Thread

Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@debian.org> - 2021-08-22 15:10 +0200
  Processed: Re: Bug#992692: general: Use https for {deb,security}.debian.org  by default "Debian Bug Tracking System" <owner@bugs.debian.org> - 2021-09-01 11:50 +0200
  Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-01 11:50 +0200
    Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-01 12:00 +0200
      Bug#992692: general: Use https for {deb,security}.debian.org by default Russ Allbery <rra@debian.org> - 2021-09-01 17:00 +0200
        Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-02 04:00 +0200
          Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Roberto C. Sánchez <roberto@debian.org> - 2021-09-02 18:30 +0200
            Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Jeremy Stanley <fungi@yuggoth.org> - 2021-09-02 19:00 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-02 21:40 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-02 23:10 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-03 04:50 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default David Kalnischkies <david@kalnischkies.de> - 2021-09-05 12:40 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-03 13:20 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-03 13:40 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Philipp Kern <pkern@debian.org> - 2021-09-03 13:40 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Hideki Yamane <henrich@iijmio-mail.jp> - 2021-09-04 22:20 +0200
              Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-09 20:10 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-10 02:00 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Simon Richter <sjr@debian.org> - 2021-09-10 17:10 +0200
          Bug#992692: general: Use https for {deb,security}.debian.org by default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 13:20 +0200
            Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 13:40 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 14:00 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-08 15:50 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 16:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Timothy M Butterworth <timothy.m.butterworth@gmail.com> - 2021-09-09 01:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Eduard Bloch <edi@gmx.de> - 2021-09-10 11:30 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-10 12:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 14:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Tim Woodall <debiandevel@woodall.me.uk> - 2021-09-08 14:20 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-08 14:30 +0200
            Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 01:30 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 08:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 14:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 15:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 15:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Timo Röhling <roehling@debian.org> - 2021-09-09 15:30 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-09 15:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 16:40 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 17:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-10 20:10 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 21:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by default Paul Wise <pabs@debian.org> - 2021-09-12 05:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Holger Levsen <holger@layer-acht.org> - 2021-09-13 00:00 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default David Kalnischkies <david@kalnischkies.de> - 2021-09-13 15:10 +0200
              Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Helmut Grohne <helmut@subdivi.de> - 2021-09-10 09:40 +0200
                Bug#992692: general: Use https for {deb,security}.debian.org by default Ansgar <ansgar@43-1.org> - 2021-09-10 10:20 +0200
                Re: Bug#992692: general: Use https for {deb,security}.debian.org by  default Michael Stone <mstone@debian.org> - 2021-09-10 14:10 +0200
                Bug#994409: task-laptop: please recommend automatic apt proxying Phil Morrell <debian@emorrp1.name> - 2021-09-15 19:20 +0200
                Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
                Re: task-laptop: please recommend automatic apt proxying Russ Allbery <rra@debian.org> - 2021-09-15 19:40 +0200
  Bug#992692: next steps Hans-Christoph Steiner <hans@eds.org> - 2021-12-09 12:30 +0100
  Bug#992692: more steps towards this goal Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 10:00 +0200
  Bug#992692: moar Hans-Christoph Steiner <hans@eds.org> - 2022-03-30 12:30 +0200
  Bug#992692: link Geert Stappers <stappers@stappers.nl> - 2022-03-30 12:50 +0200

csiph-web