On 9/17/21 2:19 PM, David Galloway wrote: > > > On 9/17/21 5:36 AM, Fabian Grünbichler wrote: >> trimmed CC list a bit to avoid noise, as this is mainly relevant for >> people (re)packaging downstream. >> >> On September 16, 2021 9:48 pm, David Galloway wrote: >>> We're happy to announce the 6th backport release in the Pacific series. >>> We recommend users to update to this release. For a detailed release >>> notes with links & changelog please refer to the official blog entry at >>> https://ceph.io/en/news/blog/2021/v16-2-6-pacific-released >>> >>> [...] >>> >>> * This is the first release built for Debian Bullseye. >>> >>> >>> Getting Ceph >>> ------------ >>> * Git at git://github.com/ceph/ceph.git >>> * Tarball at https://download.ceph.com/tarballs/ceph-16.2.6.tar.gz >>> * Containers at https://hub.docker.com/r/ceph/ceph/tags?name=v16.2.6 >>> * For packages, see https://docs.ceph.com/docs/master/install/get-packages/ >>> * Release git sha1: ee28fb57e47e9f88813e24bbf4c14496ca299d31 >> >> this release seems to have broken the Debian/APT source repository >> functionality: >> >> $ curl http://download.ceph.com/debian-pacific/dists/focal/InRelease | grep Sources >> d41d8cd98f00b204e9800998ecf8427e 0 main/source/Sources >> 7029066c27ac6f5ef18d660d5741979a 20 main/source/Sources.gz >> 4059d198768f9f8dc9372dc1c54bc3c3 14 main/source/Sources.bz2 >> da39a3ee5e6b4b0d3255bfef95601890afd80709 0 main/source/Sources >> 46c6643f07aa7f6bfe7118de926b86defc5087c4 20 main/source/Sources.gz >> 64a543afbb5f4bf728636bdcbbe7a2ed0804adc2 14 main/source/Sources.bz2 >> e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 0 main/source/Sources >> 59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2 20 main/source/Sources.gz >> d3dda84eb03b9738d118eb2be78e246106900493c0ae07819ad60815134a8058 14 main/source/Sources.bz2 >> >> the Sources index file is missing in the repo tree as well (which is >> fine, apt will prefer the compressed one anyway), and the compressed >> Sources.(gz|bz2) indices are compressed empty files. the actual source >> packages are still there (e.g., [1]), but without the chain of >> (In)Release -> Sources -> dsc there is no chain of trust back to the >> signing key (we use this as downstream for repackaging). >> >> compare with the previous release: >> >> $ curl http://download.ceph.com/debian-16.2.5/dists/focal/InRelease | grep Sources >> c02a04313b63b5e2195153e4ce2bbaa9 6889 main/source/Sources >> 8eb9b04f08704fa330810e22323e5186 1868 main/source/Sources.gz >> 5cd6b42c479bbe6739b7fea67fe64b5c 1917 main/source/Sources.bz2 >> 63504d0fd99c9e70fd5c7456913f1dee0cbaa686 6889 main/source/Sources >> 40b063d93261d476641cc4724080176046ceac56 1868 main/source/Sources.gz >> cc332c47541e73b48a1b79bb0277558eda9acf53 1917 main/source/Sources.bz2 >> b4ac5024dacfbfdade25b66cb73ba6a890b6575b39f68a0b1b12b219385439cd 6889 main/source/Sources >> b2357efe3a02f6cb6cb55daa7b56544ae8e49f5e5d34c180f1e1e0f80a882cd1 1868 main/source/Sources.gz >> 5743b96610f62c0e5c6b23b5575c7ba161188a54963bbfb1be4134d872dc3be0 1917 main/source/Sources.bz2 >> >> accessing the 16.2.6 sources using apt is broken as well (with just a >> single 'deb-src' entry pointing at the repo): >> >> $ apt update >> Hit:1 http://download.ceph.com/debian-pacific focal InRelease >> Reading package lists... Done >> >> notice how only the InRelease file is downloaded, the empty Sources file >> is skipped altogether by apt >> >> $ apt-cache showsrc ceph >> E: You must put some 'deb-src' URIs in your sources.list >> >> this error message is of course misleading, the problem is that no local >> Sources indices exist, because apt skipped downloading them in the >> previous `apt update`, since they are not supposed to be empty ;) >> >> I assume this is a bug in your repository software config or the scripts >> used for uploading - in case those are public I'd appreciate a pointer >> and might attempt fixing it myself. > > So the tool we use to store our repos before signing them is called > chacra. I added the Debian bullseye codename to the tool prior to this > recent release. > > https://github.com/ceph/chacra/commit/cc55ed5849be48a679ebc49200a9dc1600a4401a > > We combine all our Ubuntu and Debian repos on the main chacra.ceph.com node. > > Here's the focal repo: > https://chacra.ceph.com/r/ceph/pacific/ee28fb57e47e9f88813e24bbf4c14496ca299d31/ubuntu/focal/flavors/default/dists/ > > Here's the bullseye repo: > https://chacra.ceph.com/r/ceph/pacific/ee28fb57e47e9f88813e24bbf4c14496ca299d31/debian/bullseye/flavors/default/dists/ > > The script I use to pull packages from chacra.ceph.com to the signing > machine is here: > https://github.com/ceph/ceph-build/blob/master/scripts/sync-pull#L15-L25 > > The script just checks all possible combos for whichever repo has the > most packages because that's where they all got combined by the chacra tool. > > So I think the problem we're running into here is ubuntu/focal was the > latest distro combo and was where all the combined repos were going to. > But once debian/bullseye got added, that got reset somehow? Oh, actually, in this particular release, debian/buster is the combined repo where all the packages ended up: https://chacra.ceph.com/r/ceph/pacific/ee28fb57e47e9f88813e24bbf4c14496ca299d31/debian/buster/flavors/default/pool/main/c/ceph/ > > I'm honestly not sure how to rectify this. Does what I explained make > sense to you enough that you could provide some pointers (or better yet, > a PR? :) ) > >> >> the issue affects all the Debian-based repos AFAICT (e.g., bullseye, >> focal, bionic, ...). >> >> 1: http://download.ceph.com/debian-pacific/pool/main/c/ceph/ceph_16.2.6-1focal.dsc) >> >> _______________________________________________ >> Dev mailing list -- dev@xxxxxxx >> To unsubscribe send an email to dev-leave@xxxxxxx >> _______________________________________________ Dev mailing list -- dev@xxxxxxx To unsubscribe send an email to dev-leave@xxxxxxx
