Re: [bitfolk] 21 critical Exim security issues need addressi…

Top Page

Reply to this message
Author: Adam Spiers
Date:  
To: Andy Smith
CC: users
New-Topics: [bitfolk] Debian mirrors and the apt-cacher (Was Re: 21 critical Exim security issues need addressing)
Subject: Re: [bitfolk] 21 critical Exim security issues need addressing
On Sat, May 08, 2021 at 09:15:46AM +0000, Andy Smith wrote:
>Hi Adam,
>
>On Fri, May 07, 2021 at 11:21:26AM +0100, Adam Spiers wrote:
>>On Fri, May 07, 2021 at 11:06:37AM +0100, Adam Spiers wrote:
>>According to https://tools.bitfolk.com/wiki/Apt-cacher#Available_mirrors
>>I should have been able to prepend apt-cacher.lon.bitfolk.com/debian/
>>but
>>
>>     deb http://apt-cacher.lon.bitfolk.com/debian/deb.debian.org/debian buster-backports main 

>>
>>did not work.
>
>That article doesn't list "deb.debian.org" so what you tried is not
>expected to work.


Ah OK thanks, I missed that.

>If the "available mirrors" bit in the article
>didn't clearly suggest to you what you could put there, could you
>edit it to make it more clear?


I think the wording is clear; the problem is more a case of missing
information which could make it easier for Debian part-timers like me
to figure out the correct combination:

>The reason why "deb.debian.org" isn't in the list is because that
>mirror is a geo-ip thing that redirects to what it thinks is the
>nearest fastly CDN node. It's mainly used for giving out to people
>when you don't know where in the world they are so giving them a
>geographical mirror would not be appropriate. Also for mobile users,
>for example.
>
>Doesn't make a lot of sense for things permanently located in
>London, which is why the default setting is "ftp.uk.debian.org".


OK. IMHO the problem seems to be a combination of the following:

- https://backports.debian.org/Instructions/ only mentions
deb.debian.org, and says nothing about alternative mirrors.

- https://tools.bitfolk.com/wiki/Apt-cacher#Available_mirrors doesn't
mention deb.debian.org, and even though backports.debian.org is
listed, it doesn't explain how to derive a source correctly pointing
to a Bitfolk mirror of backports.

Prior to emailing the list, I tried several combinations of hosts and
paths before giving up and just using deb.debian.org. Even after your
explanation above, I'm unsure how to derive the correct cached source
URL, given that the official backport instructions don't give a source
URL which uses ftp.uk.debian.org or backports.debian.org (or any of
the other mirrors listed in the wiki page). Maybe there's an
underlying assumption that a mirror can be used simply by swapping out
the original host name for the mirror, but even if that's the case I
think it should be documented explicitly because it's not uncommon for
mirrors to be hosted at a different URL path to where they were on the
original host.

I was trying to figure all this out in a rush, so I have to admit I
didn't read the pages as carefully as I would normally want to, and
maybe being in a hurry meant that I missed something obvious. But I
suspect a few small additions in the places I've highlighted (Debian
pages too, not just Bitfolk) would have made things clearer. Hope
that makes sense.

Cheers,
Adam