Bug#1110470: apt: Apt downloads InRelease but does not request Package.gz, reports no error

David Kalnischkies <[email protected]> Wed, 6 Aug 2025 09:53:22 +0200

Newsgroups	gmane.linux.debian.apt.devel
Message-ID	<biqtzncicchbzn6a5dgmvnytr4mpzfcnuecmqdrwdkkfn72zr5__11595.8015014016$1754467646$gmane$org@jish7a7adrn4>

Hi,

Julian already wrote the gist, but as I was done with the lengthy
explanation then I saw his reply, here you go – or here you ignore,
at your choice.


Am Tue, Aug 05, 2025 at 11:39:31PM -0700, schrieb Pascal Martin:
>     Architectures: all armhf
[…]
>     SHA256:
>      a9171fbbb7b49c56050b11f1746b470b3de6527989dba506a59461f35439b10a 1996 main/binary-armhf/Packages.gz

See: https://wiki.debian.org/DebianRepository/Format#MD5Sum.2C_SHA1.2C_SHA256

In particular: "If indexes are compressed, checksum data must be provided for
 uncompressed files as well, even if not present on the server."

As to why you don't see apt complain:
https://wiki.debian.org/DebianRepository/Format#Architectures

"Clients should treat a missing entry for an architecture-specific index of a
 supported architecture as if that index file would exist, but is empty."

That you list 'all' here might very well be another issue for your setup that
you haven't encountered yet, detailed in the same section.


If you must write your own server implementation, its a good idea to read at
least that wiki page in its entirety. It might be more efficient to adapt one
of the canopy of existing ones to your needs – although I can't give you a good
suggestion as to which one as I am thoroughly spoiled and did write my own for
testing proposes.


Best regards

David Kalnischkies

signature.asc (application/pgp-signature, 833 B)