[Bug 1750625] Re: update misinterprets 304 response on Packages.gz

Mon Apr 20 08:09:59 UTC 2020

I actually tried to add a Release file without signing it, because it
would be simple, only a single command:

  apt-ftparchive release . > Release

But that did not work either. The apt update command exits with error:

root at pipa11:~# apt update
Hit:1 http://mirror.hk.leaseweb.net/ubuntu bionic InRelease
Hit:2 http://mirror.hk.leaseweb.net/ubuntu bionic-updates InRelease                 
Hit:3 http://mirror.hk.leaseweb.net/ubuntu bionic-backports InRelease               
Ign:4 http://XXX/deb  InRelease                                                                                 
Hit:5 http://security.ubuntu.com/ubuntu bionic-security InRelease
Hit:6 http://XXX/deb  Release                       
Ign:7 http://XXX/deb  Release.gpg
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.
W: Skipping acquire of configured file 'Packages' as repository 'http://XXX/deb  InRelease' does not seem to provide it (sources.list entry misspelt?)

This is only a warning, the exit code is 0, but 'apt install' does not
find any packages in the private repo.

The setup seems to be valid, here is the HTTP log:

[20/Apr/2020:09:43:32 +0200] "GET /deb/InRelease HTTP/1.1" 404 442 "-" "Debian APT-HTTP/1.3 (1.6.12)"
[20/Apr/2020:09:43:32 +0200] "GET /deb/Release HTTP/1.1" 200 1111 "-" "Debian APT-HTTP/1.3 (1.6.12)"
[20/Apr/2020:09:43:32 +0200] "GET /deb/Release.gpg HTTP/1.1" 404 442 "-" "Debian APT-HTTP/1.3 (1.6.12)"

apt update actually stores the release file, which seems to be valid:

root at pipa11:~# cat /var/lib/apt/lists/fa_deb_Release 
Date: Mon, 20 Apr 2020 07:42:24 UTC
MD5Sum:
 b531ad26ae3d375d18cb8d8bb2460102             2400 Packages.xz
 b317cbfe3c8f98153ff8b531764dab80               36 Release
SHA1:
 d45be5187c0ee43bb002cee304428f23b889fcc4             2400 Packages.xz
 af287f2a445167dd64b3af88ccfa78f4363dcb29               36 Release
SHA256:
 7466d08346b7986267dd39c3e25359402d40693d2b75f9a9ebd797a9f206c6e2             2400 Packages.xz
 43a8eb775cee00e6ca2b8ffa58d26e08fff7bd52b560a68e82d4c6765879a8b7               36 Release
SHA512:
 0395b40f19e7589682e9d29b5e39b92c3f9a9a88f75770d5ba8417f77b1d4ffb3ff9b9a5a78bd78ecea970e72e19b6744c566fd55fadc11125c547a4a14b5a8a             2400 Packages.xz
 1a8a46da3d3d2c3344d87c37acdbd32888b35b4bde58b6f249db57fb5b016a41b821c701a7a748e34511bc098adb66510603578442145cd3d176d60e8732be5f               36 Release

The Packages.xz file is there and valid (apt update reads and uses it,
if there is no Release file).

My sources file contains trusted=yes:

  deb [trusted=yes lang=none pdiffs=no] http://XXX:/deb/ /

I think it I only guess that it would work if there were a signature file. I think
had problems with it. I do not remember was not sure why Even if my

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to apt in Ubuntu.
https://bugs.launchpad.net/bugs/1750625

Title:
  update misinterprets 304 response on Packages.gz

Status in apt package in Ubuntu:
  Confirmed

Bug description:
  Description:	Ubuntu 16.04.3 LTS
  Release:	16.04

  ii  apt                              1.2.24                                      amd64        commandline package manager
  ii  apt-transport-https              1.2.24                                      amd64        https download transport for APT
  ii  apt-utils                        1.2.24                                      amd64        package management related utility programs
  ii  libapt-inst2.0:amd64             1.2.24                                      amd64        deb package format runtime library
  ii  libapt-pkg5.0:amd64              1.2.24                                      amd64        package management runtime library

  Expected behaviour:

  If apt-get gets a 304 Not Modified when requesting Packages.gz, it
  should ignore the package list (i.e., there's no update).

  Observed behaviour:

  Added a local repository to
  /etc/apt/sources.list.d/instafreight_php.list:

  > deb [arch=amd64 trusted=yes] http://ubuntu/instafreight xenial php

  The first time running apt-get update succeeds; in addition,
  apache.log shows:

  > 10.0.4.72 - - [20/Feb/2018:12:01:39 -0500] "GET
  /instafreight/dists/xenial/php/binary-amd64/Packages.gz HTTP/1.1" 200
  745 "-" "Debian APT-HTTP/1.3 (1.2.24)"

  I am able to install packages from that repo without error.

  Running apt-get a 2nd time succeeds. apache.log doesn't show a request
  for Packages.gz

  Running apt-get a 3rd time, apache.log shows:

  > 10.0.4.72 - - [20/Feb/2018:12:04:45 -0500] "GET
  /instafreight/dists/xenial/php/binary-amd64/Packages.gz HTTP/1.1" 304
  124 "-" "Debian APT-HTTP/1.3 (1.2.24)"

  However, on the console where I ran apt-get, the corresponding output
  is:

  > Err:15 http://ubuntu/instafreight xenial/php amd64 Packages
  >   404  Not Found
  > ...
  > E: Failed to fetch http://ubuntu/instafreight/dists/xenial/php/binary-amd64/Packages.gz  404  Not Found
  > E: Some index files failed to download. They have been ignored, or old ones used instead.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1750625/+subscriptions