mirror update lacks a way to continue when package import fails due to missing files

未关闭
  • 哪里不对？
#1,528 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
45/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
go
领域
cli

调研方向

Start by reading the aptly mirror update implementation and tracing what happens when a downloaded package is missing at import time. The issue does not identify specific files or tests, so locate the relevant code and existing mirror-update tests first. Done means one missing package no longer aborts the full update, and the missing package is reported or marked as failed.

由索引模型根据 Issue 内容生成。

描述

Our environment enforces the use of a malware scanner (Microsoft Defender Advanced Threat Protection).

During aptly mirror update, the scanner may immediately delete freshly downloaded .deb files if they are deemed problematic. This happens after the download completes but before aptly imports the file into its pool/db.

When this occurs, aptly aborts the entire mirror update with an error like:

Downloading: http://ch.archive.ubuntu.com/ubuntu/pool/universe/e/ettercap/ettercap-common_0.8.2-10build4_amd64.deb
[...]
ERROR: unable to import file: open /srv/aptly/.aptly/pool/fc/49/6661-493f-4245-b878-5cd1565065daettercap-common_0.8.2-10build4_amd64.deb: no such file or directory

(There are several such packages per distro and pocket)

Minimal reproduction

  1. Start a mirror update:
    sudo -u aptly aptly mirror update bionic-orig-main-test
  2. Some .deb are downloaded successfully.
  3. The problematic .deb file is being downloaded.
  4. An external malware scanner deletes the file immediately upon download completion.
  5. aptly attempts to import the file and aborts the update.

Observed behavior

  • The mirror update stops at the first such incident.
  • The order of package downloads appears nondeterministic.
  • As a result, repeated invocations of aptly mirror update stop at different points, leaving a large and unpredictable set of packages not downloaded.
  • There is currently no way to:
    • continue the update
    • downgrade this specific failure to a warning
    • complete the rest of the download queue

Expected / desired behavior

In environments where files can be externally removed (malware scanners, filesystem policies, etc.), it would be useful if aptly could:

  • Continue the mirror update when a downloaded package file is missing at import time
  • Report the missing packages at the end of the run (or mark them as failed)
  • Avoid aborting the entire update for a single missing file

This could be implemented, for example, as:

  • a flag such as --continue-on-import-error
  • or a mirror option to treat missing package files as non-fatal

Rationale

In our case, excluding the aptly pool directory from malware scanning is not an option. From a security standpoint, it is acceptable (and even desirable) that certain packages never make it into the mirror. However, the current behavior forces us to repeatedly re-run mirror updates until “by chance” all non-blocked packages are downloaded.

This makes it difficult to maintain a consistent and predictable mirror state in hardened environments.

The current behavior also makes it impossible to detect which packages are systematically blocked by the scanner, because the update stops before the full download queue is processed.

主要语言
Go
星标
2.9k
派生
436
平均合并
5 天 18 小时
30 天内合并 PR
3

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

aptly-dev/aptly 的其他 Issue

查看 aptly-dev/aptly 的全部 Issue

相似的 Issue

更多 Go Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。