Tuesday 9 July 2019

Fwd: Dropping Release and Release.gpg support from APT

Do we have any repositories that do not have InRelease files for eoan+?

See below for details, sorry about the forwarding, but it's a bit messy
with cross-posting to ubuntu-devel.

Also, of course 19.10, not 18.10, upstream me is silly.

----- Forwarded message from Julian Andres Klode <jak@debian.org> -----

Date: Tue, 9 Jul 2019 20:53:04 +0200
From: Julian Andres Klode <jak@debian.org>
To: deity@lists.debian.org, debian-devel@lists.debian.org
Subject: Dropping Release and Release.gpg support from APT
Message-ID: <20190709204321.GA10923@debian.org>
Accept-Language: de-DE, de, en-GB, en-US, en
User-Agent: NeoMutt/20180716
Tags: Debian/APT sent

So,

we currently have code dealing with falling back from InRelease
to Release{,.gpg} and it's all a bit much IMO. Now that buster
has been released with an InRelease file, the time has IMO come for
us to drop support for the old stuff from APT!

Timeline suggestion
-------------------
now add a warning to apt 1.9.x for repositories w/o InRelease, but Release{,.gpg}
Aug/Sep turn the warning into an error, overridable with an option (?)
Q1 2020 remove the code

My idea being that we give this a cycle in the Ubuntu 18.10 stable
release before we drop it, so people are ready for it.

Why remove it?
--------------
* It's annoying UX to have repositories with Release files and the "Ign" lines
* Handling the fallback from InRelease to Release{,.gpg} involves some abstractions
and logic and the less logic we have in security-relevant file fetching, the better

--
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer i speak de, en

----- End forwarded message -----

--
debian developer - deb.li/jak | jak-linux.org - free software dev
ubuntu core developer i speak de, en

--
ubuntu-devel mailing list
ubuntu-devel@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-devel