Search Results: "ag"

26 May 2012

Craig Small: JFFNMS 0.9.3

jffnms version 0.9.3 has been released today. This is a vast improvement over the 0.9.x releases and anyone using that train is strongly recommended to upgrade.So what changed? What didn t change! A nice summary would be fixing a lot of things that were broken or needed some tweaking. A really, really big thanks to Marek for all the testing and bug reports and also patient just run this and tell me what it says tests he did too. If something wasn t right before and works now, it is quite likely it is working because Marek told me how it broke. A brief overview of what has changed: You can download the file off sourceforge at https://sourceforge.net/projects/jffnms/files/JFFNMS%20Releases/

Charles Plessy: Cloud-init uploaded to Debian.

Each instance (virtual machine) started from the same image is configured identically. The same account and the same procedure will be used to connect to it. If the machine image is public and if the instance is open to the Internet, which is common when using commercial providers such as Amazon, an attacker could connect randomly to known IPs from the cloud, and eventually access to an instance before its owner. To individualise the connection to each instance, one can pass informations at startup, called instance metadata, which will be available to this instance only at a fixed HTTP URL. If the owner provides a public SSH key, this can be used to ensure that only the owner of the private key can connect. After the next update of network-console, this method of connection will be available for the Debian Installer. Likewise for the Debian images produced, by installing the cloud-init packages, that I uploaded to the experimental section of our archive. This package is far from ready. It lacks init scripts, it is not translated, and to be honest, I have not tested it. But to have it in Debian makes me benefit from the package and bugs tracking systems. Do not hesitate to report some, or better, to participate to the maintenance of this package. Cloud-init has many other interesting functionalities. I would like to thank Scott Moser, the upstream developer and maintainer of the Ubuntu package, for his cooperation during the creation of the Debian package, as I made large modifications, in particular the removal of the part managing the menu.lst for pv-grub, which will have its own package or will be transferred somewhere else.

25 May 2012

Alexander Reichle-Schmehl: Release Critical Bug report for Week 21

The bug webinterface of the Ultimate Debian Database currently knows about the following release critical bugs:
In Total:1534
Affecting Wheezy:1095
Wheezy only:238
Remaining to be fixed in Wheezy:857
Of these 857 bugs, the following tags are set:
Pending in Wheezy:82
Patched in Wheezy:175
Duplicates in Wheezy:62
Can be fixed in a security Update:27
Contrib or non-free in Wheezy:11
Claimed in Wheezy:2
Delayed in Wheezy:18
Otherwise fixed in Wheezy:86
Ignoring all the above (multiple tags possible) 500 bugs need to be fixed by Debian Contributors to get Debian 7.0 Wheezy released. However, with the view of the Release Managers, 975 need to be dealt with for the release to happen. Please see Interpreting the release critical bug statistics for an explanation of the different numbers.

Johannes Schauer: setting up mailman, postfix, lighttpd

I was worried about having to learn hundreds of configuration options to properly set up mailman, postfix and lighttpd on Debian Squeeze. Turned out, that except for lighttpd it all works out of the box.
apt-get install postfix
When asked by debconf, I specified lists.mister-muffin.de as the fully qualified domain name.
apt-get install mailman
newlist mailman
The newlist command reminds me that I have to add its output to /etc/aliases. After doing so, I have to run:
newaliases
From now on, I can add any mailinglist by running newlist, editing /etc/aliases and running newaliases. Mailinglists can also be added through the mailman webinterface but one still has to put the according entries into /etc/aliases. Following is a working lighttpd configuration that works out of the box with the default settings of mailman on Debian squeeze. This was the only part that caused me some headaches.
server.modules += ("mod_alias", "mod_cgi", "mod_accesslog")
$HTTP["host"] == "lists.mister-muffin.de"   accesslog.filename =
    accesslog.filename = "/var/log/lighttpd/lists-access-log"
    alias.url += (
        "/cgi-bin/mailman/private/" => "/var/lib/mailman/archives/private/",
        "/cgi-bin/mailman/public/" => "/var/lib/mailman/archives/public/",
        "/pipermail/" => "/var/lib/mailman/archives/public/",
        "/cgi-bin/mailman/"=> "/var/lib/mailman/cgi-bin/",
        "/images/mailman/" => "/usr/share/images/mailman/",
    )
    cgi.assign = (
        "/admin" => "",
        "/admindb" => "",
        "/confirm" => "",
        "/create" => "",
        "/edithtml" => "",
        "/listinfo" => "",
        "/options" => "",
        "/private" => "",
        "/rmlist" => "",
        "/roster" => "",
        "/subscribe" => "")
 
server.document-root        = "/var/www"
server.errorlog             = "/var/log/lighttpd/error.log"
server.pid-file             = "/var/run/lighttpd.pid"
server.username             = "www-data"
server.groupname            = "www-data"
index-file.names            = ( "index.html" )
server.dir-listing          = "disable"
include_shell "/usr/share/lighttpd/create-mime.assign.pl"
As a bonus, I wanted to import my existing email exchange with my GSoC mentors into the mailinglist. First I was planning on manually sending the email messages to the list, but a much easier option is to just import them in mbox format. To extract all email messages, I first wrote the following python snippet:
import mailbox, itertools
box = mailbox.mbox('~/out')
for message in itertools.chain(mailbox.mbox('~/sent'), mailbox.Maildir('~/Mail/Web/', factory=None)):
if (("wookey" in message.get('to', "").lower()
or "wookey" in message.get('cc', "").lower()
or "wookey" in message.get('from', "").lower()
or "abate" in message.get('to', "").lower()
or "abate" in message.get('cc', "").lower()
or "abate" in message.get('from', "").lower())
and not message['subject'][0] == '['
and not message['subject'] == "multistrap"):
box.add(message)
box.close()
It iterates through messages in my mbox and maildir mailboxes, filters them for emails by wookey or pietro, strips away some messages I found to not be relevant and then saves the filtered result into the mbox mailbox ~/out. It is important to specify factory=None for the Maildir parser, because it otherwise defaults to rfc822.Message instead of MaildirMessage. Also do not forget to call box.close(). I initially forgot to do so and ended up with missing messages in ~/out. I then copy the archive in its place:
scp out lists.mister-muffin.de:/var/lib/mailman/archives/private/debian-bootstrap.mbox/debian-bootstrap.mbox
Another thing that initially caused me trouble, was that the mbox didnt have the correct permissions due to the scp. Fixing them:
chown -R list:www-data /var/lib/mailman/archives/private/
chmod 664 /var/lib/mailman/archives/private/debian-bootstrap.mbox/debian-bootstrap.mbox
And update the mailman archive like this:
sudo -u list /usr/lib/mailman/bin/arch debian-bootstrap /var/lib/mailman/archives/private/debian-bootstrap.mbox/debian-bootstrap.mbox
Initially I was running the above command as root which screws up permissions as well.

Matthew Garrett: Fedora 17 and Mac support

Fedora 17 will be shipping next week. It's got a bunch of new features, none of which I contributed to in the slightest. What I did work on was improving our support for installation on x86 Apple hardware. There's still a few shortcomings in this so it's not an announced or supported feature, but it's sufficient progress that it's worth writing about.

There's a few ways that Apple platforms differs from normal PC hardware. The first is that Apples are very much intended to be EFI first and BIOS second, while that's still not really true for commodity PC hardware. Apple launched Boot Camp shortly after they started shipping x86 Macs (and shortly after I'd got Ubuntu running on one for the first time[1]) but the focus of Boot Camp has always been to be good enough to boot Windows and not much else[2]. The other is the integration with the boot environment. You can boot Linux easily enough by setting the standard EFI boot variables, but if you ever boot back into OS X it's easy to trigger deletion of those. There's then no straightforward way of resetting them, and you're left having to recover your installation.

The other difficult bit has been actually starting the installer at all. If you're happy to use BIOS emulation than this can be done without too much misery, but you're then left with dealing with Apple's custom synchronised GPT/MBR. More modern Macs will boot via the standard EFI mechanisms, but there's a range of problems that can be caused that way. Fedora 17 is the first Linux distribution to ship install media that will EFI boot a Mac when either written to optical media or a USB stick[3]. Put the install media in your system and then either select it in the OS X Startup Disk preferences menu and reboot, or reboot and hold down the alt key. In the latter case there'll be a nice Fedora logo. Click on it and it'll boot.

The biggest difference between Apple hardware and anyone else is that we'd normally put the bootloader in a FAT partition that's shared with any other installed operating systems. That does actually work on Apples, but then you run into the earlier point I mentioned. The Apple startup picker that you get by holding down the alt key doesn't pay any attention to the standard EFI boot variables, so it won't show a FAT partition merely because it's got an EFI bootloader on it. The same is true of the OS X Startup Disk preferences. The best way to get a drive to appear in the menu is to make it look like an OS X drive.

This was problematic in a few ways, due to the requirement for an OS X drive to be HFS+. The first was that we didn't have any support for that in our installer, so work had to be done there. The second was that the state of HFS+ was woefully poor in Linux[4]. Linux will refuse to write to an HFS+ filesystem if it hasn't been cleanly unmounted or fscked, and since we can't rely on everyone always shutting their machine down cleanly that means a working fsck.hfsplus. In theory we were shipping one of those. In practice, it reliably segfaulted on 64-bit systems[5]. So I had to package the latest version of Apple's code, and doing that involved dealing with the fact that Apple now use blocks almost as much as Grub 2 uses nested functions, and that meant using Clang and that meant dealing with a bug where Clang segfaulted if it had been built with gcc 4.7[6], but finally once all of those yaks had been shaven we could trust our filesystem.

Of course, more problems existed. You can't just drop a bootloader onto an HFS+ partition and expect it to work. You need to write its inode value into the superblock. Trivial, except that if you do this from userspace then the kernel kindly overwrites your update when you unmount the disk and it updates the superblock. That required a mechanism for updating that data via the kernel, which meant adding an ioctl. This would have been fine, except the OS X Startup Disk preference looks for a bootloader in a location other than where Fedora installs it. Changing our bootloader install path wasn't a great option, so the easiest thing to do was just to link them together. Except HFS+ doesn't really support hardlinks. When you hardlink something the original file gets moved into a magic directory in the filesystem root and the links are special files that refer to it. And it turns out that it's not actually the inode that the firmware wants when finding the bootloader, it's the catalogue ID, and these aren't the same when hardlinks are involved. So, another kernel patch.

All that was left for the boot partition then was adding an icon and a drive label. We already had code for generating the icon, and the drive label wasn't that difficult. Hurrah!

Ok, so we can construct a filesystem that (a) appears in the bootpicker, and (b) appears in the OS X Startup Disk preferences. We can even put a bootloader on it. This led to the next problem. The bootloader started without any trouble. But the bootloader couldn't read any files off the boot partition, including its configuration. This should have been obvious with hindsight - the problem was simply that grub legacy[7] doesn't support HFS+. Writing an HFS+ driver seemed like an excessive amount of work, especially since the firmware already supported reading HFS+, so instead I wrote a simple grub filesystem driver that uses the UEFI interfaces to read files.

A working bootloader! One more problem there. grub looks in its startup directory to find its configuration file. We have two "copies" of grub hardlinked to each other, each looking in a different directory for configuration. Hardlinking the config files together worked fine, except that most tools that update config files have this irritating habit of writing to a temporary file and moving that over the original, thus breaking the hardlink. Easily solved by using a symlink instead, except that the UEFI filesystem semantics don't really support symlinks because UEFI only really envisaged using FAT. If you use Apple's UEFI HFS+ driver to open a symlink, you get a short file containing the target path of the symlink. Rather less than ideal, and a rather gross hack to cope with it.

All set now, other than a bug in some older Mac firmware where read would return BUFFER_TOO_SMALL without returning the real buffersize and the odd way that Apple treat CDs. Oh, and a bug in Apple's Broadcom wifi driver that could overwrite the kernel, and case-sensitivity, something that obviously isn't something you often hit on UEFI when all you usually see is FAT.

Kernel-side, we had a couple of things. Obviously there the bugs I'd mentioned in the past, but those had already been dealt with. New issues included the fact that we were frequently picking the wrong framebuffer address, especially on machines with multiple GPUs. Fixed now, along with another issue where we'd sometimes get confused by models with different GPU configurations. And at that point, most of the implementation work was done.

Of course, there was also the work of integrating this into the tools that we use to generate our install media, and I'd like to thank Will Woods, Brian Lane and Dennis Gilmore for the work they put into that, along with anyone I've forgotten. Tom Calloway handled getting the device label graphics generated right before deadline. A cast of thousands helped with testing.

So why did I mention shortcomings? First, this only works on machines with 64-bit firmware. Early 64-bit Apples still had 32-bit firmware. In theory we can support that case - in practice it's a moderate amount of writing, including some mildly awkward kernel code. But anything later than mid-2007 should have 64-bit firmware, so it's not a massive concern. Second, we seem to have fairly significant trouble with Radeon hardware on a lot of Macs. We fixed one bug there, but something's still going wrong in setup and you'll frequently end up with a black screen. And thirdly, I'm sure there's some other machines that still don't work for (as yet) undetermined reasons.

With luck we'll get these things dealt with by Fedora 18. But even with these flaws, Fedora 17 will work fine on a lot of Apple hardware, and testing it is as simple as downloading and booting a live image. Bugs go in the usual place.

[1] Note my charming belief that the Ubuntu installer would fully support this hardware via EFI in the near future. 6 years ago. It still doesn't.
[2] This can be fairly easily seen from little things like the name "Windows" being hardcoded into every UI that sees a Boot Camp drive.
[3] I cover this in more depth here
[4] To be fair, it mostly still is - there's plenty of work to be done there.
[5] Approximately nobody had noticed this, which is all kinds of unreassuring.
[6] Thanks to Kalev Lember for dealing with that
[7] Still the EFI bootloader in Fedora 17. We've already swapped Fedora 18 over to grub 2.

comment count unavailable comments

Paul Tagliamonte: playing with non-lintian lintian checks

Crazy title, I know. Over the past $WHILE, I ve found myself checking for the same things. Some of these are fit for inclusion into lintian it s self others, not so much. Here s a rundown on what my lintian wrapper (tragically also called lintian and just higher up on my $PATH. I know it s a hack.) Since I only use lintian on .changes files - it pre-processes for some information that is stuffed in the changes. The first step is to get all the bugs that the package closes. It then takes these bugs, and queries the BTS to see what package they re filed against. If the bug is filed against a different bug then the package s source, it ll emit a warning. It has a greylist for stuff like WNPP . This will fail if something s filed against it s binary package rather then it s source :) Next, the wrapper will get other info from the changes. It checks if the suite is in the blacklist ( UNRELEASED , and testing , (stable for me as well, since I don t usually deal with SRUs often)). It ll also check for the changed-by and maintainer, ensuring they re the same. This will fail for co-maint d packages. If you ve not guessed by now, this system relies on false-positives :) Nextly, if there are .debs in the Files, it ll go through and check the control of each. It ll print out a stanza with the short-description inside a template, to see if the description works . After that, it ll attempt to make HTTP requests to the Homepage (and eventually URLs in the description and VCS-Browse) If the package has python in the source name anywhere, or in any of it s binary packages, it ll trigger jwilk s lintian4python over the source as well. After this, it passes through to regular lintian. Oh, and it colorizes all the output :) Here is a (mostly lint-free) package: As you can see, it s very (very) verbose, but i d rather cross stuff off a checklist then worry about something being off. Anyway, it s a work in progress. Not even a serious one, at that. It s a bunch of hacks put together, so I can t really endorse anyone else using this stuff. If you feel crazy enough to do so, all the tools are found on my dot-bin repo on GitHub

24 May 2012

Junichi Uekawa: A few weeks ago, my sony VAIO type P that I have been using for the past 2 years have died.

A few weeks ago, my sony VAIO type P that I have been using for the past 2 years have died. I've now got my MacBook Air and back to being productive again. One thing is that I probably lost your mail since I recovered from my home directory backup from 5 May. Not that I read mail all that often, but your mail will certainly be lost if you've sent me a mail in the meanwhile.

Mark Brown: regulator updates in 3.4

This has been a fairly quiet release from a regulator point of view, the only real framework features added were devm support and a convenience helper for setting up fixed voltage regulators. Much more coming next time, though! The most noticeable thing in the changelog is that Axel Lin continued his relentless and generally awesome stream of fixes and cleanups.

Mark Brown: regmap updates in 3.4

Things are really quieting down with the regmap API, while we re still seeing a trickle of new features coming in they re getting much smaller than they were. plus the general bug fixes and tweaks you d expect.

Sylvestre Ledru: llvm & clang 3.1 in Debian unstable + GSoC

Released a few days ago, I am happy to announce that LLVM and clang 3.1 are already available in the Debian archive in Unstable. RC versions were already available for the last few weeks in Debian experimental. They are very likely to be part of wheezy.
We will soon try a new rebuild of the Debian archive with the version 3.1. Talking about clang, a couple of months ago, I proposed a GSoC project to extend the Debian infrastructure in order to use clang instead gcc to build Debian packages. The goal is not to replace gcc but it is more about building packages with a new compiler. With Paul Tagliamonte as co-mentor, Alexander Pashaliyski is going to work during the summer on this subject. The final deliverables should be: For now, Alexander is working on an installation of the wanna-build and buildd services in order to have a dedicated testing environment.

Richard Hartmann: Public service announcement

This will be a repost for anyone subscribed to Planet Debian, sorry. In case you have not heard about git-annex yet and you care about syncing, tracking, and managing your private or public files, go click the link; it's OK, I will wait. The use cases sound intriguing, don't they? But unless you are comfortable with a shell and git, don't bother using it; pain is inevitable. joeyh announced a kickstarter project to make git-annex more user friendly, support automated adding and syncing of files, and a web front-end. Notwithstanding the cut that kickstarter and amazon payments will take and the inherent questions that are being raised by paying for FLOSS, this is a very worthwhile endeavour to support. PS: Yes, this feels a tad circle-jerky inasmuch joeyh's post links to my blog; I would have linked to his post anyway, though. If anything, this made me think twice about posting this here. PPS: Yes, I will continue writing my Trans-Siberian series even though I am home already. Air China decided to keep me in China longer than planned, real life is busy, and, truth be told, Diablo 3 came out. The second Mongolian post is half-way finished, at least.

Vincent Sanders: Linux kernel presentation

Recently I was asked to present a short introduction to the Linux kernel for our project managers. I put together a short slide deck for the presentation which I have decided to share.
I feel its important to note that I had a lot more to say about each section and the slides were more an aid for my memory to cover the important points. Of special note would be the diagram showing the "hierarchy" of contributors, this is of course nowhere near as well stratified as portrayed.

Ingo Juergensmann: About Gallery3 in Debian and MySQL

Years ago, when I started using a cheap Kodak DX3600 digital camera to make some digital photos, I used Gallery from Menalto to collect these pictures within a gallery. Gallery (version 1) was using plain text files to keep its information about galleries and photos and as the number of photos I put into the gallery the more it got slower and slower. Then Gallery2 was released which used a database, either MySQL or PostgreSQL, and was a huge improvement in speed. My main galleries do have about 10-20.000 pictures each. But Gallery2 is aged nowadays and the next logical step would be to migrate to Gallery3. But what a mess! Gallery3 has some drawbacks:
  1. there is currently no gallery3 package in Debian, although it's been released upstream for some time now.
  2. there is actually a bug open (#511715), stating that there are some license issues with Gallery3 and some SWF files
  3. it's been said that Gallery3 doesn't support per picture permissions anymore, only permission per album is now possible, which is giving me headache as I changed permissions of some personal pictures in the past for privacy reasons and which would either lead to completely unavailable albums to the public or the need of splitting album into a public and a private section, which breaks the timely order of the pictures
  4. whereas G2 supported both MySQL and PostgreSQL as database backends, G3 only supports MySQL. That's a real pitty because I prefer PostgreSQL because of its stability and easiness over MySQL. It already happened several times that MySQL databases were gone after a kernel crash or something. Even mysql.user table was gone more than once, whereas PostgreSQL never ever has shown such behaviour to me. It just works.
I'm really upset about the last point! Why is there such a strong believe in MySQL. In my eyes, MySQL is utter crap. It's more like MS Access than a real thing when talking DBMS/SQL. And my impression is that, after Oracle bought MySQL, Oracle did a good job to scare their customers off. PostgreSQL on the other hand gained a good momentum in usage since the Oracle/MySQL deal. So, it's a total mystery to me how a big software package with dozens of developers can decide not to support PostgreSQL or even drop the support of PostgreSQL for a new release! It's driving me nuts, again and again. Other big software packages like Drupal are doing the right thing: while PostgreSQL support in drupal6 was weak and buggy because of all these awful MySQLisms around, Drupal now uses a database abstraction layer in drupal7 to allow even sqlite or Oracle to be used as underlying database. That's the way to go, but it's totally awkward to drop PostgreSQL support as Gallery3 did. So, is there a way out of my dilemma? Will gallery3 be a package within Debian soon (no offense to Michael Schultheiss, I think he's doing a great job and needs assistance from upstream in this case)? Is there any good replacement for Gallery3 that can deal with tenthousends of images and dozens of users and supports PostgreSQL and has some kind of import tool from gallery2?
Kategorie:

23 May 2012

Gintautas Miliauskas: HP LaserJet 1018 on Ubuntu

An offtopic post for an issue that I just ran into for the n-th time: after upgrading to Ubuntu Precise, my HP LaserJet 1018 stopped working again, the issue being that the printer firmware was not being uploaded to the printer properly. For posterity, (one) way to fix this is to uninstall the printer-driver-foo2zjs package, remove the printer itself from the list of printers, and then use HP utilities to set up the printer:

sudo apt-get remove printer-driver-foo2zjs
sudo apt-get install hplip-gui
sudo hp-setup


You may need to turn the printer off and on after the procedure to trigger the firmware uploader.

Joey Hess: kickstarter for git-annex assistant

I'm doing a Kickstarter! The plan is to take git-annex and use it as the foundation to build a DropBox-like application, that can be used without any knowledge of git. The other part of the plan is for me to get through the summer with my finances intact. :) kickstarter My Kickstarter page explains in more detail, but the basic idea is to make git-annex watch a directory, with inotify, and automatically add and sync files placed there. Then build a local web app to control and configure it. I have a working prototype of the inotify part already; getting the distributed syncronisation to work well will be a major challenge; and overall it's going to be a challanging but I think very achievable project. One thing I'm really excited about is the potential of Kickstarter to connect me with a diverse group of potential users, who are interested enough in a distributed and autonomous equivilant to DropBox to fund my project. Because, with luck, their involvement won't stop at giving some money, but will extend to actually using what I'm developing, and giving me feedback on it. I hope this will widen the sphere of git-annex users, beyond the current very technically inclined crowd. It's awesome to have users doing things like taking git-annex on the transiberian railroad to help manage all their photos, and others using it to store scientific data ... but getting more regular folks using git, even if they don't know about it, is something I'm very interested in. xkcd-esque drawing BTW, I was surprised how much I got into doing the video for the Kickstarter. Using xkcd-style drawings used to explain technical concepts is a medium I enjoy working in. My own git-annex is stuffed with 17 gigabytes of video clips -- 99 separate takes! -- that boiled down to a 2 minute video. Anyway, please consider backing me if you can, and more importantly, do anything you can to help spread the word. Thanks!

Raphael Geissert: Installed-Size: 0

Redefining the meaning of Installed-Size:

Package: gcipher
Version: 1.1-1
Installed-Size: 0
$ dget gcipher=1.1-1
...
$ dpkg -x gcipher_1.1-1_all.deb gcipher
$ du -hs gcipher
188K gcipher
$ du --apparent-size -hs gcipher
75K gcipher

Lars Wirzenius: Summain 0.13 (file manifest/metadata/checksum tool)

I've just released version 0.13 of Summain, my tool to generate file manifests, which contain metadata about the files, and a checksum of their content for regular files. The manifest can be generated for a directory tree at different points in time and compared (with diff) to see if something has changed. Changes in this version: I've uploaded 0.13 to Debian and amd64 and i386 backports to my own package repository.

Pietro Abate: configure a local apt repository for puppet

Puppet has a built-in functionality to serve small files to its clients. However, for my internal use I sometimes find easier to create a custom debian package to install a specific component then to write a puppet recipe and to copy files around. To create a local debian repository I use the package reprepro. This is a simple tool that creates and manages apt repository, it is easy to configure and for the moment it lived fully to my expectations. First of all you need to create a configuration file where you describe your distribution. In this case I choose /var/www/debian/conf/distributions and add the following content :
Origin: PCPool
Label: PCPool
Suite: stable
Codename: pcpool
Version: 3.0
Architectures: i386 amd64
Components: contrib
Description: puppet support package repository
SignWith: D3CF695E
Notice that since reprepro wants to sing you repository, you need to provide a gpg keyid for it. To add a package to the repository it is straightforward :
reprepro -Vb /var/www/debian/ includedeb pcpool /tmp/msm_1-2_all.deb
As I said, since the repository is signed, we need to make have a way to add the keyid to the known keys of the target machine. In order to achieve this, we add the following puppet recipe :
class apt
#local repo sign key
$keyid = "D3CF695E"

exec "apt-update":
command => "/usr/bin/apt-get update",
refreshonly => true;


file "/root/pcpool.key":
source => "puppet://$server/files/root/pcpool.key"


exec "apt-key":
path => '/bin:/usr/bin',
environment => 'HOME=/root',
command => "apt-key add /root/pcpool.key",
unless => "apt-key list grep $keyid",
subscribe => File["/root/pcpool.key"]


file "/etc/apt/sources.list.d/puppet.list":
content => "deb http://puppet/debian/ pcpool contrib\n",
owner => root,
group => root,
mode => 0644,
notify => Exec["apt-update"]



class msm
package "msm": ensure => installed
First we copy the keyid that we have stored in the puppet file bucket in the root directory of the client, then we exec the apt-key command. Note that since puppet executes each action in parallel, we must specify an execution order using the attributes subscribe and notify. Similarly as soon as the file /etc/apt/sources.list.d/puppet.list is added to the machine, we run apt-get update to refresh the cache of apt. The last stanza simply installs the package that we added to the local repository.

Pietro Abate: configuring a local apt repository for puppet

Puppet has a built-in functionality to serve small files to its clients. However, for my internal use I sometimes find easier to create a custom debian package to install a specific component then to write a puppet recipe and to copy files around. To create a local debian repository I use the package reprepro. This is a simple tool that creates and manages apt repository, it is easy to configure and for the moment it lived fully to my expectations. First of all you need to create a configuration file where you describe your distribution. In this case I choose /var/www/debian/conf/distributions and add the following content :
Origin: PCPool
Label: PCPool
Suite: stable
Codename: pcpool
Version: 3.0
Architectures: i386 amd64
Components: contrib
Description: puppet support package repository
SignWith: D3CF695E
Notice that since reprepro wants to sign your repository, you need to provide a gpg keyid for it. To add a package to the repository it is straightforward :
reprepro -Vb /var/www/debian/ includedeb pcpool /tmp/msm_1-2_all.deb
As I said, since the repository is signed, we need to make have a way to add the keyid to the known keys of the target machine. In order to achieve this, we add the following puppet recipe :
class apt
#local repo sign key
$keyid = "D3CF695E"

exec "apt-update":
command => "/usr/bin/apt-get update",
refreshonly => true;


file "/etc/apt/trusted.gpg.d/pcpool.gpg":
source => "puppet://$server/etc/apt/trusted.gpg.d/pcpool.gpg"


# file "/root/pcpool.key":
# source => "puppet://$server/files/root/pcpool.key"
#

# exec "apt-key":
# path => '/bin:/usr/bin',
# environment => 'HOME=/root',
# command => "apt-key add /root/pcpool.key",
# unless => "apt-key list grep $keyid",
# subscribe => File["/root/pcpool.key"]
#

file "/etc/apt/sources.list.d/puppet.list":
content => "deb http://puppet/debian/ pcpool contrib\n",
owner => root,
group => root,
mode => 0644,
notify => Exec["apt-update"]



class msm
package "msm": ensure => installed
First we copy the keyid that we have stored in the puppet file bucket in the root directory of the client, then we exec the apt-key command. Note that since puppet executes each action in parallel, we must specify an execution order using the attributes subscribe and notify. Similarly as soon as the file /etc/apt/sources.list.d/puppet.list is added to the machine, we run apt-get update to refresh the cache of apt. The last stanza simply installs the package that we added to the local repository.

Update There is a better way to add a gpg key, that is to put it in the /etc/apt/trusted.gpg.d directory. Thanks for the suggestion !

Christian Perrier: 2012 update 23 for Debian Installer localization

Status for D-I level 1 (core D-I files): Status for D-I level 2 (packages that have localized material that may appear during default installs, such as iso-codes, tasksel, etc.): Status for D-I level 3 (packages that have localized material that may appear during non-default installs, such as win32-loader) Full 100% completeness (hall of fame) for 26 languages: Asturian, Belarusian, Bulgarian, Catalan, Czech, Danish, German, Esperanto, Spanish, Persian, French, Hebrew, Indonesian, Italian, Japanese, Kazakh, Khmer, Dutch, Polish, Portuguese, Russian, Slovak, Slovenian, Swedish, Turkish, Simplified Chinese

Next.

Previous.