Skip to content

Problems with apt-transport-https and Release files

We're having trouble with several repositories hosted on packager.io, which still use Release instead of InRelease files.

Scenario is:

  • zammad01 is a debian system using some custom https repos (elastic.co and packager.io)
  • webcache is a debian system providing apt-cacher-ng
  • repo elastic.co uses an InRelease file
  • repo packager.io uses Release+Release.gpg files
tammo@zammad01 ~ % sudo apt update
Ign:1 https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 InRelease
Hit:2 https://artifacts.elastic.co/packages/7.x/apt stable InRelease
Err:3 https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 Release                                  
  Certificate verification failed: The certificate is NOT trusted. The certificate issuer is unknown. The name in the certificate does not match the expected.  Could not handshake: Error in the certificate verification. [IP: 10.*.*.2 3142]
Hit:4 http://security.debian.org/debian-security buster/updates InRelease                                    
Hit:5 http://deb.debian.org/debian buster InRelease
Hit:6 http://deb.debian.org/debian buster-updates InRelease
Reading package lists... Done
E: The repository 'https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 Release' no longer has a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

Proxy configuration is set to our apt-cacher-ng:

tammo@zammad01 ~ % apt-config dump | grep -i proxy
Acquire::http::Proxy "http://webcache.******.local:3142";

If I attempt the download on webcache (machine hosting apt-cacher-ng):

tammo@webcache ~ % wget https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release
--2020-10-14 10:52:47--  https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release
Resolving dl.packager.io (dl.packager.io)... 178.63.71.248
Connecting to dl.packager.io (dl.packager.io)|178.63.71.248|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: ‘Release’

Release                             [ <=>                               ]   1.19K  --.-KB/s    in 0s      

2020-10-14 10:52:47 (28.0 MB/s) - ‘Release’ saved [1218]

tammo@webcache ~ % wget https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release.gpg
--2020-10-14 10:52:49--  https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release.gpg
Resolving dl.packager.io (dl.packager.io)... 178.63.71.248
Connecting to dl.packager.io (dl.packager.io)|178.63.71.248|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/pgp-signature]
Saving to: ‘Release.gpg’

Release.gpg                         [ <=>                               ]     473  --.-KB/s    in 0s      

2020-10-14 10:52:50 (8.69 MB/s) - ‘Release.gpg’ saved [473]

My sources.list:

tammo@zammad01 ~ % cat /etc/apt/sources.list{,*/*} | grep -v -E "^(#|$)"                   
deb http://deb.debian.org/debian/ buster main
deb http://security.debian.org/debian-security buster/updates main
deb http://deb.debian.org/debian/ buster-updates main
deb https://artifacts.elastic.co/packages/7.x/apt stable main
deb https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 main

If I try to directly download from packager.io:

tammo@zammad01 ~ % wget https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release
--2020-10-14 11:14:44--  https://dl.packager.io/srv/deb/zammad/zammad/stable/debian/dists/10/Release
Resolving dl.packager.io (dl.packager.io)... 178.63.71.248
Connecting to dl.packager.io (dl.packager.io)|178.63.71.248|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/plain]
Saving to: ‘Release’

Release                             [ <=>                               ]   1.19K  --.-KB/s    in 0s      

2020-10-14 11:14:44 (25.5 MB/s) - ‘Release’ saved [1218]

If I deactivate the proxy setting, I get the following:

tammo@zammad01 ~ % sudo apt update                                           
Hit:1 http://deb.debian.org/debian buster InRelease
Hit:2 http://security.debian.org/debian-security buster/updates InRelease                           
Hit:3 http://deb.debian.org/debian buster-updates InRelease                                         
Ign:4 https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 InRelease                       
Hit:5 https://artifacts.elastic.co/packages/7.x/apt stable InRelease         
Get:6 https://dl.packager.io/srv/deb/zammad/zammad/stable/debian 10 Release
Fetched 1,218 B in 1s (1,687 B/s)
Reading package lists... Done
Building dependency tree       
Reading state information... Done
All packages are up to date.

My apt-cacher-ng logfiles:

tammo@webcache ~ % tail /var/log/apt-cacher-ng/apt-cacher.err 
tammo@webcache ~ % tail /var/log/apt-cacher-ng/apt-cacher.log 
1602666741|O|229|192.168.*.9|uburep/dists/bionic-backports/InRelease
1602666741|O|52204|10.*.*.1|debrep/dists/buster-updates/InRelease
1602666741|O|52204|10.*.*.2|debrep/dists/buster-updates/InRelease
1602666741|O|234|10.*.*.2|secdeb/debian-security/dists/buster/updates/InRelease
1602666741|O|228|192.168.*.9|uburep/dists/bionic-security/InRelease
1602666742|O|215|10.*.*.23|debrep/dists/buster/InRelease
1602666742|O|234|10.*.*.23|secdeb/debian-security/dists/buster/updates/InRelease
1602666742|O|52204|10.*.*.23|debrep/dists/buster-updates/InRelease
1602666747|O|221|192.168.*.127|archive.raspberrypi.org/debian/dists/buster/InRelease
1602666747|O|224|192.168.*.127|raspbian.raspberrypi.org/raspbian/dists/buster/InRelease
Edited by Tammo