brooktrails/acng-butler
Watch
1
0
Fork
You've already forked acng-butler
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: per-suite archive host and keyring in SUITES #2

Merged
rcsheets merged 1 commit from feat/multi-archive-keyrings into main 2026-07-23 11:02:37 +00:00
Conversation 0 Commits 1 Files changed 4 +82 -27
rcsheets commented 2026-07-23 10:43:28 +00:00
Owner
Copy link

acng on c2-talos also caches Ubuntu (noble/questing) for CI, but butler could only verify against deb.debian.org + debian-archive-keyring, leaving those suites unwatched.

SUITES entries are now <archive>|<suite>[|<keyring>]:

  • a bare archive name still means an archive on deb.debian.org (existing entries unchanged)
  • an archive containing / or . is used verbatim as host/path, e.g. archive.ubuntu.com/ubuntu or security.ubuntu.com/ubuntu
  • the keyring field selects debian (default), ubuntu, or an absolute keyring path

ubuntu-keyring is installed alongside debian-archive-keyring (it ships in the Debian archive, so the install stays direct-from-upstream and isolated from the proxy under test); it is only exercised when SUITES lists Ubuntu suites.

Verified: hack/validate.sh passes (configmap regenerated, both render paths ok); parse logic unit-tested against all entry forms; Debian trixie ubuntu-keyring 2023.11.28.1 validates the current noble/questing InRelease signatures.

Motivation: c2-talos incident 2026-07-22/23 — acng range-resume splicing corrupted trixie-updates/trixie-security InRelease twice in 12h; Ubuntu suites currently have no equivalent watchdog. Companion infra PR extends the c2-talos SUITES patch once this merges.

🤖 Generated with Claude Code

acng on c2-talos also caches Ubuntu (noble/questing) for CI, but butler could only verify against deb.debian.org + debian-archive-keyring, leaving those suites unwatched. SUITES entries are now `<archive>|<suite>[|<keyring>]`: - a bare archive name still means an archive on deb.debian.org (existing entries unchanged) - an archive containing `/` or `.` is used verbatim as host/path, e.g. `archive.ubuntu.com/ubuntu` or `security.ubuntu.com/ubuntu` - the keyring field selects `debian` (default), `ubuntu`, or an absolute keyring path `ubuntu-keyring` is installed alongside `debian-archive-keyring` (it ships in the Debian archive, so the install stays direct-from-upstream and isolated from the proxy under test); it is only exercised when SUITES lists Ubuntu suites. Verified: `hack/validate.sh` passes (configmap regenerated, both render paths ok); parse logic unit-tested against all entry forms; Debian trixie ubuntu-keyring 2023.11.28.1 validates the current noble/questing InRelease signatures. Motivation: c2-talos incident 2026-07-22/23 — acng range-resume splicing corrupted trixie-updates/trixie-security InRelease twice in 12h; Ubuntu suites currently have no equivalent watchdog. Companion infra PR extends the c2-talos SUITES patch once this merges. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat: per-suite archive host and keyring in SUITES
All checks were successful
ci / validate (pull_request) Successful in 17s
Details
be4524810a 
acng on c2-talos also caches Ubuntu (noble/questing) for CI, but butler
could only verify against deb.debian.org + debian-archive-keyring, leaving
those suites unwatched. SUITES entries are now <archive>|<suite>[|<keyring>]:
a bare archive name still means deb.debian.org, an archive containing '/'
or '.' is used verbatim as host/path, and the keyring field selects
debian (default), ubuntu, or an absolute keyring path.

ubuntu-keyring is installed alongside debian-archive-keyring (it ships in
the Debian archive); it is only exercised when SUITES lists Ubuntu suites.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
brooktrails/acng-butler!2
No description provided.