普通仓库
- 以 Debian 8 / Jessie 为例,使用官方的ISO里的软件包制作apt仓库
apt-get -y install nginx reprepro dpkg-sig
mkdir -pv /data/file /mnt/d{1,2,3} /data/mirror/debian/conf
下载DVD镜像
wget -P /data/file http://mirrors.yun-idc.com/debian-cd/current/amd64/iso-dvd/debian-8.2.0-amd64-DVD-{1,2,3}.iso
挂载到本地
mount -t iso9660 -o ro,loop /data/file/debian-8.2.0-amd64-DVD-1.iso /mnt/d1
mount -t iso9660 -o ro,loop /data/file/debian-8.2.0-amd64-DVD-2.iso /mnt/d2
mount -t iso9660 -o ro,loop /data/file/debian-8.2.0-amd64-DVD-3.iso /mnt/d3
创建仓库
reprepro
根据 distributions
生成仓库:
head -9 /mnt/d1/dists/jessie/Release | sed '/Date:/d' - > /data/mirror/debian/conf/distributions
reprepro -Vb /data/mirror/debian includedeb jessie $(find /mnt/d{1,2,3}/pool/ -type f -name "*.deb")
提供HTTP服务
- 安装Nginx并修改配置指向仓库根目录,
/etc/nginx/nginx.conf
片段配置:
server {
listen 80 backlog=8192; # backlog代表此端口允许同时打开(tcp_syn)的最大值
server_name mirrors.biliops.com;
charset utf-8;
location / {
root /data/mirror;
autoindex on;
autoindex_exact_size off;
autoindex_localtime on;
access_log /data/log/nginx/access.log; #访问过程不记日志
}
location ~ ^(.*)\/\.(svn|git|hg|bzr|cvs)\/ { # 屏蔽这些目录
deny all;
access_log off;
log_not_found off;
}
location ~ /\. { # 屏蔽.开头的目录或文件,比如 .htaccess .bash_history
deny all;
access_log off;
log_not_found off;
}
}
测试使用
- 修改
/etc/apt/sources.list
指向 mirrors.biliops.com
:
deb http://mirrors.biliops.com/debian jessie main contrib
apt-get update
仓库签名
制作签名
gpg --gen-key
# Real name: mirror-key
# gpg: directory `~/.gnupg' created
# gpg: new configuration file `~/.gnupg/gpg.conf' created
# gpg: WARNING: options in `~/.gnupg/gpg.conf' are not yet active during this run
# gpg: keyring `~/.gnupg/secring.gpg' created
# gpg: keyring `~/.gnupg/pubring.gpg' created
# Not enough random bytes available.
rngd -r /dev/urandom -o /dev/random -f -t 1
gpg --list-keys
gpg --list-secret-keys
apt-key list
gpg -o ~/gpg-pub.key -a --export mirror-key # 导出公钥
gpg -o ~/gpg-sec.key -a --export-secret-keys mirror-key # 导出私钥
gpg --import ~/gpg-sec.key ~/gpg-pub.key # 恢复公、私钥
给仓库签名
- 实际上就在配置里加上
SignWith: mirror-key
,然后重新生成源数据即可:
head -9 /mnt/d1/dists/jessie/Release | sed 's/^Date:.*/SignWith: mirror-key/g' - > /data/mirror/debian/conf/distributions
# rm -rfv /data/mirror/debian/{db,dists,lists} # 可删除
reprepro -Vb /data/mirror/debian export jessie
测试仓库的签名
- 客户端需要导入公钥,否则无法使用
apt-get update
:
wget -q -O - mirrors.biliops.com/gpg-pub.key | sudo apt-key add -
打包签名
- 如果仓库不需要签名,可以只对指定的软件包签名。需要
dpkg-sig
打,示例:
dpkg-sig -k mirror-key --sign higkoo $(find /data/mirror/debian/pool -type f -name "*.deb")
手动打签名
#!/bin/bash
if [ "$1" == "checksum_md5" ]; then
printf ' '$(md5sum $2 | cut --delimiter=' ' --fields=1)' %16d '$2'\n' $(wc --bytes $2 | cut --delimiter=' ' --fields=1)
exit 0
elif [ "$1" == "checksum_sha1" ]; then
printf ' '$(sha1sum $2 | cut --delimiter=' ' --fields=1)' %16d '$2'\n' $(wc --bytes $2 | cut --delimiter=' ' --fields=1)
exit 0
elif [ "$1" == "checksum_sha256" ]; then
printf ' '$(sha256sum $2 | cut --delimiter=' ' --fields=1)' %16d '$2'\n' $(wc --bytes $2 | cut --delimiter=' ' --fields=1)
exit 0
fi
BASEDIR=/data/mirror/debian
HEADER=${BASEDIR}/conf/main-info
OS_CODENAME=jessie
SELF_SCRIPT="`pwd`/$0"
cd ${BASEDIR}
dpkg-scanpackages pool/${OS_CODENAME} 2>/tmp/deb.log | tee dists/${OS_CODENAME}/main/binary-amd64/Packages | gzip -9c > dists/${OS_CODENAME}/main/binary-amd64/Packages.gz
cat dists/${OS_CODENAME}/main/binary-amd64/Packages | bzip2 -9c > dists/${OS_CODENAME}/main/binary-amd64/Packages.bz2
cd ${BASEDIR}/dists/${OS_CODENAME}
/bin/cp -fv ${HEADER} ${BASEDIR}/dists/${OS_CODENAME}/binary-amd64/Release
/bin/cp -fv ${HEADER} Release
echo "MD5Sum:" >> Release
find main/ -type f | xargs -n 1 $SELF_SCRIPT checksum_md5 >> Release
echo "SHA1:" >> Release
find main/ -type f | xargs -n 1 $SELF_SCRIPT checksum_sha1 >> Release
echo "SHA256:" >> Release
find main/ -type f | xargs -n 1 $SELF_SCRIPT checksum_sha256 >> Release
rm Release.gpg InRelease
gpg --clearsign -o InRelease Release
gpg -abs -o Release.gpg Release