reprepro | public developer repository for reprepro

by esc C Version: Current License: GPL-2.0

X-Ray Key Features Code Snippets Community Discussions(4)Vulnerabilities Install Support

kandi X-RAY | reprepro Summary

reprepro is a C library. reprepro has no bugs, it has no vulnerabilities, it has a Strong Copyleft License and it has low support. You can download it from GitHub.

this project is a leightweight feature complete manager of a debian package (i.e. binary .deb and source .dsc+.tar.gz+.diff.gz) repository. emphasis is put on having all packages in the pool/-directory, maximal checking of all sources. generation of signed release file, contents, ... libraries needed are libdb{3,4.?,5.?} and libz. libraries used if available are libgpgme, libbz2 and libarchive. the main features work without problems. some special use cases might not be very well tested. some naming conventions: basename: the name of a file without any directory information. filekey: the position relative to the mirrordir. (as found as "filename:" in packages.gz) full filename: the position relative to /. architecture: the term like "sparc","i386","mips",... component:

Support

Quality

Security

License

Reuse

Support

reprepro has a low active ecosystem.

It has 19 star(s) with 10 fork(s). There are 3 watchers for this library.

It had no major release in the last 6 months.

reprepro has no issues reported. There are 1 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of reprepro is current.

Quality

reprepro has no bugs reported.

Security

reprepro has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

License

reprepro is licensed under the GPL-2.0 License. This license is Strong Copyleft.

Strong Copyleft licenses enforce sharing, and you can use them when creating open source projects.

Reuse

reprepro releases are not available. You will need to build from source code and install.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of reprepro

Get all kandi verified functions for this library.

reprepro Key Features

No Key Features are available at this moment for reprepro.

reprepro Examples and Code Snippets

No Code Snippets are available at this moment for reprepro.

Community Discussions

Trending Discussions on reprepro

Secure Nexus against supply chain attacks

apt-get install can't find pinned versions within Dockerfile

Removing a delimited block of lines when one of them matches a regex pattern with awk

How to extract multiple lines between a multi-line pattern and a second string pattern

QUESTION

Secure Nexus against supply chain attacks

Asked 2021-Apr-05 at 13:22

We switched from a publicly accessible reprepro Debian package repository (which was powered by an Apache web server) to the Sonatype Nexus Repository OSS, which is great piece of software. But we ran into one problem: When someone uploads a Debian package it's signed on the Nexus server, which we expose to our customers/the internet. In addition, the GPG key and passphrase is known to Nexus for package signing.

Or in other words: I am afraid of a similar situation like the SolarWinds supply chain attack. Scenario: Person attacks the publicly accessible Nexus server/Nexus itself, takes over Nexus, changes existing packages and resigns them with the GPG key/GPG passphrase. Then, malicious code is served to our customers.

I thought about exposing the file blob store directory as read only target to a publicly exposed web server and keep Nexus company internal. Sadly the internal file blob store layout is different, so that's not possible.

So my questions:

Is there a good way to expose the the blob storage in a Deb/RPM/Docker/etc. compatible format which can be served by a more protected, publicly accessible Apache server and consumed by tooks like dpkg/yum/dnf/Docker etc?
I also thought about a second read only Nexus server which is rsync'ed every 10 minutes or so. An attacker would then take over this server, but the package signing check (At least for DEB/RPM) prevents installation of the tampered package
Use an Apache reverse proxy with certificate based authentication (I guess the most secure but complex solution)

But maybe there is already such a feature/another way and I just missed it in the documentation?

...

ANSWER

Answered 2021-Apr-05 at 13:22

In the end we came up with several steps to minimize the risk:

Use a proxy that filters via GeoIP (Repository access is only possible from the countries our customers reside)
Block all URIs except the following (Replace with name of your repo):
- /service/rest/repository/browse/REPONAME/*>
- /repository/REPONAME/*>
- /static/css/nexus-content.css*>
- /favicon.ico*>
- /favicon-*.png>

Source https://stackoverflow.com/questions/66641072

QUESTION

apt-get install can't find pinned versions within Dockerfile

Asked 2021-Jan-27 at 10:56

During the building of a simple Dockerfile, the pinned version of apt-get install is never found and gives me the following output:

...

ANSWER

Answered 2021-Jan-27 at 10:56

The ruby1.9.1 and ruby1.9.1-dev are not available for ubuntu:18.04.
You can find here the list of supported packages by ubuntu version.

You can also read this askubuntu question

Source https://stackoverflow.com/questions/65915832

QUESTION

Removing a delimited block of lines when one of them matches a regex pattern with awk

Asked 2020-Sep-12 at 18:28

Let's assume the following reprepro distributions file:

...

ANSWER

Answered 2020-Sep-12 at 18:19

You can use empty RS, this is the paragraph mode, and do not print any record where that codename exists.

Source https://stackoverflow.com/questions/63863239

QUESTION

How to extract multiple lines between a multi-line pattern and a second string pattern

Asked 2019-Feb-21 at 12:23

The goal is to get the version of a source package in a reprepro-based deb repository.

Since the tracking of source packages is still experimental in reprepro, the list command has issues with --list-format option and thus cannot be used in this use case.

An excerpt of the output of the command to print out all information about tracked source packages is:

...

ANSWER

Answered 2019-Feb-20 at 14:28

It's not entirely clear what you're trying to do but i think you're saying you want to print the version value when a specific string appears in the record. If so that's just:

Source https://stackoverflow.com/questions/54787491

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install reprepro

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: