Package: debootstrap
Severity: normal
Vesrion: 1.0.56
Hi,
If you try "debootstrap <ubuntu codename> <dir>", it automatically falls
back to pre-defined HTTPS mirror.
> keyring () {
> if [ -z "$KEYRING" ]; then
> if [ -e "$1" ]; then
> KEYRING="$1"
> elif [ -z "$DISABLE_KEYRING" ]; then
> if [ -n "$DEF_HTTPS_MIRROR" ] && [ -z "$USER_MIRROR"
> ] && [ -z "$FORCE_KEYRING" ]; then
> info KEYRING "Keyring file not available at
> %s; switching to https mirror %s" "$1" "$DEF_HTTPS_MIRROR"
> USER_MIRROR="$DEF_HTTPS_MIRROR"
> else
But defined DEF_HTTPS_MIRROR is https://deb.debian.org, it fails with
a bit wrong error message.
> $ sudo debootstrap artful artful
> I: Keyring file not available at
> /usr/share/keyrings/ubuntu-archive-keyring.gpg; switching to https mirror
> https://deb.debian.org/debian
> I: Retrieving InRelease
> I: Retrieving Release
> E: Failed getting release file
> https://deb.debian.org/debian/dists/artful/Release
Expected behavior is
- fails with just "Keyring file not available" error message
- or falls back to Ubuntu https mirror.
And, https assures only secure *connection*, not integrity of *contents*
as GPG does, so this behavior is not good, IMO.
--
Regards,
Hideki Yamane henrich @ debian.org/iijmio-mail.jp
