-
Notifications
You must be signed in to change notification settings - Fork 2.2k
This issue was moved to a discussion.
You can continue the conversation there. Go to discussion →
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add apt datasource for private repositories #7041
Comments
This comment has been minimized.
This comment has been minimized.
There's no formality to worry about with the Project board and |
Does anyone else here have a use case to manage the dependency versions of actual debian packages themselves, in |
So I looked into this a bit more and I think some of the discussion in the previous issue (#3722) is still relevant:
IMO the best way forward here is:
Most of this is documented here: https://wiki.debian.org/DebianRepository Note: the above only deals with the datasource, e.g. for use with regex managers, not how renovate should incorporate that natively into a manager, although I think one could exist for managing Would love to hear some feedback if I missed anything here, from debian experts from the previous thread @psyb0t @joerocklin @ppmathis @ndbroadbent and also @rarkins if you already had to deal with other datasources that require extra parameters (not just One thing I've never tried with renovate - can multiple registryUrls/sources be combined for a dependency so that renovate picks the latest from a list of sources, like |
Really great info, thanks! You can indeed combine the results from multiple registries, with Example from maven: renovate/lib/datasource/maven/index.ts Line 29 in c077f15
What are the implications of debian repos having only one version? Is it that if you pin a particular version then your build can "break" at any time because they could update the repo to only have a newer version? In such case, what can Renovate do, repology or otherwise? |
Exactly, it doesn't make that much sense for official debian repos, so it's an issue with any datasource (https://unix.stackexchange.com/q/544432). Maybe the main reason for this specific datasource is the large index files though (50-100MB I think in some cases) to prevent people using it so it doesn't slow down renovate runs. Small private indices can be a few dozen KB and there it makes more sense. But I think this was already discussed in the previous issue and that's why it makes more sense for internal/private repositories where you can ensure that versions persist - even custom servers based on https://wiki.debian.org/DebianRepository/Setup. You basically just need an HTTP server serving a structure as defined by Debian - this is why fetching the index seems to me the most reliable way. I had a quick look at other ideas from competitors (no one has implemented this properly yet), and the only idea I could find simply relies on running local |
I've created a branch were I've implemented the Debian package source similarly to what @nejch wrote here and created the PR #13463 . I've made the architecture for binary packages configurable on a repository basis. My reasoning is that the repository that has a certain package as a dependency knows the destination it will be run at. I haven't implemented support for source packages (yet) but I think this should be easy. Currently, my approach is to download the Packages file, extract it and parse it within Node.JS. On my machine, parsing Debian's main amd64 Packages file takes ~800ms. There is plenty room for improvements there though but all in all I think it's not necessary to use the |
@Ka0o0 we would prefer to avoid using |
@rarkins it is, see my review in PR. |
I stumbled across this issue, and would like to see this in renovate, too bad the PR got closed :( Is there currently an alternative available? |
Hii |
This issue was moved to a discussion.
You can continue the conversation there. Go to discussion →
What would you like Renovate to be able to do?
#3722 was closed because we can manage packages pining with public apt repositories through the repology datasource. It does not work for private repositories and any repository that is not indexed by repology.
Did you already have any implementation ideas?
We can use the output of
apt-cache policy
but that needs an identical/etc/apt
directory between the renovate environment running the command and the environment of the project being updated.See: https://stackoverflow.com/questions/18885820/how-to-check-the-version-before-installing-a-package-using-apt-get
Are there any workarounds or alternative ideas you've tried to avoid needing this feature?
I create Docker layers with the apt packages installed in it to ensure immutability through the Docker datasource. But that is not an optimized solution at all.
The text was updated successfully, but these errors were encountered: