Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for pushing and managing Debian .deb packages. Server (urapt-server): - REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO) - .deb files stored content-addressed on disk, reference-counted for dedup - Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto) - APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand from the DB, cached in memory, signed with the server key - Full APT model: repositories -> distributions -> components -> architectures - Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads - First registrant becomes admin; repo-scoped permissions (read/write/read-write/admin) plus owner and server-admin roles - Multipart package push with control-field extraction, list/show/delete, pool serving, blob ref-count cleanup - Audit log CLI (urapt): - register/login/logout/whoami, token management - repo/distro/component/arch CRUD, member management - push/pull/ls/show/rm for packages - apt-config helper that emits apt setup commands (key, sources.list, auth.conf for private repos) Packaging & docs: - Dockerfile (multi-stage distroless), docker-compose.yml, sample config - README quick start, architecture overview, config reference, security notes - PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE - GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64) - Makefile release target producing static binaries + tarballs + checksums Tests cover the data-access layer, auth/permission checks, APT index generation, .deb parsing, GPG signing, the REST API, and the typed API client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing a real package.
2026-06-28 16:57:34 -05:00
commit 981587e83d
83 changed files with 12812 additions and 0 deletions
@@ -0,0 +1,107 @@
+package commands
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"urapt/shared/models"
+)
+
+func (r *Root) aptConfigCmd() *cobra.Command {
+	var component, signedBy string
+	cmd := &cobra.Command{
+		Use:   "apt-config <repo> <distro>",
+		Short: "Print apt client configuration (sources.list, key, and auth) for a repository",
+		Args:  cobra.ExactArgs(2),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			repoName, dist := args[0], args[1]
+			c, err := r.client()
+			if err != nil {
+				return err
+			}
+			repo, err := c.GetRepository(repoName)
+			if err != nil {
+				return err
+			}
+			comps, err := c.ListComponents(repoName, dist)
+			if err != nil {
+				return err
+			}
+			arches, err := c.ListArchitectures(repoName, dist)
+			if err != nil {
+				return err
+			}
+
+			server, err := r.server()
+			if err != nil {
+				return err
+			}
+			if signedBy == "" {
+				signedBy = "/usr/share/keyrings/urapt-" + repoName + ".gpg"
+			}
+
+			compList := component
+			if compList == "" {
+				var names []string
+				for _, comp := range comps {
+					names = append(names, comp.Name)
+				}
+				compList = strings.Join(names, " ")
+			}
+			if compList == "" {
+				compList = "main"
+			}
+
+			var archStr string
+			if len(arches) > 0 {
+				var names []string
+				for _, a := range arches {
+					names = append(names, a.Name)
+				}
+				archStr = strings.Join(names, ",")
+			}
+
+			fmt.Println("# 1. Install the repository signing key:")
+			fmt.Printf("curl -fsSL %s/api/v1/server/pubkey | sudo gpg --dearmor -o %s\n\n", server, signedBy)
+
+			fmt.Println("# 2. Add the repository to apt:")
+			line := fmt.Sprintf("deb [signed-by=%s]", signedBy)
+			if archStr != "" {
+				line = fmt.Sprintf("deb [arch=%s signed-by=%s]", archStr, signedBy)
+			}
+			line += fmt.Sprintf(" %s/apt/%s/ %s %s", server, repoName, dist, compList)
+			fmt.Printf("echo '%s' | sudo tee /etc/apt/sources.list.d/%s.list\n\n", line, repoName)
+
+			fmt.Println("# 3. Update apt:")
+			fmt.Println("sudo apt update")
+			fmt.Println()
+
+			if repo.Visibility == models.VisibilityPrivate {
+				host := hostOf(server)
+				fmt.Println("# 4. This repository is private. Configure apt credentials:")
+				fmt.Printf("sudo tee /etc/apt/auth.conf.d/%s.conf <<EOF\n", repoName)
+				fmt.Printf("machine %s\n", host)
+				fmt.Printf("login %s\n", r.cfg.Default.User)
+				tok, _ := r.token()
+				fmt.Printf("password %s\n", tok)
+				fmt.Println("EOF")
+			}
+			return nil
+		},
+	}
+	cmd.Flags().StringVar(&component, "component", "", "components to enable (default: all in distribution)")
+	cmd.Flags().StringVar(&signedBy, "signed-by", "", "path for the dearmored keyring")
+	return cmd
+}
+
+// hostOf extracts the host (and port) from a server URL for auth.conf.
+func hostOf(server string) string {
+	u, err := url.Parse(server)
+	if err != nil {
+		return server
+	}
+	return u.Host
+}