Files
urapt/cli/commands/aptconfig.go
T
owen 981587e83d Initial release: self-hostable APT repository server and CLI
urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.
2026-06-28 16:57:34 -05:00

108 lines
2.8 KiB
Go

package commands
import (
"fmt"
"net/url"
"strings"
"github.com/spf13/cobra"
"urapt/shared/models"
)
func (r *Root) aptConfigCmd() *cobra.Command {
var component, signedBy string
cmd := &cobra.Command{
Use: "apt-config <repo> <distro>",
Short: "Print apt client configuration (sources.list, key, and auth) for a repository",
Args: cobra.ExactArgs(2),
RunE: func(cmd *cobra.Command, args []string) error {
repoName, dist := args[0], args[1]
c, err := r.client()
if err != nil {
return err
}
repo, err := c.GetRepository(repoName)
if err != nil {
return err
}
comps, err := c.ListComponents(repoName, dist)
if err != nil {
return err
}
arches, err := c.ListArchitectures(repoName, dist)
if err != nil {
return err
}
server, err := r.server()
if err != nil {
return err
}
if signedBy == "" {
signedBy = "/usr/share/keyrings/urapt-" + repoName + ".gpg"
}
compList := component
if compList == "" {
var names []string
for _, comp := range comps {
names = append(names, comp.Name)
}
compList = strings.Join(names, " ")
}
if compList == "" {
compList = "main"
}
var archStr string
if len(arches) > 0 {
var names []string
for _, a := range arches {
names = append(names, a.Name)
}
archStr = strings.Join(names, ",")
}
fmt.Println("# 1. Install the repository signing key:")
fmt.Printf("curl -fsSL %s/api/v1/server/pubkey | sudo gpg --dearmor -o %s\n\n", server, signedBy)
fmt.Println("# 2. Add the repository to apt:")
line := fmt.Sprintf("deb [signed-by=%s]", signedBy)
if archStr != "" {
line = fmt.Sprintf("deb [arch=%s signed-by=%s]", archStr, signedBy)
}
line += fmt.Sprintf(" %s/apt/%s/ %s %s", server, repoName, dist, compList)
fmt.Printf("echo '%s' | sudo tee /etc/apt/sources.list.d/%s.list\n\n", line, repoName)
fmt.Println("# 3. Update apt:")
fmt.Println("sudo apt update")
fmt.Println()
if repo.Visibility == models.VisibilityPrivate {
host := hostOf(server)
fmt.Println("# 4. This repository is private. Configure apt credentials:")
fmt.Printf("sudo tee /etc/apt/auth.conf.d/%s.conf <<EOF\n", repoName)
fmt.Printf("machine %s\n", host)
fmt.Printf("login %s\n", r.cfg.Default.User)
tok, _ := r.token()
fmt.Printf("password %s\n", tok)
fmt.Println("EOF")
}
return nil
},
}
cmd.Flags().StringVar(&component, "component", "", "components to enable (default: all in distribution)")
cmd.Flags().StringVar(&signedBy, "signed-by", "", "path for the dearmored keyring")
return cmd
}
// hostOf extracts the host (and port) from a server URL for auth.conf.
func hostOf(server string) string {
u, err := url.Parse(server)
if err != nil {
return server
}
return u.Host
}