nala
nala copied to clipboard
volitank
Error $URL 404 Not Found (but apt-get is fine with it)
Hello,
we are using nala on a Debian 12-based system with various apt source files configured. However, we found a problem with nala when adding the apt source config for containerlab.
/etc/apt/source.list.d/apt_fury_io_netdevops.list:
deb [trusted=yes] https://apt.fury.io/netdevops/ /
Running $ nala update throws a bunch of errors:
$ nala update
Error: https://apt.fury.io/netdevops Packages
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Translation-en
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops Contents (deb)
404 Not Found [IP: 75.101.184.39 443]
╭─ Updating Package List ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│No Change: http://security.debian.org/debian-security bookworm-security InRelease │
│No Change: http://deb.debian.org/debian bookworm InRelease │
│No Change: http://deb.debian.org/debian bookworm-updates InRelease │
│No Change: http://deb.debian.org/debian-security bookworm-security InRelease │
│No Change: https://download.docker.com/linux/debian bullseye InRelease │
│No Change: https://apt.releases.hashicorp.com jammy InRelease │
│Ignored: https://apt.fury.io/netdevops InRelease │
│No Change: https://deb.volian.org/volian scar InRelease │
│Ignored: https://apt.fury.io/netdevops Release │
│Updated: https://apt.fury.io/netdevops Packages │
│Ignored: https://apt.fury.io/netdevops Translation-en │
│Ignored: https://apt.fury.io/netdevops Contents (deb) │
│Ignored: https://apt.fury.io/netdevops Contents (deb) │
│Fetched 21 KB in 3s (6.9 KB/s) │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
However, apt-get is fine with it:
$ apt-get update
Hit:1 http://security.debian.org/debian-security bookworm-security InRelease
Hit:2 https://download.docker.com/linux/debian bullseye InRelease
Hit:3 https://apt.releases.hashicorp.com jammy InRelease
Hit:4 http://deb.debian.org/debian bookworm InRelease
Hit:5 http://deb.debian.org/debian bookworm-updates InRelease
Hit:6 http://deb.debian.org/debian-security bookworm-security InRelease
Ign:7 https://apt.fury.io/netdevops InRelease
Hit:8 https://deb.volian.org/volian scar InRelease
Ign:9 https://apt.fury.io/netdevops Release
Ign:10 https://apt.fury.io/netdevops Packages
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Get:10 https://apt.fury.io/netdevops Packages
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Ign:11 https://apt.fury.io/netdevops Translation-en
Ign:12 https://apt.fury.io/netdevops Contents (deb)
Ign:13 https://apt.fury.io/netdevops Contents (deb)
Fetched 20.8 kB in 3s (6718 B/s)
Reading package lists... Done
Is this a problem with the apt repository of the containerlab or is it a bug/misconfiguration of nala? How can I configure nala to accept the containerlab repository?
Thanks in advance.
There are a couple of things going on here.
First Apt and Nala are handling these the same. If we ignore the 404 errors from Nala and just look at the window, you can see it is ignoring most of the things it's trying to hit except for Packages, just like apt is. The difference is that Nala is throwing errors with more information than apt and saying that it cannot reach those places it wants too.
I did a little digging and this repo from containerlab is kind of wild tbh. They do not use InRelease/Release file like basically every other repository, for example my repo https://deb.volian.org/volian/dists/scar/InRelease
The only accessible page from them is https://apt.fury.io/netdevops/Packages. They do have the package hashsums and stuff in there, but this isn't the most secure way to distribute packages. If you look at a Debian/Ubuntu InRelease, or even mine, they are PGP signed, and you have to have the corresponding public key on the system for apt/nala to trust them, or do as they've asked you to do by saying [trusted=yes]. They are putting all their security into the https basket, which I do not agree with.
In this configuration if someone were to DNS hijack this domain, they could redirect it to a server with malicious .debs and apt would upgrade your systems to malicious packages with no questions asked. (Of course they have to solve the https certificate issue, which if they could compromise their DNS account to hijack the domain that wouldn't be difficult to do with letsencrypt).
With the way that most repositories work, since they are PGP signed, they would also need that private key in order to accomplish this, so it's more unlikely, and apt would give you a warning saying that the repo is not trusted.
Security ranting aside, apt and nala are working the same in this case, just Nala is giving more info. I don't know that I personally would want to hide messages like this.
Thank you for your detailed answer.
On occasion, I will rise the issue with the weird apt repository to the Containerlab developers.