Serve the releases' .debs as a signed apt repository at /apt ea85398a51bc

//! The apt repository at `/apt` (oxygenhub#85): the `.deb` assets of the

//! configured repositories' releases, indexed and signed so that

//! `apt install oxy oh` and `apt upgrade` work. Nothing is stored apart:

//! the index is built from the releases when they change, and the pool

//! serves the assets' own bytes.

use crate::{db, Shared};

use axum::extract::{Path, State};

use axum::http::{header, StatusCode};

use axum::response::{IntoResponse, Response};

use sha2::Digest;

use std::collections::{BTreeMap, HashMap};

use std::io::Read;

use std::sync::{Arc, Mutex, OnceLock};

/// One package as the index lists it.

#[derive(Clone, Debug)]

struct Entry {

    /// The control paragraph, as the package has it.

    control: String,

    package: String,

    architecture: String,

    /// The asset's name, which is its pool file name.

    file: String,

    size: u64,

    md5: String,

    sha256: String,

}

/// The signed index, built from one set of assets.

struct Index {

    /// What it was built from: each `.deb` asset's id and hash.

    key: String,

    /// `main/binary-ARCH/Packages` and `.gz`, by their path under the suite.

    files: BTreeMap<String, Vec<u8>>,

    release: String,

    in_release: Vec<u8>,

    release_gpg: Vec<u8>,

    /// Pool file name to the asset's blob hash.

    pool: HashMap<String, String>,

}

/// Parsed `.deb`s by blob hash: a package is read once.

fn parsed() -> &'static Mutex<HashMap<String, Entry>> {

    static P: OnceLock<Mutex<HashMap<String, Entry>>> = OnceLock::new();

    P.get_or_init(Default::default)

}

fn built() -> &'static Mutex<Option<Arc<Index>>> {

    static B: OnceLock<Mutex<Option<Arc<Index>>>> = OnceLock::new();

    B.get_or_init(Default::default)

}

// ------------------------------------------------------------- .deb files

/// The members of an `ar` archive, by name.

fn ar_members(bytes: &[u8]) -> Result<Vec<(String, &[u8])>, String> {

    let body = bytes.strip_prefix(b"!<arch>\n").ok_or("not an ar archive")?;

    let mut out = Vec::new();

    let mut at = 0;

    while at + 60 <= body.len() {

        let head = &body[at..at + 60];

        let name = String::from_utf8_lossy(&head[..16]).trim().trim_end_matches('/').to_string();

        let size: usize = String::from_utf8_lossy(&head[48..58]).trim().parse().map_err(|_| "bad ar member size")?;

        let start = at + 60;

        let end = start.checked_add(size).filter(|e| *e <= body.len()).ok_or("truncated ar archive")?;

        out.push((name, &body[start..end]));

        at = end + (size & 1);

    }

    Ok(out)

}

/// The `control` file of a `.deb`.

pub fn deb_control(bytes: &[u8]) -> Result<String, String> {

    let members = ar_members(bytes)?;

    let (name, data) = members.into_iter().find(|(n, _)| n.starts_with("control.tar")).ok_or("no control.tar member")?;

    let mut tar_bytes = Vec::new();

    match name.as_str() {

        "control.tar" => tar_bytes.extend_from_slice(data),

        "control.tar.gz" => {

            flate2::read::GzDecoder::new(data).read_to_end(&mut tar_bytes).map_err(|e| e.to_string())?;

        }

        "control.tar.xz" => lzma_rs::xz_decompress(&mut std::io::BufReader::new(data), &mut tar_bytes).map_err(|e| e.to_string())?,

        "control.tar.zst" => tar_bytes = zstd::decode_all(data).map_err(|e| e.to_string())?,

        other => return Err(format!("{other}: a compression this hub does not read")),

    }

    let mut archive = tar::Archive::new(tar_bytes.as_slice());

    for entry in archive.entries().map_err(|e| e.to_string())? {

        let mut entry = entry.map_err(|e| e.to_string())?;

        let path = entry.path().map_err(|e| e.to_string())?.to_string_lossy().to_string();

        if path.trim_start_matches("./") == "control" {

            let mut text = String::new();

            entry.read_to_string(&mut text).map_err(|e| e.to_string())?;

            return Ok(text);

        }

    }

    Err("no control file".into())

}

/// A control paragraph's field.

fn field<'a>(control: &'a str, name: &str) -> Option<&'a str> {

    control.lines().find_map(|l| l.strip_prefix(name).and_then(|r| r.strip_prefix(':')).map(str::trim))

}

fn entry_of(file: &str, bytes: &[u8]) -> Result<Entry, String> {

    let control = deb_control(bytes)?;

    let package = field(&control, "Package").ok_or("no Package field")?.to_string();

    let architecture = field(&control, "Architecture").ok_or("no Architecture field")?.to_string();

    field(&control, "Version").ok_or("no Version field")?;

    Ok(Entry {

        control: control.trim_end().to_string(),

        package,

        architecture,

        file: file.to_string(),

        size: bytes.len() as u64,

        md5: hex::encode(md5::Md5::digest(bytes)),

        sha256: hex::encode(sha2::Sha256::digest(bytes)),

    })

}

// ------------------------------------------------------------------ index

/// The `.deb` assets of the configured public repositories: (asset id,

/// name, blob hash).

async fn debs(app: &Shared) -> Result<Vec<(i64, String, String)>, sqlx::Error> {

    let mut out = Vec::new();

    for slug in &app.config.apt.repos {

        let Some((owner, name)) = slug.split_once('/') else { continue };

        let Some(row) = db::repos::get(&app.db, owner, name).await? else { continue };

        if row.visibility() != hub_api::Visibility::Public {

            tracing::warn!("apt: {slug} is not public, so its packages are not served");

            continue;

        }

        let rows: Vec<(i64, String, String)> = sqlx::query_as(

            "SELECT a.id, a.name, a.hash FROM release_assets a JOIN releases r ON r.id = a.release_id \

             WHERE r.repo_id = ? AND a.name LIKE '%.deb' ORDER BY a.id",

        )

        .bind(row.id)

        .fetch_all(&app.db)

        .await?;

        out.extend(rows);

    }

    Ok(out)

}

/// The pool path of a package: `pool/COMPONENT/p/PACKAGE/FILE`.

fn pool_path(component: &str, e: &Entry) -> String {

    let first: String = e.package.chars().take(1).collect();

    format!("pool/{component}/{first}/{}/{}", e.package, e.file)

}

/// RFC 2822 date in UTC, as Release files carry it.

fn rfc2822(secs: i64) -> String {

    let t = time::OffsetDateTime::from_unix_timestamp(secs).unwrap_or(time::OffsetDateTime::UNIX_EPOCH);

    let fmt = time::macros::format_description!("[weekday repr:short], [day] [month repr:short] [year] [hour]:[minute]:[second] UTC");

    t.format(&fmt).unwrap_or_default()

}

/// Run gpg with the repository's key on `input`.

async fn gpg(app: &Shared, args: &[&str], input: &[u8]) -> Result<Vec<u8>, String> {

    use tokio::io::AsyncWriteExt;

    let home = app.config.data.join(&app.config.apt.gnupg_home);

    let mut child = tokio::process::Command::new("gpg")

        .arg("--homedir")

        .arg(&home)

        .args(["--batch", "--yes", "--quiet", "--no-tty", "--pinentry-mode", "loopback", "--passphrase", ""])

        .args(args)

        .stdin(std::process::Stdio::piped())

        .stdout(std::process::Stdio::piped())

        .stderr(std::process::Stdio::piped())

        .spawn()

        .map_err(|e| format!("gpg: {e}"))?;

    let mut stdin = child.stdin.take().expect("piped");

    stdin.write_all(input).await.map_err(|e| e.to_string())?;

    drop(stdin);

    let out = child.wait_with_output().await.map_err(|e| e.to_string())?;

    if !out.status.success() {

        return Err(format!("gpg {}: {}", args.join(" "), String::from_utf8_lossy(&out.stderr).trim()));

    }

    Ok(out.stdout)

}

/// The index for the assets there are now, built when they changed.

async fn index(app: &Shared) -> Result<Arc<Index>, String> {

    let assets = debs(app).await.map_err(|e| e.to_string())?;

    let key: String = assets.iter().map(|(id, _, h)| format!("{id}:{h};")).collect();

    if let Some(i) = built().lock().unwrap().as_ref().filter(|i| i.key == key) {

        return Ok(i.clone());

    }

    let cfg = &app.config.apt;

    let mut entries: Vec<Entry> = Vec::new();

    let mut pool = HashMap::new();

    for (_, name, hash) in &assets {

        let known = parsed().lock().unwrap().get(hash).cloned();

        let e = match known {

            Some(e) => Entry { file: name.clone(), ..e },

            None => {

                let bytes = tokio::fs::read(crate::web::releases::blob_path(app, hash)).await.map_err(|e| e.to_string())?;

                match entry_of(name, &bytes) {

                    Ok(e) => {

                        parsed().lock().unwrap().insert(hash.clone(), e.clone());

                        e

                    }

                    Err(why) => {

                        tracing::warn!("apt: {name} is left out: {why}");

                        continue;

                    }

                }

            }

        };

        if pool.contains_key(&e.file) {

            continue;

        }

        pool.insert(e.file.clone(), hash.clone());

        entries.push(e);

    }

    let mut files = BTreeMap::new();

    for arch in &cfg.architectures {

        let mut text = String::new();

        for e in entries.iter().filter(|e| e.architecture == *arch || e.architecture == "all") {

            text.push_str(&format!(

                "{}\nFilename: {}\nSize: {}\nMD5sum: {}\nSHA256: {}\n\n",

                e.control,

                pool_path(&cfg.component, e),

                e.size,

                e.md5,

                e.sha256

            ));

        }

        let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::best());

        std::io::Write::write_all(&mut gz, text.as_bytes()).map_err(|e| e.to_string())?;

        let gz = gz.finish().map_err(|e| e.to_string())?;

        files.insert(format!("{}/binary-{arch}/Packages", cfg.component), text.into_bytes());

        files.insert(format!("{}/binary-{arch}/Packages.gz", cfg.component), gz);

    }

    let sums = |f: &dyn Fn(&[u8]) -> String| -> String {

        files.iter().map(|(path, bytes)| format!(" {} {:>8} {path}\n", f(bytes), bytes.len())).collect()

    };

    let release = format!(

        "Origin: {site}\nLabel: {site}\nSuite: {suite}\nCodename: {suite}\nDate: {date}\nArchitectures: {arches}\nComponents: {component}\nDescription: {site} packages (oxy and oh)\nMD5Sum:\n{md5}SHA256:\n{sha256}",

        site = app.config.site.name,

        suite = cfg.suite,

        date = rfc2822(db::now_ms() / 1000),

        arches = cfg.architectures.join(" "),

        component = cfg.component,

        md5 = sums(&|b| hex::encode(md5::Md5::digest(b))),

        sha256 = sums(&|b| hex::encode(sha2::Sha256::digest(b))),

    );

    let in_release = gpg(app, &["--clearsign", "--digest-algo", "SHA512"], release.as_bytes()).await?;

    let release_gpg = gpg(app, &["--detach-sign", "--armor", "--digest-algo", "SHA512"], release.as_bytes()).await?;

    let i = Arc::new(Index { key, files, release, in_release, release_gpg, pool });

    *built().lock().unwrap() = Some(i.clone());

    Ok(i)

}

// ----------------------------------------------------------------- routes

fn enabled(app: &Shared) -> bool {

    !app.config.apt.repos.is_empty()

}

fn reply(ct: &str, bytes: Vec<u8>) -> Response {

    ([(header::CONTENT_TYPE, ct.to_string()), (header::CACHE_CONTROL, "no-cache".to_string())], bytes).into_response()

}

fn not_found() -> Response {

    (StatusCode::NOT_FOUND, "not found\n").into_response()

}

fn failed(why: String) -> Response {

    tracing::warn!("apt: {why}");

    (StatusCode::SERVICE_UNAVAILABLE, "the package index is not available just now\n").into_response()

}

/// `GET /apt`: how to use it.

pub async fn home(State(app): State<Shared>) -> Response {

    if !enabled(&app) {

        return not_found();

    }

    let base = app.config.base_url();

    let cfg = &app.config.apt;

    let text = format!(

        "{site} apt repository: oxy and oh for Debian and Ubuntu ({arches}).\n\n\

         Installing a .deb from a release adds this repository by itself. To add it by hand:\n\n\

         sudo curl -fsSLo /usr/share/keyrings/oxygenhub-archive-keyring.gpg {base}/apt/oxygenhub.gpg\n\

         sudo tee /etc/apt/sources.list.d/oxygenhub.sources >/dev/null <<EOF\n\

         Types: deb\nURIs: {base}/apt\nSuites: {suite}\nComponents: {component}\n\

         Signed-By: /usr/share/keyrings/oxygenhub-archive-keyring.gpg\nEOF\n\

         sudo apt update && sudo apt install oxy oh\n\n\

         The signing key's fingerprint is in {base}/apt/oxygenhub.asc (gpg --show-keys).\n",

        site = app.config.site.name,

        arches = cfg.architectures.join(", "),

        suite = cfg.suite,

        component = cfg.component,

    );

    reply("text/plain; charset=utf-8", text.into_bytes())

}

/// `GET /apt/oxygenhub.gpg` (binary keyring) and `/apt/oxygenhub.asc`.

pub async fn key(State(app): State<Shared>, Path(file): Path<String>) -> Response {

    if !enabled(&app) {

        return not_found();

    }

    let armor = match file.as_str() {

        "oxygenhub.gpg" => false,

        "oxygenhub.asc" => true,

        _ => return not_found(),

    };

    let args: &[&str] = if armor { &["--armor", "--export"] } else { &["--export"] };

    match gpg(&app, args, b"").await {

        Ok(k) if !k.is_empty() => reply(if armor { "text/plain; charset=utf-8" } else { "application/pgp-keys" }, k),

        Ok(_) => failed("the signing key is missing".into()),

        Err(e) => failed(e),

    }

}

/// `GET /apt/dists/SUITE/…`: the Release files and the Packages indexes.

pub async fn dists(State(app): State<Shared>, Path((suite, rest)): Path<(String, String)>) -> Response {

    if !enabled(&app) || suite != app.config.apt.suite {

        return not_found();

    }

    let i = match index(&app).await {

        Ok(i) => i,

        Err(e) => return failed(e),

    };

    match rest.as_str() {

        "InRelease" => reply("text/plain; charset=utf-8", i.in_release.clone()),

        "Release" => reply("text/plain; charset=utf-8", i.release.clone().into_bytes()),

        "Release.gpg" => reply("application/pgp-signature", i.release_gpg.clone()),

        path => match i.files.get(path) {

            Some(b) if path.ends_with(".gz") => reply("application/gzip", b.clone()),

            Some(b) => reply("text/plain; charset=utf-8", b.clone()),

            None => not_found(),

        },

    }

}

/// `GET /apt/pool/…/FILE`: a package's bytes.

pub async fn pool(State(app): State<Shared>, Path(path): Path<String>) -> Response {

    if !enabled(&app) {

        return not_found();

    }

    let i = match index(&app).await {

        Ok(i) => i,

        Err(e) => return failed(e),

    };

    let file = path.rsplit('/').next().unwrap_or("");

    let Some(hash) = i.pool.get(file) else { return not_found() };

    match tokio::fs::read(crate::web::releases::blob_path(&app, hash)).await {

        Ok(bytes) => (

            [

                (header::CONTENT_TYPE, "application/vnd.debian.binary-package".to_string()),

                (header::CACHE_CONTROL, "public, max-age=31536000, immutable".to_string()),

            ],

            bytes,

        )

            .into_response(),

        Err(_) => not_found(),

    }

}

#[cfg(test)]

mod tests {

    use super::*;

    /// A minimal `.deb`: an ar archive with a control archive compressed

    /// as `name` says.

    pub fn deb(control: &str, member: &str) -> Vec<u8> {

        let mut tar_bytes = Vec::new();

        {

            let mut t = tar::Builder::new(&mut tar_bytes);

            let mut h = tar::Header::new_gnu();

            h.set_size(control.len() as u64);

            h.set_mode(0o644);

            h.set_cksum();

            t.append_data(&mut h, "./control", control.as_bytes()).unwrap();

            t.finish().unwrap();

        }

        let packed = match member {

            "control.tar.gz" => {

                let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());

                std::io::Write::write_all(&mut gz, &tar_bytes).unwrap();

                gz.finish().unwrap()

            }

            "control.tar.xz" => {

                let mut out = Vec::new();

                lzma_rs::xz_compress(&mut tar_bytes.as_slice(), &mut out).unwrap();

                out

            }

            "control.tar.zst" => zstd::encode_all(tar_bytes.as_slice(), 3).unwrap(),

            _ => tar_bytes,

        };

        let mut out = b"!<arch>\n".to_vec();

        for (name, data) in [("debian-binary", b"2.0\n".to_vec()), (member, packed), ("data.tar.gz", vec![0u8; 3])] {

            out.extend_from_slice(format!("{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n", name, 0, 0, 0, 100644, data.len()).as_bytes());

            out.extend_from_slice(&data);

            if data.len() % 2 == 1 {

                out.push(b'\n');

            }

        }

        out

    }

    #[test]

    fn control_is_read_from_every_compression() {

        let control = "Package: oxy\nVersion: 0.3.0\nArchitecture: amd64\nDescription: test\n";

        for m in ["control.tar", "control.tar.gz", "control.tar.xz", "control.tar.zst"] {

            let e = entry_of("oxy_0.3.0_amd64.deb", &deb(control, m)).unwrap();

            assert_eq!((e.package.as_str(), e.architecture.as_str()), ("oxy", "amd64"), "{m}");

            assert!(e.control.contains("Version: 0.3.0"));

        }

        assert!(deb_control(b"not a deb").is_err());

        assert_eq!(

            pool_path("main", &entry_of("oxy_0.3.0_amd64.deb", &deb(control, "control.tar.gz")).unwrap()),

            "pool/main/o/oxy/oxy_0.3.0_amd64.deb"

        );

        assert_eq!(rfc2822(0), "Thu, 01 Jan 1970 00:00:00 UTC");

    }

}

//! The apt repository (oxygenhub#85): a release's `.deb` assets indexed,

//! signed and served at `/apt`, as apt reads them.

use axum::body::Body;

use axum::http::{Request, StatusCode};

use http_body_util::BodyExt;

use oxygenhub::config::Config;

use oxygenhub::db;

use oxygenhub::repos::RepoName;

use oxygenhub::Shared;

use std::io::Read;

use std::path::Path;

use std::process::Command;

use tower::ServiceExt;

async fn get(app: &Shared, path: &str) -> (StatusCode, Vec<u8>) {

    let res = oxygenhub::router(app.clone()).oneshot(Request::get(path).body(Body::empty()).unwrap()).await.unwrap();

    let status = res.status();

    (status, res.into_body().collect().await.unwrap().to_bytes().to_vec())

}

/// A minimal `.deb` with this control file (gzip control archive).

fn deb(control: &str) -> Vec<u8> {

    let mut tar_bytes = Vec::new();

    {

        let mut t = tar::Builder::new(&mut tar_bytes);

        let mut h = tar::Header::new_gnu();

        h.set_size(control.len() as u64);

        h.set_mode(0o644);

        h.set_cksum();

        t.append_data(&mut h, "./control", control.as_bytes()).unwrap();

        t.finish().unwrap();

    }

    let mut gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());

    std::io::Write::write_all(&mut gz, &tar_bytes).unwrap();

    let packed = gz.finish().unwrap();

    let mut out = b"!<arch>\n".to_vec();

    for (name, data) in [("debian-binary", b"2.0\n".to_vec()), ("control.tar.gz", packed), ("data.tar.gz", vec![1u8, 2, 3])] {

        out.extend_from_slice(format!("{:<16}{:<12}{:<6}{:<6}{:<8}{:<10}`\n", name, 0, 0, 0, 100644, data.len()).as_bytes());

        out.extend_from_slice(&data);

        if data.len() % 2 == 1 {

            out.push(b'\n');

        }

    }

    out

}

fn have_gpg() -> bool {

    Command::new("gpg").arg("--version").output().is_ok_and(|o| o.status.success())

}

fn gpg(home: &Path, args: &[&str]) -> std::process::Output {

    Command::new("gpg")

        .arg("--homedir")

        .arg(home)

        .args(["--batch", "--quiet", "--pinentry-mode", "loopback", "--passphrase", ""])

        .args(args)

        .output()

        .unwrap()

}

#[tokio::test(flavor = "multi_thread")]

async fn releases_debs_are_an_apt_repository() {

    if !have_gpg() {

        eprintln!("gpg is not installed: the apt repository is not tested here");

        return;

    }

    let dir = tempfile::tempdir().unwrap();

    let mut config = Config::load(dir.path()).unwrap();

    config.apt.repos = vec!["andy/oxy".into(), "andy/hidden".into()];

    // The signing key, in the hub's data as on Earth.

    let home = dir.path().join("apt-gnupg");

    std::fs::create_dir_all(&home).unwrap();

    std::fs::set_permissions(&home, std::os::unix::fs::PermissionsExt::from_mode(0o700)).unwrap();

    let made = gpg(&home, &["--quick-gen-key", "Test archive key <[email protected]>", "ed25519", "sign", "never"]);

    assert!(made.status.success(), "{}", String::from_utf8_lossy(&made.stderr));

    let app = oxygenhub::build(config).await.unwrap();

    // Off when no repository is configured is checked by the default

    // config elsewhere; here, a public repository with a release, and a

    // private one whose packages must not leak.

    db::accounts::create_account(&app.db, "andy", "[email protected]", "x", "salt", true).await.unwrap();

    for (name, vis) in [("oxy", hub_api::Visibility::Public), ("hidden", hub_api::Visibility::Private)] {

        app.repos.create(&RepoName::parse(&format!("andy/{name}")).unwrap(), None).unwrap();

        db::repos::create(&app.db, "andy", name, "", vis).await.unwrap();

    }

    let control = |pkg: &str, v: &str, arch: &str| {

        format!("Package: {pkg}\nVersion: {v}\nArchitecture: {arch}\nMaintainer: Andy <[email protected]>\nDescription: {pkg} for tests\n")

    };

    let oxy = db::repos::get(&app.db, "andy", "oxy").await.unwrap().unwrap();

    let rel = db::releases::create(&app.db, oxy.id, "v0.3.0", "0.3.0", "", true, None).await.unwrap();

    let amd = deb(&control("oxy", "0.3.0", "amd64"));

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_amd64.deb", "", &amd).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy_0.3.0_riscv64.deb", "", &deb(&control("oxy", "0.3.0", "riscv64")))

        .await

        .unwrap();

    oxygenhub::web::releases::store_asset(&app, rel.id, "oxy-0.3.0-linux-x86_64.tar.gz", "", b"not a deb").await.unwrap();

    let hidden = db::repos::get(&app.db, "andy", "hidden").await.unwrap().unwrap();

    let hr = db::releases::create(&app.db, hidden.id, "v1", "1", "", false, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, hr.id, "secret_1_amd64.deb", "", &deb(&control("secret", "1", "amd64"))).await.unwrap();

    let (st, how) = get(&app, "/apt").await;

    assert_eq!(st, StatusCode::OK);

    assert!(String::from_utf8_lossy(&how).contains("sources.list.d/oxygenhub.sources"));

    // The index lists both architectures' packages, not the tarball, not

    // the private repository's.

    let (st, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;

    assert_eq!(st, StatusCode::OK);

    let packages = String::from_utf8(packages).unwrap();

    assert!(packages.contains("Package: oxy\nVersion: 0.3.0\nArchitecture: amd64"), "{packages}");

    assert!(packages.contains("Filename: pool/main/o/oxy/oxy_0.3.0_amd64.deb"), "{packages}");

    assert!(packages.contains(&format!("Size: {}", amd.len())));

    assert!(!packages.contains("secret"), "a private repository's packages are not served");

    let (_, riscv) = get(&app, "/apt/dists/stable/main/binary-riscv64/Packages").await;

    assert!(String::from_utf8_lossy(&riscv).contains("oxy_0.3.0_riscv64.deb"));

    let (st, gz) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages.gz").await;

    assert_eq!(st, StatusCode::OK);

    let mut unzipped = String::new();

    flate2::read::GzDecoder::new(gz.as_slice()).read_to_string(&mut unzipped).unwrap();

    assert_eq!(unzipped, packages);

    // Release names every index with its hash; InRelease and Release.gpg

    // verify against the published key.

    let (_, release) = get(&app, "/apt/dists/stable/Release").await;

    let release = String::from_utf8(release).unwrap();

    use sha2::Digest;

    let sum = hex::encode(sha2::Sha256::digest(packages.as_bytes()));

    assert!(release.contains(&format!("{sum} {:>8} main/binary-amd64/Packages\n", packages.len())), "{release}");

    assert!(release.contains("Architectures: amd64 arm64 riscv64"));

    let (st, key) = get(&app, "/apt/oxygenhub.gpg").await;

    assert_eq!(st, StatusCode::OK);

    let keyring = dir.path().join("keyring.gpg");

    std::fs::write(&keyring, &key).unwrap();

    let (_, in_release) = get(&app, "/apt/dists/stable/InRelease").await;

    assert!(String::from_utf8_lossy(&in_release).starts_with("-----BEGIN PGP SIGNED MESSAGE-----"));

    let signed = dir.path().join("InRelease");

    std::fs::write(&signed, &in_release).unwrap();

    let v = Command::new("gpgv").arg("--keyring").arg(&keyring).arg(&signed).output().unwrap();

    assert!(v.status.success(), "InRelease verifies: {}", String::from_utf8_lossy(&v.stderr));

    let (_, detached) = get(&app, "/apt/dists/stable/Release.gpg").await;

    std::fs::write(dir.path().join("Release.gpg"), &detached).unwrap();

    std::fs::write(dir.path().join("Release"), &release).unwrap();

    let v = Command::new("gpgv")

        .arg("--keyring")

        .arg(&keyring)

        .arg(dir.path().join("Release.gpg"))

        .arg(dir.path().join("Release"))

        .output()

        .unwrap();

    assert!(v.status.success(), "Release.gpg verifies: {}", String::from_utf8_lossy(&v.stderr));

    // The pool serves the package's own bytes; nothing else.

    let (st, bytes) = get(&app, "/apt/pool/main/o/oxy/oxy_0.3.0_amd64.deb").await;

    assert_eq!((st, bytes.len()), (StatusCode::OK, amd.len()));

    assert_eq!(get(&app, "/apt/pool/main/s/secret/secret_1_amd64.deb").await.0, StatusCode::NOT_FOUND);

    assert_eq!(get(&app, "/apt/dists/unstable/Release").await.0, StatusCode::NOT_FOUND);

    // A new release is in the index at once.

    let rel2 = db::releases::create(&app.db, oxy.id, "v0.3.1", "0.3.1", "", true, None).await.unwrap();

    oxygenhub::web::releases::store_asset(&app, rel2.id, "oxy_0.3.1_amd64.deb", "", &deb(&control("oxy", "0.3.1", "amd64"))).await.unwrap();

    let (_, packages) = get(&app, "/apt/dists/stable/main/binary-amd64/Packages").await;

    assert!(String::from_utf8_lossy(&packages).contains("Version: 0.3.1"));

    Command::new("gpgconf").arg("--homedir").arg(&home).args(["--kill", "gpg-agent"]).output().ok();

}

#[tokio::test(flavor = "multi_thread")]

async fn apt_is_off_unless_configured() {

    let dir = tempfile::tempdir().unwrap();

    let app = oxygenhub::build(Config::load(dir.path()).unwrap()).await.unwrap();

    assert_eq!(get(&app, "/apt").await.0, StatusCode::NOT_FOUND);

    assert_eq!(get(&app, "/apt/dists/stable/InRelease").await.0, StatusCode::NOT_FOUND);

}

- **An apt repository at `/apt` (#85).** The hub serves the `.deb` assets of the releases of the repositories named in `[apt] repos` (public ones only) as a signed apt repository: `dists/stable/InRelease`, `Release` and `Release.gpg`, `main/binary-{amd64,arm64,riscv64}/Packages(.gz)`, and the pool. The index is rebuilt when a release's packages change, and signed with the key in the data directory's `apt-gnupg` (public key at `/apt/oxygenhub.gpg`). `/apt` says how to add it.

name = "lzma-rs"

version = "0.3.0"

source = "registry+https://github.com/rust-lang/crates.io-index"

checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e"

dependencies = [

 "byteorder",

 "crc",

]

[[package]]

 "flate2",

 "lzma-rs",

 "md-5",

 "sha2 0.10.9",

# apt repository (oxygenhub#85): .deb control archives, index hashes.

flate2 = "1"

lzma-rs = "0.3"

sha2 = "0.10"

md-5 = "0.10"

    pub apt: Apt,

/// The apt repository at `/apt` (oxygenhub#85): the `.deb` assets of these

/// public repositories' releases, signed with the key in `gnupg_home`.

#[derive(Clone, Debug, Deserialize)]

#[serde(default, deny_unknown_fields)]

pub struct Apt {

    /// `owner/name` of each repository whose release `.deb`s are served;

    /// none turns `/apt` off.

    pub repos: Vec<String>,

    /// The suite apt's `sources` names.

    pub suite: String,

    pub component: String,

    /// GnuPG home holding the signing key (relative to the data directory).

    pub gnupg_home: String,

    /// Architectures the index lists, each with its Packages file.

    pub architectures: Vec<String>,

}

impl Default for Apt {

    fn default() -> Self {

        Apt {

            repos: vec![],

            suite: "stable".into(),

            component: "main".into(),

            gnupg_home: "apt-gnupg".into(),

            architectures: vec!["amd64".into(), "arm64".into(), "riscv64".into()],

        }

    }

}

            apt: Apt::default(),

pub mod apt;

        .route("/apt", get(crate::apt::home))

        .route("/apt/{file}", get(crate::apt::key))

        .route("/apt/dists/{suite}/{*rest}", get(crate::apt::dists))

        .route("/apt/pool/{*path}", get(crate::apt::pool))

pub(crate) fn blob_path(app: &Shared, hash: &str) -> std::path::PathBuf {