Bug 2351 – Pool directory contains a dangerous symlink which points to "."

Bug 2351 - Pool directory contains a dangerous symlink which points to "."


Summary:	Pool directory contains a dangerous symlink which points to "."

Status:	RESOLVED WONTFIX

Product:	maemo.org Website
Component:	Repositories
Version:	4.0
Platform:	All Linux

Importance:	High normal (vote)
Target Milestone:	---
Assigned To:	unassigned
QA Contact:	repositories@maemo.bugs

URL:	http://repository.maemo.org/pool/chin...
Keywords:

Depends on:
Blocks:
	Show dependency tree

Reported:	2007-11-22 15:07 UTC by Aleksandr Koltsoff
Modified:	2008-01-29 12:56 UTC (History)
CC List:	1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note

You need to log in before you can comment on or make changes to this bug.

Description Aleksandr Koltsoff (reporter) 2007-11-22 15:07:23 UTC

STEPS TO REPRODUCE THE PROBLEM:

See if you can find it with the URL above.

EXPECTED OUTCOME:

I'm told the symlink is not even required nor wasn't part of the published repo
files.

ACTUAL OUTCOME:

Tools like wget -r -l inf will mirror repositories forever. The content is
generated by mod_dir (or a variant) and HTTP lacks the capabilities to
communicate that something is a symlink on server side. Wget (on client side)
lacks the capability to see this and assumes that each "source" is yet another
subdirectory.

REPRODUCIBILITY:
(always/sometimes/once)

Always.

EXTRA SOFTWARE INSTALLED:

OTHER COMMENTS:

Hasn't anyone tried mirroring the public repositories ever with wget?

And no, it's not possible to tell wget not to download source (unless using
explicit paths which is quite stupid).

Comment 1 Aleksandr Koltsoff (reporter) 2007-11-24 15:36:52 UTC

Ok, encountered this problem via another route.

Used apt-mirror (modified) to make a mirror of repositories.maemo.org.

It is an intelligent mirror building/updating tool for Debian-style
repositories, which uses the Packages and Sources files instead of blindly
recursing directories (like wget -r).

Please see:
http://repositories.maemo.org/dists/chinook/free/source/Sources -file.

All of the source package URLs contain the 'source' component. Instead of
containing the direct URL to the directory where the sources have been munged
into with the binaries.

So, just removing 'source' symlink will break apt-get source. Don't do it.

Instead, fix your Sources file generation so that it will have URLs pointing to
the correct directories, without containing the 'source' component in between.

It should be possible to do this even now, since as far as I know, I'm the only
person who've ever attempted mirroring the repo, and I can deal with the
breakage. For regular SDK users, nothing will change.

BTW, whoever decided that keeping the source packages in the same directories
as the binaries should be "learned".

Ah yes, and with apt-mirror, one will end up with the source packages being in
different directories anyway, because of the Sources file. So 1-to-1 mirroring
is not possible.

Comment 2 Aleksandr Koltsoff (reporter) 2007-11-24 16:20:46 UTC

I was pointed out by kaltsi (thanks btw :-) that Debian also keeps bins and
sources in the same directories. Verified that Ubuntu does this as well. So I
guess I'm the one who should be "learned".

BUT, it doesn't fix the issue though :-).

Comment 3 julien.cayzac 2007-12-21 17:08:51 UTC

*** Bug 2617 has been marked as a duplicate of this bug. ***

Comment 4 Aleksandr Koltsoff (reporter) 2007-12-21 17:32:09 UTC

Bug 2617 not related to this one.

Comment 5 Marcell Lengyel maemo.org

2008-01-15 10:33:00 UTC

I remember this. The story behind this in short is that Integration creates the
repositories and then some other people take the tarball and put them to the
.maemo.org servers. It was on the chinook release day when we realized that the
source packages are not accessible. The fastest solution was to create a
symlink and solve the problem.
This seemd like a feasible workaround at that time.
For the next releases we are going to change the release process, so hopefully
these kind of issues will not happen anymore.

Comment 6 Aleksandr Koltsoff (reporter) 2008-01-29 12:56:27 UTC

For posterity: it is not possible to mirror chinook using wget -r. As this bug
won't be fixed, don't bother trying.

You might want to use apt-mirror instead (use the latest version with the
arm-fixes by yours truly).