I’m adapting reprepro
for use with the apt
repository for MongoDB CE. This is so my team can mirror the MongoDB packages we want without trusting more than our own public key.
Here is the conf/updates
file used to sync with repo.mongodb.org
Name: buster-mongodb
Method: https://repo.mongodb.org/apt/debian/
Suite: */mongodb-org/6.0
Components: main
Architectures: amd64
GetInRelease: no
VerifyRelease: 6A26B1AE64C3C388
Name: bullseye-mongodb
Method: https://repo.mongodb.org/apt/debian/
Suite: */mongodb-org/6.0
Components: main
Architectures: amd64
GetInRelease: no
VerifyRelease: 6A26B1AE64C3C388
reprepro --logdir ./logs -b . --noskipold update
prints
aptmethod got 'https://repo.mongodb.org/apt/debian/dists/bullseye/mongodb-org/6.0/Release'
aptmethod got 'https://repo.mongodb.org/apt/debian/dists/bullseye/mongodb-org/6.0/Release.gpg'
aptmethod got 'https://repo.mongodb.org/apt/debian/dists/buster/mongodb-org/6.0/Release'
aptmethod got 'https://repo.mongodb.org/apt/debian/dists/buster/mongodb-org/6.0/Release.gpg'
Calculating packages to get...
ERROR: Same file is requested with conflicting checksums:
md5 expected: 820201311332410d875e594f14af47db, got: ad7923dea5bffa7cdd2ecefa5f13d7df
sha1 expected: 708ad9650060ea3411b79ef6fb2bc24d29efea91, got: 29a96ba4f40b8fd491ee71c81ffa46b8321cbc24
sha256 expected: fe802bcdcb9a39fea564c6de4dc2537b70f518dfb2172ed034fe466ff3138429, got: d168b11caf956e0be43655406a752eb7aa5cca406acb1c005d3eb56562948de0
size expected: 47694664, got: 47735588
There have been errors!
Two things strike me as odd:
- The expected checksum is not in either downloaded
Release
file, despite using HTTPS to rule out a MITM - The size difference is a clear indication of a checksum mismatch.
I expect it’s more likely I made a mistake than the repo.mongodb.org
index being out of date. What should I check next?