# APT Repositories Debian and systems based on it like Ubuntu, Linux Mint, and Raspbian use the same package management system. APT (Advanced Package Tool) is a set of tools for managing Debian packages, and therefore the applications installed on your Debian system. It provides a wide set of operations like searching repositories, installing packages with their dependencies, and managing upgrades. See [APT Documentation](https://wiki.debian.org/Apt) Nexus Repository supports the APT repository format for proxy and hosted repositories. ## Proxying APT Repositories You may set up an APT proxy repository to access a remote repository location. Minimal configuration steps are: - Give the repository a name - apt-proxy - Define the URL of the location for the remote storage - `http://archive.ubuntu.com/ubuntu/` - Define the _Distribution_ e.g. bionic **Note** This field is optional unless _Enforce Distribution_ is enabled. When Enforce Distribution is enabled, it restricts client access to a single, explicitly configured distribution. - If the remote repository has a flat format, check the `Flat` checkbox - Pick a Blob store for storage ## Configuration Options - **Distribution** - Specifies a distribution (e.g. jammy, focal) - May be left blank for multi-distribution mode - **Enforce Distribution** - **Enabled:** restricts access to the configured distribution - **Disabled:** allows all distributions - **Signing Configuration** - **Configured:** Nexus generates and signs metadata - **Not configured:** Nexus serves upstream metadata When signing is enabled, import the Nexus public key: ``` apt-key add ``` ## APT Proxy Behavior 1. **Passthrough Mode** - **Configuration:** ```` Signing: not configured ```` - **Behavior:** - Metadata is served from upstream - No metadata is generated - Packages are cached - **Example:** ```` deb http://nexus/repository/apt-proxy jammy main ```` 2. **Re-signing Mode (Single Distribution)** - **Configuration:** ```` Signing: configured Distribution: jammy ```` - **Behavior:** - Nexus generates and signs metadata - Applies only to configured distribution - Metadata includes upstream + cached packages - Initial requests may still use upstream metadata - **Example:** ```` # Import Nexus public key curl http://nexus/repository/apt-proxy/gpg.key | apt-key add - ```` ```` # Add to sources.list deb http://nexus/repository/apt-proxy jammy main ```` 3. **Re-signing Mode (Multi-Distribution)** - **Configuration:** ```` Signing: configured Distribution: not set ```` - **Behavior:** - Distributions are tracked when accessed - Metadata generated per distribution - Supports multiple distributions - **Example:** ```` deb http://nexus/repository/apt-proxy jammy main deb http://nexus/repository/apt-proxy focal main ```` 4. **Enforce Distribution** - **Enabled with Distribution** - Only configured distribution is allowed - Other distributions return HTTP 404 - **Enabled without Distribution** - This is a misconfiguration - Requests are still allowed (fail-open behavior) ## Runtime Behavior - **Initial Requests** Generated metadata may not exist immediately after configuration. Initial requests may be served from upstream. - **Metadata Rebuild** During metadata rebuild, requests may return HTTP 503. - **Automatic Rebuilds** Metadata is rebuilt automatically when packages change or when signing configuration is updated. - **Existing Repositories** If signing is enabled on an existing proxy repository, run apt update to trigger metadata generation. ## Flat Repository Formats A flat repository does not use the `dists` hierarchy of directories and instead places meta index and indices directly into the archive root (or some part below it). In `sources.list` syntax, a flat repository is specified like this: ``` deb uri directory/ ``` Where URI specifies the archive root, and the directory specifies the position of the meta index and the indices relative to the archive root. In Flat repositories, the following indices are supported: - Packages (under the location directory/Packages) - Sources (under the location directory/Sources) InRelease, Release, Release.gpg meta-information, and indices differences are supported. Translations and Contents indices are not defined. Indices may be compressed just like in the standard Debian repository format. See [Flat Repository Format](http://https//wiki.debian.org/DebianRepository/Format#Flat_Repository_Format) ## Hosting Apt Repositories You may use a hosted APT repository to upload internally developed and third-party packages. When creating a hosted APT repository, you need to generate a GPG signing key pair or use an existing one. Hosted APT repositories only sign the metadata. Nexus Repository does not sign packages. Generate a key pair in a Linux system with the following commands: ``` apt-get update apt-get install gpg gpg --gen-key gpg --list-keys cd gpg --armor --output public.gpg.key --export gpg --armor --output private.gpg.key --export-secret-key ``` A key ID looks like: '`515F58C16D58E682E91ACEFF17B5C97F9A816AD7`' Minimal configuration steps are: - Define Name e.g. apt-hosted - Define the Distribution e.g. bionic - Put the private PGP key into the Signing Key field, as described above - Put the passphrase for the private signing key into the Passphrase field - Pick a Blob store for storage To use a hosted APT repository you need to export the GPG public key into your Linux system. Use the public key (`public.gpg.key`) from the key pair generated above. ``` apt-get update apt-get install gnupg apt-key add /public.gpg.key ``` ## Updating GPG Keys GPG (GNU Privacy Guard) keys may be set to expire, and it is generally considered a best practice to do so. When updating the GPG keys, the metadata of Nexus Repository needs to be rebuilt to sign it with the new key. You may do this by running the `Apt - Rebuild Apt metadata` task after replacing the GPG Key. See the topic [Tasks: APT Rebuild Apt metadata](https://help.sonatype.com/en/tasks.html#UUID-53669de9-914f-58da-0ba3-9e129cd2e3de_id_Tasks-Apt-RebuildAptmetadataYellowNEWIN3480 "Apt - Rebuild Apt metadata") ## Deploying Packages to Hosted APT Repositories You can use HTTP POST or _Upload_ in the UI to upload packages to a hosted APT repository. The following example uses a curl command to upload a `test.deb` file to a hosted APT repository: ``` curl -u "admin:admin123" -H "Content-Type: multipart/form-data" --data-binary "@./test.deb" "http://localhost:8081/repository/apt-hosted/" ``` ## Browsing APT Repositories and Searching Packages You can browse APT repositories in the user interface inspecting the components and assets and their details, as described in [Browsing Repositories and Repository Groups](https://help.sonatype.com/en/browsing-repositories.html "Browsing Repositories"). Searching for APT packages can be performed in the user interface, too. It finds all packages that are currently stored in the repository manager, as described in [Searching for Components](https://help.sonatype.com/en/searching-for-components.html "Searching for Components"). ## Configuring APT Client If you already loaded a metadata using `apt update` commands first clean it by removing all files from `/var/lib/apt/lists/`. To configure the APT client to work with Nexus Repository Manager edit the file `/etc/apt/sources.list`. Add the following line if you want to add the repository to the list, or replace the content of the file if you're going to use only your repository: ``` deb main ``` For a hosted repository you should use the from the repository properties. For a proxy repository, the should be the same as in the original remote repository settings. You can get the from the table in [Browsing Repositories and Repository Groups](https://help.sonatype.com/en/browsing-repositories.html "Browsing Repositories") via the UI. ## Taking a Snapshot of Repository Metadata A snapshot in terms of the APT repository is a named static copy of the metadata of the repository. Changes in the repository will not cause any changes in the snapshot. A snapshot does NOT contain any binary files. So be ready if the content of the repository changes the snapshot can include some invalid metadata. Available snapshots can be viewed in [UI Browse](https://help.sonatype.com/en/browsing-repositories.html "Browsing Repositories") in the _/snapshots_ folder. Files of a particular snapshot are available in _/snapshots/_ folder. Snapshots functionality is available for both proxy and hosted repositories. You can use a snapshot to set up an APT client. The URL of the snapshot is `/snapshots/`. For example `http://localhost:8081/repository/apt-proxy/snapshots/release123`. Snapshot functionality is useful in the following cases: - Create a snapshot and use it as a repository for a proxy repository. In this case, you are sure that packages will not be updated or removed because of changes in the remote repository. **Note** To use the removed in the remote repository package, this package must be cached in the proxy repository. If not, you are aware of the changed remote repository, the updated package will not be installed. - Use snapshots for the hosted repository to freeze versions of all packages. If someone has changed the content of the repository, you are aware of the changed remote repository, the updated package will not be installed. There are two variants to create a snapshot: - To snapshot all metadata of the repository use a HTTP MKCOL request. The following example uses the `curl` command and example credentials of _admin_ for user and _admin123_ for password to create a snapshot with the id `release123`: ``` curl -u "admin:admin123" -X MKCOL "http://localhost:8081/repository/apt-proxy/snapshots/release123" ``` - To snapshot filtered by architectures and components metadata use HTTP PUT requests with the appropriate data, as follows: 1. Create a filter. This is a text file with the following format: ``` Architectures: Components: ``` For example: ``` Architectures: i386 Components: restricted universe ``` 2. Use HTTP PUT request to snapshot a filtered metadata. This example uses `curl` to create a snapshot of repository `apt-proxy` with filter stored in `filter.txt` and id `filtered_snapshot`: ``` curl -u "admin:admin123" -X PUT -H "Content-Type: multipart/form-data" -T "filter.txt" "http://localhost:8081/repository/apt-proxy/snapshots/filtered_snapshot" ``` ## Search results No results found.