search

volitank / nala

Nala is a front-end for libapt-pkg.
GNU General Public License v3.0
1.44k stars 47 forks source link

Error $URL 404 Not Found (but apt-get is fine with it) #28

Open maxkratz opened 10 months ago

maxkratz commented 10 months ago

Hello, we are using nala on a Debian 12-based system with various apt source files configured. However, we found a problem with nala when adding the apt source config for containerlab.

/etc/apt/source.list.d/apt_fury_io_netdevops.list:

deb [trusted=yes] https://apt.fury.io/netdevops/ /

Running $ nala update throws a bunch of errors:

$ nala update
Error: https://apt.fury.io/netdevops  Packages
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Translation-en
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
Error: https://apt.fury.io/netdevops  Contents (deb)
  404  Not Found [IP: 75.101.184.39 443]
╭─ Updating Package List ──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│No Change: http://security.debian.org/debian-security bookworm-security InRelease                                                                                                                                                                         │
│No Change: http://deb.debian.org/debian bookworm InRelease                                                                                                                                                                                                │
│No Change: http://deb.debian.org/debian bookworm-updates InRelease                                                                                                                                                                                        │
│No Change: http://deb.debian.org/debian-security bookworm-security InRelease                                                                                                                                                                              │
│No Change: https://download.docker.com/linux/debian bullseye InRelease                                                                                                                                                                                    │
│No Change: https://apt.releases.hashicorp.com jammy InRelease                                                                                                                                                                                             │
│Ignored:   https://apt.fury.io/netdevops  InRelease                                                                                                                                                                                                       │
│No Change: https://deb.volian.org/volian scar InRelease                                                                                                                                                                                                   │
│Ignored:   https://apt.fury.io/netdevops  Release                                                                                                                                                                                                         │
│Updated:   https://apt.fury.io/netdevops  Packages                                                                                                                                                                                                        │
│Ignored:   https://apt.fury.io/netdevops  Translation-en                                                                                                                                                                                                  │
│Ignored:   https://apt.fury.io/netdevops  Contents (deb)                                                                                                                                                                                                  │
│Ignored:   https://apt.fury.io/netdevops  Contents (deb)                                                                                                                                                                                                  │
│Fetched 21 KB in 3s (6.9 KB/s)                                                                                                                                                                                                                            │
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯

However, apt-get is fine with it:

$ apt-get update
Hit:1 http://security.debian.org/debian-security bookworm-security InRelease
Hit:2 https://download.docker.com/linux/debian bullseye InRelease                                                                                                                                                                                
Hit:3 https://apt.releases.hashicorp.com jammy InRelease                                                                                                                                                                                         
Hit:4 http://deb.debian.org/debian bookworm InRelease                                                                                                                        
Hit:5 http://deb.debian.org/debian bookworm-updates InRelease                                                                                          
Hit:6 http://deb.debian.org/debian-security bookworm-security InRelease                      
Ign:7 https://apt.fury.io/netdevops  InRelease                                               
Hit:8 https://deb.volian.org/volian scar InRelease
Ign:9 https://apt.fury.io/netdevops  Release
Ign:10 https://apt.fury.io/netdevops  Packages
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Get:10 https://apt.fury.io/netdevops  Packages
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Ign:11 https://apt.fury.io/netdevops  Translation-en
Ign:12 https://apt.fury.io/netdevops  Contents (deb)
Ign:13 https://apt.fury.io/netdevops  Contents (deb)
Fetched 20.8 kB in 3s (6718 B/s)
Reading package lists... Done

Is this a problem with the apt repository of the containerlab or is it a bug/misconfiguration of nala? How can I configure nala to accept the containerlab repository?

Thanks in advance.

volitank commented 9 months ago

There are a couple of things going on here.

First Apt and Nala are handling these the same. If we ignore the 404 errors from Nala and just look at the window, you can see it is ignoring most of the things it's trying to hit except for Packages, just like apt is. The difference is that Nala is throwing errors with more information than apt and saying that it cannot reach those places it wants too.

I did a little digging and this repo from containerlab is kind of wild tbh. They do not use InRelease/Release file like basically every other repository, for example my repo https://deb.volian.org/volian/dists/scar/InRelease

The only accessible page from them is https://apt.fury.io/netdevops/Packages. They do have the package hashsums and stuff in there, but this isn't the most secure way to distribute packages. If you look at a Debian/Ubuntu InRelease, or even mine, they are PGP signed, and you have to have the corresponding public key on the system for apt/nala to trust them, or do as they've asked you to do by saying [trusted=yes]. They are putting all their security into the https basket, which I do not agree with.

In this configuration if someone were to DNS hijack this domain, they could redirect it to a server with malicious .debs and apt would upgrade your systems to malicious packages with no questions asked. (Of course they have to solve the https certificate issue, which if they could compromise their DNS account to hijack the domain that wouldn't be difficult to do with letsencrypt).

With the way that most repositories work, since they are PGP signed, they would also need that private key in order to accomplish this, so it's more unlikely, and apt would give you a warning saying that the repo is not trusted.

Security ranting aside, apt and nala are working the same in this case, just Nala is giving more info. I don't know that I personally would want to hide messages like this.

maxkratz commented 9 months ago

Thank you for your detailed answer.

On occasion, I will rise the issue with the weird apt repository to the Containerlab developers.