[RESOLVED] Secure Central Repository
Published: March 10, 2023 - 1:40 PM
Good morning,
I want to set up a private central repository without installing wapt but secured via password.
I installed and configured a central repository server in Debian 11 and configured Nginx with https and password-protected Wapt folder access (.htpasswd) so without installing Wapt Server.
I can securely upload my packages to the /var/www/wapt folder created on this server using SFTP.
All I need to do now is get the Packages file which lists the packages in this folder.
Previously, there was a tis-waptrepo package which provided the scripts needed to create the Packages file for listing in the wapt console (wapt-scanpackages and wapt-signpackages)
However, I cannot find the tis-waptrepo package for version 1.8. The latest available version is 1.2. (on Git)
To move forward with my project, I tested by copying the complete "/opt/wapt" folder from a working Wapt 1.8.2 Community server to my central repository server.
Then, on my central repository, I created a small bash script that reproduces this:
Everything works rather well, the debug does not display any errors, renaming the .wapt files correctly by adding the MD5, and generating the Packages file.
From the wapt console of another site, I can add my secure URL and I do have my list of packages from this console.
However, when I try to download the package, I consistently get the following message:
"Download cancelled. The downloaded file xxxxx... is corrupted; the MD5 checksum does not match."
However, when you look at the file name, the contents of Packages, the MD5 sum is indeed the same...
I don't understand where the MD5 comparison error could be coming from...
Thank you for your help.
Sincerely
I want to set up a private central repository without installing wapt but secured via password.
I installed and configured a central repository server in Debian 11 and configured Nginx with https and password-protected Wapt folder access (.htpasswd) so without installing Wapt Server.
I can securely upload my packages to the /var/www/wapt folder created on this server using SFTP.
All I need to do now is get the Packages file which lists the packages in this folder.
Previously, there was a tis-waptrepo package which provided the scripts needed to create the Packages file for listing in the wapt console (wapt-scanpackages and wapt-signpackages)
However, I cannot find the tis-waptrepo package for version 1.8. The latest available version is 1.2. (on Git)
To move forward with my project, I tested by copying the complete "/opt/wapt" folder from a working Wapt 1.8.2 Community server to my central repository server.
Then, on my central repository, I created a small bash script that reproduces this:
Code: Select all
#!/bin/bash
chown -R wapt:www-data /var/www/wapt
PYTHONPATH=/opt/wapt PYTHONHOME=/opt/wapt python /opt/wapt/wapt-signpackages.py -s --message-digest=sha256,sha1 -c /tmp/cert.crt /var/www/wapt/*.wapt
PYTHONHOME=/opt/wapt PYTHONPATH=/opt/wapt /opt/wapt/bin/python /opt/wapt/wapt-scanpackages.py -r -f -ldebug /var/www/waptFrom the wapt console of another site, I can add my secure URL and I do have my list of packages from this console.
However, when I try to download the package, I consistently get the following message:
"Download cancelled. The downloaded file xxxxx... is corrupted; the MD5 checksum does not match."
However, when you look at the file name, the contents of Packages, the MD5 sum is indeed the same...
I don't understand where the MD5 comparison error could be coming from...
Thank you for your help.
Sincerely