Debian Repositories

部loying a package using the UI

To deploy a Debian package to Artifactory, in the Artifacts Repository Browser, click部loy.

Select your Debian repository as theTarget Repository,upload the file you want to deploy.

Check the部loy as Debian Artifactcheckbox and fill in theDistribution, Component一个ndArchitecturefields in theDebian Artifactsection. Notice that theTarget Pathis automatically updated to reflect your input.

You can also deploy Debian packages to Artifactory with an explicit URL usingMatrix Parameters.

Once you have deployed your Debian package, and Artifactory has recalculated the repository index, your repository should be organized as displayed below:

部loying a package using Matrix Parameters

The URL is built similarly to theTarget Pathformat as follows:

PUT "http://SERVER_HOSTNAME:8081/artifactory/{debianRepoKey}/pool/{debianPackageName};deb.distribution={distribution};deb.component={component};deb.architecture={architecture}"

For example, to upload packagelibatk1.0_i386.deb, and specify that its layout is from thewheezydistribution, in themaincomponent and thei386架构中,你将进入:

PUT "http://localhost:8081/artifactory/debian-local/pool/libatk1.0_i386.deb;deb.distribution=wheezy;deb.component=main;deb.architecture=i386"

Setting the Target Path

TheTarget Pathneeds to be entered in a strict and specific format that uses system properties to define where the artifact will be stored and its specific layout as follows:

[path];deb.distribution=[distribution];deb.component=[component];deb.architecture=[architecture]

Specifying multiple layouts

Whether uploading a package using the UI or Matrix Parameters, you can specify multiple layouts for any Debian package you upload, by including additional values for the distribution, component or architecture separated by a comma,

For example, to upload packagelibatk1.0_i386.debto bothwheezy一个ndtrustydistributions, in bothmain一个ndcontribcomponents and bothi386一个nd64bit-arm一个rchitectures you would specify the following Target Path to upload using the UI:

池/ libatk1.0_i386.deb; deb.distribution =老生常谈的;德b.distribution=trusty;deb.component=main;deb.component=contrib;deb.architecture=i386;deb.architecture=64bit-arm

Correspondingly, to upload the file using Matrix Parameters, you would use the following:

PUT "http://localhost:8081/artifactory/debian-local/pool/libatk1.0_i386.deb;deb.distribution=wheezy;deb.distribution=trusty;deb.component=main;deb.component=contrib;deb.architecture=i386;deb.architecture=64bit-arm"

Artifact Metadata

Artifactory writes several entries from the Debian package's metadata一个s properties on all of the artifacts(based on the control file's content).

These properties can be used to search for Debian packages more efficiently using Arifactory's Package Search.

Metadata properties are written for each new Artifact that is deployed to Artifactory.

To have these properties written to Debian artifacts that already exist in your repositories you need to call theCalculate Debian Repository MetadataREST API which writes the properties to all of the artifacts by default.

Metadata Validation

To ensure that Debian repositories are not corrupted by malformed packages, Artifactory first validates parts of the Debian metadata to make sure that none of the relevant metadata fields are empty. If the validation process indicates a malformed package, Artifactory provides several indications:

• The package is not indexed
• The package is annotated with the following property:
  • 关键:deb.index.status
  • value: the reason the package failed the validation process
• If the package is selected in the Tree Browser, the Debian Info tab will display a message indicating that it was not indexed and why it failed the validation process

Remote Repositories

You can download Debian packages from Local Debian Repositories as described above, or from Remote Repositories specified as supporting Debian packages.

To specify that a Remote Repository supports Debian packages, you need to set itsPackage TypetoDebianwhen it is created.

Note that the index files for remote Debian repositories (including the sources index) are stored and renewed according to theRetrieval Cache Periodsetting.

Calculating Debian Coordinates

You can extract the component/distribution/architecture coordinates from a remote repository and assign them as properties on the cached packages.

To do this, right click on the relevant remote Debian repository and selectCalculate Debian Coordinates. You can also use theCalculate Cached Remote Debian Repository CoordinatesREST API.

Virtual Repositories

A Virtual Repository defined in Artifactory aggregates packages from both local and remote repositories.

This allows you to access both locally hosted Debian packages and remote proxied Debian repositories from a single URL defined for the virtual repository.

To define a virtual Debian repository, create a virtual repository, set thePackage Typeto beDebian,一个nd select the underlying local and remote Debian repositories to include in theBasicsettingstab.

Specifying these architectures will speed up Artifactory's initial metadata indexing process. The default architecture values are一个md64一个ndi386.

Set theOptional Index Compression Formatswith the index file formats you would like to create in addition to the default Gzip (.gzip extension).

Signing Debian Metadata

Artifactory supports signing Debian repository metadata (not packages) using a GPG key. This process will create a signed Release file namedRelease.gpg, which will be shipped alongside the Release file. Artifactory will store and manage public and private keys that are used to sign and verify Debian packages.

To generate a pair of GPG keys and upload them to Artifactory, seeManaging Signing Keys.

Working with Debian Snapshots

Creating Debian Snapshots

From Artifactory 7.41.3, Debian repositories include support for Debian Snapshots.A Debian Snapshot contains metadata of a fixed state of a local, remote or virtual Debian repository. Snapshots are immutable and contain a metadata folder for each specific distribution, including all metadata files, likeRELEASES AND PACKAGES, and not the actual packages.

Snapshots can be used in the following scenarios:

• As backups, allowing you to easily fall back to previous versions in case of package corruption due to dependency changes.
• For release purposes, whereby the tested Packages file can be immutably saved and served.

In Artifactory, the Debian snapshots are saved by default under the$repoKey/snapshots/$tagsubfolder within the Debian Repository and are created using a dedicated Create Debian Snapshot REST API.

In the following example,一个Debian snapshot named 202203141800is saved under thedeb-snapshotlocal repository, containingfocaldistribution metadata.

Rules and Guidelines

• To work with Debian Snapshots in Artifactory, you need to configure the sources file of your Debian client to point to the following path: artUrl/artifactory/api/deb/$repoKey/snapshots/$tag.
• The root of thesnapshotsub-repositoryis$repoKey/snapshots/$tag.
• All the metadata files of the$srcRepo/dists/$distribution, including the release and packages file, are copied to the snapshot folder.
• In the folder, a property calleddeb.snapshot.sourceis created pointing to the source repository.
• You need to use/artifactory/api/deb/$repoKey/snapshots/$tag, whereby the tag is a user-defined name for the snapshot.
• Deleting a snapshot does not delete the related Debian Package files as the.DebianSnapshotssub-repositories does not contain the packages, but only redirect to them.

To create a Debian Snapshot, see theCreate Debian SnapshotREST API.

Resolving Debian Snapshots

To work with Debian Snapshots in Artifactory, you need to configure the sources file of your Debian client to point to the following path:一个rtUrl/artifactory/api/deb/$repoKey/snapshots/$tag.

Adding MD5 Checksum to the Packages file

To support tools (e.g.Aptly) that require Debian packages to include their MD5 checksum in theirPackagesmetadata file for validation, you can configure Artifactory to add this value by setting the following system property in the artifactory.system.properties file:

## Add package MD5 checksum to Debian Packages file #artifactory.debian.metadata.calculateMd5InPackagesFiles=true

Artifactory needs to be restarted for this change to take effect.

Authenticated Access to Servers

If you need to access a secured Artifactory server that requires a username and password, you can specify these in your Debiansource.listfile by prefixing the artifactory host name with the required credentials as follows:

http://user:password@SERVER_HOSTNAME:8081/artifactory/{repoKey} {distribution} {components} For example: http://admin:password@localhost:8081/artifactory/debian-local wheezy main restricted

Compression Formats

Artifactory supports the following compression formats for Debian indices:

• Gzip(.gzfile extension) - created bydefault for every Debian repository and cannot be disabled.
• Bzip2(.bz2file extension)
• LZMA(.lzmaextension)
• XZ(.xzextension)

Acquiring Packages by Hash

Artifactory supports the acquire-by-hash functionality of APT clients for Debian repositories laid out using the Automatic architecture (Trivial architecture is not supported for acquiring packages by hash). This feature is supported by twosystem properties:

Using Debian InRelease metadata files

From version 7.4, Artifactory supports Debian InRelease metadata files.

Artifactory will produce anInReleasemetadata file in the repository when working with GPG signing. Downloading a Debian package from Artifactory will now be faster as the client will only download theInReleasefile without downloading theRelease一个ndRelease.gpgfiles that are heavier.

REST API Support

The Artifactory REST API provides extensive support for Debian signing keys and recalculating the repository index as follows:

• Set the public key
• Get the public key
• Set the private key
• Set the pass phrase
• Recalculate the index

Watch the Screencast