[Aptitude-devel] Bug#668876: Bug#668876: fetch from snapshot.debian.org if package not found.

[Axel Beckert]

Hi,

FOSS tech. support wrote:
> I suggest, when aptitude doesn't find a package in all mirrors, it
> should automatically look out in snapshot.debian.org to fetch the
> package.

I don't think that's a good idea:

It circumvents the package signing as AFAIK APT and friends just look
on the signature of the package lists and hashsums, not on the
individual package signature -- that's just done before including a
package in the archive.

Additionally, if a package is not on the mirrors, but on snapshot.d.o,
it's very likely outdated and shouldn't be installed for that reason
unless explicitly wanted.

And snapshot.d.o is likely not capable of coping with the load this
would cause as it is not meant to be a mirror.

OTOH adding some user interface for explicity retrieving packages from
snapshot.d.o shouldn't hurt. But that depends a lot on the actual user
interface and is hence not likely generalised (except may be the
downloading backend).

> The same should be implemented in all apt implementations like
> software centre (it uses APT python right?), apt-get, synaptic
> etc...

If that's really the case (see discussion above), then this bug better
should be filed against APT itself and not aptitude.

		Regards, Axel
-- 
 ,''`.  |  Axel Beckert <abe at debian.org>, http://people.debian.org/~abe/
: :' :  |  Debian Developer, ftp.ch.debian.org Admin
`. `'   |  1024D: F067 EA27 26B9 C3FC 1486  202E C09E 1D89 9593 0EDE
  `-    |  4096R: 2517 B724 C5F6 CA99 5329  6E61 2FF9 CD59 6126 16B5