Documentation

Nothing here is required to browse the depot. It exists so that a machine can be pointed at it reproducibly, with signature verification switched on from the first request.

Signing key

The archive is signed with one long-lived ed25519 key. Its fingerprint is printed below and is also published out of band in the about page history.

Key ID:   0x7C41A9D2E0B35F18
Type:     ed25519
Created:  2014-06-02
Expires:  2029-06-02
Fingerprint:
  9F2C 41A7 88DE 0B35 1FC6  4A0D 7C41 A9D2 E0B3 5F18

curl -fsSL https://opendepot.duckdns.org/keys/archive.asc \
  | gpg --dearmor -o /usr/share/keyrings/opendepot.gpg
gpg --show-keys /usr/share/keyrings/opendepot.gpg

apt

echo "deb [signed-by=/usr/share/keyrings/opendepot.gpg] \
https://opendepot.duckdns.org/apt stable main" \
  > /etc/apt/sources.list.d/opendepot.list
apt-get update -o Dir::Etc::trusted=/usr/share/keyrings/opendepot.gpg

To prefer the depot over the distribution's own archive, add an apt pin rather than editing sources.list:

Package: *
Pin: origin opendepot.duckdns.org
Pin-Priority: 700

dnf / yum

cat > /etc/yum.repos.d/opendepot.repo <<'EOF'
[opendepot]
name=OpenDepot mirror
baseurl=https://opendepot.duckdns.org/rpm/
enabled=1
gpgcheck=1
gpgkey=https://opendepot.duckdns.org/keys/archive.asc
repo_gpgcheck=1
metadata_expire=3600
EOF
dnf makecache

apk

echo "https://opendepot.duckdns.org/apk/v3.21/main" \
  >> /etc/apk/repositories
wget -O /etc/apk/keys/opendepot.rsa.pub \
  https://opendepot.duckdns.org/keys/apk.rsa.pub
apk update

rsync

The rsync module is read-only and anonymous. It is the cheapest way to populate a second mirror or a build cache.

rsync -av --delete rsync://opendepot.duckdns.org/apt/ /srv/mirror/apt/
rsync -av rsync://opendepot.duckdns.org/      # list modules

Bandwidth is limited to 2 MB/s per connection on the rsync endpoint. Use --bwlimit if you are also sharing the uplink, and run the sync from cron rather than on demand.

Plain HTTP

Any file can be fetched directly. Directory listings are enabled for the src/ and doc/ trees and disabled elsewhere to keep the index the single source of truth.

curl -fsSLO https://opendepot.duckdns.org/src/curl-8.11.0.tar.xz
curl -fsSL  https://opendepot.duckdns.org/src/curl-8.11.0.tar.xz.sha256 \
  | sha256sum -c -

Verifying

Three checks are worth automating, in this order:

Signature over the index file, using the archive key above.
Per-file checksum from the index, comparing against the downloaded bytes.
Valid-Until on the index, to catch a mirror that stopped refreshing.

gpgv --keyring /usr/share/keyrings/opendepot.gpg \
  /var/lib/apt/lists/opendepot.duckdns.org_apt_dists_stable_Release.gpg \
  /var/lib/apt/lists/opendepot.duckdns.org_apt_dists_stable_Release

Mirror list

Endpoint	Location	Protocols	Notes
mirror-eu-1	Frankfurt	https, rsync	primary, signs first
mirror-eu-2	Amsterdam	https, rsync	follows within 20 min
mirror-eu-3	Helsinki	https	read-only, 5 Gbit

Troubleshooting

“Release file is expired”

The mirror you are pointed at has not refreshed. Switch endpoint and re-run apt-get update; do not disable check-valid-until, because that is the one check that catches a stale mirror.

“NO_PUBKEY”

The keyring path in the sources line is wrong or the file is in the wrong format. It must be a binary keyring produced by gpg --dearmor, not the ASCII armoured .asc.

Slow downloads in CI

Pinned pipelines usually hit the same few artefacts. Run the rsync module into a local cache and point the package manager at the cache; the depot will serve the rest.