Hi!
If the apt archive server is using HTTP redirects to bounce clients to
other servers, then 'apt-get install' appears to randomly (but seamingly
deterministically) alternate between printing the original URL from the
apt sources configuration and the HTTP redirect URL received from the
server.
This seems like a UX bug to me. I would expect either the apt source
URL to be printed consistently, or possibly the HTTP redirect
destination target URL consistently. The former seems more appropriate
than printing URLs received from unprotected HTTP (I didn't test if an
ANSI terminal injection attack was possible).
The simplest way to reproduce this is to use a DiffOS container image
and then install a package like 'libreoffice' which has a lot of
dependencies that get pulled in, see output below. Notice how some
lines have URLs with 'deb.diffos.org' and some has 'deb.debian.org'.
The deb.diffos.org server is running Apache with redirects like this:
https://gitlab.com/debdistutils/diffos/archive/-/blob/main/apache/deb.diffos.org.conf?ref_type=heads#L71
RewriteRule ^/diffos/pool/main/(.*) https://deb.debian.org/debian/pool/main/$1
RewriteRule ^/diffos-security/pool/main/(.*) https://deb.debian.org/debian-security/pool/main/$1
Note though that the only configured apt sources file only contains
'deb.diffos.org' and never 'deb.debian.org':
$ podman run -it registry.gitlab.com/debdistutils/diffos/container:trixie
root@a002f9b9a14c:/# cat /etc/apt/sources.list.d/diffos.sources
Types: deb
URIs: http://deb.diffos.org/diffos
Suites: diffos-trixie diffos-trixie-updates
Components: main
Signed-By: /usr/share/keyrings/diffos-archive-keyring.gpg
Types: deb
URIs: http://deb.diffos.org/diffos-security
Suites: diffos-trixie-security
Components: main
Signed-By: /usr/share/keyrings/diffos-archive-keyring.gpg
root@a002f9b9a14c:/#
This problem was initially reported here:
https://codeberg.org/DiffOS/issues/issues/3
/Simon
$ podman run -it registry.gitlab.com/debdistutils/diffos/container:trixie-amd64
root@0789e77c4233:/# apt-get update
Get:1 http://deb.diffos.org/diffos diffos-trixie InRelease [3453 B]
Get:2 http://deb.diffos.org/diffos diffos-trixie-updates InRelease [3469 B]
Get:3 http://deb.diffos.org/diffos-security diffos-trixie-security InRelease [3268 B]
Get:4 http://deb.diffos.org/diffos diffos-trixie/main amd64 Packages [56.6 MB]
Get:5 http://deb.diffos.org/diffos diffos-trixie-updates/main amd64 Packages [2351 B]
Get:6 http://deb.diffos.org/diffos-security diffos-trixie-security/main amd64 Packages [2160 kB]
Fetched 58.8 MB in 3s (21.4 MB/s)
Reading package lists... Done
root@0789e77c4233:/# apt-get install -y gcc
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
The following additional packages will be installed:
binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-14 cpp-14-x86-64-linux-gnu cpp-x86-64-linux-gnu gcc-14 gcc-14-x86-64-linux-gnu gcc-x86-64-linux-gnu libasan8
libatomic1 libbinutils libc-dev-bin libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libgcc-14-dev libgomp1 libgprofng0 libhwasan0 libisl23 libitm1 libjansson4
liblsan0 libmpc3 libmpfr6 libquadmath0 libsframe1 libtsan2 libubsan1 linux-libc-dev manpages manpages-dev rpcsvc-proto
Suggested packages:
binutils-doc gprofng-gui binutils-gold cpp-doc gcc-14-locales cpp-14-doc gcc-multilib make autoconf automake libtool flex bison gdb gcc-doc gcc-14-multilib gcc-14-doc
gdb-x86-64-linux-gnu libc-devtools glibc-doc man-browser
The following NEW packages will be installed:
binutils binutils-common binutils-x86-64-linux-gnu cpp cpp-14 cpp-14-x86-64-linux-gnu cpp-x86-64-linux-gnu gcc gcc-14 gcc-14-x86-64-linux-gnu gcc-x86-64-linux-gnu
libasan8 libatomic1 libbinutils libc-dev-bin libc6-dev libcc1-0 libcrypt-dev libctf-nobfd0 libctf0 libgcc-14-dev libgomp1 libgprofng0 libhwasan0 libisl23 libitm1
libjansson4 liblsan0 libmpc3 libmpfr6 libquadmath0 libsframe1 libtsan2 libubsan1 linux-libc-dev manpages manpages-dev rpcsvc-proto
0 upgraded, 38 newly installed, 0 to remove and 0 not upgraded.
Need to get 60.7 MB of archives.
After this operation, 223 MB of additional disk space will be used.
Get:1 http://deb.debian.org/debian diffos-trixie/main amd64 manpages all 6.9.1-1 [1393 kB]
Get:2 http://deb.debian.org/debian diffos-trixie/main amd64 libsframe1 amd64 2.44-3 [78.4 kB]
Get:3 http://deb.debian.org/debian diffos-trixie/main amd64 binutils-common amd64 2.44-3 [2509 kB]
Get:4 http://deb.debian.org/debian diffos-trixie/main amd64 libbinutils amd64 2.44-3 [534 kB]
Get:5 http://deb.debian.org/debian diffos-trixie/main amd64 libgprofng0 amd64 2.44-3 [808 kB]
Get:6 http://deb.debian.org/debian diffos-trixie/main amd64 libctf-nobfd0 amd64 2.44-3 [156 kB]
Get:7 http://deb.debian.org/debian diffos-trixie/main amd64 libctf0 amd64 2.44-3 [88.6 kB]
Get:8 http://deb.diffos.org/diffos diffos-trixie/main amd64 libjansson4 amd64 2.14-2+b3 [39.8 kB]
Get:9 http://deb.debian.org/debian diffos-trixie/main amd64 binutils-x86-64-linux-gnu amd64 2.44-3 [1014 kB]
Get:10 http://deb.debian.org/debian diffos-trixie/main amd64 binutils amd64 2.44-3 [265 kB]
Get:11 http://deb.debian.org/debian diffos-trixie/main amd64 libisl23 amd64 0.27-1 [659 kB]
Get:12 http://deb.debian.org/debian diffos-trixie/main amd64 libmpfr6 amd64 4.2.2-1 [729 kB]
Get:13 http://deb.diffos.org/diffos diffos-trixie/main amd64 libmpc3 amd64 1.3.1-1+b3 [52.2 kB]
Get:14 http://deb.debian.org/debian diffos-trixie/main amd64 cpp-14-x86-64-linux-gnu amd64 14.2.0-19 [11.0 MB]
Get:15 http://deb.debian.org/debian diffos-trixie/main amd64 cpp-14 amd64 14.2.0-19 [1280 B]
Get:16 http://deb.debian.org/debian diffos-trixie/main amd64 cpp-x86-64-linux-gnu amd64 4:14.2.0-1 [4840 B]
Get:17 http://deb.debian.org/debian diffos-trixie/main amd64 cpp amd64 4:14.2.0-1 [1568 B]
Get:18 http://deb.debian.org/debian diffos-trixie/main amd64 libcc1-0 amd64 14.2.0-19 [42.8 kB]
Get:19 http://deb.debian.org/debian diffos-trixie/main amd64 libgomp1 amd64 14.2.0-19 [137 kB]
Get:20 http://deb.debian.org/debian diffos-trixie/main amd64 libitm1 amd64 14.2.0-19 [26.0 kB]
Get:21 http://deb.debian.org/debian diffos-trixie/main amd64 libatomic1 amd64 14.2.0-19 [9308 B]
Get:22 http://deb.debian.org/debian diffos-trixie/main amd64 libasan8 amd64 14.2.0-19 [2725 kB]
Get:23 http://deb.debian.org/debian diffos-trixie/main amd64 liblsan0 amd64 14.2.0-19 [1204 kB]
Get:24 http://deb.debian.org/debian diffos-trixie/main amd64 libtsan2 amd64 14.2.0-19 [2460 kB]
Get:25 http://deb.debian.org/debian diffos-trixie/main amd64 libubsan1 amd64 14.2.0-19 [1074 kB]
Get:26 http://deb.debian.org/debian diffos-trixie/main amd64 libhwasan0 amd64 14.2.0-19 [1488 kB]
Get:27 http://deb.debian.org/debian diffos-trixie/main amd64 libquadmath0 amd64 14.2.0-19 [145 kB]
Get:28 http://deb.debian.org/debian diffos-trixie/main amd64 libgcc-14-dev amd64 14.2.0-19 [2672 kB]
Get:29 http://deb.debian.org/debian diffos-trixie/main amd64 gcc-14-x86-64-linux-gnu amd64 14.2.0-19 [21.4 MB]
Get:30 http://deb.debian.org/debian diffos-trixie/main amd64 gcc-14 amd64 14.2.0-19 [540 kB]
Get:31 http://deb.debian.org/debian diffos-trixie/main amd64 gcc-x86-64-linux-gnu amd64 4:14.2.0-1 [1436 B]
Get:32 http://deb.debian.org/debian diffos-trixie/main amd64 gcc amd64 4:14.2.0-1 [5136 B]
Get:33 http://deb.diffos.org/diffos diffos-trixie/main amd64 libc-dev-bin amd64 2.41-12+deb13u4 [60.0 kB]
Get:34 http://deb.debian.org/debian-security diffos-trixie-security/main amd64 linux-libc-dev all 6.12.115-2 [3050 kB]
Get:35 http://deb.debian.org/debian diffos-trixie/main amd64 libcrypt-dev amd64 1:4.4.38-1 [119 kB]