List of Admins
Current list of admins: Pirate Praveen, Utkarsh Gupta, Abhijith PA, Akhil Varkey, Akshay S Dinesh, Sahil Dhiman, Gianfranco Costamagna, Mohd Bilal
DAK documentation
dak setup - Documentation for managing suites, granting permissions, accepting packages etc Note: Adding a new OpenPGP key to upload-keyring.gpg requires root.
Please note that dak's documentation is not up-to-date. (dak has switched to python3 and dependencies are not documented)
fasttrack-team maintains a "federated" branch of dak https://salsa.debian.org/fasttrack-team/dak/-/tree/federated to allow binaries without source in the fasttrack dak instance (but for which source is present in upstream/official debian repos). See https://salsa.debian.org/fasttrack-team/support/-/issues/8 for why.
The federated branch is meant to be kept up-to-date with the upstream dak master.
Upgrading dak
git fetch origin git checkout -b newbranch git rebase origin/master git diff newbranch oldbranch # inspect changes # apt install new-dependencies dak update-db
SSH upload
Add this to ~/.dput.cf for ssh upload (for unreliable connections)
[fasttrack-ssh] login = root # login = another_username fqdn = fasttrack.debian.net method = sftp incoming = /srv/dak/queue/unchecked/ allow_dcut = 1 # Please, upload your package to the proper archive # http://fasttrack.debian.net allowed_distributions = (?!UNRELEASED|.*-security)
Accept packages
dak process-upload -d /srv/dak/queue/unchecked # SSH uploads dak process-upload -d /srv/ftp/pub/UploadQueue/ # anonymous ftp uploads dak process-new dak process-policy new dak generate-packages-sources2 dak generate-release
Remove Packages
We should remove packages from buster-backports suite when they are accepted into official archive.
dak rm -s buster-backports -C <email> <package name>
Mention 'Accepted into official buster I backports' as reason.
dak dominate dak clean-suites dak generate-packages-sources2 dak generate-release
Modifying Suite Configurations
To instruct package manager to assign priorities as defined here for a suite, do
dak admin s-cfg set <suite-name> notautomatic=True butautomaticupgrades=True
The changes will be reflected in the release file when release for the suite are generated on the next try. With the above option package manager will assign a priority of 100 for the packages from the release.
Add new architecture
Example for adding armhf for buster-fasttrack
$ dak admin architecture add armhf "Arm Hard Float Port" $ dak admin suite-architecture add buster-fasttrack armhf $ dak init-dirs
Add new suite
Example for adding bookworm-fasttrack
$ dak admin suite add-all-arches bookworm-fasttrack 12.0 origin=Debian label=BookwormFasttrack codename=bookworm-fasttrack $ dak init-dirs
When accepting golang packages in NEW
You need to change the section of some golang packages to devel when accepting them from NEW.
dak@fasttrack:~$ dak process-new && dak process-policy new golang-github-hashicorp-go-retryablehttp_0.7.1-1~bpo11+1_amd64.changes ---------------------------------------------------------------------- Target: bullseye-backports-staging Changed-By: XYZ <xyz@debian.org> Date: Fri, 10 Mar 2023 14:23:34 +0530 NEW golang-github-hashicorp-go-retryablehttp-dev optional golang [!] dsc:golang-github-hashicorp-go-retryablehttp optional misc W: [!] marked entries must be fixed before package can be processed. Edit overrides, Check, Manual reject, Note edit, Prod, [S]kip, Quit ?
You have to override the section by changing it to devel
Add new OpenPGP keys for upload access
Download the keys on your local machine,
First find the OpenPGP keyid using wkd
$ gpg --locate-keys email@domain.tld # if they have setup wkd - see https://wiki.gnupg.org/WKD
or from keys.openpgp.org
$ gpg --search email@domain.tld # if the key is also available in keys.openpg.org, take keyid and download from keyring.debian.org
Or from https://salsa.debian.org/debian-keyring/keyring/-/blob/master/keyids
And download keys from keyring.debian.org
$ gpg --keyserver keyring.debian.org --recv-key 0xkeyid $ gpg --export --armor 0xF34F09744E9F5DD9 >name.key.asc $ scp name.key.asc root@fasttrack.debian.net:keys
On fasttrack server,
# ~/keys# gpg --no-default-keyring --keyring /srv/dak/keyrings/upload-keyring.gpg --import name.key.asc # su - dak $ dak import-keyring -U '%s' /srv/dak/keyrings/upload-keyring.gpg
Server Configuration
ufw
Allow all outgoing traffic
Block all incoming traffic
Open tcp ports 21 open for ftp.
Open few ports in the range 100xx to 10xxx for passive mode.
Open 80,443 port for http and https
ssh
Disable authentication via password for openssh-server
Add PasswordAuthentication no to /etc/ssh/sshd_config
nginx-http
Return 404 for files that shouldn't be publicly served
vsftpd
Set the following options in /etc/vsftpd.conf
anon_upload_enable=YES # Enables anonymous upload write_enable=YES # Enables write to be permitted pasv_enable=YES # Enables passive mode for ftp pasv_max_port=xxxxx pasv_min_port=xxxxx local_enable=NO # Disables login using local account in the server
The passive mode requires a small range of tcp ports (you can chose 10 as a range value) to be enabled. The pasv_max_port value should be greater than pasv_min_port value for the range to be proper.