[gentoo-amd64] Re: simulating apt-get on gentoo

[Duncan]

Daiajo Tibdixious posted on Mon, 18 Apr 2016 22:40:08 +1000 as excerpted:

> A package I wish to download has these instructions:
>
> wget -O -
> http://content.runescape.com/a=946/downloads/ubuntu/runescape.gpg.key
> | apt-key add -

That, and each of the following, are effectively single command-lines, 
one each, only wrapped here, as they would be on a limited-width 
terminal, for purposes of display.

That line simply adds the linked gpg key to apt's keys file, presumably 
so it can validate the later package as a validly signed package.

Of course the key fetch is using unsecured http, not https, so it's not 
as if the key really provides much actual security, since anyone with 
access to the connection could substitute a fake key, but that's more or 
less beside the point.  The point would be that apt wants packages signed 
by keys it trusts, and that adds said key to the appropriate trusted key 
store, regardless of whether the key has actually been verified as 
trustworthy.

> mkdir -p /etc/apt/sources.list.d

Makes (if it doesn't already exist) that local dir, used in the next 
command.

> echo "deb http://content.runescape.com/a=946/downloads/ubuntu trusty
> non-free" > /etc/apt/sources.list.d/runescape.list

Just to make it explicit, that ">" between non-free and /etc/apt/... is 
output redirection in the original command, not just a misplaced quote 
character.

This creates a file "runescape.list" in the directory created by the mkdir 
above, with one line of content:

deb http://content.runescape.com/a=946/downloads/ubuntu trusty non-free

Presumably, the "deb" on that line tells apt what format the repo is in, 
the link tells apt where it's at and the protocol to use, "trusty" tells 
it what version of ubuntu it's for, and non-free tells it the (Debian/
Ubuntu/apt) license status.

> apt-get update

This will be their equivalent of portage's emerge --sync command.  It'll 
sync all configured repos, including the one just configured above, with 
that /etc/apt/sources.list.d/runescape.list file and its content.

> apt-get install -y runescape-launcher

With the local apt set of repos synced by the above, this installs the 
actual package, runescape-launcher.


> I have downloaded the apt sources and have been reading it. However its
> fairly large & complex which will take me a while to figure out.

No kidding.  You'd not expect someone to download and read the portage 
sources to figure out how to manually install a package from an ebuild, 
would you?  Sure it should work... provided you're technically literate 
and patient enough, but it's definitely the long way around.

All you need is a basic general understanding of what package managers 
/do/, a look at the instructions provided, and if necessary, a look at 
the package manager's manpage, etc, tho that's not really necessary here.

FWIW I've never run a Debian-based distro, tho for about three years 
before I switched to gentoo in 2004, I ran Mandrake, an RPM-based 
distro.  My rpm foo is thus well over a decade out of date and is rpm, 
not deb, but it does give me experience with a second package manager, 
one from a binary-based distro, to compare against portage and gentoo as 
a from-source package manager and distro, and that, coupled with a 
general familiarity with how Unix-style commandlines and bash as a shell  
work, is enough to decipher the above.

> The gpg key was fairly easy, but I don't see how apt-get uses it yet.

As with most such things, it's simply a corruption detection and 
authenticity verification thing.  It's likely possible to turn off such 
checks in apt-get's options, but doing so for other than perhaps one's 
own local repo/overlay would be highly discouraged, and the above 
procedure, while not really secure because the key was fetched using 
insecure means, does at least still do integrity verification, which is 
what verification of unauthenticated signatures effectively amounts to.

But presumably you can simply gpgverify the package once you download it 
manually, skipping figuring out the precise gpg-verification code in apt-
get.  Or even skip the verification entirely...

> I also don't see how apt gets the list of files to download, since there
> is only a directory given.
> I can't display http://content.runescape.com/a=946/downloads/ubuntu in a
> browser.

Presumably, apt-get update simply fetches some standardized repository 
index or database file from that location, which then lists the packages, 
etc, in a way that apt-get can read them and fetch specific packages when 
necessary.

Now *here* you might need to go diving into apt-get's workings a bit 
deeper, but presumably there's a manpage and/or other repository layout 
documentation available, so you don't need to read the actual sources 
unless you want to.

Meanwhile, we already know the package name, runescape-launcher, from the 
above instructions.  And the package will be a deb file.

What we don't know yet is the version information part of the filename, 
and if there's any subdirs, like gentoo's categories, between the root of 
the repo and the package file we're actually trying to download.

To use a gentoo example, suppose the package we were looking for was gcc.  
We know the package name, gcc, and the likely extension, .ebuild, but we 
don't know that it's in a subdir named sys-devel, yet, instead of 
possibly just a g (first letter of gcc) subdir, or perhaps a build or 
devel subdir/category instead of sys-devel, or maybe sorted by some other 
means like first letter of say a 256-bit hash value of the package, 
expressed in hexadecimal form.[1]   And we don't know the version part, 
say -5.3.0 of the gcc-5.3.0 that I have installed here, either.

You may have to either take an educated guess at the missing parts (maybe 
you know the version info or can find it in google), or get them from the 
repo database after reading up on its documentation or the like.

But before that, it's also possible that you can find a reference to the 
specific path, or find the *.deb file elsewhere.

You can also very likely take valuable hints from the older overlay ebuild 
that Mark linked, despite it being the old java-based launcher.  Looks 
like the homepage is a github repo, with the latest 4.3.5 releases tagged 
on Sep 21, 2015, with the latest commit on master on Feb 2, changing the 
downloads to https from http, so it seems active still.

Meanwhile, a dumb search on "runescape" at github reveals nearly 700 
repos.  Of course many look to be runescape bots or the like, and many of 
them will no doubt be for other platforms, but a smarter search could 
probably narrow it down.  Anyway, 50 of those projects have been updated 
in the last 30 days, a reasonable activity metric.  A perhaps smarter 
search on runescape launcher lists 70-some projects, tho most appear to 
use the old launcher or at least be written in java.  Unfortunately, no 
github hits on runescape nxt yet. =:^(

> Just wondering if anyone has anything helpful to shorten the process of
> figuring it out.
> I'm planning to create a cut down apt-get which just fetches the files,
> but don't have much time most days.

Well, this doesn't do all the work, but it should get you well beyond the 
figuring out what apt-get does with the signature file stage, at least. 
=:^)

---
[1] Back in the day, myspace was using a scheme similar to this to index 
and store the myspace user images, including so-called "private" images, 
and someone figured out the scheme and brute-forced the entire namespace, 
resulting in an archive some 17 gigs or so in size of all those pictures, 
that was torrented out for anyone interested.  Of course this was in an 
era where 100 GiB hard drives were still considered huge and connections 
were normally sub-megabit, so this was no small undertaking, even just 
doing the torrent, let alone the work to actually mine the entire 
namespace in question.  I still have a copy around somewhere, and have 
actually looked thru IIRC about 1/8 of 1/16 of it (all the 000* thru 01f* 
images). 

-- 
Duncan - List replies preferred.   No HTML msgs.
"Every nonfree program has a lord, a master --
and if you use the program, he is your master."  Richard Stallman