Error $URL 404 Not Found (but apt-get is fine with it) about nala

[volitank]

There are a couple of things going on here.

First Apt and Nala are handling these the same. If we ignore the 404 errors from Nala and just look at the window, you can see it is ignoring most of the things it's trying to hit except for Packages, just like apt is. The difference is that Nala is throwing errors with more information than apt and saying that it cannot reach those places it wants too.

I did a little digging and this repo from containerlab is kind of wild tbh. They do not use InRelease/Release file like basically every other repository, for example my repo https://deb.volian.org/volian/dists/scar/InRelease

The only accessible page from them is https://apt.fury.io/netdevops/Packages. They do have the package hashsums and stuff in there, but this isn't the most secure way to distribute packages. If you look at a Debian/Ubuntu InRelease, or even mine, they are PGP signed, and you have to have the corresponding public key on the system for apt/nala to trust them, or do as they've asked you to do by saying [trusted=yes]. They are putting all their security into the https basket, which I do not agree with.

In this configuration if someone were to DNS hijack this domain, they could redirect it to a server with malicious .debs and apt would upgrade your systems to malicious packages with no questions asked. (Of course they have to solve the https certificate issue, which if they could compromise their DNS account to hijack the domain that wouldn't be difficult to do with letsencrypt).

With the way that most repositories work, since they are PGP signed, they would also need that private key in order to accomplish this, so it's more unlikely, and apt would give you a warning saying that the repo is not trusted.

Security ranting aside, apt and nala are working the same in this case, just Nala is giving more info. I don't know that I personally would want to hide messages like this.

[maxkratz]

Thank you for your detailed answer.

On occasion, I will rise the issue with the weird apt repository to the Containerlab developers.