Debian Taco Archive

Debian Taco, or TacOS, is a GitSecDevOps rebuild of Debian GNU/Linux.

The Debian Taco Archive project prepare and publish the package archive (dists/tacos-trixie/InRelease, dists/tacos-trixie/main/binary-amd64/Packages.gz, pool/* etc), similar to what is published at https://deb.debian.org/debian/.

Archive Location

The Debian Taco Archive is available from https://debdistutils.gitlab.io/tacos/archive/.

Apt Sources Listing

You will need to install the ca-certificates package so that apt-transport-https(1) works:

apt-get install ca-certificates

Then put one of the stanza below into /etc/apt/sources.list.d/tacos.sources.

You may add other components like contrib, non-free and/or non-free-firmware as appropriate.

You may change Types: deb into Types: deb deb-src to also download source indices.

The archive co-exist with the default Debian sources. You can remove the regular /etc/apt/sources.list.d/debian.sources file to switch to a pure Debian Tacos machine.

For Trixie:

cat <<EOF > /etc/apt/sources.list.d/tacos.sources
Types: deb
URIs: https://debdistutils.gitlab.io/tacos/archive
Suites: tacos-trixie tacos-trixie-updates tacos-trixie-security
Components: main
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 .
 mDMEaVbmnBYJKwYBBAHaRw8BAQdAvMhSvmzOapcJy5mVZ07laxUqSVox3lAz7Gpt
 BsLSlkW0LmdpdGxhYi1jb20tcGlwZWxpbmUtMjAyNi0wMS0wMUB0YWNvLmRlYmlh
 bi5uZXSImQQTFgoAQRYhBBGzzPHRRXY/SnZP4Bq6LcHTP6uSBQJpVuacAhsDBQkF
 o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBq6LcHTP6uSG9EBAN6z
 7rhLslU60Kuxn727HdxuXTaiUEP8geNHoREHLEcVAP9cf05jxJV+lIilVl1gCpzE
 RzP2PlSDhe0haO2SP/1xCbg4BGlW5pwSCisGAQQBl1UBBQEBB0AvJikoj/BL+Zvn
 +YiptXJBro8QProcxbtn0xmGdxeLDgMBCAeIeAQYFgoAIBYhBBGzzPHRRXY/SnZP
 4Bq6LcHTP6uSBQJpVuacAhsMAAoJEBq6LcHTP6uSQZMA/2kNR3CjC5HK9Sb78wnB
 JMkyGM/vXetgGQ4fJ9gc8S6PAP0eEzfRZKEQi4da/+GF4fgLogwk21JnIXTRgL95
 6JzmDg==
 =nbz7
 -----END PGP PUBLIC KEY BLOCK-----
EOF

For Forky:

cat <<EOF > /etc/apt/sources.list.d/tacos.sources
Types: deb
URIs: https://debdistutils.gitlab.io/tacos/archive
Suites: tacos-forky tacos-forky-updates tacos-forky-security
Components: main
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 .
 mDMEaVbmnBYJKwYBBAHaRw8BAQdAvMhSvmzOapcJy5mVZ07laxUqSVox3lAz7Gpt
 BsLSlkW0LmdpdGxhYi1jb20tcGlwZWxpbmUtMjAyNi0wMS0wMUB0YWNvLmRlYmlh
 bi5uZXSImQQTFgoAQRYhBBGzzPHRRXY/SnZP4Bq6LcHTP6uSBQJpVuacAhsDBQkF
 o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBq6LcHTP6uSG9EBAN6z
 7rhLslU60Kuxn727HdxuXTaiUEP8geNHoREHLEcVAP9cf05jxJV+lIilVl1gCpzE
 RzP2PlSDhe0haO2SP/1xCbg4BGlW5pwSCisGAQQBl1UBBQEBB0AvJikoj/BL+Zvn
 +YiptXJBro8QProcxbtn0xmGdxeLDgMBCAeIeAQYFgoAIBYhBBGzzPHRRXY/SnZP
 4Bq6LcHTP6uSBQJpVuacAhsMAAoJEBq6LcHTP6uSQZMA/2kNR3CjC5HK9Sb78wnB
 JMkyGM/vXetgGQ4fJ9gc8S6PAP0eEzfRZKEQi4da/+GF4fgLogwk21JnIXTRgL95
 6JzmDg==
 =nbz7
 -----END PGP PUBLIC KEY BLOCK-----
EOF

For Sid:

cat <<EOF > /etc/apt/sources.list.d/tacos.sources
Types: deb
URIs: https://debdistutils.gitlab.io/tacos/archive
Suites: tacos-sid
Components: main
Signed-By:
 -----BEGIN PGP PUBLIC KEY BLOCK-----
 .
 mDMEaVbmnBYJKwYBBAHaRw8BAQdAvMhSvmzOapcJy5mVZ07laxUqSVox3lAz7Gpt
 BsLSlkW0LmdpdGxhYi1jb20tcGlwZWxpbmUtMjAyNi0wMS0wMUB0YWNvLmRlYmlh
 bi5uZXSImQQTFgoAQRYhBBGzzPHRRXY/SnZP4Bq6LcHTP6uSBQJpVuacAhsDBQkF
 o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBq6LcHTP6uSG9EBAN6z
 7rhLslU60Kuxn727HdxuXTaiUEP8geNHoREHLEcVAP9cf05jxJV+lIilVl1gCpzE
 RzP2PlSDhe0haO2SP/1xCbg4BGlW5pwSCisGAQQBl1UBBQEBB0AvJikoj/BL+Zvn
 +YiptXJBro8QProcxbtn0xmGdxeLDgMBCAeIeAQYFgoAIBYhBBGzzPHRRXY/SnZP
 4Bq6LcHTP6uSBQJpVuacAhsMAAoJEBq6LcHTP6uSQZMA/2kNR3CjC5HK9Sb78wnB
 JMkyGM/vXetgGQ4fJ9gc8S6PAP0eEzfRZKEQi4da/+GF4fgLogwk21JnIXTRgL95
 6JzmDg==
 =nbz7
 -----END PGP PUBLIC KEY BLOCK-----
EOF

Legacy Apt Listing

If you need a legacy apt list here is a template for trixie.

cat <<EOF > /etc/apt/sources.list.d/tacos.list
deb     https://debdistutils.gitlab.io/tacos/archive tacos-trixie          main
deb-src https://debdistutils.gitlab.io/tacos/archive tacos-trixie-updates  main
deb     https://debdistutils.gitlab.io/tacos/archive tacos-trixie-security main
deb-src https://debdistutils.gitlab.io/tacos/archive tacos-trixie          main
deb     https://debdistutils.gitlab.io/tacos/archive tacos-trixie-updates  main
deb-src https://debdistutils.gitlab.io/tacos/archive tacos-trixie-security main
EOF

The PGP key is then configured via /etc/apt/trusted.gpg.d/ as follows:

cat <<EOF > /etc/apt/trusted.gpg.d/tacos.asc
-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaVbmnBYJKwYBBAHaRw8BAQdAvMhSvmzOapcJy5mVZ07laxUqSVox3lAz7Gpt
BsLSlkW0LmdpdGxhYi1jb20tcGlwZWxpbmUtMjAyNi0wMS0wMUB0YWNvLmRlYmlh
bi5uZXSImQQTFgoAQRYhBBGzzPHRRXY/SnZP4Bq6LcHTP6uSBQJpVuacAhsDBQkF
o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBq6LcHTP6uSG9EBAN6z
7rhLslU60Kuxn727HdxuXTaiUEP8geNHoREHLEcVAP9cf05jxJV+lIilVl1gCpzE
RzP2PlSDhe0haO2SP/1xCbg4BGlW5pwSCisGAQQBl1UBBQEBB0AvJikoj/BL+Zvn
+YiptXJBro8QProcxbtn0xmGdxeLDgMBCAeIeAQYFgoAIBYhBBGzzPHRRXY/SnZP
4Bq6LcHTP6uSBQJpVuacAhsMAAoJEBq6LcHTP6uSQZMA/2kNR3CjC5HK9Sb78wnB
JMkyGM/vXetgGQ4fJ9gc8S6PAP0eEzfRZKEQi4da/+GF4fgLogwk21JnIXTRgL95
6JzmDg==
=nbz7
-----END PGP PUBLIC KEY BLOCK-----
EOF

Testing

After configuration of apt (including apt-get install ca-certificates), and pruning the Debian sources, run apt-get update to fetch the index files:

root@e996343a33c1:/# apt-get update
Get:1 https://debdistutils.gitlab.io/tacos/archive tacos-trixie InRelease [50.4 kB]
Get:2 https://debdistutils.gitlab.io/tacos/archive tacos-trixie-updates InRelease [27.4 kB]
Get:3 https://debdistutils.gitlab.io/tacos/archive tacos-trixie-security InRelease [23.8 kB]
Get:4 https://debdistutils.gitlab.io/tacos/archive tacos-trixie/main amd64 Packages [13.4 MB]
Get:5 https://debdistutils.gitlab.io/tacos/archive tacos-trixie-updates/main amd64 Packages [5899 B]
Get:6 https://debdistutils.gitlab.io/tacos/archive tacos-trixie-security/main amd64 Packages [121 kB]
Fetched 13.7 MB in 2s (5752 kB/s)
Reading package lists... Done
root@e996343a33c1:/#

To test installation of a package built by Debian Taco, you can use apt-get install --reinstall as follows. This example is somewhat uninteresting, since this particular package was built reproducible, so it is bit-by-bit identical to what's in Debian.

root@e996343a33c1:/# apt-get install --reinstall hostname
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 11.0 kB of archives.
After this operation, 0 B of additional disk space will be used.
Get:1 https://debdistutils.gitlab.io/tacos/archive tacos-trixie/main amd64 hostname amd64 3.25 [11.0 kB]
Fetched 11.0 kB in 1s (16.0 kB/s)
debconf: unable to initialize frontend: Dialog
debconf: (No usable dialog-like program is installed, so the dialog based frontend cannot be used. at /usr/share/perl5/Debconf/FrontEnd/Dialog.pm line 79, <STDIN> line 1.)
debconf: falling back to frontend: Readline
debconf: unable to initialize frontend: Readline
debconf: (Can't locate Term/ReadLine.pm in @INC (you may need to install the Term::ReadLine module) (@INC entries checked: /etc/perl /usr/local/lib/x86_64-linux-gnu/perl/5.40.1 /usr/local/share/perl/5.40.1 /usr/lib/x86_64-linux-gnu/perl5/5.40 /usr/share/perl5 /usr/lib/x86_64-linux-gnu/perl-base /usr/lib/x86_64-linux-gnu/perl/5.40 /usr/share/perl/5.40 /usr/local/lib/site_perl) at /usr/share/perl5/Debconf/FrontEnd/Readline.pm line 8, <STDIN> line 1.)
debconf: falling back to frontend: Teletype
(Reading database ... 4935 files and directories currently installed.)
Preparing to unpack .../d68c8b668c7805aa4eb0c101321383153a0fc19982e344733e7bf28fc860f761 ...
Unpacking hostname (3.25) over (3.25) ...
Setting up hostname (3.25) ...
root@e996343a33c1:/#

Use DEBIAN_FRONTEND=teletype to avoid the warnings from debconf.

Use without ca-certificates

If for some reason you do not wish to install the ca-certificates packages, perhaps due to its dependency on OpenSSL, you can use the following configuration to provide the CA certificate for the relevant hosts. Note that it then becomes your responsibility to keep this configuration updated to handle if Debian, GitLab or Hetzner ever switch to another CA.

For documentation, see apt-transport-https(1) while taking into consideration it has a typo related to this setting.

cat <<EOF > /etc/apt/apt.conf.d/taco-https
Acquire::https::deb.debian.org::CAInfo "/etc/apt/taco-https.pem";
Acquire::https::hel1.your-objectstorage.com::CAInfo "/etc/apt/taco-https.pem";
Acquire::https::debdistutils.gitlab.io::CAInfo "/etc/apt/taco-https.pem";
EOF

cat <<EOF > /etc/apt/taco-https.pem
CA for deb.debian.org and CA hel1.your-objectstorage.com

-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
WhcNMzUwNjA0MTEwNDM4WjBPMQswCQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJu
ZXQgU2VjdXJpdHkgUmVzZWFyY2ggR3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBY
MTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK3oJHP0FDfzm54rVygc
h77ct984kIxuPOZXoHj3dcKi/vVqbvYATyjb3miGbESTtrFj/RQSa78f0uoxmyF+
0TM8ukj13Xnfs7j/EvEhmkvBioZxaUpmZmyPfjxwv60pIgbz5MDmgK7iS4+3mX6U
A5/TR5d8mUgjU+g4rk8Kb4Mu0UlXjIB0ttov0DiNewNwIRt18jA8+o+u3dpjq+sW
T8KOEUt+zwvo/7V3LvSye0rgTBIlDHCNAymg4VMk7BPZ7hm/ELNKjD+Jo2FR3qyH
B5T0Y3HsLuJvW5iB4YlcNHlsdu87kGJ55tukmi8mxdAQ4Q7e2RCOFvu396j3x+UC
B5iPNgiV5+I3lg02dZ77DnKxHZu8A/lJBdiB3QW0KtZB6awBdpUKD9jf1b0SHzUv
KBds0pjBqAlkd25HN7rOrFleaJ1/ctaJxQZBKT5ZPt0m9STJEadao0xAH0ahmbWn
OlFuhjuefXKnEgV4We0+UXgVCwOPjdAvBbI+e0ocS3MFEvzG6uBQE3xDk3SzynTn
jh8BCNAw1FtxNrQHusEwMFxIt4I7mKZ9YIqioymCzLq9gwQbooMDQaHWBfEbwrbw
qHyGO0aoSCqI3Haadr8faqU9GY/rOPNk3sgrDQoo//fb4hVC1CLQJ13hef4Y53CI
rU7m2Ys6xt0nUW7/vGT1M0NPAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNV
HRMBAf8EBTADAQH/MB0GA1UdDgQWBBR5tFnme7bl5AFzgAiIyBpY9umbbjANBgkq
hkiG9w0BAQsFAAOCAgEAVR9YqbyyqFDQDLHYGmkgJykIrGF1XIpu+ILlaS/V9lZL
ubhzEFnTIZd+50xx+7LSYK05qAvqFyFWhfFQDlnrzuBZ6brJFe+GnY+EgPbk6ZGQ
3BebYhtF8GaV0nxvwuo77x/Py9auJ/GpsMiu/X1+mvoiBOv/2X/qkSsisRcOj/KK
NFtY2PwByVS5uCbMiogziUwthDyC3+6WVwW6LLv3xLfHTjuCvjHIInNzktHCgKQ5
ORAzI4JMPJ+GslWYHb4phowim57iaztXOoJwTdwJx4nLCgdNbOhdjsnvzqvHu7Ur
TkXWStAmzOVyyghqpZXjFaH3pO3JLF+l+/+sKAIuvtd7u+Nxe5AW0wdeRlN8NwdC
jNPElpzVmbUq4JUagEiuTDkHzsxHpFKVK7q4+63SM1N95R1NbdWhscdCb+ZAJzVc
oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
4RgqsahDYVvTH9w7jXbyLeiNdd8XM2w9U/t7y0Ff/9yi0GE44Za4rF2LN9d11TPA
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----

CA for debdistutils.gitlab.io

-----BEGIN CERTIFICATE-----
MIIFgzCCA2ugAwIBAgIORea7A4Mzw4VlSOb/RVEwDQYJKoZIhvcNAQEMBQAwTDEg
MB4GA1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjYxEzARBgNVBAoTCkdsb2Jh
bFNpZ24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMTQxMjEwMDAwMDAwWhcNMzQx
MjEwMDAwMDAwWjBMMSAwHgYDVQQLExdHbG9iYWxTaWduIFJvb3QgQ0EgLSBSNjET
MBEGA1UEChMKR2xvYmFsU2lnbjETMBEGA1UEAxMKR2xvYmFsU2lnbjCCAiIwDQYJ
KoZIhvcNAQEBBQADggIPADCCAgoCggIBAJUH6HPKZvnsFMp7PPcNCPG0RQssgrRI
xutbPK6DuEGSMxSkb3/pKszGsIhrxbaJ0cay/xTOURQh7ErdG1rG1ofuTToVBu1k
ZguSgMpE3nOUTvOniX9PeGMIyBJQbUJmL025eShNUhqKGoC3GYEOfsSKvGRMIRxD
aNc9PIrFsmbVkJq3MQbFvuJtMgamHvm566qjuL++gmNQ0PAYid/kD3n16qIfKtJw
LnvnvJO7bVPiSHyMEAc4/2ayd2F+4OqMPKq0pPbzlUoSB239jLKJz9CgYXfIWHSw
1CM69106yqLbnQneXUQtkPGBzVeS+n68UARjNN9rkxi+azayOeSsJDa38O+2HBNX
k7besvjihbdzorg1qkXy4J02oW9UivFyVm4uiMVRQkQVlO6jxTiWm05OWgtH8wY2
SXcwvHE35absIQh1/OZhFj931dmRl4QKbNQCTXTAFO39OfuD8l4UoQSwC+n+7o/h
bguyCLNhZglqsQY6ZZZZwPA1/cnaKI0aEYdwgQqomnUdnjqGBQCe24DWJfncBZ4n
WUx2OVvq+aWh2IMP0f/fMBH5hc8zSPXKbWQULHpYT9NLCEnFlWQaYw55PfWzjMpY
rZxCRXluDocZXFSxZba/jJvcE+kNb7gu3GduyYsRtYQUigAZcIN5kZeR1Bonvzce
MgfYFGM8KEyvAgMBAAGjYzBhMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTAD
AQH/MB0GA1UdDgQWBBSubAWjkxPioufi1xzWx/B/yGdToDAfBgNVHSMEGDAWgBSu
bAWjkxPioufi1xzWx/B/yGdToDANBgkqhkiG9w0BAQwFAAOCAgEAgyXt6NH9lVLN
nsAEoJFp5lzQhN7craJP6Ed41mWYqVuoPId8AorRbrcWc+ZfwFSY1XS+wc3iEZGt
Ixg93eFyRJa0lV7Ae46ZeBZDE1ZXs6KzO7V33EByrKPrmzU+sQghoefEQzd5Mr61
55wsTLxDKZmOMNOsIeDjHfrYBzN2VAAiKrlNIC5waNrlU/yDXNOd8v9EDERm8tLj
vUYAGm0CuiVdjaExUd1URhxN25mW7xocBFymFe944Hn+Xds+qkxV/ZoVqW/hpvvf
cDDpw+5CRu3CkwWJ+n1jez/QcYF8AOiYrg54NMMl+68KnyBr3TsTjxKM4kEaSHpz
oHdpx7Zcf4LIHv5YGygrqGytXm3ABdJ7t+uA/iU3/gKbaKxCXcPu9czc8FB10jZp
nOZ7BN9uBmm23goJSFmH63sUYHpkqmlD75HHTOwY3WzvUy2MmeFe8nI+z1TIvWfs
pA9MRf/TuTAjB0yPEL+GltmZWrSZVxykzLsViVO6LAUP5MSeGbEYNNVMnbrt9x+v
JJUEeKgDu+6B5dpffItKoZB0JaezPkvILFa9x8jvOOJckvB595yEunQtYQEgfn7R
8k8HWV+LLUNS60YMlOH1Zkd5d9VUWx+tJDfLRVpOoERIyNiwmcUVhAn21klJwGW4
5hpxbqCo8YLoRT5s1gLXCmeDBVrJpBA=
-----END CERTIFICATE-----
EOF

Design

The Debian Taco Archive (dists/tacos-trixie/InRelease, etc) is generated in a GitLab Pipeline and published using GitLab Pages.

The main script ./build.sh download the latest Debian archive meta-information (Release, InRelease etc) and merge them with the Taco packages and then signs the InRelease metadata files. It is invoked from .gitlab-ci.yml.

The private PGP key was generated by Simon Josefsson on a laptop (with backup copies) and then stored as a masked and hidden GitLab CI/CD Variable. The public key is as follows:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaVbmnBYJKwYBBAHaRw8BAQdAvMhSvmzOapcJy5mVZ07laxUqSVox3lAz7Gpt
BsLSlkW0LmdpdGxhYi1jb20tcGlwZWxpbmUtMjAyNi0wMS0wMUB0YWNvLmRlYmlh
bi5uZXSImQQTFgoAQRYhBBGzzPHRRXY/SnZP4Bq6LcHTP6uSBQJpVuacAhsDBQkF
o5qABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEBq6LcHTP6uSG9EBAN6z
7rhLslU60Kuxn727HdxuXTaiUEP8geNHoREHLEcVAP9cf05jxJV+lIilVl1gCpzE
RzP2PlSDhe0haO2SP/1xCbg4BGlW5pwSCisGAQQBl1UBBQEBB0AvJikoj/BL+Zvn
+YiptXJBro8QProcxbtn0xmGdxeLDgMBCAeIeAQYFgoAIBYhBBGzzPHRRXY/SnZP
4Bq6LcHTP6uSBQJpVuacAhsMAAoJEBq6LcHTP6uSQZMA/2kNR3CjC5HK9Sb78wnB
JMkyGM/vXetgGQ4fJ9gc8S6PAP0eEzfRZKEQi4da/+GF4fgLogwk21JnIXTRgL95
6JzmDg==
=nbz7
-----END PGP PUBLIC KEY BLOCK-----

License

Third party artifacts are licensed following Debian's normal licensing policies. Licensing and copyright information is available from the package sources and normally installed as /usr/share/doc/PKG/copyright replacing PKG with the relevant package you are interested in.

Any file in this project is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

Tree

Below are the static files served by Debian Taco. Other files exists too, handled via redirects to the normal Debian Archive.

1079 directories, 691 files