Bab 6. Pemeliharaan dan Pembaharuan: Peralatan APT

What makes Debian so popular with administrators is how easily software can be installed and how easily the whole system can be updated. This unique advantage is largely due to the APT program, which Falcot Corp administrators studied with enthusiasm.

APT is the abbreviation for Advanced Package Tool. What makes this program “advanced” is its approach to packages. It doesn't simply evaluate them individually, but it considers them as a whole and produces the best possible combination of packages depending on what is available and compatible according to dependencies.

APT needs to be given a “list of package sources (repositories)”: the file /etc/apt/sources.list will list the different repositories that publish Debian packages. APT will then import the list of packages published by each of these sources. This operation is achieved by downloading Packages.xz files or a variant such as Packages.gz or .bz2 (using a different compression method) in case of a source of binary packages and by analyzing their contents. In case of a source of source packages, APT downloads Sources.xz files or a variant using a different compression method. When an old copy of these files is already present, APT can update it by only downloading the differences (see sidebar TIP Incremental updates).

KEMBALI KE DASAR Kompresi gzip, bzip2, LZMA dan XZ

Ekstensi .gz mengacu pada berkas yang dikompress dengan utilitas gzip. gzip merupakan utilitas Unix yang cepat dan efisien untuk mengompress berkas. Peralatan terbaru memiliki kemampuan kompresi yang lebih baik namun memerlukan sumber daya yang lebih (waktu penghitungan dan memori) untuk mengompress dan mengekstrak berkas. Di antaranya, berdasarkan urutan kemunculannya, ada bzip2 (menghasilkan berkas dengan ekstensi .bz2), lzma (menghasilkan berkas .lzma) dan xz (menghasilkan berkas .xz).

6.1. Mengisi Berkas `sources.list`

6.1.1. Sintaks

Each active line in the /etc/apt/sources.list file represents a package source (repository) and is made of at least three parts separated by spaces. For a complete description of the file format and the accepted entry compositions see sources.list(5).

Contoh 6.1. Example entry format in /etc/apt/sources.list

deb url distribution component1 component2 component3 [..] componentX
deb-src url distribution component1 component2 component3 [..] componentX

Field pertama menunjukkan tipe sumber:

deb: package source (repository) of binary packages
deb-src: package source (repository) of source packages

The second field gives the base URL of the source. Combined with the filenames listed in the Packages.xz files, it must give a full and valid URL. This can consist in a Debian mirror or in any other package archive set up by a third party. The URL can start with file:// to indicate a local source installed in the system's file hierarchy, with http:// or https:// to indicate a source accessible from a web server, or with ftp:// or ftps:// for a source available on an FTP server. The URL can also start with cdrom: for CD-ROM/DVD/Blu-ray disc based installations, although this is less frequent, since network-based installation methods are eventually more common.

The syntax of the last field depends on the structure of the repository. In the simplest case, you can simply indicate a subdirectory (with a required trailing slash) of the desired source. This is often a simple “./” which refers to the absence of a subdirectory. The packages are then directly at the specified URL. But in the most common case, the repositories will be structured like a Debian mirror, with multiple distributions, each having multiple components. In those cases, name the chosen distribution by its “codename” — see the list in sidebar KOMUNITAS Bruce Perens, seorang pemimpin kontroversial — or by the corresponding “suite” (oldstable, stable, testing, unstable) and then the components to enable. A typical Debian mirror provides the components main, contrib, and non-free.

KOSAKATA Arsip main, contrib dan non-free

Debian uses three components to differentiate packages according to the licenses chosen by the authors of each work. Main gathers all packages which fully comply with the Debian Free Software Guidelines.

The non-free component is different because it contains software which does not (entirely) conform to these principles but which can, nevertheless, be distributed without restrictions. This archive, which is not officially part of Debian, is a service for users who could need some of those programs and, nowadays, also require the firmware for their hardware. However, Debian always recommends giving priority to free software. The existence of this component represents a considerable problem for Richard M. Stallman and keeps the Free Software Foundation from recommending Debian to users.

Contrib (contributions) is a set of open source software which cannot function without some non-free elements — these elements can be software from the non-free section, or non-free files such as game ROMs, BIOS of consoles, etc. — or some elements, not available from the Debian main archive at all. The contrib component also includes free software whose compilation requires proprietary elements. This was initially the case for the OpenOffice.org office suite, which used to require a proprietary Java environment.

Entri cdrom menjelaskan CD/DVD-ROM yang Anda miliki. Berlawanan dengan entri lainnya, CD-ROM tidak selalu tersedia karena harus dimasukkan ke drive dan hanya satu cakram yang dapat dibaca pada satu waktu. Untuk alasan tersebut, sumber ini diatur dalam cara yang sangat berbeda, dan perlu ditambahkan dengan program apt-cdrom, biasanya dieksekusi dengan parameter add. Kemudian akan meminta agar cakram dimasukkan ke dalam drive dan akan menjelajah isinya mencari berkas Packates. Menggunakan berkas tersebut untuk memerbarui basisdatanya dari paket yang tersedia (operasi ini biasanya dilakukan dengan perintah apt update). Dari itu, APT dapat meminta cakram untuk dimasukkan jika memerlukan salah satu paketnya.

6.1.2. Repositori untuk Pengguna Stable

Berikut ini standar sources.list untuk sistem menjalankan versi Debian Stable:

Contoh 6.2. Berkas /etc/apt/sources.list untuk pengguna Debian Stable

# Security updates
deb http://security.debian.org/ buster/updates main contrib non-free
deb-src http://security.debian.org/ buster/updates main contrib non-free

## Debian mirror

# Base repository
deb https://deb.debian.org/debian buster main contrib non-free
deb-src https://deb.debian.org/debian buster main contrib non-free

# Stable updates
deb https://deb.debian.org/debian buster-updates main contrib non-free
deb-src https://deb.debian.org/debian buster-updates main contrib non-free

# Stable backports
deb https://deb.debian.org/debian buster-backports main contrib non-free
deb-src https://deb.debian.org/debian buster-backports main contrib non-free

This file lists all sources of packages associated with the Buster version of Debian (the current Stable suite as of this writing). In the example above, we opted to name “buster” explicitly instead of using the corresponding “stable“ aliases (stable, stable-updates, stable-backports) because we don't want to have the underlying distribution changed outside of our control when the next stable release comes out.

Kebanyakan paket akan datang dari “base repository” yang berisi seluruh paket namun jarang diperbaharui (sekitar 2 bulan sekali untuk sebuah “point release”). Repositori lain adalah sebagian (mereka tidak berisi seluruh paket) dan dapat menghost pembaharuan (paket dengan versi terbaru) yang mungkin diinstall APT. Bagian berikut akan menjelaskan tujuan dan peraturan yang mengatur setiap repositori tersebut.

Catat bahwa ketika versi paket yang diinginkan tersedia pada beberapa repositori, yang pertama didaftarkan di sources.list akan digunakan. Untuk alasan ini, sumber tak-resmi biasanya ditambahkan di akhir berkas.

Sebagai catatan lain, kebanyakan apa yang dikatakan bagian ini tentang Stable berlaku juga ke Oldstable karena yang terakhir hanya merupakan yang lama Stable yang dikelola secara paralel.

6.1.2.1. Pembaharuan Keamanan

Debian takes security seriously. Known software vulnerabilities in Debian are tracked in the Security Bug Tracker and usually get fixed in a reasonable timeframe. The security updates are not hosted on the usual network of Debian mirrors but on security.debian.org, a small set of machines maintained by the Debian System Administrators. This archive contains security updates prepared by the Debian Security Team and/or by package maintainers for the Stable and Oldstable distribution.

The server can also host security updates for Testing but this doesn't happen very often since those updates tend to reach the Testing suite via the regular flow of updates coming from Unstable.

For serious issues, the security team issues a Debian Security Advisory (DSA) and announces it together with the security update on the debian-security-announce@lists.debian.org mailing list (archive).

6.1.2.2. Pembaharuan Stabil

Pembaharuan Stable bukan keamanan yang sensitif tapi dianggap cukup penting untuk dikirim ke pengguna sebelum titik rilis stable selnjutnya.

This repository will typically contain fixes for critical and serious bugs which could not be fixed before release or which have been introduced by subsequent updates. Depending on the urgency, it can also contain updates for packages that have to evolve over time, like spamassassin's spam detection rules, clamav's virus database, the daylight-saving time rules of all timezones (tzdata), the ESR version of Firefox (firefox-esr) or cryptographic keyrings like debian-archive-keyring.

In practice, this repository is a subset of the proposed-updates repository, carefully selected by the Stable Release Managers. All updates are announced on the debian-stable-announce@lists.debian.org mailing list (archive) and will be included in the next Stable point release anyway.

deb https://deb.debian.org/debian buster-updates main contrib non-free

6.1.2.3. Pengajuan Pembaharuan

Sekali diterbitkan, distribusi Stable hanya diperbaharui dua kali dalam sebulan. Repositori proposed-updates merupakan di mana pembaharuan yang diharapkan dipersiapkan (di bawah supervisi Manajer Rilis Stable).

Keamanan dan pembaharuan stable yang didokumentasikan di bagian sebelumnya selalu disertakan dalam repositori ini, tetapi ada lagi juga, karena maintainer paket juga memiliki kesempatan untuk memerbaiki kutu penting yang tidak perlu terburu-buru dirilis.

Anyone can use this repository to test those updates before their official publication. The extract below uses the buster-proposed-updates alias which is both more explicit and more consistent since stretch-proposed-updates also exists (for the Oldstable updates):

deb https://deb.debian.org/debian buster-proposed-updates main contrib non-free

6.1.2.4. Backport Stable

Repositori stable-backports menghost “backport paket”. Istilah tersebut mengacu pada paket beberapa perangkat lunak terkini yang telah dokompilasi untuk distribusi lama, umumnya untuk Stable.

When the distribution becomes a little dated, numerous software projects have released new versions that are not integrated into the current Stable suite, which is only modified to address the most critical problems, such as security issues. Since the Testing and Unstable suites can be more risky, package maintainers sometimes voluntarily offer recompilations of recent software applications for Stable, which has the advantage to users and system administrators to limit potential instability to a small number of chosen packages. The page https://backports.debian.org provides more information.

Backports from stable-backports are only created from packages available in Testing. This ensures that all installed backports will be upgradable to the corresponding stable version once the next stable release of Debian is available.

Even though this repository provides newer versions of packages, APT will not install them unless you give explicit instructions to do so (or unless you have already done so with a former version of the given backport):

$ sudo apt-get install package/buster-backports
$ sudo apt-get install -t buster-backports package

6.1.3. Repositori untuk pengguna Testing/Unstable

Berikut ini sebuah standar sources.list untuk sistem yang menjalankan versi Debian Testing atau Unstable:

Contoh 6.3. Berkas /etc/apt/sources.list untuk pengguna Debian Testing/Unstable

# Unstable
deb https://deb.debian.org/debian unstable main contrib non-free
deb-src https://deb.debian.org/debian unstable main contrib non-free

# Testing
deb https://deb.debian.org/debian testing main contrib non-free
deb-src https://deb.debian.org/debian testing main contrib non-free

# Testing security updates
deb http://security.debian.org/ testing-security main contrib non-free
deb-src http://security.debian.org/ testing-security main contrib non-free

# Stable
deb https://deb.debian.org/debian stable main contrib non-free
deb-src https://deb.debian.org/debian stable main contrib non-free

# Stable security updates
deb http://security.debian.org/ stable/updates main contrib non-free
deb-src http://security.debian.org/ stable/updates main contrib non-free

With this sources.list file APT will install packages from the Unstable suite. If that is not desired, use the APT::Default-Release setting (see Bagian 6.2.3, “Pembaharuan Sistem”) to instruct APT to pick packages from another suite (most likely Testing in this case).

Ada alasan bagus untuk menyertakan seluruh repositori tersebut, meskipun satu saja sudah cukup. Pengguna Testing akan mengapresiasi kemungkinan untuk cherry-pick paket tertentu dari Unstable ketika versi di Testing terkena efek kutu yang mengganggu. Sebaliknya, pengguna Unstable terkena kemunduran yang tidak diharapkan memiliki kemungkinan untuk mendowngrade paket ke versi (seharusnya bekerja) Testing mereka.

The inclusion of Stable is more debatable but it often gives access to some packages, which have been removed from the development versions. It also ensures that you get the latest updates for packages, which have not been modified since the last stable release.

6.1.3.1. Repositori Experimental

Arsip paket Experimental ada di seluruh mirror Debian, dan berisi paket yang belum ada di versi Unstable karena kualitas substandar mereka - mereka sering berupa perangkat lunak versi pengembangan atau pre-versi (alpha, beta, rilis kandidat…). Sebuah paket dapat juga dikirim ke sana setelah mengalami perubahan berikutnya yang dapat menghasilkan masalah. Kemudian maintainer mencoba untuk menemukan mereka dengan bantuan dari para pengguna mahir yang dapat menangani isu=isu penting. Setelah langkah pertama ini, paket dipindah ke Unstable, di mana akan menjangkau audiens yang lebih banyak dan akan dites lebih mendetail.

Experimental umumnya digunakan oleh pengguna yang tidak peduli menghancurkan sistemnya dan kemudian memerbaikinya. Distribusi ini memberikan kemungkinan untuk mengimpor paket yang diinginkan pengguna untuk dicoba atau gunakan sebagaimana mereka perlukan. Inilah tentunya bagaimana pendekatan oleh Debian, karena mengambahkannya ke berkas sources.list APT tidak membawa ke penggunaan sistematis paketnya. Baris yang ditambahkan ialah:

deb https://deb.debian.org/debian experimental main contrib non-free

6.1.4. Using Alternate Mirrors

The sources.list examples in this chapter refer to package repositories hosted on deb.debian.org. Those URLs will redirect you to servers which are close to you and which are managed by Content Delivery Networks (CDN) whose main role is to store multiple copies of the files across the world, and to deliver them as fast as possible to users. The CDN companies that Debian is working with are Debian partners who are offering their services freely to Debian. While none of those servers are under direct control of Debian, the fact that the whole archive is sealed by GPG signatures makes it a non-issue.

Picky users who are not satisfied with the performance of deb.debian.org can try to find a better mirror in the official mirror list:

→ https://www.debian.org/mirror/list

But when you don't know which mirror is best for you, this list is of not much use. Fortunately for you, Debian maintains DNS entries of the form ftp.country-code.debian.org (e.g. ftp.us.debian.org for the USA, ftp.fr.debian.org for France, etc.) which are covering many countries and which are pointing to one (or more) of the best mirrors available within that country.

As an alternative to deb.debian.org, there used to be httpredir.debian.org. This service would identify a mirror close to you (among the list of official mirrors, using GeoIP mainly) and would redirect APT's requests to that mirror. This service has been deprecated due to reliability concerns and now httpredir.debian.org provides the same CDN-based service as deb.debian.org.

6.1.5. Sumber Daya Tidak-Resmi: `mentors.debian.net`

There are numerous non-official sources of Debian packages set up by advanced users who have recompiled some software — Ubuntu made this popular with their Personal Package Archive (PPA) service — by programmers who make their creation available to all, and even by Debian developers who offer pre-versions of their package online.

The mentors.debian.net site is interesting (although it only provides source packages), since it gathers packages created by candidates to the status of official Debian developer or by volunteers who wish to create Debian packages without going through that process of integration. These packages are made available without any guarantee regarding their quality; make sure that you check their origin and integrity and then test them before you consider using them in production.

KOMUNITAS Situs debian.net

Domain debian.net bukan merupakan sumber daya resmi proyek Debian. Setiap pengembang Debian boleh menggunakann nama domain tersebut untuk kegunaan mereka. Website ini dapat berisi layanan tak resmi (terkadang situs personal) dihost pada sebuah mesin yang tidak dimiliki proyek dan diatur oleh pengembang Debian, atau bahkan prototype yang akan dipindahkan ke debian.org. Dua alasan yang dapat menjelaskan mengapa beberapa prototype tetap berada di debian.net: antara tidak ada yang melakukan usaha yang diperlukan untuk mengubahnya ke dalam layanan resmi (dihost di domaing debian.org, dan dengan jaminan perawatan tertentu), atau layanan terlalu kontroversial untuk diresmikan.

Menginstall sebuah paket berarti memberikan hak root kepada pembuatnya, karena mereka menentukan pada isi skrip inisialisasi yang dijalankan dengan identitas tersebut. Paket resmi Debian dibuat oleh relawan yang telah dipilih dan ditinjau dan yang dapat menyegel paket mereka agar keaslian dan integritasnya dapat diperiksa.

In general, be wary of a package whose origin you don't know and which isn't hosted on one of the official Debian servers: evaluate the degree to which you can trust the creator, and check the integrity of the package.

6.1.6. Caching Proxy untuk Paket Debian

Ketika seluruh jaringan mesin dikonfigurasi untuk menggunakan remote server untuk mengunduh pembaharuan paket yang sama, beberapa administrator mengetahui bahwa mungkin lebih bermanfaat jika proxy menengah berlaku sebagai cache jaringan-lokal (lihat bilah tepi KOSAKATA Cache).

Anda dapat mengonfigurasi APT untuk menggunakan proxy "standard" (lihat Bagian 6.2.4, “Pilihan Konfigurasi” untuk sisi APT, dan Bagian 11.6, “Proksi HTTP/FTP” untuk sisi proxy), namun ekosistem Debian menawarkan pilihan yang lebih baik untuk mengatasi masalah ini. Perangkat lunak terdedikasi disajikan pada bagian ini lebih pintar dari cache proxy murni karena mereka dapat mengandalkan struktur khusus dari repositori APT (misalnya mereka mengetahui ketika suatu berkas usang atau tidak, dan menentukan waktu selama yang mereka simpan).

apt-cacher dan apt-cacher-ng bekerja seperti server proxy cache biasanya. Berkas sources.list milik APT tidak diubah, namun APT dikonfigurasi untuk menggunakannya sebagai proxy permintaan keluar.

approx, di lain pihak, berlaku seperti server HTTP yang “me-mirror” beberapa repositori remote pada level tertinggi URL. Pemetaan antara level-tertinggi direktori tersebut dan URL remote repositori di simpan di /etc/approx/approx.conf:

# <name> <repository-base-url>
debian   https://deb.debian.org/debian
security http://security.debian.org

approx runs by default on port 9999 via a systemd socket and requires the users to adjust their sources.list file to point to the approx server:

# Sample sources.list pointing to a local approx server
deb http://localhost:9999/security buster/updates main contrib non-free
deb http://localhost:9999/debian buster main contrib non-free