config: initial apt release inspector configuration
Metadata
Current evaluation
Merged as commit 50107e7, adding configurable apt release-inspector URLs, distributions, components, architectures, and signing keys.
Resolution: closed resolved
Reason: PR #120 was merged into the project as commit 50107e7, implementing the initial apt release-inspector configuration.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Implement user-configurable parameters for the apt release inspector.
The configuration will later be extended to other apt-related
inspectors such as package, translation, and deb package.
Inspectors configuration is applied per session. Sessions may
have different configuration parameters after session configuration
support is implemented.
The following format is used in the configuration file:
```
apt:
repositories:
default:
urls:
- http://archive.ubuntu.com/ubuntu
- http://*.archive.ubuntu.com/ubuntu
- http://security.ubuntu.com/ubuntu
- https://esm.ubuntu.com/ubuntu
- http://ftpmaster.internal/ubuntu
dists:
- jammy*
components:
- main
- universe
architectures:
- "*"
public-key: |
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQINBFufwdoBEADv/Gxytx/LcSXYuM0MwKojbBye81s0G1nEx+lz6VAUpIUZnbkq
dXBHC+dwrGS/CeeLuAjPRLU8AoxE/jjvZVp8xFGEWHYdklqXGZ/gJfP5d3fIUBtZ
HZEJl8B8m9pMHf/AQQdsC+YzizSG5t5Mhnotw044LXtdEEkx2t6Jz0OGrh+5Ioxq
X7pZiq6Cv19BohaUioKMdp7ES6RYfN7ol6HSLFlrMXtVfh/ijpN9j3ZhVGVeRC8k
KHQsJ5PkIbmvxBiUh7SJmfZUx0IQhNMaDHXfdZAGNtnhzzNReb1FqNLSVkrS/Pns
AQzMhG1BDm2VOSF64jebKXffFqM5LXRQTeqTLsjUbbrqR6s/GCO8UF7jfUj6I7ta
LygmsHO/JD4jpKRC0gbpUBfaiJyLvuepx3kWoqL3sN0LhlMI80+fA7GTvoOx4tpq
VlzlE6TajYu+jfW3QpOFS5ewEMdL26hzxsZg/geZvTbArcP+OsJKRmhv4kNo6Ayd
yHQ/3ZV/f3X9mT3/SPLbJaumkgp3Yzd6t5PeBu+ZQk/mN5WNNuaihNEV7llb1Zhv
Y0Fxu9BVd/BNl0rzuxp3rIinB2TX2SCg7wE5xXkwXuQ/2eTDE0v0HlGntkuZjGow
DZkxHZQSxZVOzdZCRVaX/WEFLpKa2AQpw5RJrQ4oZ/OfifXyJzP27o03wQARAQAB
tEJVYnVudHUgQXJjaGl2ZSBBdXRvbWF0aWMgU2lnbmluZyBLZXkgKDIwMTgpIDxm
dHBtYXN0ZXJAdWJ1bnR1LmNvbT6JAjgEEwEKACIFAlufwdoCGwMGCwkIBwMCBhUI
AgkKCwQWAgMBAh4BAheAAAoJEIcZINGZG8k8LHMQAKS2cnxz/5WaoCOWArf5g6UH
beOCgc5DBm0hCuFDZWWv427aGei3CPuLw0DGLCXZdyc5dqE8mvjMlOmmAKKlj1uG
g3TYCbQWjWPeMnBPZbkFgkZoXJ7/6CB7bWRht1sHzpt1LTZ+SYDwOwJ68QRp7DRa
Zl9Y6QiUbeuhq2DUcTofVbBxbhrckN4ZteLvm+/nG9m/ciopc66LwRdkxqfJ32Cy
q+1TS5VaIJDG7DWziG+Kbu6qCDM4QNlg3LH7p14CrRxAbc4lvohRgsV4eQqsIcdF
kuVY5HPPj2K8TqpY6STe8Gh0aprG1RV8ZKay3KSMpnyV1fAKn4fM9byiLzQAovC0
LZ9MMMsrAS/45AvC3IEKSShjLFn1X1dRCiO6/7jmZEoZtAp53hkf8SMBsi78hVNr
BumZwfIdBA1v22+LY4xQK8q4XCoRcA9G+pvzU9YVW7cRnDZZGl0uwOw7z9PkQBF5
KFKjWDz4fCk+K6+YtGpovGKekGBb8I7EA6UpvPgqA/QdI0t1IBP0N06RQcs1fUaA
QEtz6DGy5zkRhR4pGSZn+dFET7PdAjEK84y7BdY4t+U1jcSIvBj0F2B7LwRL7xGp
SpIKi/ekAXLs117bvFHaCvmUYN7JVp1GMmVFxhIdx6CFm3fxG8QjNb5tere/YqK+
uOgcXny1UlwtCUzlrSaP
=9AdM
-----END PGP PUBLIC KEY BLOCK-----
```
- [x] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)?
-----
CRAFT-2985
**Note to reviewers**: tests were not updated for this spike and are expected to fail.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Merged as commit 50107e7, adding configurable apt release-inspector URLs, distributions, components, architectures, and signing keys. | |
| stealth/space-bunny-alpha | — | closed resolved | Merged CRAFT-2985’s initial apt release-inspector configuration, supporting user-defined repository URLs, distributions, components, architectures, and signing public keys. | |
| qwen/qwen3.6-35b-a3b | — | — | Merged the initial apt release inspector configuration, adding user-configurable parameters for repositories, distributions, components, and architectures. Approved by one reviewer and merged as a spike, despite expected test failures. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #127 inspectors/apt: extend configuration to apt inspectors | fetch-service | merged | Merged PR #127 as commit 26c596c, unifying APT configuration for allowed repositories, distributions, and components across metadata files and .deb packages (CRAFT-3027). | |
| #121 Extend configurability to all apt-related inspectors | fetch-service | closed | Extended configuration to all apt-related inspectors in merged PR #127 (commit 26c596c), following the initial Release inspector work in PR #120. | |
| #425 refactor(i/apt): define release inspector id as a constant | fetch-service | merged | PR #425 merged into main as commit 8d36f22, replacing repeated "apt.release" literals with a shared i/apt release inspector ID constant. | |
| #61 inspectors: add apt and deb file inspectors | fetch-service | merged | Merged PR #61 in commit 566f57c, adding stateful APT and DEB inspectors to validate signed InRelease files, Packages.xz indexes, and .deb packages. |