Extra empty line at beginning of field `Package-List` of published mirror with source packages

[syominsergey]

Hello!

I faced with current problem when I was trying to create a mirror of full Debian Trixie repository. This problem concerned every source package. But in this issue I will show howto reproduce problem using a little subset of Debian Trixie repository consisting of only one source package - bash (just for example).

Start with new clear Debian Trixie container:

podman run --pull=always --rm -it debian:trixie bash

Goto into home dir:

cd ~

Update apt cache:

apt update

Install necessary packages:

apt install wget unzip gnupg bzip2 less

Download statically linked aptly. It's 1.6.2 at current moment. Link is from download page :

wget https://github.com/aptly-dev/aptly/releases/download/v1.6.2/aptly_1.6.2_linux_amd64.zip

Unzip downloaded package:

unzip aptly_1.6.2_linux_amd64.zip

Create symbolic link for more comfortable usage:

ln -s /root/aptly_1.6.2_linux_amd64/aptly /usr/local/bin/aptly

Check aptly version:

aptly version

In my case in was:

aptly version: 1.6.2

Create new mirror:

aptly -architectures="amd64" -ignore-signatures -with-sources mirror create -filter='Name (bash), $PackageType (source)' test_mirror http://deb.debian.org/debian trixie main

Download packages:

aptly -ignore-signatures mirror update test_mirror

This is my download log:

Downloading: http://deb.debian.org/debian/dists/trixie/Release
Downloading & parsing package files...
Downloading: http://deb.debian.org/debian/dists/trixie/main/binary-amd64/Packages.gz
Downloading: http://deb.debian.org/debian/dists/trixie/main/source/Sources.gz
Applying filter...
Packages filtered: 106388 -> 1.
Building download queue...
Download queue: 3 items (5.43 MiB)
Downloading: http://deb.debian.org/debian/pool/main/b/bash/bash_5.2.37-2.dsc
Downloading: http://deb.debian.org/debian/pool/main/b/bash/bash_5.2.37.orig.tar.xz
Downloading: http://deb.debian.org/debian/pool/main/b/bash/bash_5.2.37-2.debian.tar.xz

Mirror `test_mirror` has been updated successfully.

Create a snapshot:

aptly snapshot create test_snap from mirror test_mirror

Publish snapshot:

aptly -skip-signing publish snapshot test_snap test_dir

Now open file ~/.aptly/public/test_dir/dists/trixie/main/source/Sources:

less ~/.aptly/public/test_dir/dists/trixie/main/source/Sources

Sources in current example consists only of bash source package description with this value of field Package-List:

Package-List:
 
 bash deb shells required arch=any essential=yes
 bash-builtins deb utils optional arch=any
 bash-doc deb doc optional arch=all
 bash-static deb shells optional arch=any

It is not correct - extra empty line at beginning of field Package-List.

And it is possible to check that there is no such problem in original index file.

Download file http://deb.debian.org/debian/dists/trixie/main/source/Sources.gz:

wget http://deb.debian.org/debian/dists/trixie/main/source/Sources.gz

Open file Sources.gz:

zless Sources.gz

Value of field Package-List from source bash package:

Package-List: 
 bash deb shells required arch=any essential=yes
 bash-builtins deb utils optional arch=any
 bash-doc deb doc optional arch=all
 bash-static deb shells optional arch=any

No extra empty line in at beginning of field Package-List.

p.s. According to CONTRIBUTING.md I tried to reproduce problem with nightly build but it was impossible for me to download nightly build.

I configured new apt source:

echo "deb [trusted=yes] http://repo.aptly.info/ci trixie main" > /etc/apt/sources.list.d/aptly.list

Then I updated apt cache:

apt update

Then I tried to install nightly version of aptly:

apt install aptly

But it was impossible for me because of network problems:

Get:2 http://deb.debian.org/debian trixie/main amd64 xz-utils amd64 5.8.1-1 [660 kB]
Ign:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb                                                                 
Get:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb [10.6 MB]
Ign:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb
Get:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb [10.6 MB]
Ign:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb                                                                 
Get:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb [10.6 MB]                                                       
Err:1 http://repo.aptly.info/ci trixie/main amd64 aptly amd64 1.6.2+20260126105803.a65f79eb                                                                 
  Connection timed out [IP: 3.5.136.87 80]
  Connection timed out [IP: 52.219.169.96 80]
  Connection timed out [IP: 3.5.135.97 80]
Fetched 660 kB in 2min 9s (5122 B/s)
Error: Failed to fetch http://repo.aptly.info/ci/pool/trixie/main/a/aptly/aptly_1.6.2%2b20260126105803.a65f79eb_amd64.deb  Connection timed out [IP: 3.5.135.97 80]
Error: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

So I was unable to check nightly build.

p.p.s I tried to find already opened issues about Package-List (search) but I didn't find anything similar. So I created this issue.

[syominsergey]

In the description of issue I said that I was impossible to use night build from CI to check reproducibility of issue because of network problems.
But later I built aptly from sources:

root@c1a4d0c6b4a1:~/aptly# git log -1
commit a65f79eb79c33a83e5f6fa12848151059cf8a35b (HEAD -> master, origin/master, origin/HEAD)
Merge: 7d23196f c6a9f823
Author: Andr<C3><A9> Roth <neolynx@gmail.com>
Date:   Mon Jan 26 11:58:03 2026 +0100

    Merge pull request #1479 from abregar/issues-309-691
    
    Add config key for 'gpgKeys' and allow multiple keyRefs when signing with gpg, fixing Issues #309 and #691
root@c1a4d0c6b4a1:~/aptly#

Installed package aptly_1.6.2_amd64.deb I built and reproduced described issue in the same way (starting from Check aptly version in description).
So I think issue is actual.

[alexmyczko]

can you reproduce this with the official debian binary? trixie or trixie bpo?

[syominsergey]

@alexmyczko, thank you for comment!
Can you please explain why this is important to reproduce problem with official debian binary?
In original description of problem I used official statically linked aptly binary from https://www.aptly.info/download/

[alexmyczko]

@syominsergey welcome!
i don't say it is important to reproduce problem with official debian binary generally. but if you do, i'm interested in the result. (simply for the fact that an official debian package might not be affected by the problem someone encounters contrary to the binary upstream releases)

i don't have capacity to try official statically linked aptly binary, but i'll be glad to help if you use debian binary.

[syominsergey]

@alexmyczko, thank you for explanation.
I will try to reproduce the behavior with the official debian package when I have the time to do so.
I will definitely leave a comment about the result here as soon as it is ready.