APT-TRANSPORT-S3(8)

💖 apt-transport-s3(8) — bestie edition

hiii okay so we're looking at apt-transport-s3, section 8 of the System Manager's Manual, and ngl this one is lowkey iconic because it's the thing that makes apt go shopping in your very own private S3 bucket. let's get into it 🛒✨

---

🌸 NAME

(no content here bestie, the actual one-liner is living its best life in DESCRIPTION right below 👇)

✨ DESCRIPTION

apt-transport-s3 — it's a package which contains apt transport ('plugin') allowing apt to fetch files stored in private repositories held on AWS S3. literally just that. a little plugin with main character energy 👑

🪣 Bucket name

per the S3 bucket naming convention, for this transport to work over TLS your bucket name can NOT have dots in it. periodt. more deets are at https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html

🔐 AWS Credentials

to get into repos chillin' on S3 you must have correct permissions on the bucket where the repo lives, and those permissions have to show up in at least one of these two places:

• IAM Roles — the default place where the S3 transport goes looking for credentials that let it fetch files from an S3 bucket 💅

⚙️ Configuration

/etc/apt/s3auth.conf or an IAM role (http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) can provide the credentials you need for using private apt repositories. pick your fighter 🫶

NOTE: Region MUST match the region the buckets are stored in, and if it's not defined it will try to fetch it from the metadata service. no cap, get this one right or it's giving chaos 😭

Setting Endpoint lets you use providers other than Amazon AWS. If it's set, Endpoint disregards Region. (iconic behaviour fr fr)

Example of s3auth.conf file:

AccessKeyId     = myaccesskey
SecretAccessKey = mysecretaccesskey
Region          = 'us-east-1'
Endpoint        = 'nyc3.digitaloceanspaces.com'
PathStyle       = True

📜 Minimal IAM policy for accessing repository

here's the bare minimum policy, copy it exactly bestie, every brace matters 🎀

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::[BUCKET_ID]/*",
                "arn:aws:s3:::[BUCKET_ID]"
            ]
        }
    ]
}

🚀 Usage

install the .deb package from the releases page. your bucket repo gets specified with an s3:// prefix, for example:

deb s3://aptbucketname/repo/ trusty main contrib non-free

if you need to use a proxy to connect to the internet you can specify this as an APT configuration directive (for example in /etc/apt/apt.conf.d/90apt-transport-s3):

Acquire::http::Proxy "http://myproxy:3128/";

Bucket name hosting repo can not contain dots in it's name as this (according to AWS S3 naming convention (https://docs.aws.amazon.com/AmazonS3/latest/dev/BucketRestrictions.html)) will invalidate virtual host style paths TLS certificates. so like, no dots. we been knew 💀

🧪 Testing

The module will run in interactive mode. It accepts on stdin and outputs on stdout. The messages it accepts on stdin are in the following format and documented here (http://www.fifi.org/doc/libapt-pkg-doc/method.html/index.html#abstract).

600 URI Acquire
URI:s3://my-s3-repository/project-a/dists/trusty/main/binary-amd64/Packages
Filename:Packages.downloaded
Fail-Ignore:true
Index-File:true

This message will trigger an s3 get from the above bucket and key and save it to Filename. It needs a blank line after the message to trigger the processing by the s3 method. (yes, the blank line is doing heavy lifting, don't skip it 🙈)

🤝 Contribution

If you want to contribute a patch via PR please create it against development branch. Patches via email are welcome as well. come thru, we love a contributor 🌈

---

okay that's the whole thing, you ate that 💖 this page is from the System Manager's Manual, dated October 7, 2024, and it's APT-TRANSPORT-S3(8) — slay, bye bestie 🦋🌸