使用python-apt跨Linux发行版及架构收集同源可执行文件遇到的GPG及缓存问题求助

Hi there! Your goal of collecting cross-distribution/architecture executables from the same source code for scientific research sounds really interesting—let’s work through these issues step by step.

First, Fix the Mismatched Source File Path #

Looking at your code, you wrote the source list to /home/etc/apt/source.list, but called cache.update() with sources_list='/tmp/source_2.list'. These paths don’t match, so python-apt never actually read the Tsinghua source you configured. This is almost certainly why your cache was empty after adding [trusted=yes].

Two Solutions for the GPG Verification Error #

Option 1: Skip GPG Verification (Quick for Testing)

Since this is for scientific research and a controlled environment, skipping verification is acceptable. Just make sure your source path is consistent, and add [trusted=yes] to the source line:

import apt
import os

# Define source content with trusted flag
source_content = 'deb [trusted=yes] https://mirrors.tuna.tsinghua.edu.cn/debian/ bullseye main contrib non-free\n'
source_path = '/tmp/debian_bullseye.list'

# Write the source file correctly
with open(source_path, 'w') as f:
    f.write(source_content)

# Initialize cache with a custom root dir (isolated from system apt)
apt_root = os.path.join(os.getcwd(), 'apt_custom_root')
cache = apt.Cache(rootdir=apt_root, memonly=True)

# Update cache using the correct source file
cache.update(sources_list=source_path)

# Reload cache to load the new package list
cache.open(None)

# Check for your target packages
package_list = ['vim']
print("Available packages in cache:", list(cache.keys()))

for pkg_name in package_list:
    if pkg_name in cache:
        pkg = cache[pkg_name]
        print(f"Found {pkg_name}: latest version is {pkg.candidate.version}")
        # Uncomment to download the executable package
        # pkg.candidate.download('./downloads/')
    else:
        print(f"{pkg_name} not found in the cache")

Option 2: Import the Correct GPG Key (More Standard)

If you prefer not to skip verification, import Debian Bullseye’s official GPG key into your custom apt root directory:

import apt
import os
import subprocess

apt_root = os.path.join(os.getcwd(), 'apt_custom_root')
# Create necessary directories for apt keys
os.makedirs(os.path.join(apt_root, 'etc', 'apt', 'trusted.gpg.d'), exist_ok=True)

# Download and export Debian Bullseye's GPG key to the custom root
subprocess.run([
    'gpg', '--keyserver', 'keyserver.ubuntu.com', '--recv-keys', '0xF8D2585B8783D481',
    '--export', '--armor', '--output', os.path.join(apt_root, 'etc', 'apt', 'trusted.gpg.d', 'bullseye.gpg')
], check=True)

# Use the source without trusted=yes
source_content = 'deb https://mirrors.tuna.tsinghua.edu.cn/debian/ bullseye main contrib non-free\n'
source_path = '/tmp/debian_bullseye.list'
with open(source_path, 'w') as f:
    f.write(source_content)

# Initialize and update cache as before
cache = apt.Cache(rootdir=apt_root, memonly=True)
cache.update(sources_list=source_path)
cache.open(None)

Tips for Cross-Architecture Collection #

To fetch packages for i386 (or other architectures), add the arch flag to your source line:

deb [trusted=yes arch=i386] https://mirrors.tuna.tsinghua.edu.cn/debian/ bullseye main contrib non-free

Or set the architecture via an apt config file:

os.makedirs(os.path.join(apt_root, 'etc', 'apt', 'apt.conf.d'), exist_ok=True)
with open(os.path.join(apt_root, 'etc', 'apt', 'apt.conf.d', '01-arch'), 'w') as f:
    f.write('APT::Architectures "i386";\n')

Cross-Distribution Workflow #

For different distros (e.g., Ubuntu 18.04 bionic, Debian 12 bookworm), create separate source files and custom apt root directories for each. This keeps package lists isolated and avoids conflicts between distro repositories.

备注：内容来源于stack exchange，提问作者QiuSH