MirrorZ & apt-transport-mirror

class: center, middle, title

# MirrorZ & apt-transport-mirror

---

## What's MirrorZ?

- An opt-in collection of open-source mirrors
  - mirrorz.org & mirrors.cernet.edu.cn
- Help page
  - help.mirrorz.org & help.mirrors.cernet.edu.cn
- **Redirection service: mirrorz-302**
  - Usage: `URIs: http://mirrors.cernet.edu.cn/debian`
  - Or, `URIs: mirror+http://mirrors.cernet.edu.cn/api/apt/mirrorlist/debian`

---

## How does *normal* users set mirrors now?

- Tools by distributions to select one mirror
  - The list might be hard-coded in given tools.
- Copy commands from random pages
  - Mostly *TUNA*, *BFSU* or *USTC* if searching for tutorials on web
- Make a wish to LLM agent
  - *Could you help me set up mirrors for my machine?*
  - \[some tool calls\]. *OK, I have set up TUNA mirrors for XXX...*.

---

## Problems

- Some mirrors are overloaded, while others have few traffic.
  - Mirrors user select might not be optimal.
- Hard to fallback when one mirror is down.
- Packages updates would be delayed for a while.
  - Critical for security updates: `php`, `ca-certificates`, etc...

---

## Naive approach

- A Redirection service
  - A background service on server fetches each mirror for status.
  - Users access `http://mirrors.cernet.edu.cn/debian/xxx`.
  - Redirection service ranks mirrors by their status and user IP.
  - `HTTP/2 302`, `location: http://mirrors.example.edu.cn/debian/xxx`
- Optimal mirror ✅
- Mirror fallback ⚠️
- Delayed updates ❌
- Extra latency ❌

---

class: compact

## apt-transport-mirror

- Read list from a local file or a HTTP(S) endpoint:
  ```
  http://mirrors.tuna.tsinghua.edu.cn/debian/	priority:1
  http://mirrors.bfsu.edu.cn/debian/	priority:2
  http://mirrors.qlu.edu.cn/debian/	priority:3
  ...
  ```
- Set in `sources.list` (legacy format):
  ```debsources
  deb mirror+https://mirrors.cernet.edu.cn/api/apt/mirrorlist/debian trixie main
  # deb mirror+file:///path/to/your/mirrorlist trixie main
  ```
- Or `debian.sources` (DEB822):
  ```yaml
  Types: deb
  URIs: mirror+https://mirrors.cernet.edu.cn/api/apt/mirrorlist/debian
  # URIs: mirror+file:///path/to/your/mirrorlist
  Suites: trixie
  Components: main
  Signed-By: /usr/share/keyrings/debian-archive-keyring.pgp
  ```

---

## A review

- Optimal mirror ✅
- Mirror fallback ✅
- Delayed updates ❓
- Extra latency ✅

---

## For security updates

```
# Fetch index from security.debian.org
http://security.debian.org/debian-security/	priority:0 type:index
# Fetch packages from mirrors
http://mirrors.ustc.edu.cn/debian-security/	priority:1
http://mirrors.bfsu.edu.cn/debian-security/	priority:2
# Fetch packages from security.debian.org, if mirrors have not synced yet
http://security.debian.org/debian-security/	priority:3
```

Problem solved!

---

## Future works?

- Extend this to more APT repos
  - Example: Users using `sury` for PHP, and they need to update immediately (PHP2Shell).
  - An update on help.mirrors.cernet.edu.cn
- Make Debian installer *faster* out-of-box
  - Complained by many for slow security.debian.org access under *certain network conditions*.
  - Now it's possible to speed it up, without compromising security (delayed update).
  - (A bit lazy and I haven't submitted this on bugreport yet...)
- More tunables to apt-transport-mirror maybe?
  - Example: Fallback to next mirror, if bandwidth < 10K/s for 10 seconds.