On: Why does APT not use HTTPS?

[snuxoll]

Fedora handles this use case beautifully with MirrorManager, which includes the EPEL repos as well. All of the logic is server side, when a yum/dnf client connects to the Metalink server to fetch a mirror list from our IP block it gets sent our internal mirror - I wish more distros had similar setups.

[pritambaral → snuxoll]

So, the public metalink server is aware of your internal mirror?

[snuxoll → pritambaral]

Yes, the mirror is configured as private and is only served to machines in my IP range - since it’s on the internal network it does nobody else good to have access.

[pritambaral → snuxoll]

So every private mirror has to be registered with a central upstream. That sounds unpalatable.

[snuxoll → pritambaral]

It doesn’t HAVE to be, I can manually edit my yum configs and specify the mirror - but using MM and Metalink means it automatically gets used.