scripts/verify-termux-index.sh downloads the signed InRelease on every run and exits when that download fails. Rebuilding the Termux-sourced components is therefore impossible without network access, even when the Packages file and every .deb are already cached. That is a poor fit for this project's audience, who are the people most likely to be on a metered or intermittent connection.
The index is the root of trust for libnode.so, libbash.so, libgit.so and libpython*.so, so the change is not simply "cache it".
Shape that would work
- Keep a verified
InRelease beside the Packages file it covers, inside the cached work directory. Write it only after all three verdicts pass (signature, pinned fingerprint, freshness), so a cached copy is by construction one that already satisfied them.
- Re-run all three checks against the cached copy. Skipping the freshness check because it passed once turns a 30 day replay bound into an unbounded one.
- Gate the fallback behind an explicit opt-in such as
TERMUX_OFFLINE=1 rather than letting a transient curl failure take it silently. A gate that fails open on a flaky network is worse than one that fails closed on a real outage.
- The self-healing block refetches
Packages on a digest mismatch and calls the check a second time. With a cached index that second call compares fresh Packages bytes against a stale signed digest and fails for the wrong reason, so the refetch must be disabled when the fallback is active.
- The output must say which copy was used. Checks in this script have gone missing once before while it still printed success and exited 0, so an offline branch is a new route to the same silent skip.
The benefit is narrow and the surface is the supply-chain root of trust, so this deserves its own change with its own testing rather than riding along with unrelated work.
scripts/verify-termux-index.shdownloads the signedInReleaseon every run and exits when that download fails. Rebuilding the Termux-sourced components is therefore impossible without network access, even when thePackagesfile and every.debare already cached. That is a poor fit for this project's audience, who are the people most likely to be on a metered or intermittent connection.The index is the root of trust for
libnode.so,libbash.so,libgit.soandlibpython*.so, so the change is not simply "cache it".Shape that would work
InReleasebeside thePackagesfile it covers, inside the cached work directory. Write it only after all three verdicts pass (signature, pinned fingerprint, freshness), so a cached copy is by construction one that already satisfied them.TERMUX_OFFLINE=1rather than letting a transientcurlfailure take it silently. A gate that fails open on a flaky network is worse than one that fails closed on a real outage.Packageson a digest mismatch and calls the check a second time. With a cached index that second call compares freshPackagesbytes against a stale signed digest and fails for the wrong reason, so the refetch must be disabled when the fallback is active.The benefit is narrow and the surface is the supply-chain root of trust, so this deserves its own change with its own testing rather than riding along with unrelated work.