# Missing "origin" field on filebeat & packetbeat deb packages

**URL:** <https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541>\
**Category:** Beats\
**Created:** [March 16, 2016, 10:19am UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541 "2016-03-16T10:19:48Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![fbarbeira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbarbeira/32/441_2.png) [@fbarbeira](https://discuss.elastic.co/u/fbarbeira)\
**Post date:** [March 16, 2016, 10:19am UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/1 "2016-03-16T10:19:48Z")

</div>

I have the installation of debian packages automatized with the package "unattended-upgrades", which I think is the "debian & ubuntu way" to do the automatic upgrades. In the "unattended-upgrades" config you must select the allowed origin of the packages, for example:

```
// Automatically upgrade packages from these (origin:archive) pairs
   Unattended-Upgrade::Allowed-Origins {
   "${distro_id}:${distro_codename}-security";
   "${distro_id}:${distro_codename}-updates";
   "Puppetlabs:${distro_codename}";
   };

```

Debian, Ubuntu and Puppetlabs follow this standard, including the "origin" in the packages, but in the elastic repo this info is missing:

```
root@host:~# apt-cache policy
Package files:
 100 /var/lib/dpkg/status
     release a=now
 500 http://apt.puppetlabs.com/ precise/PC1 amd64 Packages
     release o=Puppetlabs,a=precise,n=precise,l=Puppetlabs,c=PC1
     origin apt.puppetlabs.com
 500 https://packages.elastic.co/beats/apt/ stable/main amd64 Packages
     release n=stable,c=main
     origin packages.elastic.co
 500 http://security.debian.org/ jessie/updates/main Translation-en
 500 http://security.debian.org/ jessie/updates/main amd64 Packages
     release v=8,o=Debian,a=stable,n=jessie,l=Debian-Security,c=main
     origin security.debian.org
 500 http://ftp.de.debian.org/debian/ jessie/main Translation-en
 500 http://ftp.de.debian.org/debian/ jessie/main amd64 Packages
     release v=8.3,o=Debian,a=stable,n=jessie,l=Debian,c=main
     origin ftp.de.debian.org
Pinned packages:
root@host:~#

```

I think this is due to the procedure of making the deb files. Maybe elastic could add the "Origin: Elastic" field in the packages:

[https://wiki.debian.org/RepositoryFormat#Origin](https://wiki.debian.org/RepositoryFormat#Origin)

With this we could easily automatic upgrade the elastic deb packages.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 17, 2016, 8:11pm UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/2 "2016-03-17T20:11:49Z")

</div>

You could open a pull request for this. 🙂 This script is used to build the deb packages: [https://github.com/elastic/beats/blob/master/dev-tools/packer/platforms/debian/fpm-run.sh.j2#L8](https://github.com/elastic/beats/blob/master/dev-tools/packer/platforms/debian/fpm-run.sh.j2#L8)

FPM is used to build the deb. It has the following flag that I think could be used for adding `origin`.

From `fpm -h`:

> `--deb-field 'FIELD: VALUE' (deb only) Add custom field to the control file`

---

<div class="post-metadata">

**Author:** ![fbarbeira](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbarbeira/32/441_2.png) [@fbarbeira](https://discuss.elastic.co/u/fbarbeira)\
**Post date:** [March 18, 2016, 11:03am UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/3 "2016-03-18T11:03:03Z")

</div>

It looks like the field "Origin" it's not related to the package but with the "Release" file of the repository. I double checked debian documentation about deb file creation and that field it's not listed:

[https://www.debian.org/doc/debian-policy/ch-controlfields.html](https://www.debian.org/doc/debian-policy/ch-controlfields.html)

The "Origin" should be specified in the "Release" file, for example:

ftp://ftp.de.debian.org/debian/dists/jessie/Release

The documentation says the following:

> The file "dists/$DIST/InRelease" shall contain meta-information about the distribution and checksums for the indices, possibly signed with a GPG clearsign signature (for example created by "gpg -a -s --clearsign"). For older clients there can also be a "dists/$DIST/Release" file without any signature and the file "dists/$DIST/Release.gpg" with a detached GPG signature of the "Release" file, compatible with the format used by the GPG options "-a -b -s".

On Elastic repository it looks like the packages are stored in AWS S3 buckets, so I don't know exactly how is the procedure to add this info, maybe the responsible of upload the packages could show us some light about this topic.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 18, 2016, 12:41pm UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/4 "2016-03-18T12:41:58Z")

</div>

The apt repo is updated using a tool called [deb-s3](https://github.com/krobertson/deb-s3).

The exact command is here: [https://github.com/elastic/beats/blob/master/dev-tools/packer/docker/deb-rpm-s3/deb-s3.expect](https://github.com/elastic/beats/blob/master/dev-tools/packer/docker/deb-rpm-s3/deb-s3.expect)

I searched through the deb-s3 code base and there is [an option](https://github.com/krobertson/deb-s3/blob/a73f26ba316b8a2f6c0ef53f011dc23e665caced/lib/deb/s3/cli.rb#L25) (`-o`) for setting Origin. So the script above will need to be modified to add `-o Elastic` and then it needs to be tested on a clone of repo.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 18, 2016, 1:51pm UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/5 "2016-03-18T13:51:52Z")

</div>

> <https://github.com/elastic/beats/pull/1184>

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/missing-origin-field-on-filebeat-packetbeat-deb-packages/44541/6 "2017-07-05T21:54:29Z")

</div>


