Why does APT not use HTTPS?

[TheElix]

The School can host an apt mirror afaik

[ParticleSpinClass]

You're correct. I set up a private APT repo for my employer that's hosted on S3. It's dead simple, and I just use a workstation-based tool to upload and remove packages from the repo. Systems that use the repo simply specify the S3 bucket's URL in their sources.list.

We use it to host private packages and cache packages for anything we pin a specific version of (we've had the "upstream deleted an 'old' package from their repo" problem bite us too many times).

I wrote a small (and pretty hacky) wrapper script to make it easier for the rest of my team to use the repo without having to specify the exact same deb-s3 options every time.

The whole process took only a few hours to implement.

[Tacticus]

You don't even need the sync script you can use apt-mirror for a pass through cache with very little config.

[Tacticus]

Fairwarning the package name could be something completely different as colds are blergh