# BBB selected-package repository Server: bbb-mirror / 192.168.50.82 OS: Ubuntu 22.04 amd64 Release: 2026-10-26-01 Scope: BigBlueButton 3.0, the supplied installed BBB package set, required installer tools, dependency closure and default APT Recommends. This is a selected package repository, not a full Ubuntu archive. No client server has been upgraded. ## Endpoints APT: https://mirror.bigbluebuton.ir/releases/2026-10-26-01 APT public key: https://mirror.bigbluebuton.ir/bbb-mirror-keyring.gpg APT key fingerprint: 51A094CFF96977B0718CAAF9B83369A62F97AE5C Status: https://mirror.bigbluebuton.ir/status.json Registry (TLS, public read-only): https://mirror.bigbluebuton.ir TLS: publicly trusted Lets Encrypt certificate for mirror.bigbluebuton.ir; custom CA installation is not required. Public read access on ports 80 and 443 is enabled at the user-provided NAT address 185.18.213.44. Registry publishing is available only on the repository host at 127.0.0.1:5000. ## Before using a BBB client 1. Confirm the client can reach 185.18.213.44 on ports 80 and 443. 2. Copy the APT public key to /usr/share/keyrings/bbb-mirror.gpg and verify the fingerprint above. 3. The release contains bbb-mirror.list as an example APT source. Review other enabled sources before testing; merely adding a source does not disable Internet sources. 4. Test the upgrade on one representative BBB server with its actual installed package state and held packages. Back up custom configuration and application data. 5. Use the domain mirror.bigbluebuton.ir for Docker pulls over HTTPS. No insecure-registry setting or custom CA is required. 6. See images.json for copied images and their immutable digests. Pin images to those digests during deployment. 7. The bbb-libreoffice-docker 1:3.0-14 package uses FROM bigbluebutton/bbb-libreoffice:25.8.4.2-20260129-151200. Preload the mirrored base image and tag it with that ORIGINAL name before package installation so its Docker build can use the local image. Validate this on the pilot server. 8. Greenlight database migration and container compatibility have not been tested. No database version change is implied by caching its images. The unmodified upstream bbb-install.sh adds external APT sources, fetches online assets and runs dist-upgrade. A repository alone does not adapt that installer or make certificate issuance offline. Use an audited installation procedure for the pilot server. ## Server data and commands /srv/bbb-mirror/metadata/seeds.txt - exact initial package requests /srv/bbb-mirror/metadata/download-plan.txt - upstream package URLs and download plan /srv/bbb-mirror/metadata/upstream-keys.json - verified upstream signing identities /srv/bbb-mirror/resolver - isolated APT metadata/cache with EMPTY package status /srv/bbb-mirror/aptly - aptly database, package pool and published repository /srv/bbb-mirror/registry - Docker registry data /srv/bbb-mirror/logs - download, publication and verification logs /etc/aptly.conf - aptly configuration /etc/nginx/sites-available/bbb-mirror - public APT and read-only TLS registry /etc/docker/registry/config.yml - loopback registry backend /etc/letsencrypt/live/mirror.bigbluebuton.ir - active TLS certificate and private key /etc/bbb-mirror/pki - previous bootstrap certificate, no longer used by Nginx /var/lib/bbb-mirror/.gnupg - repository signing key; keep private and back up Manual maintenance tools: - /usr/local/sbin/bbb-mirror-download : download the currently selected seed closure using cached isolated upstream indexes - /usr/local/sbin/bbb-mirror-publish RELEASE : verify downloaded files and create a NEW signed release (never reuse an existing release name) - /usr/local/sbin/bbb-mirror-verify : resolve every seed using only the published local repository with empty package status; also download and SHA256-check bbb-config - /usr/local/sbin/bbb-mirror-images : copy selected Docker images with resumable downloads and SHA256 verification; upstream tags are pinned in metadata/images-plan.json No scheduled package updates or automatic client upgrades were configured. Certificate renewal is enabled by certbot.timer, with an Nginx reload deploy hook. Image plans pin the first resolved tag; create a new reviewed plan when intentionally updating image versions. Before creating a later release: refresh isolated APT metadata, regenerate and review the simulation/download plan, download the new selection, then publish under a new release name. Do not reuse old download plans with newer indexes. Keep completed releases unchanged. The publish helper imports only files named in the reviewed download plan, even if older files remain in the download cache. Use the stored seed list when adjusting the selected scope. Adding unrelated packages is not necessary. ## Verification limits APT verification proves the selected package closure can be resolved from this signed repository. It does not run BBB services, exercise package installation scripts, or prove upgrade compatibility on all 50 existing servers. Those checks require a representative BBB client. ## Official bbb-install.sh compatibility The unchanged v3.0.x-release installer can use: -v jammy-300 -r mirror.bigbluebuton.ir The compatibility publication is https://mirror.bigbluebuton.ir/jammy-300, distribution bigbluebutton-jammy, component main. Its signing key is available at https://mirror.bigbluebuton.ir/repo/bigbluebutton.asc. This is the same fixed BBB 3.0.39 selected-package snapshot as release 2026-10-26-01. Existing release URLs are preserved. The -r flag only changes the BBB repository. For all APT package downloads to use the internal snapshot, client-side APT source selection is also required. s236 has /etc/apt/apt.conf.d/99bbb-internal-mirror configured to select only /etc/apt/sources.list.d/bigbluebutton.list and an empty sourceparts directory /etc/apt/bbb-mirror-only.d. Original other source files are retained but ignored. The standard installer can rewrite bigbluebutton.list to the same internal source. This configuration is specific to the reviewed Ubuntu 22.04 / BBB 3.0 server. The exact LibreOffice base image required by the frozen package is prefetched and tagged with its original name on s236, without restarting containers. Installation has not been run by this preparation stage.