Usage question of mirrors in China

Do not confuse the Ubuntu mirrors https://launchpad.net/ubuntu/+archivemirrors and the launchpad server for PPAs (personal package archives) like http://ppa.launchpad.net/fish-shell/release-2/ubuntu

Only the Ubuntu packages are replicated to the mirror servers.
The software in the PPAs can only be downloaded from ppa.launchpad.net

Thanks, that's what I thought. But when I use the ppa.launchpad.net domain, I get this error when doing an apt update:

```
Err:5 http://ppa.launchpad.net/fish-shell/release-2/ubuntu xenial/main amd64 Packages
  403 Forbidden [IP: 112.124.140.210 80]
```

That looks like ppa.launchpad.net denies access to my request, right? Any way around that?

That looks a bit strange.

As far as I can check on the internet, the IP address 112.124.140.210 is belonging to mirrors.aliyun.com or cn.archive.ubuntu.com but is not the address of ppa.launchpad.net (would probably be 91.189.95.83)

Can you check for strange entries in the /etc/hosts file or ask your provider whether there is some (possibly wrong) rerouting in place?

Well, that's why I thought the request is blocked by launchpad: the IP 112.124.140.210 is probably where the request is coming from and launchpad seems to respond with the 403 Forbidden event.

When I resolve ppa.launchpad.net on that host I do indeed get 91.189.95.83, so the routing is OK.

The traceroute is going through a couple of Chinese hops, then to San Jose, London and finally to makara.canonical.com and some more that don't show their footprint in detail.

The hosts file contains localhost entries only, so nothing suspicious there.

The hosts.deny is also clean, so I'm running out of ideas here.

Is this "Err:5 http://ppa.launchpad.net/... 403 Forbidden [IP: 112.124.140.210 80]"
consistently repeating if you try again?

What do you get if you try opening http://ppa.launchpad.net/fish-shell/release-2/ubuntu/dists/xenial/main/binary-amd64/Release in a web browser, or try
curl http://ppa.launchpad.net/fish-shell/release-2/ubuntu/dists/xenial/main/binary-amd64/Release

Yes, the error is consistent when retrying to apt-get update the repositories. Just the IP changes eventually, but it remains within the pool of Aliyun addresses.

When using curl, I'm getting a proper response:

Archive: xenial
Version: 16.04
Component: main
Origin: LP-PPA-fish-shell-release-2
Label: Fish shell - 2.x release series
Architecture: amd64

Found it! They have configured a proxy for apt and that way they can filter everything that's going through apt:

Acquire::http::Proxy "http://mirrors.aliyun.com/";

I've removed that and now I can also access ppa.launchpad.net and install packages from there.

You could also do something like this to make exceptions from the general proxy rule, rather than removing it outright (whether this makes sense depends on your situation):

  Acquire::http::Proxy::ppa.launchpad.net "DIRECT";

Yeah, that's what I did, also for other sources like packagecloud.io for example.