Agent Wranglers

DSK-5Recommended

Sign Linux packages and the repository that serves them

Sign every .deb or .rpm repository you run with a key kept as keep code signing keys in hardware or a signing service says. Tell users to add the key for your repository only.

By Agent Wranglers. Updated .

How to do it

A package manager checks the repository signature before it installs. Without one, anyone between the user and your server can swap the package. Sign the apt Release file or the rpm packages with GPG. Tell users to store your key in its own file and name it with signed-by, so it cannot vouch for other repositories. For AppImage or tar files outside a repository, publish a signature or a checksum list signed with the same key. Stores such as Flathub and the Snap Store sign for you.

Examples

Shell example

gpg --armor --export release@example.com | sudo tee /etc/apt/keyrings/example.asc > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/example.asc] https://apt.example.com stable main" | sudo tee /etc/apt/sources.list.d/example.list

How to check

apt-get update on a clean machine that follows your install steps prints no warning about an unsigned repository. The install steps put the key in /etc/apt/keyrings/ or /usr/share/keyrings/ and name it with signed-by, never with apt-key.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing">Agent Wranglers desktop apps, extensions and CLIs playbook</a>. In code you write, add a comment next to it with the same link.