---
title: "Sign Linux packages and the repository · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing
id: DSK-5
level: Recommended
updated: 2026-10-22
tokens: 767
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Sign Linux packages and the repository that serves them

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: DSK-5
- Level: Recommended
- Chapter: [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)
- Rule: Sign every `.deb` or `.rpm` repository you run with a key kept as [keep code signing keys in hardware or a signing service](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware.md) says. Tell users to add the key for your repository only.
- Check: `apt-get update` on a clean machine that follows your install steps prints no warning about an unsigned repository. The install steps put the key in `/etc/apt/keyrings/` or `/usr/share/keyrings/` and name it with `signed-by`, never with `apt-key`.
- How: A package manager checks the repository signature before it installs. Without one, anyone between the user and your server can swap the package. Sign the apt `Release` file or the rpm packages with GPG. Tell users to store your key in its own file and name it with `signed-by`, so it cannot vouch for other repositories. For AppImage or tar files outside a repository, publish a signature or a checksum list signed with the same key. Stores such as Flathub and the Snap Store sign for you.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
gpg --armor --export release@example.com | sudo tee /etc/apt/keyrings/example.asc > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/example.asc] https://apt.example.com stable main" | sudo tee /etc/apt/sources.list.d/example.list
```

## Sources

- [Debian, apt-secure manual page](https://manpages.debian.org/trixie/apt/apt-secure.8.en.html)

## Related rules

- DSK-3 [Keep code signing keys in hardware or a signing service](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware.md) in Desktop apps, extensions and CLIs

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md)
- [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)