Ubuntu Forums Archive Viewer

Signing packages

Archived thread 111369 from Repositories & Backports. Markdown source: Repositories_&_Backports/thread_111369_Signing_packages.md

Original URL About this archive
#1

How does one sign packages (the way that the ones from Ubuntu are signed)?

I want to set up a custom repo with my own packages, but I would like to sign them (I have a seperate key for that).

#2

Is it correct that I should only sign Release (detach, armour) on my repo?

#3

Well, AFAIK, all of the debian packaging scripts will sign the package you build if you have a key available. This will happen even if you just download the source for a package and build it on your own machine. Offhand, I do not know how to specify one particular key out of several. I am sure it is well documented in the debian helper scripts packages.

So, no, you do not only have to sign the relase file.

#4

Well, AFAIK, all of the debian packaging scripts will sign the package you build if you have a key available. This will happen even if you just download the source for a package and build it on your own machine. Offhand, I do not know how to specify one particular key out of several. I am sure it is well documented in the debian helper scripts packages.

So, no, you do not only have to sign the relase file.

The thing is that I'm creating custom packages, mainly for themes and meta packages.

I use dpkg-deb --build debian to build

#5

Hm, so far, it seems that signing Release to Release.gpg shows no 'NOT AUTHENTICATED' errors...

good