How To Create an Authenticated Repository
- Packages: apt-utils (Should be installed by default), dpkg-dev, a web server (apache2), and dpkg-sig (In Ubuntu Universe Repository)
- Base Directory for repository
- .deb files
Installing the Required Packages
Type the following commands:
sudo apt-get install dpkg-dev sudo apt-get install apache2 sudo apt-get install dpkg-sig
Create the Repository Directory Structure
Note: If you do not create the repository in the /var/www directory then you will have to create a symbolic link inside that directory linking to your repository directory
For example (Assuming you are in your home directory):
sudo ln -s ~/repository_dir /var/www/repository_dir
Create the repository in /var/www using this command, while within said directory:
sudo mkdir -p repository_dir/dists/stable/main/binary
Import the deb files to the binary directory (while within said directory):
sudo mv location_of_package/package_name.deb
Authenticating Repository and Packages
Create a GPG key pair.
Since we are only using our key for only generating digital signatures use RSA for maximum security.
Please select what kind of key you want: (1) RSA and RSA (default) (2) DSA and Elgamal (3) DSA (sign only) (4) RSA (sign only) Your selection? 4 RSA keys may be between 1024 and 4096 bits long. What keysize do you want? (2048) 4096 Requested keysize is 4096 bits
Choose "key does not expire" for length of validity.
Please specify how long the key should be valid. 0 = key does not expire <n> = key expires in n days <n>w = key expires in n weeks <n>m = key expires in n months <n>y = key expires in n years Key is valid for? (0) 0 Key does not expire at all Is this correct? (y/N) y
Give at least the name for the new key.
You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form: "Zaphod Beeblebrox (Galactic President) <email@example.com>" Real name: Repository Email address: Comment: You selected this USER-ID: "Repository" Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O
You need a passphrase to protect your secret key. Be sure to choose one you will remember. Follow the on-screen instructions to create the key. You should get output similar to this-
gpg: key 041DA354 marked as ultimately trusted public and secret key created and signed. gpg: checking the trustdb gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u pub 4096R/041DA354 2012-06-01 Key fingerprint = 2253 4C89 DE74 CF68 39D7 2A2E DB3E 384F 041D A354 uid Repository
You can list your keys anytime using the following:
Export your public key that was generated to a text file and store it in the root of the repository:
sudo gpg --output keyFile --armor --export 041DA354
Sign the packages with your key.
sudo dpkg-sig --sign builder file1.deb sudo dpkg-sig --sign builder file2.deb
On another computer to access and install these packages, edit the /etc/apt/sources.list file to update the package list for your repository.
- (You can use any text editor, this example uses vi)
sudo vi /etc/apt/sources.list
Add your repository to the list, using the following nomenclature:
deb http://10.31.31.89/repository_dir/dists/stable/main/binary /
After saving, update the packages list.
sudo apt-get update
Note: An error to the effect of "cannot find packages" is normal at this point, as no index file has been createded yet.
Download the repository's public key:
wget -O - http://10.31.31.89/repository_dir/keyFile | sudo apt-key add -
To view the added key use the following:
On the repository machine, you will need to change the ownership of the directory structure including everything in it to your user, unless you want it to be set as root.
- (From within the repository_dir directory)
sudo chown user:user -R .
Create an index file for the repository called Packages in the same directory as the deb files and zip it. An uncompressed Packages file must be kept there too.
- (From within the binary directory)
apt-ftparchive packages . > Packages gzip -c Packages > Packages.gz
Create a Release, InRelease, and Release.gpg file:
- (From within binary directory)
apt-ftparchive release . > Release gpg --clearsign -o InRelease Release gpg -abs -o Release.gpg Release
Update the package list for the recipient computer and install the packages.
sudo apt-get update sudo apt-get install package_name
More info on building and maintaining repositories can be found on the Debian website.
Originally posted The Ubuntu Forums (ubuntuforums.org)