Add signed APT channels for Debian, Ubuntu and Linux Mint
This commit is contained in:
Gerardo Betancourt committed
1 parent
db7b472861
commit
fb53fe2b70
3 files changed
+486
No files matched your search
@@ -0,0 +1,99 @@
|
||||
# Signed distribution repositories
|
||||
|
||||
The canonical source is the existing GERANAS Gitea repository
|
||||
\`gerardo/framebridge\`. Build all three reviewed DEBs from its release commit;
|
||||
do not edit installed files to produce an update.
|
||||
|
||||
One HTTPS repository at \`https://framebridge.betancourt.one/debian/\` contains
|
||||
three independent suites:
|
||||
|
||||
| Suite | Tested distribution profile |
|
||||
| --- | --- |
|
||||
| trixie | Debian 13, amd64, Python 3.13 |
|
||||
| noble | Ubuntu 24.04, amd64, Python 3.12 |
|
||||
| mint22 | Linux Mint 22.x, amd64, Python 3.12 |
|
||||
|
||||
Select exactly the suite matching the computer. These are three builds of one
|
||||
binary package, \`framebridge-original-expanded\`, with unique pool filenames.
|
||||
This table does not certify untested releases or architectures.
|
||||
|
||||
## Prepare and review
|
||||
|
||||
Run \`python3 tools/build_apt_repository.py prepare --help\` in the source
|
||||
repository. Supply the exact three version-matched DEBs, the existing official
|
||||
public key and a new output directory. The command copies the artifacts, builds
|
||||
indexes and by-hash paths, and prints the immutable input manifest SHA-256.
|
||||
It does not open a private keyring, sign, publish or install anything.
|
||||
|
||||
Review the manifest, package hashes and release identity before signing.
|
||||
The public key must contain exactly one primary release key with fingerprint
|
||||
\`2B1F01BC806C0B33CB6CEDDE52859CEBC91B8808\`. Official subkeys are allowed.
|
||||
|
||||
## Sign in the owner's normal terminal
|
||||
|
||||
Run \`python3 tools/build_apt_repository.py sign --help\`. Pass the reviewed
|
||||
output directory and exact manifest SHA-256. The signer requires a non-root
|
||||
interactive terminal and an owner-private existing signing home. Set
|
||||
\`GPG_TTY=$(tty)\` in that normal terminal if the pinentry implementation needs it.
|
||||
The owner's passphrase is entered only into normal pinentry; it is never an
|
||||
argument, environment variable or chat message.
|
||||
|
||||
The signer writes \`Release.gpg\` and \`InRelease\` for each suite, verifies the
|
||||
signatures against the public key and exact reviewed Release plaintext, then
|
||||
clears the dedicated signing agent. Existing signatures or partial results
|
||||
cause refusal; inspect a partial transaction instead of blindly rerunning it.
|
||||
|
||||
Run \`verify\` with the same pinned manifest hash after signing and again after
|
||||
transport. Metadata expires after 30 days; publish a freshly signed Release
|
||||
before expiry, without altering historical signed artifacts.
|
||||
|
||||
## Publish through GERANAS
|
||||
|
||||
Use the existing GERANAS web origin and the CLOUD HTTPS reverse proxy. Do not
|
||||
create another Git backend or expose MCP/auth/broker services. Back up the
|
||||
current public generation before activation. Preserve the existing signed
|
||||
0.3.1 downloads and old repository metadata in an archive path.
|
||||
|
||||
Publish only reviewed manifest files, the six verified signature files and the
|
||||
signing receipt. Public directories must be \`0755\` and files \`0644\`; a private
|
||||
staging umask must not leak into the served generation. Never publish the
|
||||
signing home, private receipts, account configuration or operational worktree.
|
||||
Activate a complete verified generation, preserving the web unit's existing
|
||||
read-only bind mounts, then run isolated APT update and exact-version download
|
||||
for all three suites through the final HTTPS authority.
|
||||
|
||||
## Configure a client
|
||||
|
||||
Install the verified official public key as
|
||||
\`/etc/apt/keyrings/framebridge-archive-keyring.asc\` with mode \`0644\`.
|
||||
Its fingerprint must match the value above. Add a Deb822 source file:
|
||||
|
||||
\`\`\`text
|
||||
Types: deb
|
||||
URIs: https://framebridge.betancourt.one/debian/
|
||||
Suites: trixie
|
||||
Components: main
|
||||
Architectures: amd64
|
||||
Signed-By: /etc/apt/keyrings/framebridge-archive-keyring.asc
|
||||
\`\`\`
|
||||
|
||||
Replace \`trixie\` with \`noble\` or \`mint22\` for those tested profiles. Then use
|
||||
normal APT commands:
|
||||
|
||||
\`\`\`sh
|
||||
sudo apt update
|
||||
apt-cache policy framebridge-original-expanded
|
||||
sudo apt install --only-upgrade framebridge-original-expanded
|
||||
\`\`\`
|
||||
|
||||
Do not use trusted=yes or disable signature/validity checks. APT update/download
|
||||
verification does not itself prove runtime restart or reboot persistence.
|
||||
Confirm the actual installed version and ready connection after each upgrade.
|
||||
|
||||
## Tool checks
|
||||
|
||||
\`python3 tools/test_build_apt_repository.py\` creates disposable packages and a
|
||||
disposable signing identity in a temporary directory. It tests actual isolated
|
||||
APT acceptance for each suite and rejects altered packages/indexes/signatures,
|
||||
unexpected versions, path traversal and bundled extra primary trust keys.
|
||||
It never uses the official private signing key or changes system APT sources.
|
||||
Reference in new issue
Block a user