docs(apt): signing key is configured; show the verified install path - #41
Merged
Conversation
A GPG signing key is now set as APT_GPG_PRIVATE_KEY / APT_GPG_PASSPHRASE, so the next tagged release publishes a signed repository and the generated index page switches to signed-by=. The published repository is still unsigned until that release happens, so [trusted=yes] stays the working instruction and is still labelled as skipping verification. The signed commands sit below it, marked as taking effect from the next release, rather than replacing instructions that do not work yet. Verified end to end before writing this: the release step's shell was extracted from the merged workflow and run against the real key, and the resulting InRelease and Release.gpg verify against the published public key alone -- which is what a user's apt actually does.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ❌ Deployment failed View logs |
thinkutils | e8baf91 | Jul 20 2026, 03:42 AM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A GPG signing key is now configured as
APT_GPG_PRIVATE_KEY/APT_GPG_PASSPHRASE, so the next tagged release will publish a signed APT repository and the generated index page will switch tosigned-by=.docs/download.md(from #39) says the repo is unsigned and will stay that way until a key exists. That becomes wrong at the next release.The awkward part, handled explicitly
The currently published repository is still unsigned — signing only takes effect when a release actually runs. So
[trusted=yes]remains the instruction that works today and keeps its warning. Thesigned-by=commands are shown below it, clearly marked as taking effect from the next release, rather than replacing instructions that would not work yet.The repository's own
index.htmlis generated from whichever form the release actually published, so it cannot drift from reality. This page now says so.Verification
Before writing any of this I extracted the
Update APT repositorystep's shell from the merged workflow on main and ran it against the real signing key:That verifies against the published public key alone — which is what a user's
aptdoes — so the claim that the next release produces a working signed repo is tested, not assumed.Docs build passes.