How To Create an Authenticated Repository

Requirements

• Packages: apt-utils (Should be installed by default), dpkg-dev, a web server (apache2), and dpkg-sig (In Ubuntu Universe Repository)
• Base Directory for repository
• .deb files

Installing the Required Packages

Type the following commands:

  sudo apt-get install dpkg-dev
  sudo apt-get install apache2
  sudo apt-get install dpkg-sig

Create the Repository Directory Structure

Note: If you do not create the repository in the /var/www directory then you will have to create a symbolic link inside that directory linking to your repository directory

For example (Assuming you are in your home directory):

sudo ln -s ~/repository_dir /var/www/repository_dir

Create the repository in /var/www using this command, while within said directory:

  sudo mkdir -p repository_dir/dists/stable/main/binary

Import the deb files to the binary directory (while within said directory):

  sudo mv location_of_package/package_name.deb

Authenticating Repository and Packages

Create a GPG key pair.

  gpg --gen-key

Since we are only using our key for only generating digital signatures use RSA for maximum security.

  Please select what kind of key you want:
     (1) RSA and RSA (default)
     (2) DSA and Elgamal
     (3) DSA (sign only)
     (4) RSA (sign only)
  Your selection? 4
  RSA keys may be between 1024 and 4096 bits long.
  What keysize do you want? (2048) 4096
  Requested keysize is 4096 bits

Choose "key does not expire" for length of validity.

Please specify how long the key should be valid.
           0 = key does not expire
        <n>  = key expires in n days
        <n>w = key expires in n weeks
        <n>m = key expires in n months
        <n>y = key expires in n years
  Key is valid for? (0) 0
  Key does not expire at all
  Is this correct? (y/N) y

Give at least the name for the new key.

  You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form:
      "Zaphod Beeblebrox (Galactic President) <zbeeblebrox@pres.galaxy.com>"
  Real name: Repository
  Email address:
  Comment:
  You selected this USER-ID:
      "Repository"
  Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

You need a passphrase to protect your secret key. Be sure to choose one you will remember. Follow the on-screen instructions to create the key. You should get output similar to this-

  gpg: key 041DA354 marked as ultimately trusted
  public and secret key created and signed.
  gpg: checking the trustdb
  gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
  gpg: depth: 0  valid:   1  signed:   0  trust: 0-, 0q, 0n, 0m, 0f, 1u
  pub   4096R/041DA354 2012-06-01
        Key fingerprint = 2253 4C89 DE74 CF68 39D7  2A2E DB3E 384F 041D A354
  uid                  Repository

You can list your keys anytime using the following:

  gpg --list-keys

Export your public key that was generated to a text file and store it in the root of the repository:

  sudo gpg --output keyFile --armor --export 041DA354

Sign the packages with your key.

  sudo dpkg-sig --sign builder file1.deb
  sudo dpkg-sig --sign builder file2.deb

On another computer to access and install these packages, edit the /etc/apt/sources.list file to update the package list for your repository.

• (You can use any text editor, this example uses vi)

  sudo vi /etc/apt/sources.list

Add your repository to the list, using the following nomenclature:

  deb http://10.31.31.89/repository_dir/dists/stable/main/binary /

After saving, update the packages list.

sudo apt-get update

Note: An error to the effect of "cannot find packages" is normal at this point, as no index file has been createded yet.

Download the repository's public key:

  wget -O - http://10.31.31.89/repository_dir/keyFile | sudo apt-key add -

To view the added key use the following:

  apt-key list

On the repository machine, you will need to change the ownership of the directory structure including everything in it to your user, unless you want it to be set as root.

• (From within the repository_dir directory)

  sudo chown user:user -R .

Create an index file for the repository called Packages in the same directory as the deb files and zip it. An uncompressed Packages file must be kept there too.

• (From within the binary directory)

  apt-ftparchive packages . > Packages
  gzip -c Packages > Packages.gz

Create a Release, InRelease, and Release.gpg file:

• (From within binary directory)

  apt-ftparchive release . > Release
  gpg --clearsign -o InRelease Release
  gpg -abs -o Release.gpg Release

Update the package list for the recipient computer and install the packages.

  sudo apt-get update
  sudo apt-get install package_name

More info on building and maintaining repositories can be found on the Debian website.

Originally posted The Ubuntu Forums (ubuntuforums.org)