Search code examples
debianaptdeb

How to sign deb/apt repo after release?


I have this question about updating packages hosted in my own deb repository. Should I sign every release with a new private key and put the new public key?


Solution

  • Any time you change the private key you are using for a repository, all users of that repository will need to tell apt to trust your new key (and possibly to stop trusting the old one as well). Even if all your users are automated containers in the cloud, that can be a pain to set up. When your users are people, this sort of change can require a Herculean effort.

    In a normal situation, there is no particular reason why you would need to use a new private key every time. Long-lived repositories like Debian main sometimes rotate the keys they are using, but they do this by publishing the new key months or years before they actually start using it, so that all interested systems can have a chance to start trusting it beforehand. This is probably not what you want to do at this point.