I have been tasked to create a custom repository with signed binaries for download. Our CEO explicitly mentioned that he wants the binary signed by himself and his business parther.

I set up a webserver, and created a secure apt environment with dpkg-sig. So basically for someone to download and install the package, they add to the sources.list, and apt-key add the repository key.

I am a bit confused by the details though. So as far as I can see, dpkg-sig is to sign the package and allow secure apt. Not to sign the binaries themselves. Also, it just uses one key for signing.

Thus, in order to fulfill our CEOs requirement, I was wanting to sign the binary itself with gpg and two keys: gpg --sign -u KEY1 -u KEY2 ourpkg.deb

That actually creates a new (signed) file though, so this means that the original binary would have to be extracted in order for it to be installed.

What seems right is to gpg --armor --detach-sig ourpkg.deb which then creates a separate file, and the original deb is ready to be installed via apt-get on a client machine. This however means that the actual verification would be left to the user, and the apt system just verifies that the apt-key is trusted and installs the package right away.

Am I going right about this? Or should I maybe include some script into the installation package which actually runs the verification first or something? What's the point of (double) signing the binary if the system installs it right away anyway?

Any suggestion highly appreciated.


You must log in to answer this question.

Browse other questions tagged .