How to create Authenticated key for signing deb packages?

Install the required packages

$sudo apt-get install dpkg-dev
$sudo apt-get install dpkg-sig

To create a GPG key pair type

$gpg --gen-key

Since we are only using our key for only generating digital signatures use RSA for maximum security

PLEASE SELECT WHAT KIND OF KEY YOU WANT:
(1) RSA and RSA (default)
(2) DSA and Elgamal
(3) DSA (sign only)
(4) RSA (sign only)Your selection? 4
RSA keys may be between 1024 and 4096 bits long.
What keysize do you want? (2048) 4096
Requested keysize is 4096 bits

CHOOSE “KEY DOES NOT EXPIRE” FOR LENGTH OF VALIDITY.

Please specify how long the key should be valid.
0 = key does not expire
<n> = key expires in n days
<n>w = key expires in n weeks
<n>m = key expires in n months
<n>y = key expires in n years
Key is valid for? (0) 0
Key does not expire at all
Is this correct? (y/N) y

GIVE AT LEAST THE NAME FOR THE NEW KEY.

You need a user ID to identify your key; the software constructs the user ID from the Real Name, Comment and Email Address in this form:
"Zaphod Beeblebrox (Galactic President) <[email protected]>"
Real name: Repository
Email address:
Comment:
You selected this USER-ID:
"Repository"
Change (N)ame, (C)omment, (E)mail or (O)kay/(Q)uit? O

YOU NEED A PASSPHRASE TO PROTECT YOUR SECRET KEY. BE SURE TO CHOOSE ONE YOU WILL REMEMBER. FOLLOW THE ON-SCREEN INSTRUCTIONS TO
CREATE THE KEY.

YOU SHOULD GET OUTPUT SIMILAR TO THISgpg:

key 041DA354 marked as ultimately trusted
public and secret key created and signed.
gpg: checking the trustdb
gpg: 3 marginal(s) needed, 1 complete(s) needed, PGP trust model
gpg: depth: 0 valid: 1 signed: 0 trust: 0-, 0q, 0n, 0m, 0f, 1u
pub 4096R/041DA354 2012-06-01
Key fingerprint = 2253 4C89 DE74 CF68 39D7 2A2E DB3E 384F 041D A354
uid Repository

 

YOU CAN LIST YOUR KEYS ANYTIME USING THE FOLLOWING:

$gpg --list-keys

EXPORT YOUR PUBLIC KEY THAT WAS GENERATED TO A TEXT FILE AND STORE IT IN THE ROOT OF THE REPOSITORY

$sudo gpg --output keyFile --armor --export 041DA354

SIGN THE ANY DEB PACKAGES WITH YOUR KEY.

$sudo dpkg-sig --sign builder file1.deb

DOWNLOAD THE REPOSITORY’S PUBLIC KEY ON ANY DEVICE OR PC:

$wget -O - http://192.168.x.x/debs/keyFile | sudo apt-key add -

Leave a Reply

Your email address will not be published.