{{Header}} {{title| title=APT Signing Key Folders and Other Development Notes }} {{#seo: |description=/etc/apt/trusted.gpg, /etc/apt/trusted.gpg.d, /usr/share/keyrings }} {{intro| /etc/apt/trusted.gpg, /etc/apt/trusted.gpg.d, /usr/share/keyrings }} = APT Keyring Folders = APT by default considers only signing keys in: * file /etc/apt/trusted.gpg * folder /etc/apt/trusted.gpg.d Signing keys in folder /usr/share/keyrings are ignored by default by APT, unless the signed-by keyword is used in APT sources files (i.e. in configuration file /etc/apt/sources.list or in configuration snippet drop-in folder /etc/apt/sources.list.d). Example signed-by keyword use:
[signed-by=/usr/share/keyrings/derivative.asc]
Example of complete deb line with signed-by keyword.
deb [signed-by=/usr/share/keyrings/derivative.asc] https://deb.kicksecure.com bullseye main contrib non-free
= Repository Migration = == Which project and which version comes with which repositories enabled by default? == * Kicksecure builds earlier than version 16.0.5.0 come with: deb.whonix.org * Kicksecure builds version 16.0.5.0 come with: deb.kicksecure.com * Whonix builds earlier than version 16.0.5.0 come with: deb.whonix.org * Whonix builds version 16.0.5.0 come with: deb.kicksecure.com + deb.whonix.org == Which repositories contain what packages? == * Legacy: ** 16 and below: Mixing. Legacy. For migration purposes. Both, deb.kicksecure.com and deb.whonix.org contain all packages, i.e. contain both, all Kicksecure and all Whonix packages. * Future: ** 17 and above: Clean separation. deb.kicksecure.com will contain only all Kicksecure packages and no packages of other derivatives. *** To accomplish that, in https://github.com/{{project_name_short}}/developer-meta-files/blob/master/usr/bin/dm-reprepro-wrapper#L50 the only thing to be removed is for derivative_name_item in $derivative_name_list ; do (and done). == changed its 'Origin' value from 'whonix' to 'kicksecure' == https://github.com/{{project_name_short}}/derivative-maker/blob/master/aptrepo_remote/kicksecure/conf/distributions is still using old Origin and Label values. This is to avoid the following error during "sudo apt update".
E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Origin' value from 'whonix' to 'kicksecure'
E: Repository 'tor+https://deb.kicksecure.com bullseye InRelease' changed its 'Label' value from 'Whonix' to 'Kicksecure'
N: This must be accepted explicitly before updates for this repository can be applied. See apt-secure(8) manpage for details.
* This is avoid users updates getting more complicated by seeing above error message and needing to use sudo apt update --allow-releaseinfo-change to resolve it. * Origin and Label needs to be to be changed in {{project_name_long}} 17 (actually 18) in above file once the Kicksecure repository for Debian bookworm based becomes available. This will be done during [[Release Upgrade]]. == Why does Kicksecure use Origin whonix? == * version 16 and below: For legacy compatibility. ** Technical detail: For the longest time, for most users deb.kicksecure.com was a mirror of deb.whonix.org. Hence used Origin whonix. To keep the amount of user confusion lowest, fewest users being affected it was decided to keep it that way until the release upgrade for version 16 (Debian Origin based) becomes available. Unfortunately those users who upgraded fastest saw the `Origin`/`Label` change. * version 17 above: No more legacy. Kicksecure will use Origin kicksecure. == Background on Debian APT Origin and Label == When Debian's APT sees for the first time a repository, it notes its Origin and Label fields. Should these change, Debian will show a warning/question and not proceed using any repository with a changed Origin or Label until the user accepts the change using sudo apt update --allow-releaseinfo-change. == Forum Discussion == https://forums.whonix.org/t/e-repository-tor-https-deb-kicksecure-com-bullseye-inrelease-changed-its-origin-value-from-kicksecure-to-whonix/13810 = See Also = * [[Dev/APT Pinning]] * [[Dev/APT Repository]] * [https://forums.whonix.org/t/apt-repository-signing-keys-per-apt-sources-list-signed-by/12302 signed-by keyword forum discussion] {{reflist|close=1}} {{Footer}} [[Category:Design]] [[Category:Development]]