Currently I am using reprepro and inoticoming to maintain a Debian package archive on a remote machine.
The repo is configured with this distributions file:
Origin: ...
Label: ...
Codename: squeeze
Architectures: i386 amd64 armhf source
Components: main
Description: ...
Log: /home/apt/log/reprepro.log
The daemon is running with:
inoticoming \
--logfile /home/apt/log/upload.log \
/home/apt/incoming \
--stdout-to-log \
--stderr-to-log \
--suffix .changes \
reprepro -Vb /home/apt --waitforlock 1000 processincoming default {} \;
I am building and signing my packages locally and then upload with dupload. However when I try to install a package from that archive I get:
WARNING: The following packages cannot be authenticated!
Is there a way to make the signatures work? I absolutely don't want to share my private GPG key with the remote machine. Are there other tools or a better suited workflow?