Keep private key for remote reprepro package archive local

Question

Currently I am using reprepro and inoticoming to maintain a Debian package archive on a remote machine.

The repo is configured with this distributions file:

Origin: ...
Label: ...
Codename: squeeze
Architectures: i386 amd64 armhf source
Components: main
Description: ...
Log: /home/apt/log/reprepro.log

The daemon is running with:

inoticoming \
  --logfile /home/apt/log/upload.log \
  /home/apt/incoming \
  --stdout-to-log \
  --stderr-to-log \
  --suffix .changes \
  reprepro -Vb /home/apt --waitforlock 1000 processincoming default {} \;

I am building and signing my packages locally and then upload with dupload. However when I try to install a package from that archive I get:

WARNING: The following packages cannot be authenticated!

Is there a way to make the signatures work? I absolutely don't want to share my private GPG key with the remote machine. Are there other tools or a better suited workflow?

Answer 1

The signatures apt uses are on the repo as a whole (specifically on the "Release" file, not on the individual packages. So they have to be generated as part of the process of adding packages to the repo.

Normally one creates a key specifically for signing the repository with and keeps that on the machine used to manage the repo.

Another option would be to manage the repo locally on your machine and then use a tool like rsync to transfer it to the server.

Another thing that may work would be to Download the release file and create the signature manually after each update to the repo but I haven't tried this myself.