10

I looked at another similar question about adding third-party repos. I am trying to add a third-party desktop IM client called riot . While the site gives link to the third-party it gives no instructions as how to add third-party sources or keyring in Debian. I went through https://riot.im/packages/debian/pool/main/ and made the following additions in my /etc/apt/sources.list -

######## Third party repos #######
deb https://riot.im/packages/debian/ stretch main

Now I have two questions :-

a. Is the third-party repo. I have entered is correct or should I ask for more information from upstream.

b. How do I add the secure key as all packages are usually signed in the Debian Universe. The public key is given at https://riot.im/packages/debian/repo-key.asc

I am on Debian stretch/testing.

1
  • There is a clear explanation on how to do it safely here – user202754 May 18 at 3:54
5

To add the key run:

wget https://riot.im/packages/debian/repo-key.asc
sudo apt-key add repo-key.asc

The third-party repo is correct and compatible with the general format posted on debian wiki:

The entries in this file normally follow this format:

deb http://site.example.com/debian distribution component1 component2 component3
20

You must NEVER install any 3rd party key with apt-key add, as suggested in other posts, because it would cause the system to accept signatures from the third-party keyholder on all other repositories configured on the system. You should set up the repository and install the key as follows:

  1. Create directory for manually installed OpenPGP keys:

    $ sudo mkdir /usr/local/share/keyrings
    
  2. Download the key into the directory.

    Since your key’s extension is .asc, it is probably "ascii-armored" (you can check this by downloading they key and opening it in a text editor: if it starts with something like

    -----BEGIN PGP PUBLIC KEY BLOCK-----
    

    then it is armored; if it looks like a set of some binary data, then it is not armored and you can use it as it is):

    • for an armored key:

      $ curl https://riot.im/packages/debian/repo-key.asc | gpg --dearmor | sudo dd of=/usr/local/share/keyrings/riot-archive-keyring.gpg
      
    • If the key is not armored, then use this command instead:

      $ sudo wget -O /usr/local/share/keyrings/riot-archive-keyring.gpg https://riot.im/packages/debian/repo-key.asc
      
  3. Add the desired 3rd party repository into the list of sources (pay attention to the signed-by option, it tells APT that the repo is signed with the specific key):

    • It is recommended to use the new deb822 multiline format for sources now. So create new .sources file with the respective content below:

      $ sudoedit /etc/apt/sources.list.d/riot.sources
      
      Types: deb
      URIs: https://riot.im/packages/debian/
      Suites: stretch
      Components: main
      Signed-By: /usr/local/share/keyrings/riot-archive-keyring.gpg
      
    • Or if you prefer the legacy style (one line per source), use this command instead::

      $ echo "deb [signed-by=/usr/local/share/keyrings/riot-archive-keyring.gpg] https://riot.im/packages/debian/ stretch main" | sudo tee -a /etc/apt/sources.list.d/riot.list
      
  4. Restrict the 3rd party repository to some specific software package only. Create preference control file for APT:

    $ sudoedit /etc/apt/preferences.d/riot.pref
    
  5. Put the following content into the file (if necessary, you can append the package name with asterisk (*) as a wildcard or list multiple package names separated by space ():

    Package: *
    Pin: origin riot.im
    Pin-Priority: 1
    
    Package: riot-web
    Pin: origin riot.im
    Pin-Priority: 500
    

You can find official information from Debian here: https://wiki.debian.org/DebianRepository/UseThirdParty

2
  • 1
    Is there a sensible way to do this automatically, because it would be a massive annoyance to do it laboriously like this every time we add a 3rd-party repository. Only two out of 18 of the 3rd party repos I'm using have done it in this more secure way. Also, we need a script to undo the damage for the repos that have already been added, and put the keys where they should be. I guess I'm going to have to roll up my sleeves and write that script, eh? – Sam Watkins May 24 at 16:32
  • @SamWatkins: 1. This is a custom sysadmin operation. it cannot be automated, because no two people ever want the same thing from such automation. 2. What do you mean with repos doing it in this way? Repos don't install keys, .deb packages can. If this is what you wander about, then you can check this (unanswered) question. 3. The benefit of the open-source SW is that you can propose new things, especially if you contribute with your own code. Try to propose your script to a SW, you think it fits to. – Trudy Jul 11 at 18:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.