Creating a Debian package repository for distributing multiple versions of a custom deb package

Question

We are building an application, which will be packaged into a DEB package. We would like to be able to install and (in the future) update this application on a number of Linux servers with minimal manual interaction, using apt-get.

For this, we plan to deploy our own DEB package repository within the organization. (So we host our package ONLY, but do not mirror existing external repository ) This package repository then should be used by all Linux servers within the organization to install our single application package only.

Can someone please explain me how this should be done (including best practices)?

• How to set up a minimal DEB package repository for our package (and handle when a new version is released) ?
• Setting up Debian servers so that this single package would be fetched from our custom DEB package repository server within the organization.

Answer 1

After spending some time digging around the a number of documentation sources, I came up with the following solution, which I am sharing:

1. On the machine used to host the repository, set up a personal repository according to the description of Ubuntu documentation, but do NOT add the sources.list entry on that machine.

2. Expose the directory with the DEB files and the Packages.gz file via a web server, e.g. with Nginx so that it is available all the machines that will consume the DEB file.

3. On the machines, which will fetch the DEB package, add an entry to the /etc/apt/sources.list file, which points to your server (replace foobar with your own URL): deb [trusted=yes] http://foobar/ /

4. Run sudo apt update
5. Run sudo apt install foobar to install your own package (replace foobar with your own package name)

NOTE: this setup hosts the DEB packages without any protection provided by signed packages/repositories. In case the repository is made available for a wider audience than your team's servers residing on a protected subnet behind a company firewall, you probably want to implement signing of the repository and packages.

Answer 2

You can do it manually with dpkg-scanpackages like you explained in your answer. However, there are some higher-levels tools for handling this as well. A simple tool for helping out out, which also supports migration and signed repositories and other things, is called reprepro. To get started, something like this might work:

$ mkdir ~/repo
$ cd ~/repo
$ mkdir incoming conf repository
$ cat > conf/options <<EOF
morguedir +o/old-versions
outdir +b/repository
EOF
$ cat > conf/distributions <<EOF
Codename: stretch
Origin: <you>
Label: <you>
Description: <description of this repository>
Architecture: source amd64 i386
Components: main
SignWith: <your gpg key ID>
EOF
$ cat > conf/incoming <<EOF
Name: incoming
IncomingDir: incoming
LogDir: logs
TempDir: /tmp
Multiple: yes
Permit: older_version unused_files
Allow: stretch
EOF

Now whenever you want to add any packages to your repository, you add the packages (with their .changes file) into the ~/repo/incoming directory, and then:

cd ~/repo
reprepro processincoming incoming

This will ask for your GPG key passphrase (unless it is a passwordless key); once you entered that, the repository will be up-to-date, and will be signed.

Reprepro is well documented in its man page; I suggest you have a look at it if you need more details than that.