I’m setting up a private binary package repository for an embedded device we’ve made. Want to make it secure despite users are allowed to check for, and install, software updates.
- I’ve generated the key pair with NIST P-521 EC curve. Is it considered secure nowadays? The client appears to support the algorithm i.e.
sudo apt-get updatecompletes without errors, despite all built-in Debian repositories use rsa2048 or rsa4096 for some reason.
https://wiki.debian.org/DebianRepository/Format#Signed-By says “The field should be ignored if the Valid-Until field is not present or if it is expired.”
How do I setup my repository so it always requires that specific signature
Signed-By "A0110B61F667916C04510F16CFA17833ED687281!";which always checked and never expires?