I’m setting up a private binary package repository for an embedded device we’ve made. Want to make it secure despite users are allowed to check for, and install, software updates.

  1. I’ve generated the key pair with NIST P-521 EC curve. Is it considered secure nowadays? The client appears to support the algorithm i.e. sudo apt-get update completes without errors, despite all built-in Debian repositories use rsa2048 or rsa4096 for some reason.
  2. https://wiki.debian.org/DebianRepository/Format#Signed-By says “The field should be ignored if the Valid-Until field is not present or if it is expired.”

    How do I setup my repository so it always requires that specific signature Signed-By "A0110B61F667916C04510F16CFA17833ED687281!"; which always checked and never expires?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.