2

I already have a GPG key configured. I have cloned the git source code package locally. I'm building in a chroot with extra-x86_64-build. I am able to build packages without signing and add them to the local private repo. Now I want to build the package, sign it and add it to my private local repo in a way that will require signature validation on the client when installed with pacman.

What are the steps?

Below are my current steps, which I assembled from many different Arch wiki pages, man pages, and other places. I include some detail to show what I'm doing and where I'm still having confusion or trouble. Note: I am able to complete all three of the first sections without any issues. My problems start after that.

preliminary general steps (all completed):

  1. read wiki pages (such as https://wiki.archlinux.org/index.php/Creating_packages)
  2. install base-devel, devtools, namcap, shellcheck
  3. systemctl status haveged # make sure it is active

preliminary package signing steps (all completed):

  • review /usr/share/devtools/pacman-extra.conf
    • I added my local private/custom repository here (with default SigLevel)
  • edit /etc/makepkg.conf:
    • BUILDENV=(!distcc color !ccache check sign) # make sure sign is active
    • PACKAGER="My Name <[email protected]>"
    • GPGKEY="1234ABCD09876" # use your key full fingerprint uppercase, no whitespace
  • with an existing GPG key on my user's keyring do these steps:
    • gpg --armor --output mykey.sec --export-secret-keys 1234ABCD09876
    • sudo pacman-key -a mykey.sec
    • sudo pacman-key --finger 1234ABCD09876
    • sudo pacman-key --lsign-key 1234ABCD09876

prepare source files, PKGBUILD (completed):

  1. git clone ${url} # or git pull if already cloned
  2. inspect PKGBUILD
  3. namcap -i PKGBUILD
  4. makepkg --packagelist # inspect version number (optional)

Questions:

  1. FYI - I am starting with internal & trusted source files. They are not signed and there are no sums in the PKGBUILD I start with.
  2. how do I modify the PKGBUILD for including sums of the built package and its .sig file?
    • at what step is the package's .sig file added to the PKGBUILD? How is that done?
  3. when are the sums for the built package added to the PKGBUILD?
    • when do I run this step? makepkg -g >> PKGBUILD
    • when is this used instead? updpkgsums

next, build the package in a chroot env (I can do this only without package signing)

`extra-x86\_64-build`

NOTE: I am running into this issue: makepkg: fail to sign source package with dynamic version https://bbs.archlinux.org/viewtopic.php?id=259771 (I guess this will be solved with the next release of pacman? For now, I guess the work-around is to hard-code the version number instead of using VCS-derived versions?)

how to add to private repo (I can do this without pkg signing, but I have not succeeded in creating a signed package to test with):

  • newpkg="mypackage.r10.918a28e-1-any.pkg.tar.zst" # example
  • namcap -i "$newpkg"
  • repoctl add --require-signature "$newpkg"

repo questions:

  • is the --require-signature arg needed in the line above?

1 Answer 1

2

Let's assume you've built a package $pkg inside ~/build and want to sign and then add it to a signed database named test_repo. Here are the steps how you can do it using gpg and repo-add.

pkg=some-package-0.0.2-1-any.pkg.tar.zst

# Create a detached signature.
gpg --use-agent --output ~/build/"${pkg}".sig --detach-sig ~/build/"${pkg}" 

# Copy package and its signature to repository directory.
cp ~/build/"${pkg}"{,.sig} ~/repo/

# Add package to repository and sign it.
repo-add --verify --sign ~/repo/test_repo.db.tar.gz ~/repo/"${pkg}"

To install the package and test if the signatures work, you can add the repository to /etc/pacman.conf:

[test_repo]
SigLevel = Required TrustedOnly
Server = file:///home/YOUR-USERNAME/repo

Then run pacman -Syu and pacman -S some-package.

If your signing key is not yet imported into your pacman keyring, pacman will show you the key-id and ask to import it. Say yes. Then sign the imported key with sudo pacman-key --lsign <key-id> and try to install the package again.

Sources:

  • https://archlinux.org/pacman/makepkg.conf.5.html

    • Using the --sign option with makepkg overrides the sign setting from makepkg.conf. "This will execute gpg --detach-sign --use-agent on the built package to generate a detached signature file, using the GPG agent, if it is available. The signature file will be the entire file name of the package with a “.sig” extension."
  • https://wiki.archlinux.org/title/DeveloperWiki:Package_signing#Arch_implementation

    • "[...] using repo-add --verify --sign. [...] Independently of these options, repo-add will detect the detached signature, convert it via base64 to ASCII, and add it to the repository database.

I have no experience with repoctl, but I hope the above helps you. Maybe it is enough to create the gpg signature and then run repoctl add --require-signature ~/build/"${pkg}"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .