1

I already have a GPG key configured. I have cloned the git source code package locally. I'm building in a chroot with extra-x86_64-build. I am able to build packages without signing and add them to the local private repo. Now I want to build the package, sign it and add it to my private local repo in a way that will require signature validation on the client when installed with pacman.

What are the steps?

Below are my current steps, which I assembled from many different Arch wiki pages, man pages, and other places. I include some detail to show what I'm doing and where I'm still having confusion or trouble. Note: I am able to complete all three of the first sections without any issues. My problems start after that.

preliminary general steps (all completed):

  1. read wiki pages (such as https://wiki.archlinux.org/index.php/Creating_packages)
  2. install base-devel, devtools, namcap, shellcheck
  3. systemctl status haveged # make sure it is active

preliminary package signing steps (all completed):

  • review /usr/share/devtools/pacman-extra.conf
    • I added my local private/custom repository here (with default SigLevel)
  • edit /etc/makepkg.conf:
    • BUILDENV=(!distcc color !ccache check sign) # make sure sign is active
    • PACKAGER="My Name <me@gmail.com>"
    • GPGKEY="1234ABCD09876" # use your key full fingerprint uppercase, no whitespace
  • with an existing GPG key on my user's keyring do these steps:
    • gpg --armor --output mykey.sec --export-secret-keys 1234ABCD09876
    • sudo pacman-key -a mykey.sec
    • sudo pacman-key --finger 1234ABCD09876
    • sudo pacman-key --lsign-key 1234ABCD09876

prepare source files, PKGBUILD (completed):

  1. git clone ${url} # or git pull if already cloned
  2. inspect PKGBUILD
  3. namcap -i PKGBUILD
  4. makepkg --packagelist # inspect version number (optional)

Questions:

  1. FYI - I am starting with internal & trusted source files. They are not signed and there are no sums in the PKGBUILD I start with.
  2. how do I modify the PKGBUILD for including sums of the built package and its .sig file?
    • at what step is the package's .sig file added to the PKGBUILD? How is that done?
  3. when are the sums for the built package added to the PKGBUILD?
    • when do I run this step? makepkg -g >> PKGBUILD
    • when is this used instead? updpkgsums

next, build the package in a chroot env (I can do this only without package signing)

`extra-x86\_64-build`

NOTE: I am running into this issue: makepkg: fail to sign source package with dynamic version https://bbs.archlinux.org/viewtopic.php?id=259771 (I guess this will be solved with the next release of pacman? For now, I guess the work-around is to hard-code the version number instead of using VCS-derived versions?)

how to add to private repo (I can do this without pkg signing, but I have not succeeded in creating a signed package to test with):

  • newpkg="mypackage.r10.918a28e-1-any.pkg.tar.zst" # example
  • namcap -i "$newpkg"
  • repoctl add --require-signature "$newpkg"

repo questions:

  • is the --require-signature arg needed in the line above?

1 Answer 1

0

Let's assume you've built a package $pkg inside ./build and want to sign and then add it to a signed database named test_repo. Here are the steps how you can do it using gpg and repo-add.

pkg='some-package-0.0.2-1-any.pkg.tar.zst'

cd build
gpg --use-agent --output "${pkg}".sig --detach-sig "${pkg}" 

cd ../repo
cp "../build/${pkg}"     "${pkg}"
cp "../build/${pkg}.sig" "${pkg}.sig"

repo-add --verify --sign "test_repo.db.tar.gz" "${pkg}"

To install the package and test if the signatures work, you can add the repository to /etc/pacman.conf:

[test_repo]
SigLevel = Required TrustedOnly
Server = file:///home/some_user/repo

Then run pacman -Syu and pacman -S some-package.

If your signing key is not yet imported into your pacman keyring, pacman will show you the key-id and ask to import it. Say yes. Then sign the imported key with sudo pacman-key --lsign <key-id> and try to install the package again.

Sources:

  • https://archlinux.org/pacman/makepkg.conf.5.html

    • Using the --sign option with makepkg overrides the sign setting from makepkg.conf. "This will execute gpg --detach-sign --use-agent on the built package to generate a detached signature file, using the GPG agent, if it is available. The signature file will be the entire file name of the package with a “.sig” extension."
  • https://wiki.archlinux.org/title/DeveloperWiki:Package_signing#Arch_implementation

    • "[...] using repo-add --verify --sign. [...] Independently of these options, repo-add will detect the detached signature, convert it via base64 to ASCII, and add it to the repository database.

I have no experience with repoctl, but I hope the above helps you. Maybe it is enough to create the gpg signature and then run repoctl add --require-signature "${pkg}"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.