Supporting multiple keys for signing repositories

[lazyfrosch]

With the plan of transition keys with a repository I wondered if we can support this in aptly.

Detailed Description

Debian signs its repositories with multiple keys, using multiple generations of keys over each release.

It might be wise to support this in aptly. Mainly for changing keys without breaking users right away.

Sources:

• Multiple signatures with GnuPG
• Unfortunatly no documenation on this in RepositoryFormat of Debian

Context

• Security and GPG Key Exchange
• Best usability for users without forcing a hard change

Possible Implementation

While configuration would be easy (just setting multiple key IDs), it might be tricky to do with gnupg2.

I haven't done much testing yet, but had a look on the Debian repositories.

[RadxaYuntian]

Unfortunately this is still a problem. We "naively" used the default 2-year lifetime for our signing key, instead of Debian's 8-year or Proxmox's 10-year, and now we are facing keyring migration issue.

Right now, we have to manually sign the Release file by passing -skip-signing to aptly publish repo, then run following commands:

GPG_PARAMETERS=(
	"--yes"
	"--armor"
	"-u" "72AF2B5F7B24A8FFE4F41AC4E572249A33EB9743"
	"-u" "EF181314AFE1834694A34CC65D93177D0752732A"
)

for i in "$HOME"/.aptly/public/*/dists/*/Release
do
	DISTRO_PATH="$(dirname "$i")"
	gpg "${GPG_PARAMETERS[@]}" --clear-sign -o "$DISTRO_PATH/InRelease" "$i"
	gpg "${GPG_PARAMETERS[@]}" --detach-sign -o "$DISTRO_PATH/Release.gpg" "$i"
done

[xlionjuan]

Unfortunately this is still a problem. We "naively" used the default 2-year lifetime for our signing key, instead of Debian's 8-year or Proxmox's 10-year, and now we are facing keyring migration issue.

Right now, we have to manually sign the Release file by passing -skip-signing to aptly publish repo, then run following commands:

GPG_PARAMETERS=(
"--yes"
"--armor"
"-u" "72AF2B5F7B24A8FFE4F41AC4E572249A33EB9743"
"-u" "EF181314AFE1834694A34CC65D93177D0752732A"
)

for i in "$HOME"/.aptly/public//dists//Release
do
DISTRO_PATH="$(dirname "$i")"
gpg "${GPG_PARAMETERS[@]}" --clear-sign -o "$DISTRO_PATH/InRelease" "$i"
gpg "${GPG_PARAMETERS[@]}" --detach-sign -o "$DISTRO_PATH/Release.gpg" "$i"
done

Consider made your own "keyring" package so you'll able to rotate the signing key seamlessly.

https://github.com/xlionjuan/xlion-repo-archive-keyring

[RadxaYuntian]

We already have our own keyring package but you still need to multi signing the repository so the user of old key can update the package, and then still access the repo with the new key.

[xlionjuan]

If you put the timeline long enough, you don't have this problem through. (Long enough so all the users has received the updates with old and new signing key.)

[xlionjuan]

If you just downvote without doing real test, I'll doubt the service quality for your customer. @RadxaYuntian