Integrating signatures into Debian archive files

What ist this all about?

This page is about creating signatures inside of deb-files, that's the format used by debian. It lists the necessary steps how signed debs could be integrated into the standard debian archive.

The following steps are necessary:

• the signed debs should be ar-files in the bsd-format (which are not produceable with GNU ar), see bug 161593. This would have the advantage that these files are acceptable by current apt-utils (though of course apt-utils should be more tolerant in what they accept). [Solved, see below and BTS]
• Add the features to the programs for the buildds, and for dpkg-buildpackage that make providing signed debs easy. [patch for dpkg-buildpackage in #225318]
• Make the debsigs a bit more userfriendly (e.g. same parameters a debsigns). [Solved with dpkg-sig]
• Create a policy of signature-names. [Working draft]
• Create support for "remote signing" of .debs [Supported by "policy"-draft and since dpkg-0.3]
• Provide plug-in-support for the signed debs.

Getting dpkg-sig

A preliminary FAQ-page is available.

Anything missing or wrong?

This page is set up for discussion. If there is anything wrong, please contact the author. You could find my adress e.g. by following the link below, by reading debian-devel, #debian-devel on IRC, or via a search at google. I'm not duplicating my mail address here because of spam, but you should be able to find it in less than 20 seconds.

Author: Andreas Barth [2003-12-29 13:45 CET]