Operations APT Repository

Operations: APT repository

What it is for. apt.secubox.in is the signed Debian repository that boxes update from. This page explains how it is laid out, how a package gets in, why a version must always go up, and how the signing key is unlocked.

Layout

Item	Value
Tool	reprepro
Suites	trixie (current base since alpha 9) and bookworm (frozen, no longer evolves)
Architectures	arm64, amd64 and source
Component	main
Signing	every suite declares SignWith; clients check the signature
Version scheme	X.Y.Z-N~trixie1 (or ~bookworm1)

Client sources line:

curl -fsSL https://apt.secubox.in/install.sh | sudo bash
sudo apt install secubox-lite      # or secubox-isp, secubox-full

The script installs the keyring and adds deb [signed-by=/usr/share/keyrings/secubox.gpg] https://apt.secubox.in trixie main. See Profils for what each profile installs and Trixie for the base-system change.

Publishing a built package

scripts/apt-publier.sh publishes one or several .deb files in one command:

scripts/apt-publier.sh [--force] secubox-exemple_1.2.3-1~trixie1_all.deb

What it does, in order:

1. Refuses a version lower than or equal to the one already in the repository (unless --force). A refused package makes the exit code non-zero even if the others were published, because it usually reveals a divergence between a branch and the deployed code.
2. Never publishes a preview (~aurora in the version): the automatic updater would install it overnight on every box.
3. Checks that the signing key can sign. When the key lives in the Coffre (the vault), it opens a 10-minute signing session; if the Coffre is sealed it stops before touching the repository.
4. Backs up db, dists and conf, then runs reprepro ... includedeb <suite> *.deb.
5. Runs an explicit reprepro export: an includedeb that fails on one package updates the database but does not re-export, so InRelease would stay old.
6. Verifies that InRelease is signed by the expected repository key.

The CI path (publish-packages.yml) does the same with reprepro -b repo includedeb <suite> <deb> for every artifact of a release, then exports the keyring (binary .gpg and armored .asc) and install.sh.

Rule: modified and deployed source = bumped version. Never deploy a changed package under an unchanged version: the repository would keep the old file and the boxes would never see the fix. Patch for a fix, minor for a feature, major for a release.

Downgrades

Tool	Behaviour
reprepro includedeb	refuses a lower version: the repository is protected if an outdated branch is built by mistake
dpkg -i	accepts it silently: installing a stale build rolls a box back

Before building and deploying a package, compare the first line of its debian/changelog with the version in the repository:

reprepro -b <base> list trixie secubox-<module>

If the repository is higher, your branch is stale: rebase first.

The signing key and the Coffre

The key is protected by a passphrase that must already be in the memory of gpg-agent (reprepro runs without a terminal; otherwise it fails with Pinentry: Inappropriate ioctl for device). The passphrase is a secret of the Coffre, never a file:

1. The Coffre is sealed at boot; an administrator login opens it.
2. secubox-depot-coffre.timer runs every minute coffrectl depot deverrouiller --depuis-coffre --si-ouvert: sealed Coffre, nothing; key already signing, nothing; otherwise the passphrase is read from the Coffre and handed to gpg-agent (one-year TTL).
3. After a reboot of the repository host, log in as administrator: within a minute signing works again for every suite.

Check the state:

coffrectl depot etat
systemctl list-timers secubox-depot-coffre.timer

If an export fails because the key is locked, restart the unlocking unit (systemctl restart secubox-depot-deverrouille.service) rather than setting the passphrase by hand: a hand-made preset overwrites the good value.

Time-limited signing sessions: coffrectl depot session --minutes N (N at most 60) then coffrectl depot fin.

Common problems

Symptom	Cause	Fix
NO_PUBKEY on apt update	keyring not binary or not installed under signed-by=	reinstall it with install.sh (the published .gpg is binary)
package refused <= repository	version not bumped, or stale branch	bump the version in debian/changelog, or rebase
Pinentry: Inappropriate ioctl for device	key locked after a reboot	log in as administrator, see above
repository index frozen	publication job skipped or without the signing secret	read the publish job log; a skipped job does not turn red

See also

Operations-Release-Process · Operations-Runbook · Profils · Trixie · Installation · Operations-APT-Repository-FR