debian repository instructions improvements #13
Conversation
this change allows people to setup the Grml repositories without trusting them with base packages and will enforce the signature on the repository as well instead of trusting the upstream `grml-debian-archive` package which could be hijacked.
otherwise adding just stable yields a warning on ARM
link to the manpage and suggest a filename
the docs don't clearly say how to deploy the keyring, just installing the package fails on Debian stretch
anarcat
changed the title
use more liberal pin (`100`) which allows upgrading packages while respecting default release policies. also use the `archive` name instead of none-existent suite name
|
i understand there were some concerns about the apt pinning here, which were mostly expressed over IRC. i understand those concerns. however, i would still like this to be merged. in 3a17aaf, i've made an explicit effort to make packages upgradable while retaining a lower priority than official debian packages. thanks for reconsidering! |
|
another thought: the OpenPGP key that signs the Grml apt repo shouldn't be installed in this way the Grml archive key couldn't be abused to sign the official archives. |
|
note that i have turned this into a more complete proposal in the Debian wiki: https://wiki.debian.org/RepositoryInstructions it should be noted that my previous comment about using a file for there are, however, recommendations in the above proposal that are not currently implemented in the grml repo, most notably #14. |
|
i'm pretty sure you're not going to like this, but FWIW, the instructions changed. the recommended location for keyrings is now in |
|
@anarcat heh, this is the good thing about merging this so late (sorry for that, all of us pretty overloaded :-/), any chance you might provide an acccording PR for us? (rest assured, will be merged much faster this time ;)) thx! |
|
alright, i opened #21 about that, but do note that this won't be sufficient: changes to the grml-archive-keyring will also be necessary, as the PR details. |
|
... and that's done in grml/grml-debian-keyring#3 |
this change allows people to setup the Grml repositories without trusting them with base packages and will enforce the signature on the repository as well instead of trusting the upstream
grml-debian-archivepackage which could be hijacked.it also adds a preferences sample file and a way to install the keyring without downloading the package, which fails on stretch.