[Starlingx-discuss] how to deal with loop dependent in building stage

[Jeremy Stanley]

On 2021-09-23 10:08:41 -0400 (-0400), Scott Little wrote:
[...]
> Do the Debian packaging tools need to support file signatures?
[...]

In Debian more generally, packages (these days mainly just source
packages) are signed by their maintainers or uploaders as a sort of
authentication to the build and distribution infrastructure the
project maintains, but those signatures aren't really distributed to
package consumers and may be irrelevant to your effort. If you do
want to sign source packages and changes files at build time, you
can supply signing keys to any of the usual package build tools
(debuild, gbp, et cetera), but I wouldn't bother unless your
solution assumes that the rebuilders and indexers can't trust the
mechanisms by which those packages are moved between those systems.
It's important for Debian proper because they have thousands of
people uploading packages and they want to be sure the packages are
really from authorized individuals, but that's a lot different from
how StarlingX's packages are likely to be supplied.

The apt-secure(8) manpage on any modern Debian system explains the
consumer-facing archive signatures, which are over the package
indices instead of individual packages, as those include lists of
checksums for each package being distributed. Any time the set of
packages/versions within the archive changes, the index is
regenerated and signed again with the published archive key(s). This
is what users installing software from the distribution rely on to
be sure the packages they're getting are really the ones the
distribution is serving and that they haven't been tampered with in
transit. The package management tooling verifies the signatures on
package indices any time it updates them, and then relies on the
checksums included in each signed index to confirm a particular
package is authentic.

I have no idea how much of this is useful for you, but hopefully it
helps.
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <http://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20210923/307998c3/attachment.sig>