Open lakshmi-kannan opened 8 years ago
Yeah, signing the packages with our key would be great.
According to http://blog.packagecloud.io/eng/2015/07/20/yum-repository-internals/
yum repository metatadata is structured as a series of XML files, that contain checksums of other files, and the packages to which they refer.
So the repo metadata is gpg signed, and file checksums are in that signed metadata. Looks not bad.
IF signing the metadata is NOT enough, then you need:
rpm
, since deb
is signed@armab Yep, I was on their channel and someone else had the same questions. And yep, 1-4 is what I had in mind.
Seems now it's possible to import own GPG key for repo, the PackageCloud feature announced in Jun, 2017: https://blog.packagecloud.io/eng/2017/06/08/announcing-package-signing-gpg-key-support/
With this, we can potentially sign the packages during the build with own key before uploading.
Note: this question was raised in #community Slack by Adobe
Awesome! We should do this ASAP. Bring this up as part of 18.04 support work we'll do.
According to packagecloud, they only sign the package meta. The gpg verify is turned off on packages explicitly. I think we need to start signing those packages via st2-packages before shipping it to packagecloud. We also need to add a step in install script to download st2 gpg keys and install it. Also, figure out how to turn on gpg verification with packagecloud.