Feature: Signed packages & repo

[systemofapwne]

I would be interested in having fully signed repo where

• Every package is individually signed
• Packag signatures being added/included in the repo.db
• repo.db being signed

Right now, I am maintaining a (private) custom repo with my own build chain for packages and signing my repo. I would like to replace that toolset by aurcache, as it can do everything way more elegant. The only missing icing on the cake would be signing.

[Lukas-Heiligenbrunner]

Thanks, yes thats still on my bucket list.
I think I'll need a little help here, since I'm not too familiar how package/repo signing works.
Do I need to create one or several private/public keypairs?
I sign each package after a build and the repo archive each time I add/remove a package with the private key I generated?
The public key must be available publicly to download?

[systemofapwne]

Thanks, yes thats still on my bucket list. I think I'll need a little help here, since I'm not too familiar how package/repo signing works. Do I need to create one or several private/public keypairs? I sign each package after a build and the repo archive each time I add/remove a package with the private key I generated? The public key must be available publicly to download?

You require only one public/private keypair, generated by gpg.

This is my toolchain to create such signing keys.

File: repo-key.batch

Key-Type: RSA
Key-Length: 4096
Key-Usage: sign, cert
Name-Real: my repository registry
Name-Email: my@repo.mail
Expire-Date: 0
%no-ask-passphrase
%no-protection
%commit

File: Makefile

# Makefile: shell-like syntax. Reference GLOBAL variables via ${varname} and local variables via $${varname}
.ONESHELL:
SHELL := /bin/sh
ROOT=$(shell git rev-parse --show-toplevel)
KEYNAME=repo-key

test: clean
	@# Disable local echo (.ONESHELL applies this to all following commands too)
	export GNUPGHOME="$$(mktemp -d ${ROOT}/pgpkeys-XXXXXX)"
	cat ${ROOT}/${KEYNAME}.private | gpg --import
	gpg --list-keys

key: clean
	@# Disable local echo (.ONESHELL applies this to all following commands too)
	export GNUPGHOME="$$(mktemp -d ${ROOT}/pgpkeys-XXXXXX)"
	gpg --no-tty --batch --gen-key ${ROOT}/repo-key.batch
	gpg --list-keys
	gpg --armor --export > ${ROOT}/${KEYNAME}.public
	gpg --armor --export-secret-keys > ${ROOT}/${KEYNAME}.private

clean:
	@# Disable local echo (.ONESHELL applies this to all following commands too)
	rm -rf ${ROOT}/pgpkeys-*

Running make will create the required keys. This whole step is absolutely overengineered. There are certainly more easy and shorter ways that can generate you the keypairs

You can then use the private key to sign the packages. The signatures are detached and have the name <packagenam>.sig. So e.g. visual-studio-code-bin-1.106.2-1-x86_64.pkg.tar.zst will at the end have a second file next to it, named visual-studio-code-bin-1.106.2-1-x86_64.pkg.tar.zst.sig.

Generating a detached signature with gpg is as easy as:

# Set a temporary gpg home directory in order to not mix up keys.
export GNUPGHOME=./repo.gpghome
mkdir -p $GNUPGHOME

# Import the key
cat repo-key.private | gpg --import

# Create a detached signature for a package
PKG="visual-studio-code-bin-1.106.2-1-x86_64.pkg.tar.zst"
gpg --batch --yes --output "${PKG}".sig --detach-sig ${PKG}

# This now builds the repo.db and files.db by adding the package and its signature to the db and then signing the db itself with an attached signature
repo-add --sign --include-sigs --verify ./repo.db.tar.gz ${PKG}

Keep a look on how repo-add with --include-sigs builds the repo.files.tar.gz and repo.db.tar.gz. It will have another tag %PGPSIG% right after the hash of package in the desc file for each package (looks like the "ascii armored"/base64 encoded signature of the <package>.sig). The beauty of having the signatures of each package also in the DB is, that pacman only needs to download the db to verify a new package. If one does not add the signatures to the DB, pacman will try to download the signature file for each package (The visual-studio-code-bin-1.106.2-1-x86_64.pkg.tar.zst.sig file).

When using repo-add, the repo.files.tar.gz and repo.db.tar.gz will then also get signed with a detached signature with suffix .sig.

And yes, the public key then gets ideally published on a well known key-server. pacman uses keyserver.ubuntu.com at the moment. In order to then have it deployed on an Arch client, one has to import and sign it locally:

sudo pacman-key --recv-keys <KEYID>
sudo pacman-key --lsign-key <KEYID>

Until AURCache is natively supporting signing the repo, I will use my little Flask app, that I quickly put together. It simply generates detached signatures on the fly but does not add signatures to the DB. You can find it here: https://github.com/systemofapwne/arch-repo-signer

[Lukas-Heiligenbrunner]

Thanks for the write-up, I have a plan what to do now.
I need a place in the backend where to store the private key permanently, since it must survive redeploys. Do you think it is safe to store it as clear-text in the database?

[systemofapwne]

It the end, the key must be somehow available in the container. One could use a Docker secret for that.
But I would honestly go for storing the key in the DB, as keys can be password protected. The password however then should be provided by a docker secret or similar and unlocked only during the signing operation.