One of the first things that I wanted to install on my system after switching to Arch was ArangoDB. Sadly it wasn’t in the official repos. I’ve had mixed success installing things from the AUR and the Arango packages there didn’t improve my ratio.
Using those packages as a starting point, I did a little tinkering and got it all working the way I like. I’ve been following all the work being done on reproducible builds, and why that is needed and it seems that with all that going on, anyone dabbling with making packages should at the very least be signing them. With that as my baseline, I figured I might as well start with mine .
Of course package signing involves learning about gpg/pgp whose “ease of use” is legendary.
Securely sharing passwords, 2016 edition pic.twitter.com/5R7AW0JvrF
— Richard Jones (@metabrew) February 2, 2016
Before we get to package signing, a little about gpg.
gpg --list-keys gpg -k gpg --list-public-keys
All of these commands list the contents of ~/.gnupg/pubring.gpg.
gpg --list-secret-keys gpg -K
Both list all keys from ~/.gnupg/secring.gpg.
The pacman package manager also has its own gpg databases which you can explore with:
gpg --homedir /etc/pacman.d/gnupg --list-keys
So the task at hand is getting my public key into the list of public keys that pacman trusts. To do that we will need to do more than just list keys we need to reference them individually. gpg has a few ways to do that by passing an argument to one of our list keys commands above. I’ll do a quick search through the list of keys that pacman trusts:
mike@longshot:~/projects/arangodb_pkg☺ gpg --homedir /etc/pacman.d/gnupg -k pierre pub rsa3072/6AC6A4C2 2011-11-18 [SC] uid [ full ] Pierre Schmitz (Arch Linux Master Key) <pierre@master-key.archlinux.org> sub rsa1024/86872C2F 2011-11-18 [E] sub rsa3072/1B516B59 2011-11-18 [A] pub rsa2048/9741E8AC 2011-04-10 [SC] uid [ full ] Pierre Schmitz <pierre@archlinux.de> sub rsa2048/54211796 2011-04-10 [E] mike@longshot:~/projects/arangodb_pkg☺ gpg --homedir /etc/pacman.d/gnupg --list-keys stephane pub rsa2048/AB441196 2011-10-30 [SC] uid [ unknown] Stéphane Gaudreault <stephane@archlinux.org> sub rsa2048/FDC576A9 2011-10-30 [E]
If you look at the output there you can see what is called an openpgp short key id. We can use those to refer to individual keys but we can also use long id’s and fingerprints:
gpg --homedir /etc/pacman.d/gnupg -k --keyid-format long stephane
pub rsa2048/EA6836E1AB441196 2011-10-30 [SC]
uid [ unknown] Stéphane Gaudreault <stephane@archlinux.org>
sub rsa2048/4ABE673EFDC576A9 2011-10-30 [E]
gpg --homedir /etc/pacman.d/gnupg -k --fingerprint stephane
pub rsa2048/AB441196 2011-10-30 [SC]
Key fingerprint = 0B20 CA19 31F5 DA3A 70D0 F8D2 EA68 36E1 AB44 1196
uid [ unknown] Stéphane Gaudreault <stephane@archlinux.org>
sub rsa2048/FDC576A9 2011-10-30 [E]
So we can identify Stephane’s specific key using either the short id, the long id or the fingerprint:
gpg --homedir /etc/pacman.d/gnupg -k AB441196 gpg --homedir /etc/pacman.d/gnupg -k EA6836E1AB441196 gpg --homedir /etc/pacman.d/gnupg -k 0B20CA1931F5DA3A70D0F8D2EA6836E1AB441196
Armed with a way to identify the key I want pacman to trust I need to do the transfer. Though not initially obvious, gpg can push and pull keys from designated key servers. The file at ~/.gnupg/gpg.conf tells me that my keyserver is keys.gnupg.net, while pacman’s file at /etc/pacman.d/gnupg/gpg.conf says it is using pool.sks-keyservers.net
Using my key’s long id I’ll push it to my default keyserver and tell pacman to pull it and then sign it.
#send my key gpg --send-key F77636AC51B71B99 #tell pacman to pull that key from my keyserver sudo pacman-key --keyserver keys.gnupg.net -r F77636AC51B71B99 #sign the key it recieved and start trusting it sudo pacman-key --lsign-key F77636AC51B71B99
With all that done, I should be able to sign my package with
makepkg --sign --key F77636AC51B71B99
We can also shorten that by setting the default-key option in ~/.gnupg/gpg.conf.
# If you have more than 1 secret key in your keyring, you may want to # uncomment the following option and set your preferred keyid. default-key F77636AC51B71B99
With my default key set I’m able to make and install with this:
mike@longshot:~/projects/arangodb_pkg☺ makepkg --sign mike@longshot:~/projects/arangodb_pkg☺ sudo pacman -U arangodb-2.8.1-1-x86_64.pkg.tar.xz loading packages... resolving dependencies... looking for conflicting packages... Packages (1) arangodb-2.8.1-1 Total Installed Size: 146.92 MiB Net Upgrade Size: 0.02 MiB :: Proceed with installation? [Y/n] y (1/1) checking keys in keyring [##################################################] 100% (1/1) checking package integrity [##################################################] 100%
The ease with which I can make my own packages is a very appealing part of Arch Linux for me. Signing them was the next logical step and I’m looking forward to exploring some related topics like running my own repo, digging deeper into GPG, the Web of Trust, and reproducible builds. It’s all fun stuff, if you can only find the time.
I wanted:
gpg –detach-sig –armor