Provide a verified signed APT repository - #45
Open
dskvr wants to merge 6 commits into
Open
Conversation
Track the issue 35 development slice, artifact trust model, publication contract, guest lifecycle evidence, and explicit human production activation boundary. Constraint: Keep Ubuntu and Debian package identity separate and preserve native release bytes Directive: Do not advertise repository installation before public verification and activation Scope-risk: narrow Tested: Plan mapped to all eight development requirements in issue 35
Generate and verify signed Ubuntu and Debian suites from existing release packages. Retain immutable package and by-hash objects, serialize publication over authenticated SSH, and atomically replace each suite's InRelease file. Add expiry refresh, recoverable promotion and explicit rollback, while keeping the public channel pending until operator verification activates its setup. Provide a scoped bootstrap, protected release integration, matching-guest lifecycle harness, and homepage/documentation support for the activated channel. Constraint: Initial native repository targets are Ubuntu 24.04 and Debian 13 amd64 Constraint: OpenPGP repository trust is separate from the OpenSSL release checksum key Rejected: Reuse Bunny storage PUT as atomic publication | documented overwrite guarantees are insufficient Confidence: high Scope-risk: moderate Directive: Preserve old immutable URLs and require expected-revision checks during publication Directive: Fixture credentials and synthetic package revisions are not production release proof Tested: Repository tests on Ubuntu 24.04 and Debian 13; real APT trust and tamper checks Tested: Full APT suite including real SSH, interruption recovery, bootstrap, HTTPS and proof validation Tested: Pending and activated-fixture browser flows, docs build and static site verification Tested: Workflow contracts, actionlint, Node/Python/Bash checks and ShellCheck Not-tested: Fresh KVM lifecycle execution and full workspace checks run after this reproducible commit Not-tested: Production hosting, credentials and public channel activation remain operator tasks
Debian installs GnuPG without the standalone gpgv verifier, while Ubuntu made it available transitively. Declare the verifier explicitly so both clean guest runs exercise the same signed repository checks. Keep the project validation contract synchronized with the new dedicated APT gate. Constraint: Guest proof must use clean distribution package state Confidence: high Scope-risk: narrow Tested: Requirements contract, Bash syntax, ShellCheck and whitespace checks Not-tested: Fresh Ubuntu and Debian KVM lifecycle reruns follow this commit
Compare the served repository manifest as well as every indexed file before emitting an activation record, and prevent custom test trust roots from producing production activation data. Make the disposable HTTPS server send a proper TLS shutdown so Debian's stricter APT client verifies the same fixture as Ubuntu. Correct the operator guide to match the publication protocol. Constraint: Fixture CA verification may prove behavior but cannot activate the public channel Confidence: high Scope-risk: narrow Tested: 9 public HTTPS verification cases and 16 APT VM proof-verifier cases Tested: Dedicated APT suite, workflow contracts, docs/site build, actionlint, Bash/Node/Python syntax and ShellCheck Not-tested: Fresh matching-guest lifecycle reruns follow this commit
Normalize compressed deb payloads through dpkg-deb before hashing their tar contents. This avoids relying on Python 3.14's Zstandard support when Ubuntu 24.04 and Debian 13 use older runtimes. Align HTTPS proof counts with the served manifest and correct the operator runbook. Constraint: Verification must work with the documented Ubuntu 24.04 and Debian 13 toolchains Confidence: high Scope-risk: narrow Directive: Keep real Zstandard package coverage in the pinned APT tools suite Tested: Real -Zzstd package regression and 17 APT proof-verifier cases Tested: Debian 13 clean-guest lifecycle passed at parent implementation commit 7849a1b Not-tested: Full suite and Ubuntu evidence revalidation follow this commit
Map every issue 35 development task to its delivered files and fresh checks, including both clean-guest lifecycles. Keep production provisioning and public activation explicit as the remaining human-owned work. Constraint: Fixture trust and synthetic upgrades are development proof only Confidence: high Scope-risk: narrow Tested: pnpm check; Ubuntu and Debian KVM lifecycle evidence reverified Not-tested: Production publication and public client installation await operator provisioning
This was referenced Sep 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ubuntu 24.04 and Debian 13 users currently need several direct-download and verification commands before installing a native package. This adds the complete development surface for a project-owned signed APT channel: authenticated repository generation, guarded publication, repeat-safe client bootstrap, lifecycle proof, protected automation, and gated website integration.
packaging/repositories/apt-channel.jsonremainspending. Existing homepage installation works unchanged until a maintainer provisions the production origin/signing identity, completes the first public run, and commits its reviewed verification record. That record switches only the Ubuntu and Debian panels tosudo apt install loopwireand links the one-time setup separately.resolves #35
Architecture and behavior
ubuntu-24.04anddebian-13main/binary-amd64suites from the exact OpenSSL-authenticated GitHub Release debs. OpenPGP-signedInReleasemetadata binds by-hash indexes and package hashes.InReleasereplacement.Signed-Bybootstrap/removal helper; it pins the full fingerprint and preserves unrelated APT configuration.packages-productionworkflow for stable release publication, manual publish/refresh/rollback, and weekly metadata refresh. Public activation records require exact HTTPS byte verification.No audio/backend behavior or application dependencies changed. The development toolchain uses Python/Bash/Node standard libraries plus distro APT, GnuPG, OpenSSL, OpenSSH, and dpkg tools. A checksum-pinned Debian 13 container provides reproducible tooling off Debian-family hosts.
Validation
pnpm checkpassed: all verification gates, typechecks, 295 workspace tests, 22 Rust tests, package builds, production web/docs builds, and static-site verification.pnpm verify:aptpassed: 13 generator, 22 publisher, 11 bootstrap, 9 public HTTPS, 5 workflow preflight, 17 proof-verifier, and 4 channel-gating cases. Publisher coverage includes actual SSH, all interruption checkpoints, restrictive umask permissions, CAS/locking, expiry recovery, and immutable collision handling./usrfile, provider commands, backend JSON, GUI linkage, and a real X11 application window.dpkg-deb --fsys-tarfilefix for Zstandard payload portability.Human operations remaining
The issue’s five Human operational tasks remain unchecked: select/provision the HTTPS origin, create and safeguard the APT signing identity, configure the protected GitHub environment, and perform the first public publication plus clean-client verification. No production account, key, secret, host, DNS/TLS, repository, deployment, or website activation was changed by this PR.
Power-loss behavior and network filesystems were not exercised; production requires local POSIX lock/fsync/atomic-rename semantics. Guest keys, CAs, and
+aptfixture1versions are disposable development evidence, not public release material.Detailed requirement mapping and evidence