repo-add_and_sign: batch-sign packages and repos

Xyne · 2012-07-24 23:24:30

Info: http://xyne.archlinux.ca/projects/repo-add_and_sign
Summary: repo-add_and_sign lets you batch sign packages and then generate a signed repo with a single passphrase prompt

If you need to sign a lot of packages and don't want to deal with a keyring agent, this is for you.

Last edited by Xyne (2012-12-25 09:36:08)

Xyne · 2012-12-25 09:36:23

packaged

ShadowKyogre · 2013-01-01 11:20:07

Just wanted to drop by here and say that this has really helped me with starting up my own repository. One suggestion I'd like to add that if there is a signature for an old package version that is to be purged, it should be deleted as well.

Xyne · 2013-01-01 23:41:13

@ShadowKyogre
As of today's version matching signatures are deleted too.

Thanks for the feedback!

ShadowKyogre · 2013-01-03 19:21:53

@Xyne: Tested it with the new changes and it works as expected!

bionade24 · 2021-01-13 12:14:46

1. Sometimes after running repo-add_and_sign I have wrong signatures still afterwards. Is this a bug? Doesn't repo-add_and_sign resign every package? (I maybe have sometimes pkgs where the version didn't change but the hash of it)
2. If repo-add_and_sign resigns everything, why is it doing that? Why not check if the package already is signed and the signature newer than the pkg file?

Xyne · 2021-01-27 23:13:13

@bionade24
I've refactored the code to address those issues. The previous monstrosity was a quick hack that relied on false assumptions to determine which packages needed to be (re-)added. It now checks the expected file name, SHA256 sum and PGP signature so the issue should be fixed.

Please let me know if it works as expected. The refactoring may have introduced other bugs that I didn't notice after some quick testing.

Arch Linux

#1 2012-07-24 23:24:30

repo-add_and_sign: batch-sign packages and repos

#2 2012-12-25 09:36:23

Re: repo-add_and_sign: batch-sign packages and repos

#3 2013-01-01 11:20:07

Re: repo-add_and_sign: batch-sign packages and repos

#4 2013-01-01 23:41:13

Re: repo-add_and_sign: batch-sign packages and repos

#5 2013-01-03 19:21:53

Re: repo-add_and_sign: batch-sign packages and repos

#6 2021-01-13 12:14:46

Re: repo-add_and_sign: batch-sign packages and repos

#7 2021-01-27 23:13:13

Re: repo-add_and_sign: batch-sign packages and repos

Board footer